github-actions[bot] commented on issue #11494: URL: https://github.com/apache/cloudstack/issues/11494#issuecomment-6520628094
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41040764159) for details. > > </details> ## 🎯 Triage report A domain admin cannot attach an ISO that lives in a child domain to an instance in that child domain, because non-public ISOs are not visible across domain boundaries. The author asks for domain admins to be able to attach ISOs to instances in child domains. A maintainer comment says cross-domain attach of non-public ISOs needs a security review, and that the item was postponed to v23 at least. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:enhancement | Requested change to existing permission behaviour; no crash reported | | **Component** | component:api | ISO visibility and permission checks are API-side | | **Severity** | n/a | Not a bug report | | **Labels** | type:enhancement, component:api | | | **Coding agent** | Not suitable | Permission model decision with security implications, already deferred by maintainers | ### 🔗 Similar issues - #9482 (related) — unable to assign ISO permissions to an account in a sub-domain - #9322 (related) — template visibility in subdomains <details> <summary>💡 Notes and suggestions</summary> - The open question is cross-domain sharing direction, e.g. whether a domain admin of D1 may attach non-public ISOs from sibling or child domains. Maintainers have said this needs investigation. - Consider scoping the fix to the parent-to-child case first. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41040764159) · copilot · haiku55 · \~3 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41040764159, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41040764159 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41040764159","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41040764159","publishing_job":{"key":"safe_outputs","check_run_id":"124016161242"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
