Scenario: convert_basic

Threat model for Dangerzone

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        subgraph cluster_boundary_Docker_Podman_VM {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <Docker/Podman VM>;
            ]

            subgraph cluster_boundary_Outer_container {
                graph [
                    fontsize = 10;
                    fontcolor = black;
                    style = dashed;
                    color = firebrick2;
                    label = <Outer container>;
                ]

                subgraph cluster_boundary_gVisor_sandbox {
                    graph [
                        fontsize = 10;
                        fontcolor = black;
                        style = dashed;
                        color = firebrick2;
                        label = <gVisor sandbox>;
                    ]

                    component_doc_to_pixels_py_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "doc_to_pixels.py";
                        URL = "component_doc_to_pixels_py.html";
                        tooltip = "doc_to_pixels.py";
                        margin = 0.02;
                    ]

                }

            }

        }

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "1. Start the\nDangerzone App";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Select documents\nfor conversion";    ]
    component_DZ_App_Local_host -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "3. Send the\nsuspicious document\nto the stdin of the\ngVisor sandbox";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Rasterize PDF\ninto pixels and\nwrite them to the\ngVisor sandbox's\nstdout";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reconstruct a\nsafe doc from pixels\nto PDF (and\noptionally OCR it)";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Save safe PDF\nwith a '-safe.pdf'\nprefix";    ]
}

Sequence Diagram

sequenceDiagram
    participant User as User
    link User: Component @ component_User.html
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant doc_to_pixels_py as doc_to_pixels.py
    link doc_to_pixels_py: Component @ component_doc_to_pixels_py.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html

    User->>DZ_App: 1. Start the Dangerzone App
    User->>DZ_App: 2. Select documents for conversion
    DZ_App->>doc_to_pixels_py: 3. Send the suspicious document to the stdin of the gVisor sandbox
    doc_to_pixels_py->>DZ_App: 4. Rasterize PDF into pixels and write them to the gVisor sandbox's stdout
    DZ_App->>Host_storage: 5. Reconstruct a safe doc from pixels to PDF (and optionally OCR it)
    DZ_App->>Host_storage: 6. Save safe PDF with a '-safe.pdf' prefix

Show data flows

ID	Name	Source	Sink	Type
1	Start the Dangerzone App	User	DZ App	Request
2	Select documents for conversion	User	DZ App	Request
3	Send the suspicious document to the stdin of the gVisor sandbox	DZ App	doc_to_pixels.py	Request
4	Rasterize PDF into pixels and write them to the gVisor sandbox's stdout	doc_to_pixels.py	DZ App	Request
5	Reconstruct a safe doc from pixels to PDF (and optionally OCR it)	DZ App	Host storage	Request
6	Save safe PDF with a '-safe.pdf' prefix	DZ App	Host storage	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-UPD		DZ App	verifies resources.updates
DZ-2-CODE		DZ App	is reviewed
DZ-2-BUILD		DZ App	is reproducible is verifiable
CAPEC-23	File Content Injection	DZ App	is sandboxed
CAPEC-131	Resource Leak Exposure	DZ App	is resource constrained
CAPEC-131	Resource Leak Exposure	doc_to_pixels.py	is resource constrained
CAPEC-153	Input Data Manipulation	DZ App	is sandboxed
CAPEC-176	Configuration/Environment Manipulation	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-177	Create files with the same name as files protected with a higher classification	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-186	Malicious Software Update	DZ App	verifies resources.updates
CAPEC-263	Force Use of Corrupted Files	doc_to_pixels.py	assume not compromised verifies resources.system
CAPEC-444	Development Alteration	DZ App	is reviewed
CAPEC-480	Escaping Virtualization	doc_to_pixels.py
CAPEC-639	Probe System Files	DZ App	is sandboxed
CAPEC-639	Probe System Files	Suspicious doc	is sandboxed
CAPEC-639	Probe System Files	Pixels (rasterized document)	is sandboxed

Back to Summary