kumaab opened a new pull request, #1333: URL: https://github.com/apache/ranger/pull/1333
## What changes Updates `THREAT_MODEL.md` to v1.2 with four PMC rulings, one per commit: - **Service Admin and global roles.** Adds Service Admin as a caller role. Roles are global, so a Service Admin of any service can create, delete, and grant/revoke membership of any role; this lets services such as Hive use Ranger roles. Recorded as by design (§2, §6–§11a). Also clarifies that the plugin-bucket "grant/revoke" in §14 Q10 means policy grant/revoke. - **KMS endpoint authentication.** No KMS endpoint is meant to be reachable without authentication, so any KMS HTTP path is in-model (§4, §11a). - **Unauthenticated-access config.** `ranger.admin.allow.unauthenticated.access=true` is not a supported production setting (`OUT-OF-MODEL: non-default-build`). `ranger.admin.allow.unauthenticated.download.access=true` is a supported, reduced posture (§5a, §9–§11). - **Policy script sandbox.** New §8 `#7`: scripts in policies run sandboxed and cannot run host code. An escape is `VALID` when a delegated, security-zone or Service Admin can write the script (§6–§8, §11a). **Testing:** not applicable; no code or build changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
