docs: add shared responsibility model section for multi-user environments#27224
docs: add shared responsibility model section for multi-user environments#27224galz10 wants to merge 1 commit into
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the project's security documentation by clarifying the intended single-user design of the Gemini CLI. It provides actionable recommendations for users in shared environments to mitigate risks related to cross-user data leakage and unauthorized access. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
Size Change: -4 B (0%) Total Size: 33.9 MB
ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates SECURITY.md to include a 'Shared Responsibility Model' section, outlining security best practices for using the Gemini CLI in multi-user environments. The review feedback highlights documentation inconsistencies, specifically regarding platform-specific commands for directory permissions and contradictions with the global installation instructions provided in the README.md.
Note: Security Review has been skipped due to the limited scope of the PR.
| - **Restrict directory permissions:** Ensure your `~/.gemini` configuration | ||
| directory is readable and writable only by your user account (for example, | ||
| `chmod 700 ~/.gemini`). Gemini CLI requires write permissions to this | ||
| directory. |
There was a problem hiding this comment.
The provided example chmod 700 ~/.gemini is specific to Unix-like systems and will not work on Windows. Since the document explicitly addresses Windows users in other sections (e.g., the execution paths bullet), it should provide a platform-neutral instruction or a Windows-specific equivalent to ensure all users can effectively secure their configuration directory. Inconsistent security guidance across platforms can lead to users on unsupported platforms skipping critical security steps.
| - **Restrict directory permissions:** Ensure your `~/.gemini` configuration | |
| directory is readable and writable only by your user account (for example, | |
| `chmod 700 ~/.gemini`). Gemini CLI requires write permissions to this | |
| directory. | |
| - Restrict directory permissions: Ensure your configuration directory (typically ~/.gemini) is readable and writable only by your user account (e.g., chmod 700 ~/.gemini on Unix). Gemini CLI requires write permissions to this directory. |
References
- Maintain consistency in documentation. When information about a feature is present in multiple documents, ensure all instances are updated or removed together to avoid contradictions.
| - **Avoid global installations:** Install Gemini CLI locally per-user rather | ||
| than globally to minimize the risk of shared dependencies being compromised. |
There was a problem hiding this comment.
This recommendation to avoid global installations directly contradicts the primary installation instructions in the README.md, which prominently feature npm install -g, brew install, and port install. This inconsistency can confuse users about the recommended and secure way to install the tool. Please either update the README.md to prioritize more secure alternatives like npx or clarify in SECURITY.md the specific conditions under which global installations pose a risk in multi-user environments.
| - **Avoid global installations:** Install Gemini CLI locally per-user rather | |
| than globally to minimize the risk of shared dependencies being compromised. | |
| - Avoid global installations: Where possible, use npx or install Gemini CLI locally per-user rather than globally to minimize the risk of shared dependencies being compromised in multi-user environments. |
References
- Maintain consistency in documentation. When information about a feature is present in multiple documents, ensure all instances are updated or removed together to avoid contradictions.
gemini-cli
Bot
added
the
status/need-issue
galz10
force-pushed
the
galzahavi/fix/docs-security-topic
branch
from
b00ac0d to
e12359b
Compare
1 participant
Summary
Adds a "Shared Responsibility Model" section to
SECURITY.mdto clarify that Gemini CLI is designed for single-user environments. It provides best practices for users operating on shared devices or multi-user systems.Details
The documentation now explicitly outlines recommendations for multi-user environments. This includes guidance on restricting directory permissions for
~/.gemini, utilizing local (per-user) installations instead of global ones, and isolating execution paths to maintain individual user boundaries.Related Issues
How to Validate
Review the newly added "Shared Responsibility Model" section in
SECURITY.mdto ensure the guidance is clear and helpful.Pre-Merge Checklist