Repository navigation
[pull] main from NVIDIA:main - #296
Merged
Merged
Conversation
* fix(policy): propose rules for unknown DNS hosts Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * docs(policy): clarify synthetic DNS use across protocols Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(policy): harden unknown-host DNS observations - Emit the policy_dns_ineligible denial for every unknown name and report observation staging failures as DNS failure events. - Refuse unknown names during fail-closed quarantine and after the observation budget, now a quarter of each address family's pool. - Pin transparent TCP to the mapping of the deciding policy generation so a reload between DNS and authorization fails closed. - Stop Docker workloads from inheriting host DNS search domains, which let the first expanded short name claim an observation address. - Share mechanistic draft polling in conformance, register new-hostname-proposal in the installed suite, and update docs. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test(policy): build policy DNS proxy tests on every target The proxy tests name PolicyEndpointId, which proxy.rs imported only on Linux, so the macOS test build failed. Import it for test builds too. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(policy): name DNS queries and mapped hosts in OCSF denials DNS denial and failure events attached port 53 to the queried name, which read as a connection to that host. They now carry only the name. Transparent TCP denials for a policy DNS address show the mapped hostname and keep the synthetic address in dst_endpoint.ip. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> --------- Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* docs: refresh architecture and agent guides Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs: describe updated security architecture neutrally Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs: highlight new isolation primitives Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(sandboxes): clarify how to disconnect Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs: align architecture and guides with current navigation Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(extensibility): streamline extension authentication guidance Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )