You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@zeppelin.apache.org by "jongyoul (via GitHub)" <gi...@apache.org> on 2026/09/05 06:01:14 UTC
[PR] [MINOR] Clarify security boundaries and notebook permissions [zeppelin-site]
jongyoul opened a new pull request, #84:
URL: https://github.com/apache/zeppelin-site/pull/84
## Summary
- Link the operator-facing security page to the canonical threat model.
- Clarify that UI, REST, and WebSocket note operations must enforce notebook permissions.
- Distinguish application-level notebook ACLs from interpreter and OS-level isolation.
- Describe the default interpreter OS identity and point operators to user impersonation.
This resolves an ambiguity where the previous wording could be read as disclaiming notebook authorization for authenticated users.
## Verification
- git diff --check
- Threat model and user impersonation links returned HTTP 200
- Jekyll build was not run locally because Docker is unavailable
This is a documentation-only change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MINOR] Clarify security boundaries and notebook permissions [zeppelin-site]
Posted by "jongyoul (via GitHub)" <gi...@apache.org>.
jongyoul commented on code in PR #84:
URL: https://github.com/apache/zeppelin-site/pull/84#discussion_r3939679505
##########
security.md:
##########
@@ -96,12 +102,19 @@ to other services on the same domain.
If you expose your Zeppelin instance on a network you don't fully trust,
you should configure [Apache Shiro authentication](https://zeppelin.apache.org/docs/latest/setup/security/shiro_authentication.html).
-Non-authenticated users cannot view, store or execute notes, so they
-cannot execute code on the server or on other users' browsers.
-Authenticated users, however, have the same access as described above,
-so even when using authentication it is still important to only give
-trusted users access to Zeppelin. Specifically, users technically
-have access to all notes by other users.
+With Shiro authentication configured, unauthenticated users cannot view, store
+or execute notes, so they cannot execute code on the server or on other users'
+browsers. Authenticated users remain subject to each note's configured owner,
+reader, writer and runner permissions for operations through Zeppelin's UI,
+REST APIs and WebSocket APIs.
Review Comment:
Added a direct link to the notebook authorization documentation.
##########
security.md:
##########
@@ -96,12 +102,19 @@ to other services on the same domain.
If you expose your Zeppelin instance on a network you don't fully trust,
you should configure [Apache Shiro authentication](https://zeppelin.apache.org/docs/latest/setup/security/shiro_authentication.html).
-Non-authenticated users cannot view, store or execute notes, so they
-cannot execute code on the server or on other users' browsers.
-Authenticated users, however, have the same access as described above,
-so even when using authentication it is still important to only give
-trusted users access to Zeppelin. Specifically, users technically
-have access to all notes by other users.
+With Shiro authentication configured, unauthenticated users cannot view, store
+or execute notes, so they cannot execute code on the server or on other users'
+browsers. Authenticated users remain subject to each note's configured owner,
+reader, writer and runner permissions for operations through Zeppelin's UI,
+REST APIs and WebSocket APIs.
+
+These notebook permissions are application-level access controls, not an OS or
+interpreter sandbox. A user who is allowed to run interpreter code can access
Review Comment:
Changed the wording to “These note permissions” for consistent terminology.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MINOR] Clarify security boundaries and notebook permissions [zeppelin-site]
Posted by "voidmatcha (via GitHub)" <gi...@apache.org>.
voidmatcha merged PR #84:
URL: https://github.com/apache/zeppelin-site/pull/84
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MINOR] Clarify security boundaries and notebook permissions [zeppelin-site]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #84:
URL: https://github.com/apache/zeppelin-site/pull/84#discussion_r3939672006
##########
security.md:
##########
@@ -96,12 +102,19 @@ to other services on the same domain.
If you expose your Zeppelin instance on a network you don't fully trust,
you should configure [Apache Shiro authentication](https://zeppelin.apache.org/docs/latest/setup/security/shiro_authentication.html).
-Non-authenticated users cannot view, store or execute notes, so they
-cannot execute code on the server or on other users' browsers.
-Authenticated users, however, have the same access as described above,
-so even when using authentication it is still important to only give
-trusted users access to Zeppelin. Specifically, users technically
-have access to all notes by other users.
+With Shiro authentication configured, unauthenticated users cannot view, store
+or execute notes, so they cannot execute code on the server or on other users'
+browsers. Authenticated users remain subject to each note's configured owner,
+reader, writer and runner permissions for operations through Zeppelin's UI,
+REST APIs and WebSocket APIs.
Review Comment:
The updated text explains that authenticated users are constrained by owner/reader/writer/runner permissions, but it doesn’t link to the operator docs that describe how to configure notebook authorization. Adding a direct link would make this new guidance easier to act on.
##########
security.md:
##########
@@ -96,12 +102,19 @@ to other services on the same domain.
If you expose your Zeppelin instance on a network you don't fully trust,
you should configure [Apache Shiro authentication](https://zeppelin.apache.org/docs/latest/setup/security/shiro_authentication.html).
-Non-authenticated users cannot view, store or execute notes, so they
-cannot execute code on the server or on other users' browsers.
-Authenticated users, however, have the same access as described above,
-so even when using authentication it is still important to only give
-trusted users access to Zeppelin. Specifically, users technically
-have access to all notes by other users.
+With Shiro authentication configured, unauthenticated users cannot view, store
+or execute notes, so they cannot execute code on the server or on other users'
+browsers. Authenticated users remain subject to each note's configured owner,
+reader, writer and runner permissions for operations through Zeppelin's UI,
+REST APIs and WebSocket APIs.
+
+These notebook permissions are application-level access controls, not an OS or
+interpreter sandbox. A user who is allowed to run interpreter code can access
Review Comment:
This section switches from “note” terminology (lines 107–109) to “notebook” (“These notebook permissions…”), which can read like two different permission models. Consider using the same term throughout or explicitly noting that “note” and “notebook” refer to the same object here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org