Scenario: upgrade_sandbox

Threat model for Dangerzone's sandbox container update and verification process

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;
        ]

        component_Cosign_Binary__embedded__Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(embedded)";
            URL = "component_Cosign_Binary__embedded_.html";
            tooltip = "Cosign Binary (embedded)";
            margin = 0.02;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> actor_User_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "1. Should enable\nsandbox updates?";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. User consent";    ]
    component_DZ_App_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Query registry";    ]
    externalentity_GitHub_Container_Registry_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Registry response";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. Store remote log\nindex";    ]
    datastore_Host_storage_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Read current log\nindex";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Pull sandbox\nimage";    ]
    component_DZ_App_Local_host -> component_Cosign_Binary__embedded__Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Verify sandbox\nsignatures";    ]
    component_Cosign_Binary__embedded__Local_host -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Verify rekor log";    ]
    component_Cosign_Binary__embedded__Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signature\nverification result";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "11. Store signatures";    ]
    component_Container_manager_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "12. Install sandbox";    ]
    component_Container_manager_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Pull sandbox\nimage";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant User as User
    link User: Component @ component_User.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant Container_manager as Container manager
    link Container_manager: Component @ component_Container_manager.html
    participant Cosign_Binary__embedded_ as Cosign Binary (embedded)
    link Cosign_Binary__embedded_: Component @ component_Cosign_Binary__embedded_.html
    participant Rekor_Log_Server as Rekor Log Server
    link Rekor_Log_Server: Component @ component_Rekor_Log_Server.html

    DZ_App->>User: 1. Should enable sandbox updates?
    User->>DZ_App: 2. User consent
    DZ_App->>GitHub_Container_Registry: 3. Query registry
    GitHub_Container_Registry->>DZ_App: 4. Registry response
    DZ_App->>Host_storage: 5. Store remote log index
    Host_storage->>DZ_App: 6. Read current log index
    DZ_App->>Container_manager: 7. Pull sandbox image
    DZ_App->>Cosign_Binary__embedded_: 8. Verify sandbox signatures
    Cosign_Binary__embedded_->>Rekor_Log_Server: 9. Verify rekor log
    Cosign_Binary__embedded_->>DZ_App: 10. Signature verification result
    DZ_App->>Host_storage: 11. Store signatures
    Container_manager->>Host_storage: 12. Install sandbox
    Container_manager->>GitHub_Container_Registry: 13. Pull sandbox image

Show data flows

ID	Name	Source	Sink	Type
1	Should enable sandbox updates?	DZ App	User	Request
2	User consent	User	DZ App	Request
3	Query registry	DZ App	GitHub Container Registry	Request
4	Registry response	GitHub Container Registry	DZ App	Request
5	Store remote log index	DZ App	Host storage	Request
6	Read current log index	Host storage	DZ App	Request
7	Pull sandbox image	DZ App	Container manager	Request
8	Verify sandbox signatures	DZ App	Cosign Binary (embedded)	Request
9	Verify rekor log	Cosign Binary (embedded)	Rekor Log Server	Request
10	Signature verification result	Cosign Binary (embedded)	DZ App	Request
11	Store signatures	DZ App	Host storage	Request
12	Install sandbox	Container manager	Host storage	Request
13	Pull sandbox image	Container manager	GitHub Container Registry	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-UPD		DZ App	verifies resources.updates
DZ-2-CODE		DZ App	is reviewed
DZ-2-BUILD		DZ App	is reproducible is verifiable
CAPEC-23	File Content Injection	DZ App	is sandboxed
CAPEC-88	OS Command Injection	Container manager	is sandboxed sanitizes input
CAPEC-131	Resource Leak Exposure	DZ App	is resource constrained
CAPEC-153	Input Data Manipulation	DZ App	is sandboxed
CAPEC-186	Malicious Software Update	DZ App	verifies resources.updates
CAPEC-276	Inter-component Protocol Manipulation	Container manager	is sandboxed sanitizes input
CAPEC-444	Development Alteration	DZ App	is reviewed
CAPEC-582	Route Disabling	GitHub Container Registry	works offline
CAPEC-582	Route Disabling	Remote Sandbox Image	works offline
CAPEC-582	Route Disabling	Rekor Log Server	works offline
CAPEC-639	Probe System Files	DZ App	is sandboxed
CAPEC-639	Probe System Files	GitHub Container Registry	is sandboxed
CAPEC-639	Probe System Files	Remote Log Index	is sandboxed
CAPEC-639	Probe System Files	Remote Sandbox Image	is sandboxed
CAPEC-639	Probe System Files	Sandbox Signature Data	is sandboxed
CAPEC-639	Probe System Files	Sandbox Public Key	is sandboxed
CAPEC-639	Probe System Files	Rekor Log Server	is sandboxed

Back to Summary