Mark object as TLP:RED for limited sharing (restricted objects) #584
Labels
type:discussion
Issues that need to be discussed before implementation
type:feature
New feature description e.g. which involves implementation of new components
zone:backend
MWDB backend core related tasks
zone:frontend
MWDB frontend tasks
Describe the problem
In current sharing model we have
everything
group withaccess_all_objects
capability and all objects are automatically shared with that group. The main use-case for that feature is to make all objects in MWDB visible for repository owner. That group is created by default in new MWDB installations.But sometimes we want to share all objects with some other participants as well, but still be able to limit sharing for some objects that are too sensitive to be shared with broader community (e.g. TLP:RED).
Marking object as
TLP:RED
will turn off all of additional sharing features and will share object during upload only with specified group. No shares will be removed during this operation, so if object was already shared with e.g.public
, it won't be unshared during upload operation withtlp:red
mark.Describe the solution you'd like
Initial steps:
adding_restricted_objects
restricted
that limits sharing only to the chosen group*
andpublic
whenrestricted
is turned onSharing rules:
access_all_objects
groupsThe tricky part is with children of restricted objects, because they can be uploaded without restriction options and be added to
everything
group. But if we're aware of these restriction options, we can upload artifacts fromkarton
restricted by default. Shares toeverything
and other groups will be inherited in that case. If the only parent is restricted, descendant objects will be restricted as well.We may also need special option in https://github.com/CERT-Polska/karton-mwdb-reporter to make it fully functional.
In frontend: option should be presented as additional checkbox under Share with. After checking that checkbox, the only possible
Share with
options should beSingle group...
andOnly me
.So the other things in todo are:
Describe alternatives you've considered
None
The text was updated successfully, but these errors were encountered: