trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-23 06:30:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(prover): only flag write bypass on explicit read-only intent

Browse Source 
L4-only endpoints are not implicitly read-only. A policy with
access: full and no protocol is an explicit grant of full access,
not a violated intent. Write bypass now only fires when the policy
expresses read-only intent via access: read-only or GET-only L7 rules.

Signed-off-by: Alexander Watson <zredlined@gmail.com>
This commit is contained in:
Alexander Watson
2026-03-31 17:10:42 -07:00
parent 8ba9e26b37
commit 52fdded395
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
python/openshell/prover/queries.py
+1 -1
View File
@@ -177,7 +177,7 @@ def check_write_bypass(model: ReachabilityModel) -> list[Finding]:
for policy_name, rule in model.policy.network_policies.items():
for ep in rule.endpoints:
if ep.intent not in (PolicyIntent.READ_ONLY, PolicyIntent.L4_ONLY):
if ep.intent != PolicyIntent.READ_ONLY:
continue
for port in ep.effective_ports: