Tighten ingress/egress controls #58

New issue

Open

opened 2026-05-23 20:55:28 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:55:28 +00:00

Owner

Originally filed by @coilysiren on 2026-05-05T08:23:35Z - https://github.com/coilysiren/repo-recall/issues/54

Today repo-recall binds 127.0.0.1 (no auth), shells out to git/gh, and makes outbound calls to FCM (opt-in push) plus gh API. Reasonable for a personal-laptop tool, but the surface is wider than it needs to be: any local process can hit :7777, and subprocess construction is scattered across call sites.

Three tiers, pick one:

Tier 1 - tighten what's there (~2-4h)

Bearer token on HTTP (env-injected, required header). Localhost-only bind stays.
Audit every Command::new call site. Confirm no sh -c with interpolation, all args go through .arg().
CORS lockdown - deny *, allow only explicit origins (or null for file-scheme MCP widgets).
--mcp-only flag that skips the HTTP listener when the dashboard isn't wanted.

Tier 2 - real fences (~1 day)

Move HTTP from TCP to a unix socket under $XDG_RUNTIME_DIR (or $TMPDIR on Mac) with 0600 perms. Kills the "any process on the box" ingress.
Single subprocess chokepoint: run_tool(Tool::Git | Tool::Gh, args). Reject anything else. Log invocations to a ring buffer for audit.
Outbound HTTP pinned to FCM host. Custom reqwest resolver or connect-time hostname check, deny everything else.

Tier 3 - sandbox the process (~2 days)

macOS sandbox-exec profile - filesystem read-only outside ~/projects and ~/.claude/projects, network deny except FCM, no exec except git/gh. Brew binary becomes a launcher that re-execs itself under the profile.
Linux equivalent via systemd unit hardening (ProtectSystem=strict, RestrictAddressFamilies, SystemCallFilter). Skip until there's a homelab deployment that wants it.

Recommendation

Tier 2. Unix socket + subprocess chokepoint covers most of the upside without the launcher complexity of Tier 3. Tier 1 items are cheap enough to fold in alongside.

Out of scope

Multi-user auth. Single-user-on-laptop assumption stays.
Rate limiting. Not a real threat for a local tool.
Encrypted-at-rest cache. The cache is in $TMPDIR, regenerable, not sensitive.

_Originally filed by @coilysiren on 2026-05-05T08:23:35Z - [https://github.com/coilysiren/repo-recall/issues/54](https://github.com/coilysiren/repo-recall/issues/54)_ Today repo-recall binds `127.0.0.1` (no auth), shells out to `git`/`gh`, and makes outbound calls to FCM (opt-in push) plus `gh` API. Reasonable for a personal-laptop tool, but the surface is wider than it needs to be: any local process can hit `:7777`, and subprocess construction is scattered across call sites. Three tiers, pick one: ## Tier 1 - tighten what's there (~2-4h) - Bearer token on HTTP (env-injected, required header). Localhost-only bind stays. - Audit every `Command::new` call site. Confirm no `sh -c` with interpolation, all args go through `.arg()`. - CORS lockdown - deny `*`, allow only explicit origins (or `null` for file-scheme MCP widgets). - `--mcp-only` flag that skips the HTTP listener when the dashboard isn't wanted. ## Tier 2 - real fences (~1 day) - Move HTTP from TCP to a unix socket under `$XDG_RUNTIME_DIR` (or `$TMPDIR` on Mac) with 0600 perms. Kills the "any process on the box" ingress. - Single subprocess chokepoint: `run_tool(Tool::Git | Tool::Gh, args)`. Reject anything else. Log invocations to a ring buffer for audit. - Outbound HTTP pinned to FCM host. Custom reqwest resolver or connect-time hostname check, deny everything else. ## Tier 3 - sandbox the process (~2 days) - macOS `sandbox-exec` profile - filesystem read-only outside `~/projects` and `~/.claude/projects`, network deny except FCM, no exec except `git`/`gh`. Brew binary becomes a launcher that re-execs itself under the profile. - Linux equivalent via systemd unit hardening (`ProtectSystem=strict`, `RestrictAddressFamilies`, `SystemCallFilter`). Skip until there's a homelab deployment that wants it. ## Recommendation Tier 2. Unix socket + subprocess chokepoint covers most of the upside without the launcher complexity of Tier 3. Tier 1 items are cheap enough to fold in alongside. ## Out of scope - Multi-user auth. Single-user-on-laptop assumption stays. - Rate limiting. Not a real threat for a local tool. - Encrypted-at-rest cache. The cache is in `$TMPDIR`, regenerable, not sensitive.

coilysiren added the

label

2026-05-31 01:55:00 +00:00

coilysiren added

and removed

labels

2026-05-31 07:01:11 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-flight-deck/repo-recall#58

No description provided.

Rows
Columns