feat: socket authentication for daemon (audit H1 fix) #17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "doxios/avault:feat/socket-auth"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Adds token-based authentication to the Unix socket daemon, addressing finding H1 from the security audit (#16).
Problem
Previously, any process running as the same user could connect to the avault Unix socket and issue commands (
get,set,shutdown). This undermined the vault's purpose of isolating secrets from the agent — the agent process (same user) could just talk to the socket directly.Solution
Token-based socket authentication:
secrets.token_hex(32)$XDG_RUNTIME_DIR/avault.token(chmod0600){"token": "<hex>"}fieldsecrets.compare_digest()(constant-time, no timing attacks)handle_request()(no leakage to business logic)daemon_request()) automatically reads token from file and injects into requestsAccess Control
The token file can be further restricted via:
setfacl -m u:cobot:r /run/user/1000/avault.token)Changes
scripts/avault.pyhandle_client(), token injection indaemon_request(), doctor checkscripts/test_avault.pyTestSocketAuthandTestAuthTokenFileOps.gitignore__pycache__/Tests
11 new tests, all passing:
TestSocketAuth::test_valid_token_allows_request✅TestSocketAuth::test_missing_token_rejected✅TestSocketAuth::test_wrong_token_rejected✅TestSocketAuth::test_no_auth_when_token_not_set✅TestSocketAuth::test_token_stripped_before_handle_request✅TestAuthTokenFileOps::test_write_and_read_token✅TestAuthTokenFileOps::test_read_missing_token✅TestAuthTokenFileOps::test_cleanup_token✅TestAuthTokenFileOps::test_cleanup_missing_token_no_error✅TestAuthTokenFileOps::test_generate_auth_token_length✅TestAuthTokenFileOps::test_generate_auth_token_unique✅All 69 existing tests continue to pass (1 pre-existing QR test failure, unrelated).
Backward Compatibility
auth_tokenisNone(daemon started without token generation, e.g., old code), auth is skipped — requests pass through as beforedaemon_request()sends request without token — daemon will reject it with a clear error message pointing to the token file locationAVAULT_TOKENenv var overrides the token file path (same pattern asAVAULT_SOCKET)Refs
PR by Doxios 🦊 — security patch from audit findings
Add token-based authentication to the Unix socket daemon to prevent unauthorized same-user processes from accessing secrets. How it works: - Daemon generates a random 32-byte token on startup - Token written to $XDG_RUNTIME_DIR/avault.token (chmod 0600) - Every socket request must include {"token": "<hex>"} field - Token verified with constant-time comparison (secrets.compare_digest) - Token file cleaned up on daemon shutdown - CLI automatically reads token from file and injects into requests This addresses audit finding H1: any same-user process could previously connect to the socket and read/modify all secrets. Now only processes that can read the token file are authorized. The token file can be further restricted via filesystem ACLs to limit which specific processes (e.g., only the Cobot agent) can access it. Doctor command updated with auth_token health check. 11 new tests added (all passing). Ref: nazim/avault#16 (security audit)View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.