Update Hassio with security options#2067
Update Hassio with security options#2067bramkragten merged 5 commits intohome-assistant:devfrom bramkragten:hassio
Conversation
ghost
added
the
|
🎉 I'm really thankful that you are doing this @bramkragten! 👍
Some other small remarks:
|
|
This looks great! Does the security rating go with the addon or does it change depending on whether the protection mode is enabled/disabled? |
|
Current: Suggestion: I think the latter explains it a little more and adds the security risk to it as well. |
| </div> | ||
| <div class="security"> | ||
| <h3>Security</h3> | ||
| <ha-label-badge |
There was a problem hiding this comment.
Description:
Addon Security Rating
Hass.io provides a security rating to each of the add-ons, which indicates the risks involved when using this add-on. The more access an addon requires on your system, the lower the score, thus raising the possible security risks.
A score is on a scale from 1 to 6. Where 1 is the lowest score (considered the most insecure and highest risk) and a score of 6 is the highest score (considered the most secure and lowest risk).
There was a problem hiding this comment.
I wonder if all badges should link to a help article with all the extended info
| ></ha-label-badge> | ||
| </template> | ||
| <template is="dom-if" if="[[addon.homeassistant_api]]"> | ||
| <ha-label-badge |
There was a problem hiding this comment.
Description:
Home Assistant API Access
This add-on is allowed to access your running Home Assistant instance directly via the Home Assistant API. This mode handles authentication for the addon as well, which enables an addon to interact with Home Assistant without the need for additional authentication tokens.
| ></ha-label-badge> | ||
| </template> | ||
| <template is="dom-if" if="[[addon.full_access]]"> | ||
| <ha-label-badge |
There was a problem hiding this comment.
Badge description:
Full Hardware Access
This addon is given full access to the hardware of your system, by request of the addon author. Access is comparable to the privileged mode in Docker. Since this opens up possible security risks, this feature impacts the addon security score negatively.
This level of access is not granted automatically and needs to be confirmed by you. To do this, you need to disable the protection mode on the addon manually. Only disable the protection mode if you know, need AND trust the source of this addon.
| description="" | ||
| ></ha-label-badge> | ||
| </template> | ||
| <template is="dom-if" if="[[addon.hassio_api]]"> |
There was a problem hiding this comment.
Description of badge:
Hass.io API Access
The addon was given access to the Hass.io API, by request of the addon author. By default, the addon can access general version information of your system. When the addon requests "manager" or "admin" level access to the API, it will gain access to control multiple parts of your Hass.io system. This permission is indicated by this badge and will impact the security score of the addon negatively.
| description="" | ||
| ></ha-label-badge> | ||
| </template> | ||
| <template is="dom-if" if="[[addon.docker_api]]"> |
There was a problem hiding this comment.
Description of badge:
Full Docker Access
The addon author has requested the addon to have management access to the Docker instance running on your system. This mode gives the addon full access and control to your entire Hass.io system, which adds security risks, and could damage your system when misused. Therefore, this feature impacts the addon security score negatively.
This level of access is not granted automatically and needs to be confirmed by you. To do this, you need to disable the protection mode on the addon manually. Only disable the protection mode if you know, need AND trust the source of this addon.
| ></ha-label-badge> | ||
| </template> | ||
| <template is="dom-if" if="[[addon.host_pid]]"> | ||
| <ha-label-badge |
There was a problem hiding this comment.
Badge description:
Host Processes Namespace
Usually, the processes the addon runs, are isolated from all other system processes. The addon author has requested the addon to have access to the system processes running on the host system instance, and allow the addon to spawn processes on the host system as well. This mode gives the addon full access and control to your entire Hass.io system, which adds security risks, and could damage your system when misused. Therefore, this feature impacts the addon security score negatively.
This level of access is not granted automatically and needs to be confirmed by you. To do this, you need to disable the protection mode on the addon manually. Only disable the protection mode if you know, need AND trust the source of this addon.
@cogneato That is not determined by the frontend, but by Hass.io. See: https://github.com/home-assistant/hassio/blob/master/hassio/addons/utils.py#L17 |
|
@bramkragten Missing in this list (IMHO):
|
AppArmor
|
Home Assistant Authentication
|
|
This is already looking very nice. I agree with Frenck to move the warning banner down, between the header and config blocks. Edit: with modal I meant a dialog like how the changelog for an add-on is currently shown. One last thing that I think is important when speaking about the whole security aspect of add-ons: which folders can they access (config, share, ssl...) and is it either read-only or R/W. Also, could you provide a screenshot on how non-available add-ons are shown in the store? |
|
I love it! Thanks @frenck for the comments 👍 |
|
lol we need a designer so badly 😉 It feels like a mismash of data thrown into a single card. I won't block this PR on it but we should think about it after this is merged. Maybe split in 2 cards: info + config/control. Inspiration for a card based UI with a lot of info is the Play Store: https://play.google.com/store/apps/details?id=com.google.android.gm |
Added more info modal and moved the security components.
|
I totally agree with the design part @balloob... (PS: that google store example.... ❤️ So much information in there... If we could show, size of the add-on, the author, the last date updated....) This is a pretty big step forward (from a functional perspective), so thanks @bramkragten 👍 |
7 participants
Fixes #1710 (except the upload snapshot)
Unavailble addon: