mir/kea
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/kea synced 2025-08-22 18:08:16 +00:00
Code Issues Releases Wiki Activity

[#3848] Change risk to policy

Browse Source 
modified:   doc/sphinx/arm/agent.rst
modified:   doc/sphinx/arm/ddns.rst
modified:   doc/sphinx/arm/dhcp4-srv.rst
modified:   doc/sphinx/arm/dhcp6-srv.rst
modified:   doc/sphinx/arm/security.rst
This commit is contained in:
Thomas Markwalder 2025-06-18 09:52:02 -04:00
parent d8eb27b3fa
commit 0a85700c28
5 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/sphinx/arm/agent.rst
View File

@ -288,7 +288,7 @@ Starting and Stopping the Control Agent
- ``-X`` - As of Kea 3.0, disables security restrictions. The server will - ``-X`` - As of Kea 3.0, disables security restrictions. The server will
still check for violations but will emit warning logs when they are found still check for violations but will emit warning logs when they are found
rather than fail with an error. Please see rather than fail with an error. Please see
:ref:`sec-kea-runtime-security-risk-checking` for details. :ref:`sec-kea-runtime-security-policy-checking` for details.
The CA is started by running its binary and specifying the configuration The CA is started by running its binary and specifying the configuration
file it should use. For example: file it should use. For example:

2
doc/sphinx/arm/ddns.rst
View File

@ -166,7 +166,7 @@ directly. It accepts the following command-line switches:
- ``-X`` - As of Kea 3.0, disables security restrictions. The server will - ``-X`` - As of Kea 3.0, disables security restrictions. The server will
still check for violations but will emit warning logs when they are found still check for violations but will emit warning logs when they are found
rather than fail with an error. Please see rather than fail with an error. Please see
:ref:`sec-kea-runtime-security-risk-checking` for details. :ref:`sec-kea-runtime-security-policy-checking` for details.
Upon startup, the module loads its configuration and begins listening Upon startup, the module loads its configuration and begins listening
for NCRs based on that configuration. for NCRs based on that configuration.

2
doc/sphinx/arm/dhcp4-srv.rst
View File

@ -81,7 +81,7 @@ the following command-line switches:
- ``-X`` - As of Kea 3.0, disables security restrictions. The server will - ``-X`` - As of Kea 3.0, disables security restrictions. The server will
still check for violations but will emit warning logs when they are found still check for violations but will emit warning logs when they are found
rather than fail with an error. Please see rather than fail with an error. Please see
:ref:`sec-kea-runtime-security-risk-checking` for details. :ref:`sec-kea-runtime-security-policy-checking` for details.
On startup, the server detects available network interfaces and On startup, the server detects available network interfaces and
attempts to open UDP sockets on all interfaces listed in the attempts to open UDP sockets on all interfaces listed in the

2
doc/sphinx/arm/dhcp6-srv.rst
View File

@ -81,7 +81,7 @@ the following command-line switches:
- ``-X`` - As of Kea 3.0, disables security restrictions. The server will - ``-X`` - As of Kea 3.0, disables security restrictions. The server will
still check for violations but will emit warning logs when they are found still check for violations but will emit warning logs when they are found
rather than fail with an error. Please see rather than fail with an error. Please see
:ref:`sec-kea-runtime-security-risk-checking` for details. :ref:`sec-kea-runtime-security-policy-checking` for details.
On startup, the server detects available network interfaces and On startup, the server detects available network interfaces and
attempts to open UDP sockets on all interfaces listed in the attempts to open UDP sockets on all interfaces listed in the

11
doc/sphinx/arm/security.rst
View File

@ -556,15 +556,16 @@ and DDNS servers since Kea version 2.7.2.
The three primary Kea daemons (:iscman:`kea-dhcp4`, :iscman:`kea-dhcp6` and :iscman:`kea-dhcp-ddns`) all support a control The three primary Kea daemons (:iscman:`kea-dhcp4`, :iscman:`kea-dhcp6` and :iscman:`kea-dhcp-ddns`) all support a control
channel, which is implemented as a UNIX socket. The control channel, which opens a UNIX socket, is disabled by default. channel, which is implemented as a UNIX socket. The control channel, which opens a UNIX socket, is disabled by default.
.. _sec-kea-runtime-security-risk-checking: .. _sec-kea-runtime-security-policy-checking:
Kea Runtime Security Risk Checking Kea Runtime Security Policy Checking
================================== ====================================
Runtime security risk checking was initially added to Kea daemons :iscman:`kea-dhcp4`, Runtime security policy checking was initially added to Kea daemons :iscman:`kea-dhcp4`,
:iscman:`kea-dhcp6`, :iscman:`kea-dhcp-ddns`, :iscman:`kea-ctrl-agent`. in Kea 2.7.9 :iscman:`kea-dhcp6`, :iscman:`kea-dhcp-ddns`, :iscman:`kea-ctrl-agent`. in Kea 2.7.9
release. In Kea 3.0 additional checks were added. By default, when a daemon detects release. In Kea 3.0 additional checks were added. By default, when a daemon detects
a security risk it emits an error log and exits. The following checks are performed: a security policy violation it emits an error log and exits. The following checks are
performed:
- Use of unsupported file paths or permissions as detailed in :ref:`sec-summary-of-path-restrictions` - Use of unsupported file paths or permissions as detailed in :ref:`sec-summary-of-path-restrictions`