oceans2alaska
610a3bb447
- Add privacy projection (core/privacy.py), private report storage, bounded
process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
"Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
53 lines
4.7 KiB
Markdown
53 lines
4.7 KiB
Markdown
# Security remediation status — 2026-10-30
|
|
|
|
This is an implementation follow-up to the unchanged historical `audit/` documents.
|
|
It is not a new comprehensive audit, vulnerability scan or production approval.
|
|
|
|
| Audit finding | Implemented change | Remaining acceptance requirement |
|
|
| --- | --- | --- |
|
|
| S01 — PHI-capable free text | Explicit projection, opaque labels/canonical products, exact reviewed allowlists before UI/history/export; stale findings discarded | CHS approves retained fields/roots/IPs; metadata can enter source/import memory; no PHI-free assurance |
|
|
| S02 — Broad provider objects | No default certificates/open files; task fields narrowed; service account/descriptions and disk labels no longer requested | Windows CIM/provider behavior and permissions must be lab-tested; provider internals not established |
|
|
| S03 — Raw retention | No raw sidecar; JSON minimized; bounded session history and clear action | Review legacy artifacts, retention/deletion, memory dumps, encrypted storage and endpoint backups |
|
|
| S04 — Output boundaries | Configured private local root, no overwrite, mode 0700/0600, Windows DACL gate, remote/link rejection | Windows ACL/race tests; CHS-approved root/backup/sync policy; unusual backing storage remains unverified |
|
|
| S05 — Temporary stdout | Bounded in-memory pipe, sanitized failure codes, discard stderr, terminate/reap owned process | OS swap/dumps/cache/log policy and native-child behavior review; memory is not secure-erased |
|
|
| S06 — Environment/registry | Small child environment allowlist; registry DoNotExpandEnvironmentNames; no stored credentials | Trusted interpreter/runtime deployment, inherited indispensable environment and native module behavior review |
|
|
| S07 — Supply chain | Minimal Qt Essentials; direct version pins and observed transitive constraints | Hash/platform locks, complete native SBOM, authorized advisory scan and signed reproducible release still outstanding |
|
|
| S08 — Contracts | Closed nested schema, bounded rows/strings/depth, independent timestamp validation, repeated export projection | Fuzzing/resource stress and untrusted file race review; legacy input still read before reduction |
|
|
| S09 — Egress | No first-party upload added; reject common remote import/output paths before filesystem probes | Monitored Windows/native egress tests, enterprise firewall and approved storage controls |
|
|
| S10 — Read-only/least privilege | Collection remains read/query operations; no elevation/remoting/configuration added; output writes isolated | Native read side effects, standard-user filtering, each supported Server OS, CHS least-privilege approval |
|
|
|
|
## Test evidence
|
|
|
|
`QT_QPA_PLATFORM=offscreen .venv/bin/python -m unittest discover -s tests -v`
|
|
discovered 71 tests on the Linux development host: 70 passed and one native
|
|
PowerShell test was skipped. Python, synthetic regression, GUI and report tests
|
|
passed. Native PowerShell AST/mocked collector tests are skipped because no PowerShell
|
|
runtime exists here. No real Windows collection, installation/update, vulnerability
|
|
lookup, production access or network transmission was performed.
|
|
|
|
New regression cases verify canary removal across major free-text surfaces and old
|
|
findings, schema/marker bypass rejection, exact-root approval excluding descendants,
|
|
private/exclusive output, memory capture limits and cleanup, and bounded/cleared UI
|
|
history. Seven workload scenarios retain scores 0/0/70/70/95/80/0 after projection.
|
|
The 80-point file-server case uses **imported synthetic historical aggregates**;
|
|
the new live default collector does not query SMB open-file activity and cannot
|
|
create that evidence itself.
|
|
|
|
## Release gates
|
|
|
|
1. Review the actual release provenance. The workspace has no usable `.git` checkout;
|
|
the historical bundle is not updated by these source edits. Earlier upstream
|
|
`7fed3b9` cannot be verified as included without an authorized source reconciliation.
|
|
2. Obtain native Windows lab results, including revised task-CIM queries, registry
|
|
read-only behavior, service/role projection, cancellation and output permissions.
|
|
3. Build clean target environments with verified dependencies, hash locks, native
|
|
SBOM, advisory results and release signing. Existing broad Qt installations are
|
|
not changed by editing requirements.
|
|
4. CHS security/privacy owners approve the reduced dataset and document residual
|
|
PHI possibilities, dedicated least-privilege access, encryption/storage, egress,
|
|
retention, audit logging and incident response. HIPAA status is an organizational
|
|
determination, not an application-generated pass/fail badge.
|
|
|
|
No source fix alone clears these gates. See [the deployment guide](PRIVACY_HARDENING.md)
|
|
for exact configuration, manual output-folder provisioning and authorized lab checks.
|