Confirmed users
1,927
edits
Auto-tools/Projects/Pulse: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
|||
| Line 42: | Line 42: | ||
** PulseGuardian will have to be updated for this. | ** PulseGuardian will have to be updated for this. | ||
* After a grace period following PulseGuardian's launch, remove the "public" user. | * After a grace period following PulseGuardian's launch, remove the "public" user. | ||
* Move to a tighter permission model. New software (an external app or a plugin) may be required to achieve all points | * Move to a tighter permission model. New software (an external app or a plugin) may be required to achieve all points. See the Security Model section below. | ||
==== Other ==== | ==== Other ==== | ||
| Line 55: | Line 52: | ||
* Add git shim? | * Add git shim? | ||
* Other shims? | * Other shims? | ||
=== Security Model === | |||
In order to have a reliable, well behaved system, the following assertions will need to be true. | |||
* All users, publishers and consumers alike, must have their own accounts (no guest/public users). | |||
* Only publishers should be able to declare exchanges. | |||
* Only the publisher user account associated with a particular vhost should be allowed to publish messages to exchanges in the vhost. In other words, exactly one user account should be allowed to publish messages within a given vhost. | |||
* Only the user that created a particular queue should be allowed to consume from it. | |||
Since exchange and queue permissions go together, we'll need exchange and queue naming conventions mixed with restrictive permissions. Each publishing user, in addition to being restricted to a particular vhost, will also be restricted to a particular set of exchange names. For example, the BuildBot publisher will have permissions of <code>"^org.mozilla.exchange.build*" "^org.mozilla.exchange.build*" "^org.mozilla.exchange.build*"</code>. Similarly, we'll need a name convention for queues, e.g. org.mozilla.queue.<username>.*. This will both prevent consumer users from writing to exchanges as well as prevent them from consuming from the queues of other users. | |||
=== Admin Procedures === | === Admin Procedures === | ||