Skip to content

Commit a461e4c

Browse files
committed
Extend multiple contexts per process section
1 parent 5995840 commit a461e4c

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

articles/ros2_security_contexts.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,13 +232,17 @@ For circumstances where the context path is orthogonal to node namespace, the us
232232
Before the use of contexts, multiple nodes composed into a single process where each mapped to a separate participant.
233233
Each participant subsequently load an security identity and access control credential prevalent to its' respective node.
234234
The composition of multiple nodes per context however, inevitably means that code compiled to node `foo` could access credentials/permissions only trusted to node `bar`.
235-
This consequence of composition could unintendedly subvert the minimal spanning policy as architected by the designer or measured/generated via ROS 2 tooling/IDL.
235+
This consequence of composition could unintendedly subvert the minimal spanning policy as architected by the policy designer or measured/generated via ROS 2 tooling/IDL.
236236

237237
With the introduction of contexts, it becomes possible to describe the union of access control permission by defining a collection of SROS 2 policy profiles as element within a specific context.
238238
This would allow for formal analysis tooling to check for potential violations in information flow control given the composing of nodes at runtime.
239239
However, should multiple contexts be used per process, then such security guaranties are again lost.
240240
Thus it should be asked whether if multiple contexts per process should even be supported.
241241

242+
In summery, the distinction here is that before, the composition of multiple permissions could not be conveyed to the tooling.
243+
Whether nodes could gain the permission of others in the same process space is not the hinge point of note; it's the fact that such side effects could not be formally modeled or accounted for by the designer.
244+
Allowing for multiple contexts per process again exacerbates the same modeling inaccuracies
245+
242246
## References
243247

244248
1. [Procedurally Provisioned Access Control for Robotic Systems](https://doi.org/10.1109/IROS.2018.8594462)

0 commit comments

Comments
 (0)