Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
48 lines
2.2 KiB
Markdown
48 lines
2.2 KiB
Markdown
# Security policy
|
|
|
|
**English** · [Português](SECURITY.pt-BR.md)
|
|
|
|
Acauã is defensive software, but it processes hostile input: packet captures,
|
|
Zeek logs and flow records may be malformed on purpose. Treat every dataset as
|
|
untrusted.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public issue with exploit details. Open a minimal issue asking for
|
|
a private channel, or contact the maintainer through the Gitea profile listed on
|
|
the repository. Include the affected version, the input shape and a minimal
|
|
reproduction when a private channel is available.
|
|
|
|
## Scope and threat model
|
|
|
|
- **Container hardening:** the container runs as an unprivileged user (`acaua`, UID 10001),
|
|
with a read-only root filesystem (`read_only: true`), all capabilities dropped
|
|
(`cap_drop: [ALL]`), and security hardening (`no-new-privileges:true`).
|
|
- **Input parsing:** a malformed log line must not panic the daemon, exhaust
|
|
memory or escape the configured data directory.
|
|
- **Path handling:** dataset paths are resolved and confined to the configured
|
|
root; symbolic links are not followed outside it.
|
|
- **API exposure:** `serve` binds to `127.0.0.1` by default. Exposing it on a
|
|
network interface is an explicit operator decision and needs a reverse proxy
|
|
with authentication.
|
|
- **Evidence integrity:** alert evidence must be reproducible from the same
|
|
input and code version. Silent nondeterminism is a correctness and security
|
|
issue.
|
|
- **Updates:** updates are delivered as verified multi-arch container images.
|
|
The daemon terminates gracefully upon receiving `SIGTERM` without data corruption.
|
|
- **Privacy:** there is no telemetry. Retention defaults to seven days of
|
|
normalized events; the operator is responsible for local law and policy.
|
|
|
|
## Out of scope
|
|
|
|
- Vulnerabilities in third-party Zeek, DuckDB or operating-system packages
|
|
that are already fixed upstream.
|
|
- Attacks that require the operator to disable the documented security controls
|
|
(for example, running `serve` as root on a public interface).
|
|
- Detection quality claims: the pillars are defensive heuristics, not absolute guarantees.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest `0.1.x` line is supported while the project is pre-alpha. There
|
|
is no long-term support branch yet.
|