Scenario: convert

Threat model for Dangerzone

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_Random_doc_source_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Random doc\nsource";
            URL = "component_Random_doc_source.html";
            tooltip = "Random doc source";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        subgraph cluster_boundary_Docker_Podman_VM {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <Docker/Podman VM>;
            ]

            subgraph cluster_boundary_Outer_container {
                graph [
                    fontsize = 10;
                    fontcolor = black;
                    style = dashed;
                    color = firebrick2;
                    label = <Outer container>;
                ]

                subgraph cluster_boundary_gVisor_sandbox {
                    graph [
                        fontsize = 10;
                        fontcolor = black;
                        style = dashed;
                        color = firebrick2;
                        label = <gVisor sandbox>;
                    ]

                    component_LibreOffice_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "LibreOffice";
                        URL = "component_LibreOffice.html";
                        tooltip = "LibreOffice";
                        margin = 0.02;
                    ]

                    component_doc_to_pixels_py_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "doc_to_pixels.py";
                        URL = "component_doc_to_pixels_py.html";
                        tooltip = "doc_to_pixels.py";
                        margin = 0.02;
                    ]

                }

                component_entrypoint_py_Outer_container [
                    shape = circle;
                    color = black;
                    fontcolor = black;
                    label = "entrypoint.py";
                    URL = "component_entrypoint_py.html";
                    tooltip = "entrypoint.py";
                    margin = 0.02;
                ]

            }

            component_Container_runtime_Docker_Podman_VM [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "Container\nruntime";
                URL = "component_Container_runtime.html";
                tooltip = "Container runtime";
                margin = 0.02;
            ]

        }

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        component_PDF_reader_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "PDF reader";
            URL = "component_PDF_reader.html";
            tooltip = "PDF reader";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    actor_User_Local_host -> externalentity_Random_doc_source_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Request untrusted\ndoc from remote\nsource";    ]
    externalentity_Random_doc_source_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Receive untrusted\ndoc from remote\nsource and store it\nlocally";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "3. Start the\nDangerzone App";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Invoke\nDocker/Podman to\ncheck if the\ncontainer image is\npresent and\ninstalled";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "5. Is the image\npresent in the VM?";    ]
    component_Container_runtime_Docker_Podman_VM -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Image is present";    ]
    component_Container_manager_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Reply to\nDangerzone APP that\nthe container image\nis installed";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Select documents\nfor conversion";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "9. Request a Linux\ncontainer for\nconversion";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "10. Start a Linux\ncontainer";    ]
    component_Container_runtime_Docker_Podman_VM -> component_entrypoint_py_Outer_container [        color = black;        fontcolor = black;        dir = forward;        label = "11. Run entrypoint\nscript of Linux\ncontainer";    ]
    component_entrypoint_py_Outer_container -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "12. Start the\nDangerzone converter\nin the gVisor\nsandbox";    ]
    component_DZ_App_Local_host -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "13. Send the\nsuspicious document\nto the stdin of the\ngVisor sandbox";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_LibreOffice_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "14. Convert the\nsuspicious doc to\nPDF (if not already)";    ]
    component_LibreOffice_gVisor_sandbox -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "15. Receive\nsuspicious doc as\nPDF";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "16. Rasterize PDF\ninto pixels and\nwrite them to the\ngVisor sandbox's\nstdout";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "17. Reconstruct a\nsafe doc from pixels\nto PDF (and\noptionally OCR it)";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "18. Save safe PDF\nwith a '-safe.pdf'\nprefix";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "19. Archive the\nsuspicious PDF into\nthe 'unsafe/'\ndirectory";    ]
    component_DZ_App_Local_host -> component_PDF_reader_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "20. Open the PDF\nusing the program of\nthe user's choice,\nor the default one";    ]
}

Sequence Diagram

sequenceDiagram
    participant User as User
    link User: Component @ component_User.html
    participant Random_doc_source as Random doc source
    link Random_doc_source: Component @ component_Random_doc_source.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant Container_manager as Container manager
    link Container_manager: Component @ component_Container_manager.html
    participant Container_runtime as Container runtime
    link Container_runtime: Component @ component_Container_runtime.html
    participant entrypoint_py as entrypoint.py
    link entrypoint_py: Component @ component_entrypoint_py.html
    participant doc_to_pixels_py as doc_to_pixels.py
    link doc_to_pixels_py: Component @ component_doc_to_pixels_py.html
    participant LibreOffice as LibreOffice
    link LibreOffice: Component @ component_LibreOffice.html
    participant PDF_reader as PDF reader
    link PDF_reader: Component @ component_PDF_reader.html

    User->>Random_doc_source: 1. Request untrusted doc from remote source
    Random_doc_source-->>Host_storage: 2. Receive untrusted doc from remote source and store it locally
    User->>DZ_App: 3. Start the Dangerzone App
    DZ_App->>Container_manager: 4. Invoke Docker/Podman to check if the container image is present and installed
    Container_manager->>Container_runtime: 5. Is the image present in the VM?
    Container_runtime-->>Container_manager: 6. Image is present
    Container_manager-->>DZ_App: 7. Reply to Dangerzone APP that the container image is installed
    User->>DZ_App: 8. Select documents for conversion
    DZ_App->>Container_manager: 9. Request a Linux container for conversion
    Container_manager->>Container_runtime: 10. Start a Linux container
    Container_runtime->>entrypoint_py: 11. Run entrypoint script of Linux container
    entrypoint_py->>doc_to_pixels_py: 12. Start the Dangerzone converter in the gVisor sandbox
    DZ_App->>doc_to_pixels_py: 13. Send the suspicious document to the stdin of the gVisor sandbox
    doc_to_pixels_py->>LibreOffice: 14. Convert the suspicious doc to PDF (if not already)
    LibreOffice->>doc_to_pixels_py: 15. Receive suspicious doc as PDF
    doc_to_pixels_py->>DZ_App: 16. Rasterize PDF into pixels and write them to the gVisor sandbox's stdout
    DZ_App->>Host_storage: 17. Reconstruct a safe doc from pixels to PDF (and optionally OCR it)
    DZ_App->>Host_storage: 18. Save safe PDF with a '-safe.pdf' prefix
    DZ_App->>Host_storage: 19. Archive the suspicious PDF into the 'unsafe/' directory
    DZ_App->>PDF_reader: 20. Open the PDF using the program of the user's choice, or the default one

Show data flows

ID	Name	Source	Sink	Type
1	Request untrusted doc from remote source	User	Random doc source	Request
2	Receive untrusted doc from remote source and store it locally	Random doc source	Host storage	Response to Request untrusted doc from remote source
3	Start the Dangerzone App	User	DZ App	Request
4	Invoke Docker/Podman to check if the container image is present and installed	DZ App	Container manager	Request
5	Is the image present in the VM?	Container manager	Container runtime	Request
6	Image is present	Container runtime	Container manager	Response to Is the image present in the VM?
7	Reply to Dangerzone APP that the container image is installed	Container manager	DZ App	Response to Image is present
8	Select documents for conversion	User	DZ App	Request
9	Request a Linux container for conversion	DZ App	Container manager	Request
10	Start a Linux container	Container manager	Container runtime	Request
11	Run entrypoint script of Linux container	Container runtime	entrypoint.py	Request
12	Start the Dangerzone converter in the gVisor sandbox	entrypoint.py	doc_to_pixels.py	Request
13	Send the suspicious document to the stdin of the gVisor sandbox	DZ App	doc_to_pixels.py	Request
14	Convert the suspicious doc to PDF (if not already)	doc_to_pixels.py	LibreOffice	Request
15	Receive suspicious doc as PDF	LibreOffice	doc_to_pixels.py	Request
16	Rasterize PDF into pixels and write them to the gVisor sandbox's stdout	doc_to_pixels.py	DZ App	Request
17	Reconstruct a safe doc from pixels to PDF (and optionally OCR it)	DZ App	Host storage	Request
18	Save safe PDF with a '-safe.pdf' prefix	DZ App	Host storage	Request
19	Archive the suspicious PDF into the 'unsafe/' directory	DZ App	Host storage	Request
20	Open the PDF using the program of the user's choice, or the default one	DZ App	PDF reader	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-UPD		DZ App	verifies resources.updates
DZ-2-CODE		DZ App	is reviewed
DZ-2-BUILD		DZ App	is reproducible is verifiable
CAPEC-23	File Content Injection	DZ App	is sandboxed
CAPEC-28	Fuzzing	LibreOffice	sanitizes input is fuzzed
CAPEC-40	Manipulating Writeable Terminal Devices	LibreOffice	sanitizes input
CAPEC-88	OS Command Injection	Container manager	is sandboxed sanitizes input
CAPEC-130	Excessive Allocation	LibreOffice	is resource constrained sanitizes input
CAPEC-131	Resource Leak Exposure	DZ App	is resource constrained
CAPEC-131	Resource Leak Exposure	doc_to_pixels.py	is resource constrained
CAPEC-131	Resource Leak Exposure	LibreOffice	is resource constrained
CAPEC-153	Input Data Manipulation	DZ App	is sandboxed
CAPEC-176	Configuration/Environment Manipulation	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-176	Configuration/Environment Manipulation	LibreOffice	assume not compromised verifies resources.system
CAPEC-177	Create files with the same name as files protected with a higher classification	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-177	Create files with the same name as files protected with a higher classification	LibreOffice	assume not compromised verifies resources.system
CAPEC-186	Malicious Software Update	DZ App	verifies resources.updates
CAPEC-263	Force Use of Corrupted Files	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-263	Force Use of Corrupted Files	LibreOffice	assume not compromised verifies resources.system
CAPEC-276	Inter-component Protocol Manipulation	Container manager	is sandboxed sanitizes input
CAPEC-444	Development Alteration	DZ App	is reviewed
CAPEC-480	Escaping Virtualization	doc_to_pixels.py
CAPEC-480	Escaping Virtualization	LibreOffice
CAPEC-582	Route Disabling	Random doc source	works offline
CAPEC-639	Probe System Files	Random doc source	is sandboxed
CAPEC-639	Probe System Files	DZ App	is sandboxed
CAPEC-639	Probe System Files	Suspicious doc	is sandboxed
CAPEC-639	Probe System Files	Pixels (rasterized document)	is sandboxed

Back to Summary