mirror of
https://github.com/narrrl/proton-drive-linux.git
synced 2026-11-04 00:47:00 +01:00
nvrl
6e9beb4b16
ARCHITECTURE.md described the 2.x write path, where namespace changes waited for Drive and every mount had its own inode space. Rewrite it around the local tree (lid, inode = lid + 1, local~<lid> stand-ins), the queue and its 16 drain workers, sync issues, and the remaining split between the mount and the mirror engine. Drop the pins.json claim; pins moved into the database at schema v5. TESTING.md gains the simulation runs and loses the per-case narrative that --list and BUGS.md already carry. ROADMAP.md takes over the post-3.0.0 items from the milestone status file. Remove MILESTONE-3.0.0-STATUS.md (a working log) and UI_UX_PLAN.md (the 2.x design audit). Code comments and CI that cited the untracked docs/MILESTONE-3.0.0.md now point at TESTING.md, ARCHITECTURE.md and ROADMAP.md. Threat-model links follow the section to §10.
40 lines
2.0 KiB
Markdown
40 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Fixes land on the latest release. Please reproduce on the most recent version before reporting.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not open a public issue.** Report privately through GitHub's
|
|
[private vulnerability reporting](https://github.com/narrrl/proton-drive-linux/security/advisories/new),
|
|
or by email to <contact@narl.io>.
|
|
|
|
Please include the version (`pdfs --version`), your distribution and desktop environment, what an
|
|
attacker gains, and a reproduction if you have one. You can expect an acknowledgement within a few
|
|
days; a fix ships in the next release, and you are credited in the advisory unless you ask
|
|
otherwise.
|
|
|
|
## Scope
|
|
|
|
This client holds Proton account credentials and decrypted file content on the local machine, so
|
|
the interesting boundaries are:
|
|
|
|
- **Credentials.** Sessions and the mailbox password live in the system Secret Service. Anything
|
|
that writes them elsewhere — logs, temp files, crash dumps — is a vulnerability.
|
|
- **The control socket.** Anything that can connect to `control.sock` has the daemon's
|
|
authenticated session. It is `0600`, and the state, cache, and config directories must be real,
|
|
current-user-owned `0700` directories; the daemon fails closed otherwise. Reports that defeat
|
|
those checks are in scope.
|
|
- **Local cache and staging.** Decrypted block content and staged writes on disk.
|
|
- **Cryptography.** Key derivation, signature handling, and anything that could publish plaintext
|
|
or the wrong key material to Proton.
|
|
|
|
What the client deliberately keeps in plaintext on disk, and why, is documented in the
|
|
[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
|
|
Behaviour described there is known and not a vulnerability by itself; a way to make it worse
|
|
than described is.
|
|
|
|
Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that
|
|
require an attacker who already has your user account on the machine.
|