You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Joe Orton <jo...@apache.org> on 2026/05/12 17:23:27 UTC
[RFC] Describe the security model
One thing which has come out of discussions about stemming the tide of
LLM reports is having a security model written down which a) the LLMs
can read, and b) we can use when assessing poor/slop reports.
Most importantly the "we" in (b) should include the security@a.o team
who can hopefully use it to filter out the slop before "we" (this
project's committers on security@httpd.a.o) see it.
I find this task difficult to scope properly... it's hard to know what
should/should not be covered here. And there's probably an academic
discipline behind this topic of which I'm ignorant. Anyway I took a
first stab, attached, definitely a lot missing.
I'm thinking we put this at ./docs/security-model.md or somewhere while
it's a WIP. Ideally I think it ends up in docs/manual too when we're
happy with it, but we probably need to keep a canonical version in
markdown for the LLMs, so there's another problem to solve.
Thoughts? (I only started using RFC 2119-style MUST/SHOULD half way
through editing so it's not consistent on that style)
Regards, Joe
Re: [RFC] Describe the security model
Posted by Rich Bowen <rb...@rcbowen.com>.
(You’ve probably already done this but) I encourage you to talk with Jarek Potiuk, who has thought a LOT about this, and has a very elaborate setup over on Airflow to deal with this workflow.
> On May 12, 2026, at 1:23 PM, Joe Orton <jo...@apache.org> wrote:
>
> One thing which has come out of discussions about stemming the tide of
> LLM reports is having a security model written down which a) the LLMs
> can read, and b) we can use when assessing poor/slop reports.
>
> Most importantly the "we" in (b) should include the security@a.o team
> who can hopefully use it to filter out the slop before "we" (this
> project's committers on security@httpd.a.o) see it.
>
> I find this task difficult to scope properly... it's hard to know what
> should/should not be covered here. And there's probably an academic
> discipline behind this topic of which I'm ignorant. Anyway I took a
> first stab, attached, definitely a lot missing.
>
> I'm thinking we put this at ./docs/security-model.md or somewhere while
> it's a WIP. Ideally I think it ends up in docs/manual too when we're
> happy with it, but we probably need to keep a canonical version in
> markdown for the LLMs, so there's another problem to solve.
>
> Thoughts? (I only started using RFC 2119-style MUST/SHOULD half way
> through editing so it's not consistent on that style)
>
> Regards, Joe
> <security-model.md>
—
Rich Bowen
rbowen@rcbowen.com
Re: [RFC] Describe the security model
Posted by Joe Orton <jo...@apache.org>.
On Thu, May 14, 2026 at 04:36:23PM +0100, Joe Orton wrote:
> On Thu, May 14, 2026 at 11:53:04AM +0200, Ruediger Pluem wrote:
> > On 5/12/26 7:23 PM, Joe Orton wrote:
> > > I'm thinking we put this at ./docs/security-model.md or somewhere while
> >
> > What is the best location for a LLM that scans the repo to pick it up automatically?
> > Is there any generic LLM model agnostic default location / filename?
>
> From some off-list conversation, it looks like there is a convention to
> use "SECURITY.md" at the top-level. (We should also reference the web
> site pages about how to report vulnerabilities from there too)
Of course that exists already. Updated with the (draft) model so others
can fill in holes here if desired.
Re: [RFC] Describe the security model
Posted by Joe Orton <jo...@apache.org>.
On Thu, May 14, 2026 at 11:53:04AM +0200, Ruediger Pluem wrote:
> On 5/12/26 7:23 PM, Joe Orton wrote:
> > I'm thinking we put this at ./docs/security-model.md or somewhere while
>
> What is the best location for a LLM that scans the repo to pick it up automatically?
> Is there any generic LLM model agnostic default location / filename?
From some off-list conversation, it looks like there is a convention to
use "SECURITY.md" at the top-level. (We should also reference the web
site pages about how to report vulnerabilities from there too)
> > it's a WIP. Ideally I think it ends up in docs/manual too when we're
> > happy with it, but we probably need to keep a canonical version in
> > markdown for the LLMs, so there's another problem to solve.
>
> I think for now we should focus on the LLM's usability. We can try to tackle
> the docs/ issue later.
Makes sense to me. Thanks for the review.
Regards, Joe
Re: [RFC] Describe the security model
Posted by Ruediger Pluem <rp...@apache.org>.
On 5/12/26 7:23 PM, Joe Orton wrote:
> One thing which has come out of discussions about stemming the tide of
> LLM reports is having a security model written down which a) the LLMs
> can read, and b) we can use when assessing poor/slop reports.
>
> Most importantly the "we" in (b) should include the security@a.o team
> who can hopefully use it to filter out the slop before "we" (this
> project's committers on security@httpd.a.o) see it.
>
> I find this task difficult to scope properly... it's hard to know what
> should/should not be covered here. And there's probably an academic
> discipline behind this topic of which I'm ignorant. Anyway I took a
> first stab, attached, definitely a lot missing.
Thank you for starting it.
>
> I'm thinking we put this at ./docs/security-model.md or somewhere while
What is the best location for a LLM that scans the repo to pick it up automatically?
Is there any generic LLM model agnostic default location / filename?
> it's a WIP. Ideally I think it ends up in docs/manual too when we're
> happy with it, but we probably need to keep a canonical version in
> markdown for the LLMs, so there's another problem to solve.
I think for now we should focus on the LLM's usability. We can try to tackle
the docs/ issue later.
>
> Thoughts? (I only started using RFC 2119-style MUST/SHOULD half way
> through editing so it's not consistent on that style)
Looks already pretty good from my point of view.
Regards
Rüdiger
Re: [RFC] Describe the security model
Posted by Ruediger Pluem <rp...@apache.org>.
On 5/13/26 10:32 AM, Emmanuel Dreyfus wrote:
> On Wed, May 13, 2026 at 09:17:51AM +0100, Joe Orton wrote:
>> IIRC chroot jails are relatively easy to escape?
>
> They are if you are root: you can create a device and remount the root
> inside the chroot. A non-privilegied user cannot do that, but we could
> imagine an attacker tricking the root privilegied httpd parent(*) process
> into doing the dirty work.
>
> The point here may be so specify what the child can cause the parent
> process to do. Anything not specified is a security violation.
>
> (*) Is it called master? Or parent? Perhaps the document should
> define the approriate term.
I would say it is the parent process.
Regards
Rüdiger
Re: [RFC] Describe the security model
Posted by Emmanuel Dreyfus <ma...@netbsd.org>.
On Wed, May 13, 2026 at 09:17:51AM +0100, Joe Orton wrote:
> IIRC chroot jails are relatively easy to escape?
They are if you are root: you can create a device and remount the root
inside the chroot. A non-privilegied user cannot do that, but we could
imagine an attacker tricking the root privilegied httpd parent(*) process
into doing the dirty work.
The point here may be so specify what the child can cause the parent
process to do. Anything not specified is a security violation.
(*) Is it called master? Or parent? Perhaps the document should
define the approriate term.
--
Emmanuel Dreyfus
manu@netbsd.org
Re: [RFC] Describe the security model
Posted by Joe Orton <jo...@apache.org>.
On Tue, May 12, 2026 at 07:07:17PM +0000, Emmanuel Dreyfus wrote:
> Hi
>
> On Tue, May 12, 2026 at 06:23:27PM +0100, Joe Orton wrote:
> > If an issue is reported against an aspect of the security model which
> > is not documented here, it MUST be accompanied by a clear description
> > of that model, showing why a trust boundary exists and how it is
> > violated.
>
> It feels odd, as if we are asking the security researcher to
> specify a new model on its own. Or did you meant "aspect" instead
> of "model" here?
> s/a clear description of that model/a clear description of that aspect/
Yup, that's exactly what I meant - thanks for the review!
> > The less-privileged user:
> >
> > * cannot obtain root privileges,
> > * cannot read or truncate log files,
> > * retains access to e.g. any private TLS key data loaded in memory.
>
> Cannot escape a chroot if httpd is configured to use that feature?
I'd say that's explicitly out of scope (IIRC chroot jails are relatively
easy to escape?), so maybe:
"Attacks against OS-specific sandboxing or security features (such as
use of containers, chroot jails, or Mandatory Access Control models) are
out of scope for this security model."
Regards, Joe
Re: [RFC] Describe the security model
Posted by Emmanuel Dreyfus <ma...@netbsd.org>.
Hi
On Tue, May 12, 2026 at 06:23:27PM +0100, Joe Orton wrote:
> If an issue is reported against an aspect of the security model which
> is not documented here, it MUST be accompanied by a clear description
> of that model, showing why a trust boundary exists and how it is
> violated.
It feels odd, as if we are asking the security researcher to
specify a new model on its own. Or did you meant "aspect" instead
of "model" here?
s/a clear description of that model/a clear description of that aspect/
> The less-privileged user:
>
> * cannot obtain root privileges,
> * cannot read or truncate log files,
> * retains access to e.g. any private TLS key data loaded in memory.
Cannot escape a chroot if httpd is configured to use that feature?
--
Emmanuel Dreyfus
manu@netbsd.org