Add security specific documentation and OWASP event logging#315
Open
matperin wants to merge 4 commits intocanonical:mainfrom
Open
Add security specific documentation and OWASP event logging#315matperin wants to merge 4 commits intocanonical:mainfrom
matperin wants to merge 4 commits intocanonical:mainfrom
Conversation
matperin
changed the title
Include security documentation in public product documentation for SSDLC compliance. The added documentation also expands on hardening scenarios. Signed-off-by: Matteo Perin <matteo.perin@canonical.com>
Add a securitylog package that emits structured INFO-level log entries following the OWASP Application Logging Vocabulary via the existing lxd/shared/logger framework. Every entry carries fixed fields (security=true, category, event) merged with call-site context. Covered events: [AUTHN] authn_token_created: join token generated (microovn cluster add) [AUTHN] authn_password_changed: CA or service certificate (re)issued [AUTHZ] authz_admin: cluster join / leave, service enable / disable, configuration set / delete, CA regeneration [SYS] sys_startup: daemon start hook [SYS] sys_shutdown: node departing the cluster These changes are part of SSDLC compliance for microovn. Signed-off-by: Matteo Perin <matteo.perin@canonical.com>
Add a "Security event logging" section to security documentation regarding the structured fields present on every log entry, a table of covered events (AUTHN / AUTHZ / SYS) with realistic example log lines, and a table of OWASP events that are intentionally not implemented along with the architectural reason for each. This is a required artifact for microovn SSDLC compliance. Signed-off-by: Matteo Perin <matteo.perin@canonical.com>
Add a --disable-security-logging flag to microovnd that suppresses all output from the securitylog package. The snap wrapper (snapcraft/commands/daemon.start) reads the snap configuration key "security-logging" via snapctl. When the value is "false" it appends --disable-security-logging to the microovnd command line. A snap configure hook (snap/hooks/configure) validates that the value is either "true", "false", or unset, and returns an error otherwise. Added socumentation describes the snap option and how to set it. Signed-off-by: Matteo Perin <matteo.perin@canonical.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Include security documentation in public product documentation for SSDLC compliance. The added documentation also expands on hardening scenarios.
This PR also includes the addition of OWASP event logging, required for SSDLC compliance as well.