Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(doc): #919 info disclosure #935

Merged
merged 1 commit into from
Sep 24, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/src/SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ SPDX-License-Identifier: MIT
- [Contributing](./contributing/README.md)
- [Governance](./governance/README.md)
- [Security](./security/README.md)
- [Design Principles](./security/design-principles.md)
- [Software Assurance](./security/assurance.md)
- [SLSA](./security/slsa.md)
- [Threat Model](./security/threat-model.md)
28 changes: 28 additions & 0 deletions docs/src/security/threat-model.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,34 @@ SPDX-License-Identifier: MIT

## Information Disclosure

- Although the `/nix/store` is individual per user,
a user may write secrets to it,
and then those secrets can be published to a binary cache
that is publicly accessible.

Mitigation:

- Makes has utilities for working with secrets in a way
that they are only copied to the `/nix/store`
in encrypted form,
and then decrypted at runtime,
where there are safe from disclosure.
- Makes copies the contents of the git repository
into a trusted control plane,
and excludes all of the files
that are not tracked by Git
from this checkout.
- Nothing from the `/nix/store`
is pushed to a binary cache by default.
A user would need to configure the cache explicitly,
and expose the corresponding secret
in an environment variable.
- Makes has support for binary caches
that are not publicly accessible as well,
so a user may chose to use this instead
as an extra layer of prevention.
Please see <https://cachix.org/> for more information.

## Denial of Service

## Elevation of Privileges