42 lines
2.4 KiB
Markdown
42 lines
2.4 KiB
Markdown
---
|
|
title: "Add-on security"
|
|
---
|
|
|
|
Home Assistant rates every add-on based on the wanted rights. An add-on with a rating of 6 is very secure. If an add-on has a rating of 1, you shouldn't run this add-on unless you are 100% sure that you can trust the source.
|
|
|
|
## API Role
|
|
|
|
For access to Supervisor API you need to define a role or you run in default mode. This is only required for Supervisor API not Home Assistant proxy. Any of the roles already have access to the default API calls, and do not require any additional settings.
|
|
|
|
### Available Roles
|
|
|
|
| Role | Description |
|
|
|------|-------------|
|
|
| `default` | Have access to all `info` calls |
|
|
| `homeassistant` | Can access all Home Assistant API endpoints |
|
|
| `backup` | Can access all backup API endpoints |
|
|
| `manager` | Is for Add-ons that run CLIs and need extended rights |
|
|
| `admin` | Have access to every API call. That is the only one they can disable/enable the Add-on protection mode |
|
|
|
|
## Codenotary CAS
|
|
|
|
You can sign your images and also verify our base image which you build from to provide a full chain of trust. This feature us supported by our [Builder](https://github.com/home-assistant/builder) and the [build config](/docs/add-ons/configuration#add-on-extended-build). For enable this feature on the Supervisor for your Add-on, you simple need add your email address to the Add-on configuration `codenotary`.
|
|
|
|
## Protection
|
|
|
|
Default, all add-ons run in protection enabled mode. This mode prevents the add-on from getting any rights on the system. If an add-on requires more rights, you can disable this protection via the API add-on options for that add-on. But be careful, an add-on with disabled protection can destroy your system!
|
|
|
|
## Making a secure add-on
|
|
|
|
As a developer, follow the following best practices to make your add-on secure:
|
|
|
|
- Don't run on host network
|
|
- Create an AppArmor profile
|
|
- Map folders read only if you don't need write access
|
|
- If you need any API access, make sure that you do not grant permission that aren't needed
|
|
- Sign the image with [Codenotary CAS](https://cas.codenotary.com/)
|
|
|
|
## Use Home Assistant User backend
|
|
|
|
Instead of allowing users to set new login credential in plain text config, use the Home Assistant [Auth backend](/docs/api/supervisor/endpoints#auth). You can enable the access to API with `auth_api: true`. Now you are able to send the login credential to auth backend and validate it again Home Assistant.
|