Mit Desai created YUNIKORN-3457:
-----------------------------------
Summary: Add SECURITY.md to document vulnerability reporting
process and security model for yunikorn-core
Key: YUNIKORN-3457
URL: https://issues.apache.org/jira/browse/YUNIKORN-3457
Project: Apache YuniKorn
Issue Type: Improvement
Reporter: Mit Desai
Assignee: Mit Desai
yunikorn-core currently has no security documentation. As per ASF guidance on
documenting a project's security model
([https://cwiki.apache.org/confluence/spaces/SECURITY/pages/308153000/Documenting+your+security+model]),
projects should publish the assumptions and guarantees they make with respect
to security, so operators can deploy safely and maintainers can quickly triage
whether an incoming report is a real vulnerability or expected behavior.
yunikorn-core has several documented-but-unwritten assumptions worth capturing
explicitly — e.g. the REST/web service on :9080 ships with no authentication,
authorization, or TLS; Access-Control-Allow-Origin: * is set on all responses;
and the scheduler core trusts the submitter identity (UserGroupInformation)
asserted by the Resource Manager without independent verification.
We need to add a SECURITY.md at the repository root containing:
* A private vulnerability-reporting policy pointing to [email protected]
* A documented security model: scope boundaries relative to sibling repos
(yunikorn-k8shim, yunikorn-web, yunikorn-scheduler-interface, yunikorn-release,
yunikorn-site), deployment trust assumptions, the REST API's endpoint
sensitivity,
ACL/authorization semantics, user/group and LDAP resolution, logging caveats,
and a "not secure by default" note on service-account/RBAC scoping.
* A triage table listing recurring non-findings (e.g. unauthenticated :9080,
exposed pprof, LDAP Insecure option) with the reasoning for why each is out of
scope, and what would make it in scope — to reduce noise from scanners and
AI-assisted
reports.
* A "Supported Versions" section pointing to the project download page rather
than asserting an unstated support policy.
This will be the first SECURITY.md in the Apache YuniKorn project family and is
intended to serve as a reference for the sibling repositories to adapt.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
