[randomizedcoder]

What this is

The full security assessment of the gRPC ConfigService.Set filesystem-write exposure, and the program to close it — eight documents under docs/security-hardening/, linked from docs/README.md. Docs only: no code, proto, or build changes in this PR.

Documents

Doc	Contents
Advisory	The Set → filesystem flow; the five Set-reachable write primitives; who can call Set (auth off by default); the fleet container deployment and permission model (NET_ADMIN/SYS_ADMIN, read-only rootfs, private pidns — what each does and does not stop); how the classic container-escape path idioms fare; defense layers L0–L7
Hardening plan	Workstreams W0–W13, issue register I1–I19, open decisions OD-1–OD-14, fleet rollout runbook, end-state verification checklist
Implementation plan	Phases 0–5 mapped to PR-1…PR-24 with acceptance gates and a rollback matrix
Phase 1	Build-time elimination (dest_file/capture tags), protovalidate path patterns, runtime path policy + frozen fields, universal validating interceptor, Set audit logging, golden-config CI gate, and a startup confinement check (PR-24)
Phase 2	Landlock self-confinement: the exact ruleset, ABI degradation, re-exec persistence (the soft-restart corner case), and the table-driven test matrices
Phase 3	Privilege separation: a writer process with a path-free gRPC service over a UDS on the shared pkg/ipc stack (peer uid checked before HTTP/2 parsing, protovalidate both ends, monotonic seq, streamed ipmeta, crash-safe commit dance), collector :ro flip, the complete write inventory, and the target admission checklist
Phase 4	Egress pinning in three layers (build tags closing OD-9, Landlock v4 network rules, a collector-scoped nftables rule), escape-hatch removal, v1.x revision retirement, standing CI gates
Phase 5	Privilege brokers: a netlink broker (gRPC; builds and sends every netlink request, relays the replies unfiltered as raw chunks) and a Docker broker (typed gRPC, four-field projection) take CAP_NET_ADMIN, CAP_SYS_ADMIN and docker.sock out of the collector; per-process seccomp + AppArmor profiles

Headline findings

• Set has no path or scheme validation, and listener auth is off by default — one unauthenticated call switches dest to file:<path> and the daemon writes root-owned files at that path on the next poll.
• Five write primitives are Set-reachable; three are debug tooling with no build gate at all today (file:, write_files/capture_path, UDS binds).
• The classic /proc/1/root/... escape targets fail on role-deployed containers (private pidns + read-only rootfs make /proc/1/root/... the container's own root); outside that deployment shape the same Set calls land as root.
• The network stdlib destinations (tcp/udp/http/https/unix/unixgram) are always compiled in — the dest-repoint egress/exfil class is structural (OD-9 closes it in Phase 4).
• Even in the container, docker.sock, CAP_NET_ADMIN in the host netns, and CAP_SYS_ADMIN (bpf/perf_event_open under Docker's default seccomp) make a compromised collector host-root-equivalent — Phase 5 removes all three.
• The Critical shape (bare host as root, --privileged, a pod without seccomp) is now refused at startup — PR-24 checks no-new-privs, seccomp, read-only root and the capability bound; a per-check -insecureAllowUnconfined waiver is alerted on.

Design decisions worth reviewing closely

1. L0 build-time elimination over runtime-only checks — debug writers leave the production binary entirely.
2. Landlock as primary kernel enforcement (survives execve, including Set's soft restart; not bypassable by a privileged process) — seccomp cannot express path rules.
3. Writer split (Phase 3) — only two legitimate writes exist (baseline JSON ≤64 KiB, ipmeta cache); the writer's protocol carries no paths anywhere, so the parameter list is the security model.
4. gRPC over UDS for every xtcp2 process (pkg/ipc) — one typed, validated stack; the peer uid is checked in the transport handshake, so only the expected process reaches the HTTP/2 parser.
5. Standing CI gates (Phase 4) — write-site inventory drift check, flavor matrix, golden-config validation, and a weekly crippled-build proof so none of it regresses silently.
6. Privilege brokers (Phase 5) — the collector sends no netlink message into any namespace: the broker builds every request from a typed RPC (TCP only, no attributes, so no inet_diag bytecode) and relays replies unfiltered, at the cost of one copy (benchmark-gated). A passed fd was rejected because its holder can send anything on it. The broker lacks CAP_NET_ADMIN, so the kernel still refuses SOCK_DESTROY, route changes and MD5 keys even if the broker is buggy.
7. Check confinement, not container markers (PR-24) — /.dockerenv-style checks pass --privileged and fail a hardened systemd unit; the in-tree NixOS module is hardened to pass with no waiver.

Verification

• All relative links checked (docs/README.md + cross-links between all eight docs).
• Every code-level claim in the docs was verified against main at 97bed69c (call sites, line references, build tags, nix flavors, protobuf-go semantics).

🤖 Generated with Claude Code