smengcl commented on code in PR #11185:
URL: https://github.com/apache/ozone/pull/11185#discussion_r4078867504
##########
THREAT_MODEL.md:
##########
@@ -384,6 +424,13 @@ list. *(requested by jojochuang, 2026-06-25.)*
Folded into §5a.)* (§8.)
- **Q-token.** Block/delegation token lifetimes, signing-key rotation, and the
bearer-token caveat in §9 — confirm. (§8/§9.)
+- **Q-svcacl.** *(inferred — pending maintainer confirmation.)* Confirm that
+ Hadoop service-level authorization (`hadoop.security.authorization` + the
+ `hdds.security.client.*.protocol.acl` /
`ozone.om.security.client.protocol.acl`
+ ACLs) is the intended in-cluster gate for internal OM↔SCM↔DN RPC protocols;
that
+ its `*` default is operator-tightened like object ACLs; and that internal
+ protocols (e.g. SCM block: `deleteKeyBlocks`, `finalizeUpgrade`)
intentionally
+ rely on it without a per-method admin check. (§5a/§9/§10/§11a.)
Review Comment:
Please separate verified implementation details from the policy question. A
narrower question can remain pending maintainer confirmation; §§9/11a should
not declare that policy “by design” before it is settled.
```suggestion
- **Q-svcacl.** Confirm the intended security contract for internal RPCs
such as
SCM block `deleteKeyBlocks`: is a correctly configured service ACL
sufficient
authorization for these operations, without a per-method admin check?
Document the confirmed scope in §9/§11a. (§5a/§9/§10/§11a.)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
