Skip to content

Commit

Permalink
Allow extension of RestrictedSecurity profiles
Browse files Browse the repository at this point in the history
RestrictedSecurity profiles sometimes share a lot of duplicate settings
with only minor differences. With these changes the extension, similar
to object-orientation, of profiles becomes possible.

More specifically, a profile A can extend another a profile B, using
RestrictedSecurity.<profile A name>.extends =
RestrictedSecurity.<profile B name>. This allows profile A to inherit
all of profile B's properties. One can add additional properties to
profile A, or amend some of the existing ones. That includes overriding,
appending or removing from a property (wherever that's applicable).

An additional property is introduced. The RestrictedSecurity.<profile
name>.desc.hash = <hash algorithm>:<hash> is used to ensure the profile
hasn't been unintentionally altered. The profile's properties are hashed
using the selected <hash algorithm>, and the result is compared to the
<hash> provided through the property. This property is mandatory for
base profiles (i.e., profiles that are not extending anything), and
optional for the rest.

Signed-off-by: Kostas Tsiounis <kostas.tsiounis@ibm.com>
  • Loading branch information
KostasTsiounis committed Jun 24, 2024
1 parent 8dadc9e commit c49042f
Show file tree
Hide file tree
Showing 3 changed files with 964 additions and 436 deletions.
Loading

0 comments on commit c49042f

Please sign in to comment.