search

prometheus / procfs

procfs provides functions to retrieve system, kernel and process metrics from the pseudo-filesystem proc.
Apache License 2.0
754 stars 311 forks source link

Add the Scorecard Action to monitor procfs' security posture #570

Closed pnacht closed 8 months ago

pnacht commented 9 months ago

Hey, it's Pedro (see https://github.com/prometheus/common/pull/490 and https://github.com/prometheus/prometheus/pull/12841). I'm back with another security suggestion.

I found the issues fixed by those PRs by scanning procfs with Scorecard. It looks at a repository's settings and configurations to identify potential points of improvement in a project's security posture.

As it happens, the first issues I worked on involved workflows, which procfs pulls from /common and/or /prometheus, so I sent the PRs over there.

Scorecard is also available as a GitHub Action. It then monitors a project's security posture and populates the Security Panel with any tips it may find relevant for the project. In doing so, it can also flag whenever a code or setting change accidentally weakens the project's security.

procfs' current score is 6.8/10, which places it at the top 10% of projects important to the open-source ecosystem.

I'll write a PR implementing the Action and send it along with this issue.

SuperQ commented 9 months ago

If we're going to include this action, we should add it to https://github.com/prometheus/prometheus/blob/main/scripts/sync_repo_files.sh. This way it's automatically managed in all Prometheus project repos.

pnacht commented 8 months ago

Sorry for the delay here, but sure thing, I'd be happy to send this to prometheus/prometheus and add it to the sync script.

I do have one question though. After one of my previous PRs, I realized there's automation keeping things in sync with prometheus/prometheus but there's also prometheus/common, which I'd understood was the container for all "common" things in prometheus projects.

Has /common been deprecated, with /prometheus now being the source-of-truth for common files?