Security & Audits

A root supervisor is worth attacking. Kernel mode's security posture is recorded in the repository, where you can check it: a threat model, a generated unsafe inventory, and a per-milestone audit trail.

Trust boundary

Trusted: the manifest (operator-controlled — its commands are intended execution) and a same-UID or root socket peer. Untrusted: everything else — socket frame contents, service names, IPC-supplied config paths, filesystem state in service-writable directories, and, in system mode, every non-root local user. The full model is audits/threat-model.md.

Standing mitigations

• Control socket: 0700 runtime dir, 0600 socket, kernel peer credentials (SO_PEERCRED / getpeereid) verified on every accept, before any read
• IPC frames: 1 MiB cap, typed decode, fuzzed on a weekly CI schedule (fuzz/fuzz_targets/ipc_frame.rs)
• Config: O_NOFOLLOW open + same-fd fstat + parse (no TOCTOU window)
• Privilege drops: ordered transaction; supplementary groups always reset; environment cleared and rebuilt
• Descriptors: FD_CLOEXEC by default; handoff FDs cleared briefly and restored
• Identity: PID + start time + session; no signal is ever sent on the basis of command-string matching

Audit records

Record	What it is
audits/README.md	Audit policy and index
audits/threat-model.md	Living threat model
audits/unsafe-inventory.md	Generated unsafe inventory
reports/	Historical security reviews

No formal release-candidate audit has been published yet. reports/ holds the security reviews done so far, and audits/ holds the threat model and the generated unsafe inventory that any future audit starts from.

Supply-chain gates do run in CI on every change: cargo audit, cargo deny, and cargo vet, whose exemption baseline is frozen so new dependencies must be vetted.

The canonical trust model for all of systemg remains Security; this page covers what kernel mode adds.