M4 (files in and out)

Goal

Files move in and out of the box by SFTP and SCP inside SSH, confined to the session’s capabilities and audited. There is no other inbound service and no other way in.

• A transfer runs in a transfer server the steward starts for one unlabelled session’s channel, in a budget carved from the session’s, with exactly the session’s file binds.
• A vault session gets no transfers: what leaves a label leaves by declassification.
• Every operation is one signed record in the audit log, which begins here.

Attack suite

• Confined to the session’s binds. A path-escape suite (.., absolute paths, long and odd names) reaches only the session’s binds, and a second principal’s files are unreachable (sshd, transfer).
• Only what 9P can say. Symlink, chmod and chown requests are refused, and so is the SCP protocol (scp -O), which runs a command on the server.
• No transfers from a vault. A subsystem request on a vault channel is refused (R67 (a channel keeps its labels), transfer).
• Every operation is audited once. Each open, close (with its byte count), remove, rename, mkdir, rmdir and setstat yields exactly one record, signed through keyd’s audit purpose, naming the principal from the badge the steward minted, never the transfer server’s claim (the steward).
• The audit key signs nothing else. The steward’s keyd grant signs audit records and no caller-chosen bytes (R44 (one key, one purpose, keyd’s own digest)).

Remaining work

In this order, after M3 (agents, approvals and the attack suite):

1. The transfer audit log: the steward’s append-only file of signed records (the steward).
2. The transfer server: SFTP over the session’s binds, started by the steward on sshd’s request (sshd).
3. SCP served as SFTP, which current scp clients speak; the SCP protocol (scp -O) and every transfer on a vault channel refused (transfer).

Progress

Nothing of this milestone is built. What it builds on: sshd’s sessions and channels and the steward, from M1 (sessions over SSH, kept apart), and keyd’s audit purpose, which is built and tested in host tests (keyd).