[neamul602]

Part 3 of 3 for #334 (parts 1 and 2: #376, #377), following the merged backend contract (BrainStation-23/Compliance-OS#572): process_taint. Linux; off by default.

What it does

A file written to a monitored drive that can't be judged on its own (unreadable, for example a password-protected archive built straight onto the stick; or an archive) is judged by the files its writer read just before.

• Watching opens: a second fanotify group gets FAN_OPEN notifications for the mount holding /home, only while taint is on and a drive or share is watched. It's opened the first time it's needed. It has its own reader, so a flood of opens (a build, npm install) can only overflow its own queue, never the drive's write events.
• Recording: each open under /home costs a readlink and an fstat. The path and identity go into an in-memory store: 32 per process, 4096 processes, for taint_window_seconds. Nothing is scanned at open time.
• Correlating happens when a written file matched nothing and couldn't be judged on its own:
  • up to 8 sources are checked, newest first;
  • only opens after the process started count, so a reused PID inherits nothing;
  • each source is reopened with O_NOFOLLOW, checked to be the same file (device and inode), and scanned through the cache like any file;
  • a match replaces the fail-mode events with correlated ones (correlation: {method: taint, source_sha256, source_name}, verdict_source: correlation), and the after-write action (File DLP copy correlation, part 1: settings, after-write action, capabilities (#334) #376) applies to the written file.
• No false blame: a readable file that matched nothing is never judged by what its writer read earlier. Saving an unrelated document after opening a sensitive one isn't flagged.
• capabilities.copy_correlation.process_taint is supported on Linux. Health reports processes tracked and open events lost to overflow.

Measured cost

In a privileged container: 100,000 file opens while a drive was mounted and taint was on.

	With the open watch	Without
Workload wall time	1.054 s	0.826 s
Agent CPU	520 ms (~5 µs per open)	7 ms
Open events lost	0	—

So open-heavy work runs about 28% slower while a drive is mounted with taint on. That's why it's off by default and only active while a destination is mounted. A later improvement could use FAN_REPORT_FID to avoid a file descriptor per event.

Test plan

• Taint store: newest first, per-process cap, reopen moves to the front, opens before the process started and outside the window don't count, pruning, process cap.
• Decider: an encrypted archive after reading a sensitive file gets a correlated event (source name, hash) and the after-write action; a clean readable file is not correlated; with no sensitive source the usual unscannable event stays; taint off gives no correlation; a monitor policy records without touching the file.
• The source opener refuses a replaced file (new inode) and a symlink. The process start time is parsed correctly with odd command names. Opens outside the root aren't recorded.
• End to end as root (TestEnforcer_TaintEndToEnd, added to CI's must-run list): a shell reads a secret file and writes a binary blob to the tmpfs stick, giving a correlated event with plan.txt as the source. Another process writing the same blob gives no event.
• golangci-lint: 0 issues (linux, darwin, windows). gosec: 0. Race tests, actionlint, make verify-cross and the changelog check pass.
• Not tested on a real Ubuntu desktop with a real USB stick.

Refs #334

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7fe6dfed-4603-4627-8367-4968822fd3c2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.2% Coverage on New Code
2.6% Duplication on New Code

See analysis details on SonarQube Cloud