BOOTC-SECURITY(7)

💖 BOOTC-SECURITY(7) 💖

okay so bestie, welcome to bootc-security — that's the miscellaneous information manual page (section 7, the ~lore~ section, if u will) and it's literally just the ✨security + threat model✨ rundown. we are going to talk trust boundaries and how to crank your guarantees way past the defaults. buckle up 🎀

---

🦋 NAME 🦋

bootc-security — the security and threat model situation, explained 🌸

👑 DESCRIPTION 👑

this page spills the tea on bootc's trust boundaries and how to configure stronger guarantees than whatever the defaults are handing you. and if you genuinely think you found a valid vulnerability? do NOT just vibe about it — go read SECURITY.md for how to report it, k?

pretty please use this url, no cap:

https://github.com/bootc-dev/bootc/blob/main/SECURITY.md

🔐 Privileges

okay so bootc is a binary that is intended to be run with full privileges. periodt. that's its whole thing.

it does not expose a service (socket, HTTP endpoint) by default — nope, that's the role of higher level tooling, not our girl.

which means: all inputs (CLI arguments, etc) are hence considered fully trusted by default. 💅 she trusts you. completely. don't make it weird.

🖼️ Container image verification

bootc honors the default /etc/containers/policy.json when it's fetching images. and the upstream default at the time of this writing? yeah it does not require signatures for generic images. 🙈

so listen — it is not a vulnerability in bootc that signatures are not required by default. that's the vibe, that's not a bug.

it is however a very good idea for bootc users to enable signatures for their images. like, highkey iconic behavior. do it. 🫶

🔍 On-disk integrity vs. pull-time verification

the default backend is ostree (with a composefs mount), but fsverity is not enabled by default. 😭

the composefs backend enables fsverity by default if available, but it does not verify the composefs image (because there's nothing to verify it against by default, bestie — nothing to check it against, it's giving lonely).

the composefs backend with sealed UKIs does verify the composefs mount. ⭐

and with composefs + sealed UKIs? it is a vulnerability if e.g. an attacker can mutate a file in the image store and have that persist across a re-mount without it resulting in an EIO error — which is the default for Linux kernel fsverity. so like, if it just... silently survives?? that's the bad timeline. 💀

🌈 SEE ALSO 🌈

• bootc(8)
• bootc-docs(7)

🎀 VERSION 🎀

v1.17.1

---

and that's the whole page bestie, ty for coming to my ted talk 💖 this was bootc-security(7), miscellaneous information manual energy, version v1.17.1 — slay, stay safe, verify your signatures, mwah 🌸🦋✨