VeilNet

Security

What conflux adds to anchor's threat model, how it protects the machine's identity and binaries, and what to do when a manifest is stolen.

What the Manifest Holds

Conflux stores the machine's identity in one file, manifest.b64, in the state directory. The file holds the 32-byte identity seed. Whoever holds the seed can act as that anchor.

A manifest from a guardian also carries the renewal secret, a bearer token for the machine's renewals. Whoever holds that manifest can also keep the credential current.

  • Backups. A backup, VM snapshot or container image of /var/lib/conflux holds the identity. If you restore it onto a second machine while the first runs, the anchor exists twice and anchor reports an address conflict. Keep the directory out of shared backups, or treat those backups as secrets, as you would an SSH host key.
  • Moving a machine. Copying the manifest moves the machine, because there is no account to transfer. If you keep the original as well, the anchor exists twice. If you do not need to keep the address, run sudo conflux uninstall on the old machine and give the new machine a new identity.
0 of 1 done

  1. On Linux, list the directories and the manifest:

    $ sudo ls -ld /etc/conflux /var/lib/conflux
$ sudo ls -l /var/lib/conflux/manifest.b64

    You should see drwx------ for both directories and -rw------- for the manifest, all owned by root. For the directories on other platforms, see the CLI Reference.

Stolen Manifests

You cannot withdraw a copy of the manifest once it has left the machine. The thief can act as that anchor until the identity is no longer admitted. What you can do depends on the network:

The instance VeilNet hostsA sovereign network
Who recorded the machineNobody. Enrolment is anonymous and stores nothing.The operator who commissioned it, in the guardian.
Can the copy be cut offNo. Renewal is unauthenticated, so the thief can renew the credential indefinitely, despite its thirty-day validity window.Yes. The guardian stops renewing the credential, and it lapses at the end of the validity window that the operator chose. A block cuts the copy off sooner.
The remedyStop using the identity. If the thief must not reach your other machines, move them all to a new taint.Revoke the machine in the guardian, and commission a new identity for it.

On the instance VeilNet hosts

0 of 4 done

  1. On the machine whose manifest leaked, run:

    $ sudo conflux uninstall --yes

On a sovereign network

0 of 3 done

  1. Ask the guardian's operator to stop renewing the machine's credential and to block the machine. The block cuts the machine off before the credential lapses. See Revocation and Blocks.

Protecting the Manifest

Conflux keeps the manifest in one file that only root can read, and passes it on only through standard input.

Fig. 01 — Where the manifest goes
STATE DIRECTORY · 0700 · ROOTMANIFEST.B64 · 0600The machineSEED · REALM ROOT · CHAINTAINTS · BOOTSTRAPEXPIRY · RENEWAL URL+ BEARER, FROM A GUARDIANSTDININLINEANCHORCTL START-manifest -ANCHORDThe anchorAN ARGUMENT LISTNOT IN PS OR /PROCA LOG LINEPRINTS AS REDACTEDA SECOND FILEONE COPY, ON DISK

The manifest is stored in one file that only root can read, in a directory that only root can read. Conflux passes it to anchorctl on standard input, and anchorctl passes it to anchord inline, never as a path. On Windows, a protected access list for SYSTEM and Administrators gives the same protection.

  • File modes. The file has mode 0600, and conflux sets the mode before it writes any content, so the file never has the umask's mode, even briefly.
  • Directory mode. The directory has mode 0700, so no other user can replace the file by renaming another file over it.
  • Atomic writes. A crash or a full disk leaves the previous manifest, never a truncated one.
  • Windows. A protected access list restricts %ProgramData%\conflux to SYSTEM and Administrators. Conflux refuses a directory that another account created first. See Windows Problems.
  • No argument lists. The manifest passes on standard input to anchorctl start -manifest -, so it never shows in ps or /proc/*/cmdline.
  • No logs. Any value that holds the manifest prints as <anchor manifest, redacted>, in every format. The renewal secret is redacted in the same way.
  • Telemetry headers. The headers in an export block are credentials too, so conflux.json and the generated anchord.json also have mode 0600.

To install a credential without first saving it with the shell's default file mode, pipe it to sudo conflux enrol --manifest -, which reads standard input.

Extracted Binaries

Conflux writes anchord and anchorctl to disk and runs them. Malware droppers do the same, so conflux limits where and how it does this:

  • Location. The binaries go to bin/<setID>/, a directory named after their content, inside the root-owned state directory with mode 0700. They never go to /tmp.
  • Source. The binaries come from inside the conflux binary, and nothing is downloaded. Verifying conflux therefore also verifies them.
  • Ownership on Windows. Anyone can work out a set's directory name, so conflux runs a set only if Administrators, SYSTEM or the account running conflux owns it. Otherwise, it extracts the set again.
  • Boot service. The service runs as root (SYSTEM on Windows) and starts a copy of conflux in the state directory, which only root can change. It never starts the file you ran, which another account might be able to replace.
  • Downloads. The only file conflux downloads is wintun.dll, on Windows in TUN mode. Conflux checks it against a pinned SHA-256 digest before using it. See Windows Problems.
Where the service's copy of conflux lives
PlatformPath
Linux/var/lib/conflux/conflux
macOS/Library/Application Support/conflux/conflux
Windows%ProgramData%\conflux\conflux.exe
FreeBSD, OpenBSD/var/db/conflux/conflux
0 of 2 done

  1. Before you install the download, check it against the release's checksums:

    $ sha256sum -c SHA256SUMS --ignore-missing
conflux-linux-amd64: OK

    Each release also carries a build-provenance attestation.

Threats Out of Scope

Conflux does not defend against these threats:

  • A local attacker with root. Root can read the manifest and take the identity.
  • A compromised release channel. The checksums, the digests in conflux version and the release attestation are the only checks against one.
  • Traffic analysis. This is anchor's concern, and anchor's documentation covers it.
  • A taint as a tenant boundary. A taint limits the damage inside a realm that has already admitted all its members.
  • Guessed taint names. Taint names are not secret, and on the instance VeilNet hosts anyone may ask for a credential with any taint name. A generated taint of about 128 bits cannot be guessed, but a name such as prod can.
  • A member with the taint power. A member whose credential grants the taint power can move a machine to other taints while it runs. Credentials from the instance VeilNet hosts grant that power to nobody, but a guardian may grant it.

A badly wrong clock is not an attack, but it can stop a machine from starting or connecting in ways that look like one. See Clock Skew.

Reporting an Issue

Report security issues through Report a problem on the pre-release page. Say whether the issue concerns conflux itself (its files, binaries or service) or anchor's protocol, handshake or credential format.