Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2.2 KiB
2.2 KiB
Security policy
English · Português
Acauã is defensive software, but it processes hostile input: packet captures, Zeek logs and flow records may be malformed on purpose. Treat every dataset as untrusted.
Reporting a vulnerability
Do not open a public issue with exploit details. Open a minimal issue asking for a private channel, or contact the maintainer through the Gitea profile listed on the repository. Include the affected version, the input shape and a minimal reproduction when a private channel is available.
Scope and threat model
- Container hardening: the container runs as an unprivileged user (
acaua, UID 10001), with a read-only root filesystem (read_only: true), all capabilities dropped (cap_drop: [ALL]), and security hardening (no-new-privileges:true). - Input parsing: a malformed log line must not panic the daemon, exhaust memory or escape the configured data directory.
- Path handling: dataset paths are resolved and confined to the configured root; symbolic links are not followed outside it.
- API exposure:
servebinds to127.0.0.1by default. Exposing it on a network interface is an explicit operator decision and needs a reverse proxy with authentication. - Evidence integrity: alert evidence must be reproducible from the same input and code version. Silent nondeterminism is a correctness and security issue.
- Updates: updates are delivered as verified multi-arch container images.
The daemon terminates gracefully upon receiving
SIGTERMwithout data corruption. - Privacy: there is no telemetry. Retention defaults to seven days of normalized events; the operator is responsible for local law and policy.
Out of scope
- Vulnerabilities in third-party Zeek, DuckDB or operating-system packages that are already fixed upstream.
- Attacks that require the operator to disable the documented security controls
(for example, running
serveas root on a public interface). - Detection quality claims: the pillars are defensive heuristics, not absolute guarantees.
Supported versions
Only the latest 0.1.x line is supported while the project is pre-alpha. There
is no long-term support branch yet.