13 KiB
Executable File
Self-assessment
The Self-assessment is the initial document for projects to begin thinking about the security of the project, determining gaps in their security, and preparing any security documentation for their users. This document is ideal for projects currently in the CNCF sandbox as well as projects that are looking to receive a joint assessment and currently in CNCF incubation.
For a detailed guide with step-by-step discussion and examples, check out the free Express Learning course provided by Linux Foundation Training & Certification: Security Assessments for Open Source Projects.
Self-assessment outline
Table of contents
- Metadata
- Overview
- Self-assessment use
- Security functions and features
- Project compliance
- Secure development practices
- Security issue resolution
- Appendix
Metadata
A table at the top for quick reference information, later used for indexing.
| Assessment Stage | Complete |
| Software | https://github.com/cubefs/cubefs |
| Security Provider | No |
| Languages | Mainly Go language |
| SBOM | https://github.com/cubefs/cubefs/blob/master/go.mod |
Security links
Provide the list of links to existing security documentation for the project. You may use the table below as an example:
| Doc | url |
|---|---|
| Security file | https://github.com/cubefs/cubefs/blob/master/SECURITY.md |
| Default and optional configs | https://cubefs.io/docs/master/security/security_practice.html |
Overview
CubeFS is a file storage system that provides cloud-native file system capabilities and is compatible with object storage. Moreover, it offers a multitude of competitive features and capabilities. The project’s differentiation is the main feature of CubeFS: link to md#section
Background
File storage and object storage are key in the storage domain.
- CubeFS Introduction includes what CubeFS does, and why it does it
- Use Case: How CubeFS Accelerates AI training in Hybrid Cloud platform: link
- Documentation:Integration with Kubernetes
Actors
CubeFS fundamentallly have five actors，includes
- Client : User side for business service
- Master Node : Cluster management
- Auth Node : Authentication management
- Meta Node : Metadata management
- Data Node : Replica data management
Actions
According to authnode check architecture , CubeFS has the authentication mechanism to confirm the safety of data transfer. Based on the architecture, messages over HTTPS and TCP can be encrypted and decrypted by the endpoint.Now the mechanism is mainly used between the client and the master node, as the volume information and management are much more important.
Goals
CubeFS has planned the future work to do, which are our goals.
Non-goals
Self-assessment use
This self-assessment is created by the CubeFS team to perform an internal analysis of the project's security. It is not intended to provide a security audit of CubeFS , or function as an independent assessment or attestation of CubeFS 's security health.
This document serves to provide CubeFS users with an initial understanding of CubeFS 's security, where to find existing security documentation, CubeFS plans for security, and general overview of CubeFS security practices, both for development of CubeFS as well as security of CubeFS .
This document provides the CNCF TAG-Security with an initial understanding of CubeFS to assist in a joint-assessment, necessary for projects under incubation. Taken together, this document and the joint-assessment serve as a cornerstone for if and when CubeFS seeks graduation and is preparing for a security audit.
Security functions and features
- Critical. According to the guide documentation, CubeFS adopted MITM threat module, Suggest user start CubeFS with AuthNode step by step， thus allows the cluster and volume management to be protected by authentication; this is a basic security method, especially for multi-tenant clusters.
- Security Relevant. A listing of security relevant components of the project with
brief description. These are considered important to enhance the overall security of
the project, such as deployment configurations, settings, etc. These should also be
included in threat modeling.
- Don't use the owner information directly which have super access, Ceate user and grant the authetiction to mount the volume accoring to USER Management
- Massive users authetication management can reference to ladp+autoMount,
- The master IP is not directly exposed, and a domain name approach is used through a gateway.
- Traffic QoS for volumes is crucial for ensuring the stable operation of the system : reference documentation
- Limiting requests to the master interface by QoS is essential when many clients are online : reference documentation
- S3 Authentication Capability : reference documentation
Project compliance
- Compliance. List any security standards or sub-sections the project is already documented as meeting (PCI-DSS, COBIT, ISO, GDPR, etc.).
Secure development practices
-
Development Pipeline. A description of the testing and assessment processes that the software undergoes as it is developed and built. Be sure to include specific information such as if contributors are required to sign commits, if any container images immutable and signed, how many reviewers before merging, any automated checks for vulnerabilities, etc.
- Typically, commits must include test cases and coverage for most processes, and GitHub will notify users of any coverage gaps
- Code submissions on GitHub undergo multiple layers of checks.CubeFS have integrated many tools in CI, includes ci-test-unit,ci-test-s3 and ci-sast : reference link
- Contributor make the commit message need comply the rules or else can't pass the pull request t : reference link
-
Communication Channels. Reference where you document how to reach your team or describe in corresponding section.
-
Internal. As most of the maintainers and committers are chinese, we use wechat communicate with each other: reference link
-
Inbound. How do users or prospective users communicate with the team?
- Users can communicate with the team by joining WeChat or Slack directly:reference link
- Feedback and suggestions can also be submitted via Github Issues: reference link
- Users can propose project suggestions and initiate public discussions through the discussion portal:reference link
- Additionally, we have an email system; specific information is available.
-
Users can communicate with the team by joining WeChat or Slack directly.
-
Feedback and suggestions can also be submitted via Issues.
-
-
Outbound. How do you communicate with your users? (e.g. flibble-announce@ mailing list)
- WeChat or Slack:WeChat reference link,cubefs.slack.com
- Portal website:https://cubefs.io
- Mailing list:users@cubefs.groups.io
-
Ecosystem. How does your software fit into the cloud native ecosystem?
- CubeFS Container Storage Interface (CSI) plugins: reference link
- The cubefs-helm project helps deploy a Cubefs cluster orchestrated by Kubernetes:reference link
Security issue resolution
-
Responsible Disclosures Process.
- Disclosures Process
- CubeFS security issue can also be reported through the portal ##Open a draft security advisory.
-
Vulnerability Response Process.
- Securty committe memeber will review it through portal ## Security Advisories Triage, once the issue be resolved it will be published at portal ## Security Advisories published
-
Incident Response. A description of the defined procedures for triage, confirmation, notification of vulnerability or security incident, and patching/update availability.
According to CubeFS security committee's duty description， the definitions are list below:
- Triage: make sure the people who should be in "the know" (aka notified) are notified, also responds to issues that are not actually issues and let the CubeFS maintainers know that. This person is the escalation path for a bug if it is one.
- Infra: make sure we can test the fixes appropriately.
- Disclosure: handles public messaging around the bug. Documentation on how to upgrade. Changelog. Explaining to public the severity. notifications of bugs sent to mailing lists etc. Requests CVEs.
- Release: Create new release addressing a security fix.
Appendix
-
Known Issues Over Time. List or summarize statistics of past vulnerabilities with links. If none have been reported, provide data, if any, about your track record in catching issues in code review or automated testing.
- CubeFS has provided portal of security overview, where the detailed trend charts available.
-
Open SSF Best Practices. Best Practices. A brief discussion of where the project is at with respect to CII best practices and what it would need to achieve the badge.
- CubeFS passed the OpenSSF Best Practices two years ago: reference link. Since then, CubeFS has made improvements for better management. Now, CubeFS is working towards achieving the silver badge.
-
Case Studies. Provide context for reviewers by detailing 2-3 scenarios of real-world use cases.
- CubeFS Third part security audit report some issues and already been fixed，and the case finially be published now.
-
Related Projects / Vendors. Reflect on times prospective users have asked about the differences between your project and projectX. Reviewers will have the same question.
- File storage and object storage are key in the storage domain. CubeFS is a file storage system that provides cloud-native file system capabilities and is compatible with object storage. Moreover, it offers a multitude of competitive features and capabilities.
- The project’s differentiation is the main feature of CubeFS: link to md#section
- Use Case: How CubeFS Accelerates AI training in Hybrid Cloud platform: link
- Well-Rounded Roadmap Schedule to adapt CubeFS to the requirements of multiple scenarios.
