[Discussion] Do we need to rectify SecurityMgr? (Sensitive Data handling)

[MoonkiHong]

I personally think that sensitive data is returned by an access to passPhraseJWTPath. What do you think? @tdrozdovsky

edge-home-orchestration-go/src/controller/securemgr/authenticator/authenticator.go

Line 70 in 22ce49b

log.Panicf("Failed to create passPhraseJWTPath %s: %s\n", passPhraseJWTPath, err)

This might be the same potential security risk as follow.

edge-home-orchestration-go/src/controller/securemgr/authenticator/authenticator.go

Line 84 in 22ce49b

log.Println(logPrefix, "cannot create "+passPhraseJWTFilePath+": ", err)

[MoonkiHong]

@tdrozdovsky Plus, could you rectify if err is used in our platform?

edge-home-orchestration-go/src/orchestrationapi/orchestration_api.go

Line 180 in 22ce49b

deviceResources[i].score, err = orcheEngine.GetScoreWithResource(dev.resource)

[MoonkiHong]

@tdrozdovsky This is due to my ongoing analysis with the tool lgtm as follow.

https://lgtm.com/projects/g/lf-edge/edge-home-orchestration-go/alerts/?mode=list

[tdrozdovsky]

I personally think that sensitive data is returned by an access to passPhraseJWTPath. What do you think? @tdrozdovsky

edge-home-orchestration-go/src/controller/securemgr/authenticator/authenticator.go

Line 70 in 22ce49b

log.Panicf("Failed to create passPhraseJWTPath %s: %s\n", passPhraseJWTPath, err)

This might be the same potential security risk as follow.

edge-home-orchestration-go/src/controller/securemgr/authenticator/authenticator.go

Line 84 in 22ce49b

log.Println(logPrefix, "cannot create "+passPhraseJWTFilePath+": ", err)

Good point, I know and remember this security issue.

These only informs about a failed attempt to create the passPhraseJWTFilePath file.
But of course, storing such information in files (passPhrase, edge-orchestration.key, etc) is a security risk.
I think in the future this should be solved with secure storage or with access control system such as: SeLinux, SMACK, etc.

Thank you for reminder

[MoonkiHong]

@tdrozdovsky Thank you for accepting my suggestion. I have just assigned this issue to you. We are looking forward to seeing your another valuable contribution soon!

[tdrozdovsky]

@tdrozdovsky Plus, could you rectify if err is used in our platform?

edge-home-orchestration-go/src/orchestrationapi/orchestration_api.go

Line 180 in 22ce49b

deviceResources[i].score, err = orcheEngine.GetScoreWithResource(dev.resource)

I researched using err variable. Error handling is done below.

if len(deviceScores) <= 0 {
		return errorResp
} else if deviceScores[0].score == scoringmgr.INVALID_SCORE {
	return errorResp
}

Additional processing will make the code more complex.

Therefore, I suggest to ignore the err variable.

	deviceResources[i].score, _ = orcheEngine.GetScoreWithResource(dev.resource)

[MoonkiHong]

@tdrozdovsky Plus, could you rectify if err is used in our platform?

edge-home-orchestration-go/src/orchestrationapi/orchestration_api.go

Line 180 in 22ce49b

deviceResources[i].score, err = orcheEngine.GetScoreWithResource(dev.resource)

I researched using err variable. Error handling is done below.

if len(deviceScores) <= 0 {
		return errorResp
} else if deviceScores[0].score == scoringmgr.INVALID_SCORE {
	return errorResp
}

Additional processing will make the code more complex.

Therefore, I suggest to ignore the err variable.

	deviceResources[i].score, _ = orcheEngine.GetScoreWithResource(dev.resource)

@tdrozdovsky It is reasonable. ^^ Could you suggest the regarding PR for this?