---
title: Security & Audits
---
# Security & Audits
A root supervisor is worth attacking. Kernel mode's security posture is
recorded in the repository, where you can check it: a threat model, a
generated `unsafe` inventory, and a per-milestone audit trail.
## Trust boundary
Trusted: the manifest (operator-controlled — its commands are intended
execution) and a same-UID or root socket peer. Untrusted: everything else —
socket frame contents, service names, IPC-supplied config paths, filesystem
state in service-writable directories, and, in system mode, every non-root
local user. The full model is
[`audits/threat-model.md`](https://github.com/ra0x3/systemg/blob/main/audits/threat-model.md).
## Standing mitigations
- Control socket: `0700` runtime dir, `0600` socket, kernel peer credentials
(`SO_PEERCRED` / `getpeereid`) verified on every accept, before any read
- IPC frames: 1 MiB cap, typed decode, fuzzed on a weekly CI schedule
(`fuzz/fuzz_targets/ipc_frame.rs`)
- Config: `O_NOFOLLOW` open + same-fd `fstat` + parse (no TOCTOU window)
- Privilege drops: ordered transaction; supplementary groups always reset;
environment cleared and rebuilt
- Descriptors: `FD_CLOEXEC` by default; handoff FDs cleared briefly and
restored
- Identity: PID + start time + session; no signal is ever sent on the basis
of command-string matching
## Audit records
| Record | What it is |
|---|---|
| [`audits/README.md`](https://github.com/ra0x3/systemg/blob/main/audits/README.md) | Audit policy and index |
| [`audits/threat-model.md`](https://github.com/ra0x3/systemg/blob/main/audits/threat-model.md) | Living threat model |
| [`audits/unsafe-inventory.md`](https://github.com/ra0x3/systemg/blob/main/audits/unsafe-inventory.md) | Generated `unsafe` inventory |
| [`reports/`](https://github.com/ra0x3/systemg/tree/main/reports) | Historical security reviews |
No formal release-candidate audit has been published yet. `reports/` holds the
security reviews done so far, and `audits/` holds the threat model and the
generated `unsafe` inventory that any future audit starts from.
Supply-chain gates do run in CI on every change: `cargo audit`, `cargo deny`,
and `cargo vet`, whose exemption baseline is frozen so new dependencies must be
vetted.
The canonical trust model for all of systemg remains
[Security](/docs/security); this page covers what kernel mode adds.