nordisk/gunnar

Gunnar threat model

This is Gunnar's threat model and security assurance case. It says what Gunnar protects, where the trust boundaries are, who might attack it, and which code stops each attack. It describes the code on master as it is. Anything that is planned or missing is listed under Residual risks and known gaps, never as a mitigation.

A citation such as crates/gunnar-core/src/sandbox.rs resolve_repo_path names a file and a symbol or phrase that file contains. xtask/tests/threat_model.rs checks every such citation on every test run, so a citation that goes stale fails the build. Code outside this repository is named by crate and version, for example gunnar-pack 2.0.0 (edda).

To report a vulnerability, see SECURITY.md.

Scope

The products

The estate pieces in this repository are covered where they touch the server: crates/gunnar-front (the front VM's PID 1: the WireGuard relay, the twin's certification, the egress door), crates/gunnar-pairing-door, and crates/gunnar-monetize-guest (Gunnar's WASM plugin for monetize).

Out of scope: the internals of gunnar-ui, monetize and its WASM host, the nordisk-pairing crate, the operations of the hosted service at gunnar.rs, and the kernel and hypervisor below Gunnar.

The builds

The default build is the AIRGAP install. It makes no outbound connection.

An outbound extra also needs its explicit configuration before it dials anything. The test xtask/tests/the_three_products.rs each_product_carries_the_named_extras_over_an_airgap_default holds the extras on all three products.

Gunnar runs in three shapes: a container, an OS-less appliance (Gunnar is PID 1, with no shell and no OS users), and a service on an operating system. A bare gunnar serves on loopback only (crates/gunnar/src/main.rs a_bare_gunnar_serves_on_loopback).

Assets

Trust boundaries

                         untrusted network
   git over SSH        git smart HTTP        gRPC control plane        browser
   (port 2222)         (port 8080, TLS       (127.0.0.1:50051 by          |
        |               optional)             default)                    v
        |                   |                     |  <--- sshsig ---  gunnar-ui console
        v                   v                     v       per call    (other repository)
 +------------------------------------------------------------------------------+
 |  gunnar (the server process; PID 1 on the appliance)                         |
 |   [B1] path sandbox + ACL      [B2] wire parsers + ceilings                  |
 |   [B3] push policy gates       [B4] sealed secrets under the KEK             |
 +-------+-----------------------------+-----------------------------+----------+
         | [B5] filesystem              | [B6] twin link              | [B7] outbound
         v                              |  mutual TLS, inside         |  (extras only):
   data root: archive, txlog,           |  WireGuard                  |  webhooks, SSO IdP,
   secrets log, secrets.kek             v                             v  HTTPS mirrors
                                   twin gunnar                   egress door on the front

 [B8] estate: the front (gunnar-front: WireGuard relay, pairing, twin certification);
      the monetize ONE box: Gunnar pulls signed orders; the WASM guest runs in its host
 [B9] supply chain: crates.io, Cargo.lock, vendor/, the release runner, the YubiKey

Attackers

Mitigations

A1: anonymous network attacker

A2: authenticated low-privilege user

A3: malicious repository content

A4: compromised twin

A5: compromised dependency or build input

A6: local host user

A7: insider operator

Residual risks and known gaps

1. Bus factor 1. One person holds the maintainer and release-manager roles, the forge's admin key and the release signing key (GOVERNANCE.md Known gap (bus factor)).
2. Advisory floors cover only what is already known. Every committed lock is held above the gix and russh versions with published advisories: gix 0.90 for GHSA-q54r-jf2p-rfr2 (xtask/tests/gix_advisory_floor.rs no_committed_lock_resolves_gix_below_0_90) and russh 0.65 for the 2026-10-30 russh advisories, which reach the SSH server too (xtask/tests/ssh_server_advisory_floor.rs every_lock_builds_the_ssh_server_on_a_russh_without_advisories). A new advisory is red only once the vulnerability database names it; until then the floor holds an old version as readily as a new one.
3. Delta chain depth is not capped on read in the default engine. Cycles are refused, but a chain of depth d costs d inflates. A user with write access can make reads of their objects slow.
4. Push size limits are off unless configured. LimitPolicy defaults to no ceiling (crates/gunnar-policy/src/config.rs pub max_pack_bytes: Option<u64>), and the gate runs after the pack was received and indexed. Until a limit is set, only disk space admission bounds a push.
5. The gRPC control plane has no TLS by default. Calls are signed, but responses are in the clear unless it stays on loopback or a private interface, runs inside WireGuard, or uses --grpc-tls-self (crates/gunnar-server/src/serve.rs pub grpc_tls: Option).
6. No private-address refusal for webhooks and HTTPS mirrors. SSO egress refuses private addresses (crates/gunnar-server/src/sso_egress.rs pub struct GuardedResolver); we found no such check for webhook targets or mirror URLs (extra online). A scope admin could aim them at internal services.
7. The KEK sits beside the data by default. Someone with the disk, root or memory can read every sealed secret. Hand the KEK in with GUNNAR_SECRET_KEK to avoid that.
8. A compromised twin is a full disclosure. It holds all data and the KEK, and a recharge from it restores what it holds.
9. The monetize order key is a trust anchor. Whoever holds it can sign fence, adopt and purge orders. Its check lives in the shared pump outside this repository.
10. Encrypted repositories still leak. Sizes, timing, file counts and the shape of history are visible, and with Level 1 also file names and commit messages (.nornir/encrypted-repos.md ## 8. What still leaks). In the browser, the server delivers the code that opens the keys (.nornir/encrypted-repos.md ## 9. The trust gap: the server delivers the wasm).
11. Release provenance is below SLSA L3. The release runner and build image have no provenance of their own, and there is no transparency log (docs/SLSA.md What still keeps us below L3).
12. Supply-chain policy gaps. deny.toml allows git dependencies (deny.toml unknown-git = "allow"), though the lock has none today, and it only warns on duplicate versions.

Reporting a vulnerability

Write to gunnar@gunnar.rs with a subject that starts with SECURITY:. Do not open a public issue. We acknowledge within 14 days and aim to fix within 60 days. The full policy, the supported versions and how fixes are announced are in SECURITY.md.