Conversation
|
🌿 Preview your docs: https://nvidia-preview-pr-3355.docs.buildwithfern.com/openshell |
b9ad685 to
ad9c479
Compare
6476d30 to
7d5404f
Compare
There was a problem hiding this comment.
This module doesn't look like it's used anywhere anymore.
It got deleted here: https://github.com/NVIDIA/OpenShell/pull/2942/changes#diff-9f56559056bc6d68aded0ccb5b9aaf3894b500b76d103e26268392922cb21391, but I didn't if it got moved elsewhere or if this functionality got dropped.
There was a problem hiding this comment.
Addressed: removed the obsolete bypass monitor. It has no remaining call site under the RFC 0012 isolation architecture, so retaining it here would add dead code.
Previously, Network Activity could be constructed without a source or destination endpoint, allowing connection, accept, relay, and configuration events to violate the OCSF 1.8 endpoint constraint. Now, NetworkActivityBuilder requires a source or destination endpoint at compile time. Connection failures identify the workload peer or genuine transparent destination, listener failures identify the listening endpoint, and mediation-lane failures use Application Lifecycle rather than fabricated network endpoints. Malformed forward requests use HTTP Activity with a method-only request, generated 400 response, and workload peer. Additionally, Unix relay-channel events use Base Event, policy-validation warnings use Config State Change, and the unused bypass monitor is removed because the current isolation architecture no longer uses it. Signed-off-by: Kris Hicks <khicks@nvidia.com>
7d5404f to
ea8896d
Compare
| AppLifecycleBuilder::new(openshell_ocsf::ctx::ctx()) | ||
| .activity(ActivityId::Fail) | ||
| .severity(SeverityId::Low) | ||
| .status(StatusId::Failure) | ||
| .message(message) | ||
| .build() |
There was a problem hiding this comment.
This may be better represented as base event. ActivityId::Fail (4) maps to Stop in application lifecycle event: https://schema.ocsf.io/1.8.0/classes/application_lifecycle?extensions=
But in this case the application keeps running.
The event below, causes a application shutdown, so that one looks good.
2 participants
Summary
Previously, Network Activity could be constructed without a source or destination endpoint, allowing connection, accept, relay, configuration, and bypass-monitor events to violate the OCSF 1.8 endpoint constraint.
Now, NetworkActivityBuilder requires a source or destination endpoint at compile time. Connection failures retain the workload peer, and accept failures identify the listening endpoint. Malformed forward requests use HTTP Activity with a method-only request, generated 400 response, and workload peer.
Additionally, Unix relay-channel events use Base Event, policy-validation warnings use Config State Change, and bypass-monitor startup failures use Detection Finding rather than fabricated network endpoints.
Related Issue
#1055
Changes
Testing
mise run pre-commitpassesChecklist