SEC-CAT-004 — Make system-schema policy deterministic
| Field | Value |
|---|---|
| Status | Open finding; source-verified, deployed effective policies unverified |
| Severity | High |
| Affected surface | Ranger policies for information_schema and cogrion_system |
| Implementation issue | platform-stacks #673 |
| Code-change repository | sparqd/platform-stacks |
Where the problem appears
Compare effective Ranger policies in a clean workspace and an upgraded workspace, then exercise discovery and internal product paths.
Concrete observed case
The information-schema policy differs between fresh creation and update behavior, and reconciliation does not fully normalize all resource fields. No explicit cogrion_system contract exists even though internal product features depend on it.
Expected condition
One declarative reconciliation produces identical resources, principals, and accesses on clean and upgraded workspaces. information_schema is filtered read-only metadata; cogrion_system is denied to direct users and available only through least-privilege product identities.
Cause and evidence
- Fresh and update policy paths do not declare the same access set.
- Existing policy resources and principals may survive partial reconciliation.
- Internal services need a distinct access contract from ordinary users.
Why it matters
Workspaces can differ by installation history, either breaking product features or exposing internal metadata more broadly than intended.
Existing controls and workarounds
Inspect effective Ranger policy and audit in each workspace; do not infer the result from bootstrap success alone.
Alternatives considered
- Recommended: full declarative policy reconciliation and regression fixtures.
- Migration-only repair — useful for current workspaces but does not prevent future drift.
- Broad public grants — rejected because they violate the intended system-schema boundary.
Component involvement
- Platform deployment owns deterministic reconciliation.
- Ranger owns enforcement and audit.
- Product services own scoped service identities; Catalog owns presentation.
Reproduction and verification
Follow CAT-S018. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when clean and upgraded workspaces converge to the same policy and role-based discovery, direct denial, and internal service access all pass.
Validation and blockers
Platform, Ranger, security, and affected service owners must validate deployed effective policy.