Skip to content

doc: Update security model #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iinuwa wants to merge 1 commit into
base: main
Choose a base branch
from
Open

doc: Update security model #236

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,21 +52,30 @@ time described above.
for any origin.
- _unprivileged client_: A client that is allowed to make requests for
credentials for only a preconfigured set of origins.
- _user session privileges_: All of the privileges granted to a user by means
of its Unix user and groups.
- _sandboxed application_: An application that runs with restricted access to
the user session and filesystem.

## Scope

Here is the current list of items that are in scope:

- Privileged clients may request credentials via this service[^1] for any origin.
- The list of privileged clients cannot change without:
- `root` privileges, or
- user session privileges, or
- user consent[^2]
- The list of unprivileged clients cannot change without:
- `root` privileges, or
- user session privileges, or
- user consent[^2]

The determination of a client's permissions to this API is not performed by
credentialsd; that operation is delegated to trusted intermediary services, who
should uphold the guarantees above.

We implicitly trust the kernel and D-Bus, so any attacks that exploit those are
out of scope for this project.
out of scope for this project. When appropriate, we will use hardening techniques
to raise the bar for some operations from user session privileges to `root` privileges.

Some other attacks that are explicitly out of scope are those that require:

Expand Down