Repository navigation
docs(ci-syslog-watcher): document risk-acceptance for unvalidated rsyslog config copy - #9882
Open
Calvin S. (calvin197) wants to merge 1 commit into
Open
Calvin S. (calvin197) wants to merge 1 commit into
Calvin S. (calvin197) wants to merge 1 commit into
Conversation
…slog config copy
ci-syslog-watcher.sh copies /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf
into /etc/rsyslog.d and restarts rsyslog without validating its content.
This is intentional, not an oversight:
- The trust boundary for this script is the /var/run/mdsd-ci directory
itself, which is populated by the privileged Container Insights
(mdsd/AMA) add-on via a hostPath mount - a component deployed and
access-controlled entirely outside this repo. AgentBaker has no
visibility into, or control over, who can write to that directory.
- Anything capable of writing into /var/run/mdsd-ci already has
node-level privilege equivalent to what content validation here
could additionally restrict, so adding it would not meaningfully
reduce risk - it would only create a false sense of security.
- The real control point is the add-on's own hostPath/RBAC
configuration, which is out of scope for this repo.
No functional change - in-place comment only. Verified: bash -n and
shellcheck both pass with no warnings. No existing ShellSpec coverage
for this script to regress.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981
Contributor
Windows Unit Test Results 3 files 18 suites 58s ⏱️ Results for commit 5139fd0. |
Contributor
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The risk acceptance depends on external writer privileges and access controls that require confirmation from the add-on owner.
1 open issue
What changed in this PR
Documents the risk-acceptance rationale for AgentBaker’s Container Insights syslog watcher copying configuration without content validation.
Changes:
- Adds an inline explanation of the intended trust boundary and external add-on access controls.
- Leaves configuration copying and rsyslog restart behavior unchanged.
| File | Description |
|---|---|
parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh |
Adds security rationale comments around the existing configuration copy. |
Review effort: Balanced
Comment on lines
+15
to
+19
| # mount - a component deployed and access-controlled outside this repo. Anything | ||
| # capable of writing into that directory already has node-level privilege equivalent | ||
| # to what this script could additionally restrict, so adding content validation here | ||
| # would not meaningfully reduce risk; the real control point is that add-on's | ||
| # hostPath/RBAC configuration, not this script. |
Contributor
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
A security scan flagged
ci-syslog-watcher.shcopying/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.confinto/etc/rsyslog.dand restarting rsyslog without validating its content (ADO finding 37518910). This PR documents why that is intentional and should not be changed:/var/run/mdsd-cidirectory itself, which is populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath mount — a component deployed and access-controlled entirely outside this repo. AgentBaker has no visibility into, or control over, who can write to that directory./var/run/mdsd-cialready has node-level privilege equivalent to what content validation here could additionally restrict, so adding it would not meaningfully reduce risk — it would only create a false sense of security.No functional/behavioral change — in-place comment only. Validated:
bash -nandshellcheckboth pass with no warnings. No existing ShellSpec coverage for this script to regress.Which issue(s) this PR fixes:
Fixes #
ADO work items (msazure/CloudNativeCompute): 37518910 (parent: 37518878)