Repository navigation
docs: Adopt current NVIDIA SECURITY.md template - #473
Conversation
TRI-1935
mc-nv
added
the
documentation
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
TRI-1935
| * Models, configuration and other inputs come from trusted sources. | ||
| * Dependencies and the build environment are kept up to date and obtained from trusted sources. | ||
| * Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. | ||
| * Host operating system, driver and hardware security are the operator's responsibility. |
There was a problem hiding this comment.
--triton-server-directory selects a library loaded with dlopen; MPI and CUDA libraries are also loaded by name. If an untrusted user can influence one of those locations, the tool can load unintended code. How this was verified: The configured server-library path reaches dlopen, while MPI and CUDA libraries are loaded by name.
|
|
||
| 1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. | ||
| 2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. | ||
| 3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. |
There was a problem hiding this comment.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| 2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. | ||
| 3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. | ||
| 4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. | ||
| 5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. |
There was a problem hiding this comment.
--profile-export-file is used, the export contains request inputs and response outputs and is written with default file permissions. Operators who restrict logs may still share or leave that file accessible without realizing it contains payload data. How this was verified: The profile exporter serializes request and response data into JSON and opens the output file with fopen(..., "w").
| * Models, configuration and other inputs come from trusted sources. | ||
| * Dependencies and the build environment are kept up to date and obtained from trusted sources. | ||
| * Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. | ||
| * Host operating system, driver and hardware security are the operator's responsibility. |
There was a problem hiding this comment.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
|
Closing: SECURITY.md already exists in this repository with NVIDIA's standard reporting text, so no change is needed here. Tracked in TRI-1935. |
mc-nv
changed the title
|
|
||
| ## Critical Security Assumptions | ||
|
|
||
| * The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. |
There was a problem hiding this comment.
--input-data JSON file containing message_generator can execute a shell command with those privileges. The general advice to use trusted inputs does not make that risk clear to operators. How this was verified: The input-data command reaches popen and runs with the Perf Analyzer process’s privileges.
This branch is being deployed
2 participants
What does the PR do?
NVIDIA/NeMo,cuda-pythonandMegatron-LM.cuda-python, since Triton repos are mirrored to internal GitLab.Checklist
<commit_type>: <Title>Commit Type:
Check the conventional commit type
box here and add the label to the github PR.
Related PRs:
Where should the reviewer start?
SECURITY.md— compare againstNVIDIA/NeMo/SECURITY.mdfor the canonical wording.Test plan:
Documentation only; no code paths affected.
CI Pipeline ID:
Caveats:
NVIDIA/NeMosays "through GitHub",NVIDIA/cuda-pythonsays "through GitHub/GitLab". This PR uses the latter because Triton repositories exist on both GitHub and internal GitLab.Background
An AIVO asset review (securityportal.nvidia.com/aivo/assets) flagged Triton repositories with no SECURITY.md. Rather than authoring per-repository security documentation, every repository adopts NVIDIA's current standard template so the policy is identical everywhere and carries no repository-specific claims to maintain.
Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)