Static analysis of security context requirements
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 523
- Forks
- 75
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 24
Description
Summary of the new feature / enhancement
Required security context can be described in the configuration via a top level directive, but individual resources can also have their own directive to override. Resource manifests can also declare which operations require a specific security context.
There is also a future feature to allow an elevated context to create restricted child processes for resources.
So the whole result is complicated, but ideally there should be static analysis performed if the deployment would be successful under the current security context before deployment starts.
Proposed technical implementation details (optional)
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by tracing how top-level and per-resource security-context directives and resource operation requirements are represented, then identify the deployment validation path; done would mean a defined static check for whether deployment succeeds under the current context, including the stated override and operation cases.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100