branderson
c61eebb5b5
dejima carries this and its wording covers all three repositories by name: these projects, any of these repositories. A reader landing here would not have seen it. Duplicated rather than linked, which is the opposite of what attribution and the security policy do here, and deliberately. A disclaimer behind a link is a disclaimer the reader does not see, and its whole value is being on the page where the security argument is being made. Everything else that gets linked is reference material someone goes looking for; this is the one thing that has to arrive uninvited. test/disclaimer.bats pins it. The line is the one most likely to be dropped without anyone deciding to drop it - by a rewrite of some section that happened to contain it - and every other test here would still pass on a repository that had lost it.
1.7 KiB
Security policy
What dejima-ci-hardener claims
It reduces what a job can reach. It does not make a host safe.
A confined runner is given no Docker socket, its own bridge, and a deny-by-default egress allowlist. A privileged runner is given the socket and the host network deliberately, and its containment is the hypervisor firewall and a scheduled rollback, not anything this program does inside the guest. Neither tier holds against an attacker who is already root on the box.
The README's How it fails section covers this in detail.
This is not proven software
These projects are in early development. Nothing in them has been through outside review, an external audit, or adversarial testing by anyone other than the people who wrote them. Where a design argument is stated it is one person's reasoning; where a test asserts something it asserts what that person thought to check.
Treat every security property described in any of these repositories as a claim awaiting scrutiny rather than one that has survived it, and do not deploy them where being wrong would matter.
Reporting a vulnerability
Email dejima@branderson.io. Please do not open a public issue for a vulnerability; the tracker is public, and a report there is a disclosure.
Useful things to include:
- what an attacker gets;
- the steps to reproduce it;
- which tier it applies to: confined, privileged, or both;
- the commit you tested.
The rest of the policy
What is promised in return, the support position, supported versions and warranty are set once for the whole organisation and are not restated here:
https://gitbox.branderson.io/dejima/dejima/src/branch/main/SECURITY.md