snxraven/bare-operating-system
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

Browse Source 
sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.
This commit is contained in:
Raven Scott
2026-04-04 21:23:49 -04:00
parent c29ec13cf9
commit 346bb71ffe
177 changed files with 8087 additions and 876 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/vault-threat-model.md
+29
View File
@@ -0,0 +1,29 @@
# Vault encryption at rest — threat model (Bare OS)
This document summarizes how personal-drive vault material is expected to behave in guest and host contexts. It complements `/proc/bare_os/security_posture.json` (`vaultAtRest`, `vaultRotation`, `accountKeyRotationContinuity`).
## Scope
- **In scope**: encryption of vault payloads at rest on replicated drives, AEAD usage, key-handle lifetimes, rotation checkpoints, and operator-supplied metadata (non-secret).
- **Out of scope**: host disk encryption (FileVault, LUKS), Pear platform keychains unless explicitly bridged via env pointers, and side-channel analysis.
## Threats and mitigations
| Threat | Mitigation sketch |
|--------|-------------------|
| Drive snapshot exfiltration | Vault bodies use **AEAD** (e.g. AES-256-GCM or XChaCha20-Poly1305 via **bare-crypto**) with keys outside the snapshot; only ciphertext and public metadata replicate. |
| Tampering on replication | AEAD tags reject modified ciphertext on decrypt; audit chain rows (`auditChain` in security posture) support append-only operator review. |
| Long-lived key exposure | **Key handles** with TTL (`keyHandlePolicy` in security posture) and **rotation checkpoints** (`/run/bare-os/vault-rotation-state.json`, `/.bare/vault-rotation.json`) document handoff. |
| Multi-device continuity | Operators may pass **`BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`** (non-secret JSON) so guests surface signing continuity during overlapping trust windows — not private keys. |
| Malicious extension | Extensions run under boot policy and optional **capability tokens**; vault APIs must not log or persist raw key material. |
## Operator responsibilities
- Supply secure random nonces per AEAD seal where the API requires caller-provided nonces.
- Mirror rotation checkpoints to durable storage outside the guest when recovering from total loss.
- Treat **`BARE_OS_PEAR_SECURE_ENCLAVE_JSON`** as an opaque host capability pointer — the guest must never assume hardware backing without host attestation policy.
## References
- `packages/bare-os-booter/index.js` — `procBareOsSecurityPostureText`
- `docs/reference/kernel-security-subsystems.md` — identity and audit overview