Repository navigation
Embedded Linux control software: sub-models, privilege contexts, embedded-linux library - #25
Merged
Merged
Conversation
…nes on elements Optional, additive fields (no schema bump, ADR-0015). topology.py answers where an element runs, its effective zone (inherited from the host) and which boundary a flow crosses; assistant, ARC, reports and the SVG diagram use the effective zone. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…, host takeover New errors runs-on-invalid, runs-on-cycle, refines-unresolved, refines-multiple-parents, refines-cycle; new warnings exposed-service-unauthenticated, privilege-boundary-gap, host-takeover-understated, duplicate-assessment, sbom-ref-invalid. Refined and refining elements share threat coverage, and CRA coverage is checked once per product (model plus its sub-models). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…lumns, attack surface A model and the sub-models refining it form one document and one assessment: sub-model ids are qualified (software/T-0001), risk distribution, traceability, approvals and CRA coverage count them together, and build no longer renders a sub-model on its own (--model still does). Element and flow tables gain host, privilege context, refinement and boundary columns when the model uses them, plus a technical attack surface table. The SVG diagram frames hosts and privilege contexts and dashes flows across a privilege boundary. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
New bundled library for control software on a Linux industrial PC: 21 element types (processes, OS services, kernel and modules, shared memory, update staging, local IPC, SSH, SMTP, USB HID, people with system access), 55 threat templates and 14 Linux-specific measures; everything else points at existing OT measures. library.yaml gains `requires` (checked as library-invalid), element types can preset privilege, authentication and listens_on. init -l embedded-linux brings ot along; --example creates a machine model main and a sub-model software whose host refines the industrial PC (validate: 0 errors). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…by library The diagram frames each host with what runs on it and each privilege context inside, draws flows across a privilege boundary dotted and nests hosts inside zones in the auto layout; processes take the zone of their host. The element form edits runs_on, privilege, listens_on, authentication, memory_safe, purl/CPE and refines (elements of the other models come with the model payload). The palette filters building blocks by library once more than one is active; /api/library names each type's library. Adding embedded-linux in the wizard adds ot first. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
methodik (sub-models and privilege contexts), bibliotheksformat (requires, element defaults, new library), vorlagenreferenz (columns and variables), quick starts, agent skill and changelog. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Control software that runs as several processes on a Linux industrial PC can now be modelled as a sub-model refining an element of the machine model, with trust boundaries inside a host (privilege contexts). One risk assessment per product (BSI TR-03183-1) is kept.
runs_on,privilege(kernel|root|service|user, account, capabilities),listens_on,authentication,memory_safe,sbom_ref(purl/CPE),refines: <model>/<id>. A process without a zone takes its host's zone. New moduletopology.py, mirrored inapp/src/topology.ts.runs-on-invalid,runs-on-cycle,refines-unresolved,refines-multiple-parents,refines-cycle.exposed-service-unauthenticated,privilege-boundary-gap,host-takeover-understated(no fixed impact threshold),duplicate-assessment,sbom-ref-invalid.software/T-0001. Risk distribution, traceability, approvals and CRA coverage count both models.buildno longer renders a sub-model on its own;--modelstill does.embedded-linux: 21 element types, 55 threat templates and 14 Linux-specific measures; everything else points at OT measures.library.yamlgainsrequires: [ot], and element types can preset privilege, authentication and listeners.init -l embedded-linux --examplecreatesmainplus a refining sub-modelsoftware(validate: 0 errors).Exports (CSV/JSON/XLSX) are unchanged; they run on the example and already carry a model column. OSCAL is import-only and not affected.
Test plan
uv run pytest --ignore=tests/e2e: 392 passed (compat corpus v0.1.0–v0.4.0 unchanged)uv run pytest tests/e2e: 68 passed (de/en)scripts/library_coverage.py ot embedded-linux: no issues, 0 gapsthreatwright init x -l embedded-linux --example && threatwright validate x: 0 errors;build --format mdwrites one analysis document🤖 Generated with Claude Code