Repository navigation
Replies: 2 comments
strata Security Audit: Backdoors and Data Upload
SummaryNo backdoor found. No OS data upload found. The main question was: does the program scan, collect, or upload OS data in the background, without the user knowing?
Four strong pieces of proof:
The code is generally careful about security. Command lookup has anti-hijack checks Part 1: The main question — data sent in the background1. What counts as "background behavior"Rule: anything the program does on its own, without a clear click or action from the user.
Result: the only network activity that runs on its own is the update check, and it 2. All network pathsThere are exactly 3 HTTP GET paths. A search for 2.1 Update check (the only background network use)
Judgment: benign. This is a standard update check. The request has zero identity data. 2.2 Update download and package version checks (user starts these)
Reply size limits are set: 128 MiB archive, 32 KiB manifest, 8 KiB signatures, Judgment: benign. Pure download of versions and files. 2.3 Download of a URL the user typed (user starts this)
Judgment: benign. Traffic only goes where the user asked. 2.4 Links opened in the browser (strata sends nothing)
2.5 Things we confirmed are absent
3. Telemetry, crash reports, usage stats — none exist
4. What data the code reads4.1 What is read (data item → place → where it goes)
4.2 What is not read (confirmed by tree-wide search)
4.3 Is saved data read back and sent out?No. 4.4 What the diagnostics report contains (user starts it, out of scope)
Part 2: Backdoor review5. Backdoors, obfuscation, hidden execution — none found5.1 Obfuscation and hidden payloads
5.2 Every place the code runs another program
Shell use: only 5.3 The sandbox boundary (the key gate against data leaving)
What this means: all document and media parsers (docx-rs, calamine, unrar, sevenz, zip, The 5.4 The embedded JS engine (rquickjs)One call site only: ctx.eval::<(), _>(include_str!("../../data/math-renderer.js"))?;
let render: rquickjs::Function = ctx.globals().get("strataMath")?;
render.call((source.as_str(), display))
Judgment: benign. 5.5 Persistence and privilege
5.6 Hidden backdoors, easter eggs, debug doors
Part 3: Update signature chain and supply chain6. Update signature checks — assessment: solid
Judgment: the check chain is complete and cannot be bypassed from the network side. 6.1 What is left over in the update mechanism (not a defect)
7. Build-time and install-time supply chain7.1 build.rs (247 lines, read in full) — clean
7.2 install.sh (1847 lines, read in full) — not used by kan-linuxThe upstream installer only talks to
7.3 Dependencies (Cargo.lock)
[LOW] [INFO] About 8 oddly named transitive dependencies ( 7.4 Binary blobsFull-tree ELF magic scan (excluding .git): 0 files. No The largest opaque asset is 7.5 Upstream developer scripts (not in the shipped product, recorded for completeness)
Part 4: What is left over8. Remaining risks (none is a backdoor, none is data upload)
Appendix : Terms
|
strata 后门与数据外传专项安全审计报告
结论摘要未发现后门，未发现 OS 数据外传。 针对「运行时后台是否扫描 / 搜集 / 上传 OS 数据」这一核心问题：
支撑这一结论的四条硬证据：
代码整体安全素养较高：命令解析有 第一部分：核心问题 —— 后台数据外传1. 何为「后台自动行为」判定标准：未经用户明确点击/触发，由程序自行发起的动作。逐条枚举结果：
结论：唯一的后台联网行为是更新检查，且不携带 OS 数据。 2. 网络出口全量清单全程序仅 3 条 HTTP GET 路径。生产代码中 2.1 更新检查（唯一后台联网）
判定：良性。 教科书式更新检查，请求中零标识数据。对端可见的只有客户端 IP 与请求时刻， 2.2 更新下载与包版本查询（用户触发）
响应体积有硬上限（128 MiB 归档 / 32 KiB 清单 / 8 KiB 签名 / 1 MiB AUR / 4 MiB repo db）。 判定：良性，纯版本与制品拉取。 注：AUR / Omarchy / Pacman 三条路径在 kan-linux 上 2.3 用户输入 URL 的远程下载（用户触发）
判定：良性。 流量只去用户指定的地址。 2.4 由外部浏览器打开的链接（strata 不发数据）
2.5 明确排除项
3. 遥测 / 崩溃上报 / 用量统计 —— 不存在
4. 敏感数据采集面 —— 全量清单4.1 读取了什么（按数据项 → 位置 → 去向）
4.2 没有读取的东西（全树 grep 确认）
4.3 落盘数据是否被回读外发没有。 4.4 诊断报告内容（用户主动，范围外）
第二部分：后门审查5. 后门 / 混淆 / 隐藏执行 —— 均无5.1 混淆与编码载荷
5.2 进程 spawn 全量清单
shell 使用面：仅 5.3 沙箱边界（防外传的关键一闸）
含义：文档/媒体解析器（docx-rs、calamine、unrar、sevenz、zip、mermaid-svg、rquickjs）
5.4 内嵌 JS 引擎（rquickjs）唯一调用点 ctx.eval::<(), _>(include_str!("../../data/math-renderer.js"))?;
let render: rquickjs::Function = ctx.globals().get("strataMath")?;
render.call((source.as_str(), display))
判定：良性。 5.5 持久化 / 提权
5.6 隐藏后门 / 彩蛋 / 调试口
第三部分：更新签名链与供应链6. 更新签名验证 —— 评价：扎实
判定：校验链完整，网络侧不可绕过。 6.1 更新机制的固有残留（非缺陷）
7. 构建期 / 安装期供应链7.1 build.rs（247 行通读）—— 干净
7.2 install.sh（1847 行通读）—— 对 kan-linux 不适用上游安装器，只访问
7.3 依赖供应链（Cargo.lock）
[LOW] [INFO] 约 8 个命名冷僻的传递依赖（ 7.4 二进制 blob全树 ELF 魔数扫描（排除 .git）：0 个。 无 最大不透明资产 7.5 上游开发机脚本（不进产物，仅记录）
第四部分：残留风险汇总与建议8. 残留风险（均非后门、非数据外传）
附录：术语
|
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Strata is a Rust-based lightweight file manager. It is our featured file manager in Kan-Linux(in our opinion, Strata outperforms GNOME’s Nautilus and KDE’s Dolphin: it offers the same functionality while being much lightweight and modern, very suitable for standalone Linux distro such as Kan-Linux).
USB disk connected with Laptop(running Kan-Linux v0.3.1):
Android phone connected with Laptop(running Kan-Linux v0.3.1) in MTP mode:
Android phone connected with Laptop(running Kan-Linux v0.3.1) in PTP mode:
As a daily-use application on Kan-Linux, we care deeply about its security. Here is the security audit(English version and Chinese version) of Strata for Kan-Linux.
All reactions