You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Michael Smith (Code Review)" <ge...@cloudera.org> on 2026/06/01 18:20:15 UTC

[Impala-ASF-CR] IMPALA-15062: Add draft project security threat-model document

Michael Smith has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24388


Change subject: IMPALA-15062: Add draft project security threat-model document
......................................................................

IMPALA-15062: Add draft project security threat-model document

Adds a draft project-level security threat-model document
(draft-THREAT-MODEL.md) at repo root, improving discoverability
for automated security scanners running against this repository.
The file follows the rubric format used by several other ASF
projects piloting security-model discoverability.

The "draft-" prefix signals this is a proposal for the PMC to
review, correct, or reject — not a finalised maintainer-blessed
model. Every claim carries a provenance tag (documented /
inferred / maintainer) so reviewers can see where each claim
originates; §14 collects open questions for the maintainers.

Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Assisted-By: Claude Opus 4.7 (1M context) <no...@anthropic.com>
---
A draft-THREAT-MODEL.md
1 file changed, 884 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/88/24388/1
-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>

[Impala-ASF-CR] IMPALA-15062: Add draft project security threat-model document

Posted by "Zoltan Borok-Nagy (Code Review)" <ge...@cloudera.org>.
Zoltan Borok-Nagy has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: Add draft project security threat-model document
......................................................................


Patch Set 1:

(29 comments)

Thanks Michael for working on this, tried to answer most questions.

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md
File draft-THREAT-MODEL.md:

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@683
PS1, Line 683: Confirm?
Yes.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@683
PS1, Line 683: change with the upcoming
             : Iceberg-REST-only `impalad` mode
No, Iceberg-REST-only behaves the same


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@687
PS1, Line 687: (we propose **yes**)
Yes, we treat HMS/Ranger as trusted sources.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@692
PS1, Line 692: "report upstream to Apache Kudu;
             : we pick up fixes via vendored sync" (proposed)?
Seems good to me


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@698
PS1, Line 698: (proposed: **yes**, `OUT-OF-MODEL: equivalent-harm`)?
"Yes" seems OK.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@701
PS1, Line 701: disclaim (proposed)?
Yes, no sandboxing by design.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@704
PS1, Line 704: Proposed: memory corruption is `VALID`; crash /
             : exception / slow path / OOM on a malformed file *landed by a writer with
             : INSERT* is `OUT-OF-MODEL: equivalent-harm`; the same on a writer-controlled
             : file in a *read-only-to-writer* deployment is `VALID-HARDENING`. *(maps to
             : §3 item 6, §8 P8, §9, §11a)*
Seems OK


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@712
PS1, Line 712: Anything to add or remove?
We could add `bin/` which only contain operationsl / helper scripts.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@716
PS1, Line 716: Is the Web UI a per-user authentication surface or a flat-admin
             : surface?
Flat-admin


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@721
PS1, Line 721: do you make any Impala-side
             : claim about tolerance, or is that entirely the operator's responsibility
             : (proposed)?
Confirm, it's the operator's responsibility


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@726
PS1, Line 726: no child processes besides codegen
Impala also spawns:
--ssl_private_key_password_cmd
--s3a_access_key_cmd
--ldap_bind_password_cmd
java -version


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@726
PS1, Line 726: no signal handlers besides
             : breakpad
Impala also adds handlers for:
SIGPIPE->SIG_IGN
SIGTERM->HandleSigTerm
SIGUSR1->minidump
SIGRTMIN+10->stack-trace


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@727
PS1, Line 727: Any
             : exceptions?
JAVA_TOOL_OPTIONS is read from the environment and merged (not sanitized)


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@742
PS1, Line 742: Proposed across the board: **dev/test, operator must flip per §10**, except
             : the last. *(maps to §5a, §10, §13)*
All proposed "dev/test"


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@746
PS1, Line 746: Is a Web UI port reachable without auth a
             : `VALID` report on the operator's behalf, or `OUT-OF-MODEL:
             : non-default-build`?
OUT-OF-MODEL: non-default-build. The docs strongly recommend setting --webserver_password_file and the security guidelines explicitly call this out


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@751
PS1, Line 751: Confirm
             : that setting these is `OUT-OF-MODEL
Confirm


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@761
PS1, Line 761: `--cookie_secret_file`: when unset, do HS2-HTTP cookies fall back
             : to a per-process random secret (proposed)? Is the cookie HMAC algorithm
             : documented and considered a §8 property?
Confirm, when unset, Impala generates a 256-bit cryptographically random key per-process via RAND_bytes()


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@767
PS1, Line 767: **Q16.** Treat `ai_generate_text` responses and JDBC-external-table rows as
             : data crossing a trust boundary (proposed)? Does Impala itself attempt any
             : sanitization of LLM responses or external-JDBC rows? *(maps to §6, §10)*
Confirm, treat as untrusted data crossing a trust boundary.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@771
PS1, Line 771: is there an enforced maximum (proposed: yes
Yes, max_statement_length_bytes = 16 MB


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@775
PS1, Line 775: is admission control (the
             : `--default_pool_*` family) the entire enforcement, with no engine-level
             : guard?
Mostly true, but we also have concurrency limitation via --fe_service_threads


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@781
PS1, Line 781: (proposed:
             : game-over)
Yes, game-over.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@784
PS1, Line 784: out of
             : scope (proposed)
Yes, out of scope.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@788
PS1, Line 788: so any compromised peer with a valid Kerberos identity is unbounded
             : (proposed)?
Confirm


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@803
PS1, Line 803: (proposed:
             : **no** — delegated to storage layer)?
Confirm


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@807
PS1, Line 807: all delegated to SASL/Kerberos/JWT
             : libraries?
All delegated to SASL/krb5/OpenSSL.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@810
PS1, Line 810: proposed:
             : **no**, an authorization-view feature with known existence-leak side
             : channels through error messages and query profiles
Confirm, authorization view, not confidentiality boundary.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@816
PS1, Line 816: (proposed: **no**, the
             : plan is finalized at start)
Confirm


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@831
PS1, Line 831: `docs/threat-model.md`
LGTM


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@835
PS1, Line 835: Is there an existing Impala threat-model document (Confluence,
             : internal) that this should reconcile against rather than supersede?
I'm not aware of such document



-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 14:19:43 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-15062: Add draft project security threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: Add draft project security threat-model document
......................................................................


Patch Set 1:

I plan to add a follow-up patch to address outstanding questions.


-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Mon, 01 Jun 2026 18:20:49 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-15062: Add draft project security threat-model document

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: Add draft project security threat-model document
......................................................................


Patch Set 1:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/22679/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Mon, 01 Jun 2026 18:41:54 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................


Patch Set 2: Code-Review+1

Submitted by Apache Security team, plan to accept as-is for review.


-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 18:34:51 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................


Patch Set 1: Code-Review+1

(24 comments)

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md
File draft-THREAT-MODEL.md:

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@692
PS1, Line 692: "report upstream to Apache Kudu;
             : we pick up fixes via vendored sync" (proposed)?
> Seems good to me
I think the Hive source is so far diverged from upstream that we should probably handle those. It doesn't seem to be explicitly called out the way Kudu source is though.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@704
PS1, Line 704: Proposed: memory corruption is `VALID`; crash /
             : exception / slow path / OOM on a malformed file *landed by a writer with
             : INSERT* is `OUT-OF-MODEL: equivalent-harm`; the same on a writer-controlled
             : file in a *read-only-to-writer* deployment is `VALID-HARDENING`. *(maps to
             : §3 item 6, §8 P8, §9, §11a)*
> Seems OK
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@712
PS1, Line 712: Anything to add or remove?
> We could add `bin/` which only contain operationsl / helper scripts.
I have a mild preference for leaving bin/ in for utilities we might run on untrusted sources like minidumps. I think the noise from it should be low.


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@716
PS1, Line 716: Is the Web UI a per-user authentication surface or a flat-admin
             : surface?
> Flat-admin
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@721
PS1, Line 721: do you make any Impala-side
             : claim about tolerance, or is that entirely the operator's responsibility
             : (proposed)?
> Confirm, it's the operator's responsibility
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@726
PS1, Line 726: no child processes besides codegen
> Impala also spawns:
Done


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@726
PS1, Line 726: no signal handlers besides
             : breakpad
> Impala also adds handlers for:
Done


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@727
PS1, Line 727: Any
             : exceptions?
> JAVA_TOOL_OPTIONS is read from the environment and merged (not sanitized)
Done


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@742
PS1, Line 742: Proposed across the board: **dev/test, operator must flip per §10**, except
             : the last. *(maps to §5a, §10, §13)*
> All proposed "dev/test"
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@746
PS1, Line 746: Is a Web UI port reachable without auth a
             : `VALID` report on the operator's behalf, or `OUT-OF-MODEL:
             : non-default-build`?
> OUT-OF-MODEL: non-default-build. The docs strongly recommend setting --webs
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@751
PS1, Line 751: Confirm
             : that setting these is `OUT-OF-MODEL
> Confirm
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@761
PS1, Line 761: `--cookie_secret_file`: when unset, do HS2-HTTP cookies fall back
             : to a per-process random secret (proposed)? Is the cookie HMAC algorithm
             : documented and considered a §8 property?
> Confirm, when unset, Impala generates a 256-bit cryptographically random ke
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@767
PS1, Line 767: **Q16.** Treat `ai_generate_text` responses and JDBC-external-table rows as
             : data crossing a trust boundary (proposed)? Does Impala itself attempt any
             : sanitization of LLM responses or external-JDBC rows? *(maps to §6, §10)*
> Confirm, treat as untrusted data crossing a trust boundary.
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@771
PS1, Line 771: is there an enforced maximum (proposed: yes
> Yes, max_statement_length_bytes = 16 MB
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@775
PS1, Line 775: is admission control (the
             : `--default_pool_*` family) the entire enforcement, with no engine-level
             : guard?
> Mostly true, but we also have concurrency limitation via --fe_service_threa
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@781
PS1, Line 781: (proposed:
             : game-over)
> Yes, game-over.
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@784
PS1, Line 784: out of
             : scope (proposed)
> Yes, out of scope.
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@788
PS1, Line 788: so any compromised peer with a valid Kerberos identity is unbounded
             : (proposed)?
> Confirm
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@803
PS1, Line 803: (proposed:
             : **no** — delegated to storage layer)?
> Confirm
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@807
PS1, Line 807: all delegated to SASL/Kerberos/JWT
             : libraries?
> All delegated to SASL/krb5/OpenSSL.
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@810
PS1, Line 810: proposed:
             : **no**, an authorization-view feature with known existence-leak side
             : channels through error messages and query profiles
> Confirm, authorization view, not confidentiality boundary.
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@816
PS1, Line 816: (proposed: **no**, the
             : plan is finalized at start)
> Confirm
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@831
PS1, Line 831: `docs/threat-model.md`
> LGTM
Ack


http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@835
PS1, Line 835: Is there an existing Impala threat-model document (Confluence,
             : internal) that this should reconcile against rather than supersede?
> I'm not aware of such document
Ack



-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 18:34:08 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................


Patch Set 2:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md
File draft-THREAT-MODEL.md:

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@831
PS1, Line 831: `docs/threat-model.md`
> Ack
An alternative would be to put it at SECURITY.md.



-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 18:38:28 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Zoltan Borok-Nagy (Code Review)" <ge...@cloudera.org>.
Zoltan Borok-Nagy has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................


Patch Set 2: Code-Review+2

(1 comment)

LGTM!

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md
File draft-THREAT-MODEL.md:

http://gerrit.cloudera.org:8080/#/c/24388/1/draft-THREAT-MODEL.md@831
PS1, Line 831: `docs/threat-model.md`
> An alternative would be to put it at SECURITY.md.
Spark also adds SECURITY.md: https://github.com/apache/spark/commit/411dedc1aa98a5a1aeacfd9b27487583f18eaab1

Other projects that I checked still seem to lack the threat-model document.



-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Wed, 03 Jun 2026 09:07:34 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................

IMPALA-15062: (Part 1) Add draft threat-model document

Adds a draft project-level security threat-model document
(draft-THREAT-MODEL.md) at repo root, improving discoverability
for automated security scanners running against this repository.
The file follows the rubric format used by several other ASF
projects piloting security-model discoverability.

The "draft-" prefix signals this is a proposal for the PMC to
review, correct, or reject — not a finalised maintainer-blessed
model. Every claim carries a provenance tag (documented /
inferred / maintainer) so reviewers can see where each claim
originates; §14 collects open questions for the maintainers.

Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Assisted-By: Claude Opus 4.7 (1M context) <no...@anthropic.com>
Reviewed-on: http://gerrit.cloudera.org:8080/24388
Reviewed-by: Michael Smith <mi...@cloudera.com>
Reviewed-by: Zoltan Borok-Nagy <bo...@cloudera.com>
Tested-by: Michael Smith <mi...@cloudera.com>
---
A draft-THREAT-MODEL.md
1 file changed, 884 insertions(+), 0 deletions(-)

Approvals:
  Michael Smith: Looks good to me, but someone else must approve; Verified
  Zoltan Borok-Nagy: Looks good to me, approved

-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 3
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Hello Zoltan Borok-Nagy, Impala Public Jenkins, 

I'd like you to reexamine a change. Please visit

    http://gerrit.cloudera.org:8080/24388

to look at the new patch set (#2).

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................

IMPALA-15062: (Part 1) Add draft threat-model document

Adds a draft project-level security threat-model document
(draft-THREAT-MODEL.md) at repo root, improving discoverability
for automated security scanners running against this repository.
The file follows the rubric format used by several other ASF
projects piloting security-model discoverability.

The "draft-" prefix signals this is a proposal for the PMC to
review, correct, or reject — not a finalised maintainer-blessed
model. Every claim carries a provenance tag (documented /
inferred / maintainer) so reviewers can see where each claim
originates; §14 collects open questions for the maintainers.

Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Assisted-By: Claude Opus 4.7 (1M context) <no...@anthropic.com>
---
A draft-THREAT-MODEL.md
1 file changed, 884 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/88/24388/2
-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>

[Impala-ASF-CR] IMPALA-15062: (Part 1) Add draft threat-model document

Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24388 )

Change subject: IMPALA-15062: (Part 1) Add draft threat-model document
......................................................................


Patch Set 2: Verified+1

Only changing a markdown file, so code review checks should be sufficient.


-- 
To view, visit http://gerrit.cloudera.org:8080/24388
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I4d9c22f3b95f0a542888e56eeb618423104cc9fd
Gerrit-Change-Number: 24388
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Reviewer: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Comment-Date: Wed, 03 Jun 2026 20:25:09 +0000
Gerrit-HasComments: No