Skip to content

SEC-ALPHA: Remove default auth token + Docker non-root #309

@gHashTag

Description

@gHashTag

Security Fixes: SEC-02 + SEC-06

SEC-02: Remove default auth token (CRITICAL)

File: tools/mcp/trinity_mcp/cloud_monitor.zig:67

The cloud monitor falls back to a hardcoded default token "trinity" when MONITOR_TOKEN env var is not set. This allows unauthenticated access.

Task:

  • Remove the fallback "trinity" from token validation
  • If MONITOR_TOKEN is not set → @panic("MONITOR_TOKEN env var required") at startup
  • Ensure all Railway services have MONITOR_TOKEN set

SEC-06: Docker runs as root (HIGH)

File: deploy/Dockerfile.agent

Container runs as root by default, expanding blast radius of any RCE.

Task:

  • Add RUN adduser --disabled-password --gecos "" agent after package install
  • Add USER agent before ENTRYPOINT
  • Ensure workdir permissions: RUN chown -R agent:agent /app
  • Verify entrypoint.sh works as non-root

Verification

# Build check
zig build
docker build -f deploy/Dockerfile.agent -t trinity-agent-test .

# Non-root check
docker run --rm trinity-agent-test id
# Expected: uid=1000(agent) gid=1000(agent)

# Token check — grep for fallback
grep -n "trinity" tools/mcp/trinity_mcp/cloud_monitor.zig
# Should NOT find hardcoded fallback token

References

  • Parent: Security Audit tracking issue (will be linked)
  • Priority: P0 (Critical + High)

Metadata

Metadata

Assignees

No one assigned

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions