On 13/05/14 17:45, Joey STANFORD wrote: > >> Part of the problem is that each charm is given root access on the >> machine >> to configure whatever services are actually needed. And there isn't >> part of >> the spec that has them define where the configuration files are >> going, what >> things they are installing, etc. > > Right. This a feature but also a bit of a challenge to detect when > something has been changed by hand.
Compliance auditing is moving towards verification of the process, not the result. So in this case, for auditable and secure environments, it's best to: * disallow SSH * log any "juju run" type commands carefully Then, auditing the charms themselves is directly verifying the integrity of the process rather than trying to audit the result. Mark
signature.asc
Description: OpenPGP digital signature
-- Juju mailing list Juju@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/juju
