* Re: Security Working Group meeting - Wednesday June 23 - results
2021-06-23 13:45 Security Working Group meeting - Wednesday June 23 Joseph Reynolds
@ 2021-06-24 3:12 ` Joseph Reynolds
0 siblings, 0 replies; 2+ messages in thread
From: Joseph Reynolds @ 2021-06-24 3:12 UTC (permalink / raw)
To: openbmc
On 6/23/21 8:45 AM, Joseph Reynolds wrote:
> This is a reminder of the OpenBMC Security Working Group meeting
> scheduled for this Wednesday June 23 at 10:00am PDT.
>
> We'll discuss the following items on the agenda
> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>,
> and anything else that comes up:
>
Attended:
Joseph Reynolds, Andrei Yadro, James Mihm, Bruce Mitchell, Chris Engel,
Daniil Engranov, Dhananjay Phadke, Jiang Zhang.
We switched the order of topics from the original agenda.
Note the July 7 meeting is tentatively cancelled unless someone hosts
and runs it.
BONUS ITEM:
1 How can the security response team track items reported to openbmc?
DISCUSSION:
Urgency? The security response team is not losing track of issues, but
is having difficulty keeping focus on issues. Will create a spreadsheet
of currently open issues and email it to the private email list.
We want a database to track issues (see ideas below).
The database needs to be secure. Meaning (a) a secure database which
has an active security community, (b) hosted on a secure system, (c)
handled by a trusted admin.
Options for secure database:
1.
Redmine
2.
Github based? Does github have a solution? TODO: Joseph to look at
a private issues database.
3.
Bugzilla? Note UEFI uses bugzilla with a “security attribute”
Idea: Set up a secure bug database on a server donated to OpenBMC.
TODO: Joseph talk to AndrewG
TODO Joseph to ask for help from the Linux Foundation.
> 1. Gerrit review BMCWeb “Automate PrivilegeRegistry to code”
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/43939
> <https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/43939>.
>
Gerrit review BMCWeb “Automate PrivilegeRegistry to code”
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/43939
<https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/43939>.
DISCUSSION:
Item 1:
Yes, the consensus is: please separate the tools to (A) download the new
privilegeRegistry JSON file, and (B) transform a Redfish
PrivilegeRegistry into the privilege_registry.hpp header file. The tool
(B) to transform a Redfish PrivilegeRegistry into the
privilege_registry.hpp header file should run when the image is being
built, that is, during bmcweb build-time.
Item 2: Joseph brought up the Redfish spec DSP0266 and described how the
Redfish operation to privilege mapping worked, and described privilege
overrides. The consensus was: the way BMCWeb currently handles property
overrides and subordinate overrides seems okay. And: having separate
follow-on commits to change which privileges are required seems like the
right approach.
- Joseph
>
> The July 6 meeting is tentatively cancelled, unless someone want to
> run it.
>
>
> Access, agenda and notes are in the wiki:
> https://github.com/openbmc/openbmc/wiki/Security-working-group
> <https://github.com/openbmc/openbmc/wiki/Security-working-group>
>
> - Joseph
^ permalink raw reply [flat|nested] 2+ messages in thread