# Security Policy — mgf-vm-forensics

## Reporting a vulnerability

**Do not** file a public issue or open a PR for a suspected vulnerability. Instead:

- **Email**: `bassam@magogi.org` with the subject prefix `[mgf-vm-forensics security]`.
- Include: a description of the issue, the affected component, a proof-of-concept where possible, and the impact you observed.
- Acknowledgement target: within **5 business days**. Fix or documented mitigation target: within **30 days** for confirmed, exploitable issues. Coordinated disclosure timelines are negotiated case-by-case.

For non-security friction (a design call you'd push back on, a missing primitive, an awkward contract), file in [`FEEDBACK.md`](FEEDBACK.md) — the public, designed-for-friction channel.

## Scope

`mgf-vm-forensics` is a **forensic-analysis library** — it parses
captured evidence from quarantined / malware-analysis VMs. Unlike a
pure data-model library, it has a real attack surface:

- **Parses attacker-controllable input.** pcap / pcapng bytes (via
  `dpkt`), filesystem-baseline JSON, memory dumps, and extracted
  strings can all originate from a malicious guest. dpkt's upper
  bound is pinned tight for this reason (SH-05 / SH-06).
- **Opens files and walks directories.** Case directories, artifacts,
  YARA rule trees. Case names are validated against path traversal
  (`CaseStore.case_dir` rejects `/`, `\`, `.`, `..`); sensitive files
  (`case.yaml`, reports) are written `0o600`, case dirs `0o700`, via
  atomic temp-file + rename.
- **Spawns subprocesses (list-argv, never `shell=True`).** `tcpdump`
  for capture / live views, `qemu-nbd` for offline disk mounts. All
  invocations build an explicit argv list; `sudo -n` is used so a
  missing sudoers entry fails closed rather than prompting.
- **Writes archives.** `archive_case` builds a `tar.gz` (write-only;
  it does NOT extract untrusted archives, so tar-slip on extraction
  is out of scope here — a consumer that unpacks a case archive owns
  that boundary).

It does NOT execute privileged hypervisor operations or drive VMs —
that surface lives in the adapter libraries (`mgf-vm-libvirt`,
`mgf-vm-firecracker`) and the privileged daemons. Each has its own
`SECURITY.md`.

### Integrity-manifest threat model

`manifest.json` (SHA-256 per artifact) catches **accidental
corruption** — bit rot, truncated copies. It is **NOT** tamper-evidence
against an attacker with write access to the case directory (the
manifest is unsigned and excludes itself from the walk). True
tamper-evidence needs an off-box root of trust. See the module
docstring in `src/mgf/vm/forensics/manifest.py` (threat-model note).

## Threat model — read these first

Architectural threat-model context lives in the central docs repo:

- `vm-vmanager-docs/ARCHITECTURE.md` (boundaries, privilege model)
- `vm-vmanager-docs/DECISIONS.md` (security-related ADRs: D-D3 identity, D-D4 multi-tenancy, D-G3 error taxonomy, D-G4 log redaction)

## Standards alignment

This library follows the `mgf-common` SC-* rules. The per-rule status is tracked in `docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`.
