Conversation
|
🌿 Preview your docs: https://nvidia-preview-pr-3355.docs.buildwithfern.com/openshell |
b9ad685 to
ad9c479
Compare
6476d30 to
7d5404f
Compare
There was a problem hiding this comment.
This module doesn't look like it's used anywhere anymore.
It got deleted here: https://github.com/NVIDIA/OpenShell/pull/2942/changes#diff-9f56559056bc6d68aded0ccb5b9aaf3894b500b76d103e26268392922cb21391, but I didn't if it got moved elsewhere or if this functionality got dropped.
There was a problem hiding this comment.
Addressed: removed the obsolete bypass monitor. It has no remaining call site under the RFC 0012 isolation architecture, so retaining it here would add dead code.
7d5404f to
ea8896d
Compare
| AppLifecycleBuilder::new(openshell_ocsf::ctx::ctx()) | ||
| .activity(ActivityId::Fail) | ||
| .severity(SeverityId::Low) | ||
| .status(StatusId::Failure) | ||
| .message(message) | ||
| .build() |
There was a problem hiding this comment.
This may be better represented as base event. ActivityId::Fail (4) maps to Stop in application lifecycle event: https://schema.ocsf.io/1.8.0/classes/application_lifecycle?extensions=
But in this case the application keeps running.
The event below, causes a application shutdown, so that one looks good.
There was a problem hiding this comment.
Addressed: endpointless per-connection failures now emit Base Event (Proxy connection failure), and a mediation-source accept-loop failure emits Base Event (Network mediation source failure). Both retain Failure status without implying lifecycle Stop. The PR includes regression coverage asserting class_uid: 0 and that neither event has activity Stop. The genuine supervisor-shutdown lifecycle event is unchanged.
ea8896d to
51ac38e
Compare
Previously, Network Activity could be constructed without a source or destination endpoint, allowing connection, accept, relay, and configuration events to violate the OCSF 1.8 endpoint constraint. Now, NetworkActivityBuilder requires a source or destination endpoint at compile time. Connection failures identify the workload peer or genuine transparent destination, listener failures identify the listening endpoint, and mediation-lane failures use Application Lifecycle rather than fabricated network endpoints. Malformed forward requests use HTTP Activity with a method-only request, generated 400 response, and workload peer. Additionally, Unix relay-channel events use Base Event, policy-validation warnings use Config State Change, and the unused bypass monitor is removed because the current isolation architecture no longer uses it. Signed-off-by: Kris Hicks <khicks@nvidia.com>
51ac38e to
1b4ab2e
Compare
2 participants
Summary
Previously, Network Activity could be constructed without a source or destination endpoint, allowing connection, accept, relay, configuration, and bypass-monitor events to violate the OCSF 1.8 endpoint constraint.
Now, NetworkActivityBuilder requires a source or destination endpoint at compile time. Connection failures retain the workload peer, and accept failures identify the listening endpoint. Malformed forward requests use HTTP Activity with a method-only request, generated 400 response, and workload peer.
Additionally, Unix relay-channel events use Base Event, policy-validation warnings use Config State Change, and bypass-monitor startup failures use Detection Finding rather than fabricated network endpoints.
Related Issue
#1055
Changes
Testing
mise run pre-commitpassesChecklist