ceos/cagebreak
1
0
Fork 0
mirror of https://cagebreak.project-repo.co/cagebreak.git synced 2026-08-22 05:24:22 +02:00
Code Issues Projects Releases Packages Wiki Activity

Improve SECURITY.md

Browse source
This commit is contained in:
project-repo 2022-09-30 23:54:17 +02:00
commit 32e13e13a5
1 changed files with 19 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

34
SECURITY.md
View file

@ -1,10 +1,12 @@
# Security
The main possibility for security bugs to occur in cagebreak is by privilege
escalation using the socket. Indeed, any program with access to the socket
immediately gains arbitrary code execution rights. As of right now, the socket
is world-writable. If you disagree with this threat model, you may contact
us via email (See section Email Contact below.) or [open an issue on github](https://github.com/project-repo/cagebreak/issues/new).
The main possibility for security bugs in cagebreak is by privilege
escalation through the socket. Any program with access to the socket
immediately gains arbitrary code execution rights. The socket
is restricted to the user of the cagebreak process (700).
If you disagree with this threat model, you may contact us via email (See
section Email Contact below.) or [open an issue on github](https://github.com/project-repo/cagebreak/issues/new).
Should any problem with the github issue system arise or any other reason
for (potentially confidential) contact with the Cagebreak authors appear,
@ -12,9 +14,9 @@ you may contact us via email (See section Email Contact below.).
## Supported Versions
The latest release always contains the latest bug fixes and features.
There are no official backports for security vulnerabilities. Builds
are reproducible under conditions outlined in [README.md](README.md).
The most recent release always contains the latest bug fixes and features.
There are no official backports for security vulnerabilities.
Builds are reproducible under conditions outlined in [README.md](README.md).
## Bug Reports
@ -25,11 +27,11 @@ is available below.
## Email Contact
Should you want to get in touch with the developers of cagebreak to report
If you want to get in touch with the developers of cagebreak to report
a security vulnerability or anything else via email, contact
`cagebreak @ project-repo . co`.
We will try to respond to everything that is not obvious spam.
We try to respond to everything that is not obvious spam.
### GPG-Encrypted Emails
@ -47,21 +49,23 @@ public key or provide the fingerprint and directions to obtain the key.
## Threat Model
Cagebreak is a wayland compositor, which is run by the user of the system
Cagebreak is a wayland compositor run by the user of the system
and thus has access to whichever resources this user has access to.
Cagebreak can restrict other programs in no way, because this would hamper
usability (consider a web browser unable to write a downloaded file to disk
for instance). There is no transmission of information by cagebreak other
than to the screens, ipc and potentially other documented local channels.
for instance).
There is no transmission of information by cagebreak other than to the
screens, ipc and potentially other documented local channels.
### STRIDE Threat List
This is not a thorough analysis, just an overview of the ways in which cagebreak
has/does not have an attack surface.
has (no) attack surface.
#### Spoofing
Not applicable - Using cagebreak already requires a login as a user.
Not applicable - Using Cagebreak already requires a login as a user.
#### Tampering