Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarifying PLUGINS_FOLDER permissions by DAG authors (#43022) #43029

Merged
merged 1 commit into from
Oct 16, 2024
Merged

Clarifying PLUGINS_FOLDER permissions by DAG authors (#43022) #43029

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion docs/apache-airflow/security/security_model.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,12 +212,15 @@ DAG author to choose the code that will be executed in the scheduler or webserve
should not be arbitrary code that DAG author can add in DAG folder. All those functionalities are
only available via ``plugins`` and ``providers`` mechanisms where the code that is executed can only be
provided by installed packages (or in case of plugins it can also be added to PLUGINS folder where DAG
authors should not have write access to). PLUGINS FOLDER is a legacy mechanism coming from Airflow 1.10
authors should not have write access to). PLUGINS_FOLDER is a legacy mechanism coming from Airflow 1.10
- but we recommend using entrypoint mechanism that allows the Deployment Manager to - effectively -
choose and register the code that will be executed in those contexts. DAG Author has no access to
install or modify packages installed in Webserver and Scheduler, and this is the way to prevent
the DAG Author to execute arbitrary code in those processes.

Additionally, if you decide to utilize and configure the PLUGINS_FOLDER, it is essential for the Deployment
Manager to ensure that the DAG author does not have write access to this folder.

The Deployment Manager might decide to introduce additional control mechanisms to prevent DAG authors from
executing arbitrary code. This is all fully in hands of the Deployment Manager and it is discussed in the
following chapter.
Expand Down