Move security details into the docs

Signed-off-by: Jean-Christophe Morin <[email protected]>

Author: JeanChristopheMorinPerso

SECURITY.md

@@ -1,25 +1,6 @@
 # Security Policy
 
-## Threat Model
-
-List assumptions (rez will run inside an internal network, we assume good intentions, package definitions are written in python and executed)
-
-Access to shared filesystem
-
-The current assumptions are:
-* Rez was designed to be used within a studio environment.
-* Package definitions, both for building packages and resulting from a build are Python files (`package.py`). Rez will read and load them in memory at resolve time.
-* Rez config files can be written in YAML or Python.
-* Package definitions and config files written in Python can contain arbitrary code.
-* Rez will create new shells via subprocesses.
-* Packages can inject environment variables into the resulting shells via [commands](https://rez.readthedocs.io/en/stable/package_commands.html).
-* Packages can inject arbitrary commands to be executed when the shells are started via [commands](https://rez.readthedocs.io/en/stable/package_commands.html).
-
-With that in mind, the main entry points are config files (written in python) and pacakge definition files.
-Config files will be loaded from default paths and it's also posssible to tell rez
-to load them from any arbitraty path using the [REZ_CONFIG_FILE](https://rez.readthedocs.io/en/stable/environment.html#envvar-REZ_CONFIG_FILE) which can contain more than one path.
-
-Document that it can talk to memcached and RabbitMQ (AMQP).
+All security information can be found in https://rez.readthedocs.io/en/stable/security.html.
 
 ## Supported Versions
 

docs/source/security.rst

@@ -0,0 +1,33 @@
+========
+Security
+========
+
+.. important::
+   This page is a work in progress.
+
+TODO: List assumptions (rez will run inside an internal network, we assume good intentions, package definitions are written in python and executed). Access to shared filesystem.
+
+Security Considerations
+=======================
+
+The current assumptions are:
+* It designed to be used within a studio environment.
+* Package definitions, both for building packages and resulting from a build are Python
+  files (`package.py`). Rez will read and load them in memory at resolve time.
+* Config files can be written in YAML or Python.
+* Package definitions and config files written in Python can contain arbitrary code.
+* It will create new shells via subprocesses.
+* Packages can inject environment variables into the resulting shells via
+  [commands](https://rez.readthedocs.io/en/stable/package_commands.html).
+* Packages can inject arbitrary commands to be executed when the shells are started
+  via [commands](https://rez.readthedocs.io/en/stable/package_commands.html).
+
+With that in mind, the main entry points are config files (written in python) and package definition files.
+Config files will be loaded from default paths and it's also posssible to tell rez
+to load them from any arbitrary path using the [REZ_CONFIG_FILE](https://rez.readthedocs.io/en/stable/environment.html#envvar-REZ_CONFIG_FILE)
+environment variable which can contain more than one path.
+
+Document that it can talk to memcached and RabbitMQ (AMQP).
+
+* File permissions
+* How to mitigate risks