64 lines
4.7 KiB
Markdown
64 lines
4.7 KiB
Markdown
# Security and threat model
|
|
|
|
## Assets
|
|
|
|
- Host control through the Docker socket.
|
|
- Player worlds, configuration, mods and backups.
|
|
- User accounts, sessions and instance permissions.
|
|
- Game API, SMTP and webhook credentials.
|
|
- Catalog/template/module integrity.
|
|
- Availability of game servers and the management plane.
|
|
|
|
## Actors and assumptions
|
|
|
|
- Internet users and authenticated non-admin users may be malicious.
|
|
- Managers are trusted only for assigned permissions, not host administration.
|
|
- Templates, modules, archives, artwork, webhooks and game responses are untrusted.
|
|
- The host administrator controls Compose, secret files and bind roots.
|
|
- A fully compromised Docker daemon or host is outside DoGaMa's containment guarantee.
|
|
|
|
## Principal threats and controls
|
|
|
|
| Threat | Required controls |
|
|
|---|---|
|
|
| Main-app compromise reaches Docker | No socket mount; private authenticated restricted agent; typed operations; registered-instance binding |
|
|
| Targeting unrelated containers | No list-all API; database + agent registry + labels + plan digest agreement; opaque IDs |
|
|
| Host path escape | Canonical allowlisted roots; symlink-aware validation; no arbitrary template mounts; create-new filesystem operations |
|
|
| Malicious archive | Separate staging; traversal/link/device rejection; size/count/depth/time limits; no execution; safe swap |
|
|
| Malicious WASM module | No ambient WASI; fuel/memory/time limits; capability/ABI validation; instance-only host networking; circuit breaker |
|
|
| SSRF | Scheme/port allowlists, IP classification, redirect revalidation, DNS pinning/rebinding defense for artwork, webhooks and downloads |
|
|
| Secret disclosure | Authenticated encryption; external key; write-only API; redaction; no normal export/audit/log inclusion |
|
|
| Broken object authorization | Backend instance-scoped checks; deny overrides; object lookup under principal; endpoint denial tests |
|
|
| CSRF/session theft | Secure HttpOnly SameSite cookies, CSRF token, TLS guidance, session rotation/revocation and idle/absolute expiry |
|
|
| Password attack | Modern password hashing, rate limits, backoff, generic errors, repeated-failure audit/notification |
|
|
| Supply-chain substitution | Immutable version snapshots, checksums, optional signatures/trust labels, digest-pinned images, controlled activation |
|
|
| Label/template injection | Structured key/value parsing, reserved namespaces, explicit substitution allowlist, no arbitrary template execution |
|
|
| Destructive mistake | Preview, recent authentication, typed-name confirmation, pre-restore/update backups and recoverable workflows |
|
|
| Resource exhaustion | Upload/extraction limits, job concurrency, per-instance locks, Docker limits, disk checks, notification/module bounds |
|
|
| Replay/race | Signed nonce/timestamp agent calls, idempotency keys, optimistic revisions and durable operation phases |
|
|
|
|
## Authentication baseline
|
|
|
|
V1 local accounts use a current password-hashing algorithm with calibrated parameters. Bootstrap accepts the first administrator only through a one-time local setup state. Sessions rotate at login/privilege change, can be revoked, and never appear in URLs. Critical actions require recent password confirmation.
|
|
|
|
The deployment documentation must recommend TLS through a trusted reverse proxy and restrictive permissions on `secrets/`, data and backup paths.
|
|
|
|
## Template and module trust
|
|
|
|
Display source as `official`, `verified community`, `local`, `locally modified` or `unverified`. Trust is informative but never bypasses validation/sandboxing. Catalog updates cannot overwrite local copies or silently update live instances.
|
|
|
|
Artwork downloads accept bounded raster formats, verify decoded content, convert locally and reject SVG in V1. Preserve source attribution metadata without loading remote assets on every page.
|
|
|
|
## Security headers and API limits
|
|
|
|
Use a restrictive Content Security Policy, frame denial, MIME sniffing protection and explicit referrer policy. Bound request bodies, pagination and expensive query rates. CORS is disabled by default for cross-origin browser clients. Error responses expose stable codes and safe messages, not stack traces.
|
|
|
|
## Backup security
|
|
|
|
Game backups are not assumed encrypted in V1; filesystem permissions and host backup policy protect them. They contain no DoGaMa secrets. Restore never follows archive links or writes outside declared destinations. Database/system disaster recovery is documented separately from player-data backups.
|
|
|
|
## Residual risk
|
|
|
|
The agent still holds Docker-equivalent host power. Its restriction reduces exposed functionality and mistakes but is not a sandbox for a fully compromised agent. Keep it small, non-public, dependency-light, fuzz path/plan parsers and treat agent changes as high-risk reviews.
|
|
|