[Security Review] Dragonfly

[gaius-qi]

Project Name: Dragonfly

Github URL: https://github.com/dragonflyoss/Dragonfly2

Project Security Lead: Wenbo Qi(Gaius)

CNCF project stage and issue (NA if not applicable): Incubation, applying for graduation.

Security Provider: no

• Identify team
  • Project security lead @gaius-qi
  • Lead security reviewer: @mnm678
  • 1 or more additional reviewer(s) @JustinCappos @nyrahul @mrcdb @hubbertsmith
  • Every reviewer has read security reviewer guidelines and stated declaration of conflict
  • Sign off by facilitator on reviewer conflicts
• Create slack channel (#sec-assessment-dragonfly)
• Project lead provides draft document
• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review
• Presentation & discussion
• Share draft findings with project
• Assessment summary and doc checked into /assessments/projects/project-name (require at least 1 co-chair approval)
• CNCF TOC presentation (if requested by TOC)

[JustinCappos]

@gaius-qi Okay, can you edit the info above to mention who from the dragonfly side will be the "Project Security Lead"? Please also link to the self assessment as the "Project lead provides draft document"?

[JustinCappos]

I am willing to be a security reviewer for this project.

I have read the security reviewer guidelines (in the past, before their link was broken... 😦 ), and have no conflicts.

[nyrahul]

Hey @JustinCappos, I would like to volunteer with the security review (depending on eligibility).

@gaius-qi, The "security reviewer guidelines" link and the "outline" links are not working in your initial comment. I would love to go through those.

Disclosure: I have not done a CNCF project security review before. However, I am working in the security domain and have done threat modeling, security review of other projects outside of CNCF.

[JustinCappos]

Hey @JustinCappos, I would like to volunteer with the security review (depending on eligibility).

@gaius-qi, The "security reviewer guidelines" link and the "outline" links are not working in your initial comment. I would love to go through those.

Disclosure: I have not done a CNCF project security review before. However, I am working in the security domain and have done threat modeling, security review of other projects outside of CNCF.

Super, adding you. Would you kindly read this document and comment if you have any conflicts of interest? https://github.com/cncf/tag-security/blob/main/community/assessments/guide/security-reviewer.md (I'll try to get the link fixed.)

[nyrahul]

I have read the security reviewer guidelines, and have no conflicts.

[krishnakv]

Happy to volunteer. Have read the Security Reviewer Guidelines and have no conflicts.

[gaius-qi]

@gaius-qi Okay, can you edit the info above to mention who from the dragonfly side will be the "Project Security Lead"? Please also link to the self assessment as the "Project lead provides draft document"?

@JustinCappos Hey! I have edited the issue to add the "Project Security Lead". Is this PR a "Project lead provides draft document"? Do you need me to provide other content? 😊

Thanks @nyrahul @krishnakv

[JustinCappos]

@gaius-qi Are you also going to be the Dragonfly POC throughout the joint review?

[mrcdb]

I'd be happy to be a security reviewer for this project. I have read the security reviewer guidelines and don't have any hard or soft conflicts.

[gaius-qi]

@gaius-qi Are you also going to be the Dragonfly POC throughout the joint review?

Sure

[hubbertsmith]

I am willing to be a reviewer
I have read the guidlines
I have no conflicts of interest, neither hard nor soft
[email protected]

[mnm678]

I'm willing to be the lead reviewer on this. I have no hard or soft conflicts.

[JustinCappos]

Okay, great! And away we go!

@mnm678 you're all set to kick this off with the naive questions phase...

[mnm678]

@gaius-qi Could you create a draft joint assessment for us to iterate on? Most of the content will be similar to the self assessment that you linked. Maybe in Google docs or similar format for now to allow for comments and discussion.

[nyrahul]

@gaius-qi Could you create a draft joint assessment for us to iterate on? Most of the content will be similar to the self assessment that you linked. Maybe in Google docs or similar format for now to allow for comments and discussion.

@gaius-qi , Gentle reminder.

[JustinCappos]

pinging again on this... Just want to make sure we're no dropping this issue...

[gaius-qi]

@gaius-qi Could you create a draft joint assessment for us to iterate on? Most of the content will be similar to the self assessment that you linked. Maybe in Google docs or similar format for now to allow for comments and discussion.

@gaius-qi , Gentle reminder.

@nyrahul @JustinCappos I'm sorry sir, I'm very busy with work recently. I will provide a draft joint assessment before September 28th. 🙏🙏🙏

[gaius-qi]

@mnm678 @nyrahul @JustinCappos Hey, I have finished a draft jonit assessment.

[JustinCappos]

@mnm678 should we start this process? Maybe we should use the channel #sec-assessment-dragonfly to discuss next steps.

[mnm678]

Thank you @gaius-qi! I have requested access to the joint assessment document to begin the clarifying questions phase.

[gaius-qi]

Thank you @gaius-qi! I have requested access to the joint assessment document to begin the clarifying questions phase.

@mnm678 Thanks!

[angellk]

I do not see any activity in the #sec-assessment-dragonfly channel - could you please give Nikhita and I access to the joint assessment document @gaius-qi

[gaius-qi]

I do not see any activity in the #sec-assessment-dragonfly channel - could you please give Nikhita and I access to the joint assessment document @gaius-qi

I have added the access.

[gaius-qi]

@nyrahul @mnm678 I have finished Security Analysis . Please help to review, thanks.

https://docs.google.com/document/d/1qOVFC_q4goCicwkBlrSKcE8orbvU5MSUfMf7pLBckqc

[mnm678]

Before we officially start the hands-on assessment, if any reviewers would like to help out with the threat model, feel free to take a look at the document!

[gaius-qi]

Before we officially start the hands-on assessment, if any reviewers would like to help out with the threat model, feel free to take a look at the document!

@mnm678

Dragonfly maintainers have finished Threat Model. I have updated the threat model section in document.

[mnm678]

Reviewers, we are ready to start the assessment! Please review the assessment document and other relevant materials by the end of next week.

[nyrahul]

Reviewers, we are ready to start the assessment! Please review the assessment document and other relevant materials by the end of next week.

Ack. I have started review/commenting in the doc. Will finish my review by Tuesday.

[mrcdb]

Same here, I will try to prioritise this review early next week so I can get something by Tuesday/Wednesday at most.

[nyrahul]

Reviewers, we are ready to start the assessment! Please review the assessment document and other relevant materials by the end of next week.

Ack. I have started review/commenting in the doc. Will finish my review by Tuesday.

I have added my review in the doc. Also I did following as part of Hands-on Assessement section:

• setup an execution env for dragonfly on kind and reviewed the final workload manifests
• scanned the different workloads created by dragonfly and added the findings (two findings) in the hands-on-assessment

[mrcdb]

Same here, I will try to prioritise this review early next week so I can get something by Tuesday/Wednesday at most.

I have finished my review in the doc, there are several points where clarification is needed by the project maintainers.

[mnm678]

@gaius-qi do you have some time this week to make some clarifications in the doc? Then we can schedule a call to discuss and write up the joint assessment. Reviewers, please react with 👍 or 👎 on this message to indicate if you can join a call on November 4 at 11am EST.

[gaius-qi]

@gaius-qi do you have some time this week to make some clarifications in the doc? Then we can schedule a call to discuss and write up the joint assessment. Reviewers, please react with 👍 or 👎 on this message to indicate if you can join a call on November 4 at 11am EST.

@mnm678 I can reply the docs in this week. Do I need to join the discussion meeting?

[mrcdb]

@gaius-qi do you have some time this week to make some clarifications in the doc? Then we can schedule a call to discuss and write up the joint assessment. Reviewers, please react with 👍 or 👎 on this message to indicate if you can join a call on November 4 at 11am EST.

@mnm678 I can join for the first 30 minutes at that time and then I have another appointment

[mnm678]

Looks like that time isn't great. Here's a poll to find a better one: https://doodle.com/meeting/participate/id/aMorOOOd.

[mnm678]

@gaius-qi do you have some time this week to make some clarifications in the doc? Then we can schedule a call to discuss and write up the joint assessment. Reviewers, please react with 👍 or 👎 on this message to indicate if you can join a call on November 4 at 11am EST.

@mnm678 I can reply the docs in this week. Do I need to join the discussion meeting?

@JustinCappos can confirm the process, but I think as long as we have the replies in the doc you don't need to join the meeting.

[gaius-qi]

@gaius-qi do you have some time this week to make some clarifications in the doc? Then we can schedule a call to discuss and write up the joint assessment. Reviewers, please react with 👍 or 👎 on this message to indicate if you can join a call on November 4 at 11am EST.

@mnm678 I can reply the docs in this week. Do I need to join the discussion meeting?

@JustinCappos can confirm the process, but I think as long as we have the replies in the doc you don't need to join the meeting.

@mnm678 I will respond to questions on time, thanks.

[gaius-qi]

@mnm678 Hi, what is the current status of the assessment? 🙏

[mnm678]

We're going to re-schedule the joint assessment meeting. Please put your availability here: https://doodle.com/meeting/participate/id/e0OvYZ3d