mdaleo404
aded37d491
CI / test (3.11) (push) Canceled after 0s
CI / test (3.12) (push) Canceled after 0s
CI / test (3.13) (push) Canceled after 0s
CI / test (3.14) (push) Canceled after 0s
CI / package (push) Canceled after 0s
CI / precommit-and-security (push) Canceled after 11s
CI / typecheck (push) Canceled after 11s
53 lines
1.6 KiB
Markdown
53 lines
1.6 KiB
Markdown
# Security policy
|
|
|
|
`schedls` writes scheduler configuration and, when run as root, writes files in
|
|
privileged locations. Security is therefore a primary design concern.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Report suspected vulnerabilities privately to the maintainer listed in
|
|
`pyproject.toml`. Do not open a public issue for a security-sensitive report.
|
|
|
|
## Promises
|
|
|
|
`schedls` does not:
|
|
|
|
- run a background daemon;
|
|
- listen on a network port;
|
|
- make network requests;
|
|
- automatically invoke `sudo`, `su`, `pkexec`, or any other privilege
|
|
escalation mechanism;
|
|
- execute discovered scheduled commands;
|
|
- open an editor or pager while managing jobs;
|
|
- use a shell internally for helper commands (`shell=True` is forbidden);
|
|
- modify unmanaged schedules by default.
|
|
|
|
## Security model
|
|
|
|
See [docs/security-model.md](docs/security-model.md) for the threat model and
|
|
the mitigations implemented in this repository.
|
|
|
|
## Release checklist
|
|
|
|
Before every release:
|
|
|
|
```text
|
|
[ ] No new shell=True usage
|
|
[ ] No automatic privilege escalation
|
|
[ ] No new implicit command execution
|
|
[ ] No pager/editor invocation under privilege
|
|
[ ] Unit serialization tests pass
|
|
[ ] Cron serialization tests pass
|
|
[ ] Symlink tests pass
|
|
[ ] Atomic-write tests pass
|
|
[ ] Trusted-directory ownership/mode tests pass
|
|
[ ] Helper resolution ownership tests pass
|
|
[ ] Unit-name path traversal tests pass
|
|
[ ] Log sanitization tests pass
|
|
[ ] Dependency audit passes
|
|
[ ] JSON schema changes reviewed
|
|
[ ] New mutating operations support --dry-run
|
|
[ ] New mutating operations have clear confirmation behavior
|
|
[ ] Documentation describes new filesystem/state changes
|
|
```
|