diff --git a/creds-matrix-notes.md b/creds-matrix-notes.md index 3c7708f..e2caa96 100644 --- a/creds-matrix-notes.md +++ b/creds-matrix-notes.md @@ -215,6 +215,16 @@ ## Checker behaviour worth knowing before you "fix" it +**E2 reports FILE MODE, not reachability -- read an E2 finding before calling it an +exposure.** SEC-024 was opened on a 0664 state file and first written up as +"group- and world-readable"; measuring the path showed `opentofu/` is 0700 and `~` is 0750, +so no other account could actually reach it. It was a defence-in-depth defect, not a live +exposure, and the row had to be corrected the same day. Reporting mode alone is the RIGHT +default for a credential gate -- directory modes change, a `cp -p` or a tarball escapes +them, and a gate that reasons about traversal would go quiet the moment someone tightened a +parent directory for an unrelated reason. But it means the human writing up an E2 finding +owes a reachability check before using the word "exposed". + **S5 compares `mint-stage` and `mint-ref` as part of the per-DC shape, deliberately.** Today both DCs agree on both, so it does not fire on them. A future DC that legitimately mints the same credential at a DIFFERENT stage -- one standing up after Stage 5, say -- diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index e28b24f..45226e1 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -966,8 +966,17 @@ `opentofu/terraform.tfstate.backup` is mode **0664** (group- and world-readable) and carries the Office1 MAAS API key in plaintext per DOCFIX-175; the live state file is correctly 0600. Invisible to every prior control because the world-readable check was - custody-gated and the siblings were undeclared. **LOGGED, NOT ACTIONED (hard rule 1)** -- - the `chmod` and the retain-or-delete question are mutations outside this step. + custody-gated and the siblings were undeclared. **REMEDIATED 2026-07-26 (mode):** operator-approved `chmod 600` on + `terraform.tfstate.backup` and `.pre-G16-20260721`, read-back verified -- all four state + files now 0600 and the E2 finding cleared. **SEVERITY CORRECTED first:** the row's + original "group- and world-readable" overstated it -- `opentofu/` is 0700 and `~` is + 0750, so no other account could traverse to it, and neither file is git-tracked, so + SEC-004 was never implicated. It was defence-in-depth, not live exposure. The RETENTION + question on the two `pre-*` state-surgery snapshots is operator-DEFERRED to stage close + (both gates CLOSED, but deletion is irreversible with no other copy of that state). The + umask CAUSE was out of ruled scope, so a future apply may rewrite 0664 -- P5 will catch + it. The key reaching state files in plaintext at all remains DOCFIX-175, rotation owed + under SEC-018/-019. **STILL OUTSTANDING (not done, not silently dropped):** ruling 1's TIER 2 `Pn` (tier 1 is wired -- see above); tier 3 (BUILT 2026-07-26 -- see below); tier 3's behavioural-probe half diff --git a/docs/changelog-20260726-d137-tier1.md b/docs/changelog-20260726-d137-tier1.md index 2e8d014..f4cd74f 100644 --- a/docs/changelog-20260726-d137-tier1.md +++ b/docs/changelog-20260726-d137-tier1.md @@ -637,3 +637,36 @@ **Revert:** `git revert` this commit; the eight summaries return inline and the cap is breached again. + +## Item 20 -- SEC-024 remediated (mode); severity corrected; retention deferred + +**Severity corrected BEFORE the fix.** The row as I opened it said "group- and +world-readable". Measuring the path showed `opentofu/` is 0700 and `~` is 0750, so no other +account could traverse to the file -- and neither it nor the snapshots are git-tracked, so +SEC-004's public-repo angle was never implicated. It was a DEFENCE-IN-DEPTH defect, not a +live exposure. Corrected in its own commit before any remediation, because a ledger row +that overstates an exposure is its own defect. + +**Operator-approved mutation, executed and read-back verified.** `chmod 600` on +`terraform.tfstate.backup` and `terraform.tfstate.pre-G16-20260721`. All four state files +now 0600 (matching the live `terraform.tfstate` and `pre-G6`), and the checker's +`E2 WORLD-READABLE` finding cleared. + +**Retention DEFERRED by ruling, not forgotten.** Question put: keep the two `pre-*` +state-surgery snapshots, delete them, keep permanently, or move them out of the clone. +Operator selected "Keep, decide at stage close" -- both gates (G6, G16) are CLOSED and the +outer plan has converged to zero diff repeatedly since, but deletion is irreversible with no +other copy of that state, so it belongs in the close-out review. + +**Two things deliberately NOT done:** the umask CAUSE was out of the ruled scope, so a +future `tofu apply` may write 0664 again -- the P5 gate will catch it, which is the system +working rather than a gap. And the underlying issue that the key reaches state files in +plaintext at all is DOCFIX-175, with rotation owed under SEC-018/-019; neither is closed by +this. + +**Caveat recorded in `creds-matrix-notes.md`:** E2 reports file MODE, not reachability. +That is the right default for a gate -- directory modes change and a `cp -p` escapes them -- +but whoever writes up an E2 finding owes a reachability check before using the word +"exposed". This defect is exactly why. + +**Revert:** `chmod 664` on the two files (restores the defect) and reopen the row.