🔒 security(sweep): GA multi-lens findings — UID bypass, admin wide-open, bundle reload, config drift

Verified findings from a 6-lens adversarial sweep. One critical (HostConfig.Capabilities
allowlist bypass) was investigated and REJECTED as a false positive — the field exists in
no Docker release (v20.10/v24/master all lack it; PR #38380 reverted pre-release).

- 🔒 security(filter): zero-padded numeric UIDs ("00","000:5") no longer bypass
  require_non_root_user / allow_root_user — parse the UID, treat any 0 as root
- 🔒 security(config): wide-open dedicated admin listener (non-loopback plaintext, no
  CIDR allowlist) is now a validation error, gated by new admin.listen.insecure_allow_wide_open
- 🐛 fix(reload): verifyBundle reads signature_path from the CANDIDATE config, not the
  last-applied one — rotating the bundle no longer wedges every subsequent reload
- 🐛 fix(config): register allow_sysctls + image_trust.verify_timeout SetDefaults so their
  SOCKGUARD_* env vars are honored (Viper only unmarshals registered keys)
- 🐛 fix(filter): oversized /nodes/*/update and /build bodies return 413, not 403
- ⚡ perf(proxy): drain upstream inspect responses before close (ownership + visibility)
  so daemon keep-alive connections are reused
- 📝 docs(configs): drop non-existent allowed_users from cis + gitlab-runner exec comments
- ✅ test: zero-padded UID boundaries, candidate signature_path, env-var defaults, node/build 413
- 📝 docs: admin.listen.insecure_allow_wide_open in configuration.mdx + env table; roadmap refresh

Deferred to roadmap: stale per-profile in-flight gauge on profile removal; SecurityOpt
label=/systempaths= passthrough (needs policy design).

Author: scttbnsn

CHANGELOG.md

@@ -7,8 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Zero-padded numeric UIDs can no longer bypass root-user enforcement.** `require_non_root_user` (container create) and `allow_root_user: false` (exec) compared the user field to the exact string `"0"`, but Docker parses `Config.User` numerically — so `"00"`, `"000"`, or `"0000:5"` all run as root while slipping past the check. Both inspectors now parse the UID and treat any value resolving to 0 as root.
+- **A wide-open dedicated admin listener is now a validation error, not just a startup warning.** A non-loopback plaintext admin listener with no `clients.allowed_cidrs` exposes candidate-YAML submission and policy metadata with no authentication and no IP backstop. Validation now rejects that shape unless the operator sets `clients.allowed_cidrs`, configures `admin.listen.tls`, or explicitly acknowledges the exposure with the new `admin.listen.insecure_allow_wide_open: true`.
+
 ### Fixed
 
+- **A hot reload that rotates `policy_bundle.signature_path` no longer wedges every subsequent reload.** Bundle verification resolved the signature file from the last-applied config instead of the candidate, so changing `signature_path` (which is intentionally reload-mutable) loaded the wrong bundle, failed the digest check, and — because the active config only advances on success — left the operator permanently stuck until a restart. Verification now reads the path from the candidate config.
+- **`SOCKGUARD_REQUEST_BODY_CONTAINER_CREATE_ALLOW_SYSCTLS` and the `image_trust.verify_timeout` env vars are no longer silently ignored.** Three `request_body` keys were missing their `SetDefault` registration, and Viper only unmarshals registered keys — so configuring those fields purely through their `SOCKGUARD_*` env vars (no config file) had no effect. All three are now registered.
+- **Oversized `POST /nodes/{id}/update` and `POST /build` request bodies now return `413` instead of `403`,** matching every other body-limited inspector (a policy `403` implied the request was forbidden by rule rather than too large).
 - **Release images now carry real `commit` and `built` metadata.** The release workflow's Docker build only passed the `VERSION` build arg, so `sockguard version` in published images reported `commit unknown / built unknown`. The workflow now passes `COMMIT` (the tagged SHA) and `BUILD_DATE` (UTC build timestamp) through to the existing ldflags wiring.
 - **The container-label ACL exclusivity warning now fires once per process instead of on every hot-reload.** It was wired into the handler-chain build, which reruns on each config reload, so long-running deployments with reload enabled accumulated duplicate warnings. The warning is now gated by a process-lifetime guard (and finally has test coverage for both the enable-check and the once semantics).
 - **Coalesced inspect-cache waiters now honor their own context.** A request that joined an in-flight upstream inspect blocked unconditionally until that inspect finished — a slow daemon could pin waiter goroutines past their own deadlines. Waiters now return `ctx.Err()` promptly on cancellation while the in-flight resolve (and its cache fill) continues for future callers.
@@ -17,6 +25,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Test coverage for review-flagged gaps:** legacy (map-format) Docker filter encoding through the ownership and visibility rewrites end-to-end, the visibility meta-cache's one-inspect-per-TTL-window behavior, admin path-normalization variants on the policy-version interceptor (the validate interceptor already had them), and double-encoded `%252f` admin paths pinning the fail-closed pass-through. Corrected the visibility meta-cache code comment and the 1.3.0-rc.2 changelog wording: the cache accelerates repeated single-resource reads — list responses are filtered from their own payload and never inspect upstream.
+- **Upstream inspect responses are now drained before close** on the ownership and visibility owner-isolation paths, so idle keep-alive connections to the daemon are reused instead of discarded after each inspect.
+- **Corrected misleading exec comments in the `cis-docker-benchmark` and `gitlab-runner` presets** that referenced a non-existent `allowed_users` field; exec identity is controlled by `allow_root_user` and the argv `allowed_commands` allowlist.
 
 ## [1.3.0-rc.2] - 2026-06-10
 

README.md

@@ -461,9 +461,9 @@ LinuxServer's socket-proxy env surface is already Tecnativa-compatible for the b
 
 | Tier | Theme |
 |---|---|
-| Security hardening (v1.x) | Continued mutation-test hardening of the rule-evaluation core and config validators; swarm `ContainerSpec.User` / `Privileges` enforcement parity with container create; wide-open admin listener promoted from startup warning to error behind an explicit opt-in flag |
+| Security hardening (v1.x) | Continued mutation-test hardening of the rule-evaluation core and config validators; swarm `ContainerSpec.User` / `Privileges` enforcement parity with container create; `HostConfig.SecurityOpt` `label=`/`systempaths=` policy evaluation (currently passed through) |
 | Policy refinement (v1.x) | Multiple frontend listeners on the main proxy, named rule path aliases |
-| Internals (v1.x) | Code-review backlog: collapse the config → filter-options → policy translation layers behind a single source of truth (generated Viper defaults); allocation-free rate-limit bucket state (packed `atomic.Uint64`); profiling-gated JSON redaction fast path |
+| Internals (v1.x) | Code-review backlog: collapse the config → filter-options → policy translation layers behind a single source of truth (generated Viper defaults); allocation-free rate-limit bucket state (packed `atomic.Uint64`); profiling-gated JSON redaction fast path; clear per-profile in-flight gauges when a hot reload removes the profile |
 | Compliance (v1.x) | CIS Docker Benchmark control mapping, audit-ready policy templates |
 | Multi-host (v1.3) | Remote Docker TCP upstreams, multi-upstream fan-out, remote daemon health checking, connection pooling, automatic failover |
 | Extensibility (v1.x+) | Optional plugin extension points (WASM or Go plugins), OPA/Rego policy integration |

app/configs/cis-docker-benchmark.yaml

@@ -115,8 +115,9 @@ request_body:
   # 5.22 / 5.23 — no privileged exec, no root exec).
   exec:
     allow_privileged: false
-    # allowed_users left empty = no `User:` override on exec. Combine
-    # with allow_root_user: false below for full CIS 5.23 enforcement.
+    # allow_root_user: false denies any exec whose User resolves to root
+    # (empty, "root", or numeric 0 incl. zero-padded). For full CIS 5.23
+    # enforcement, also pin the permitted argv with allowed_commands.
     allow_root_user: false
 
 # Read responses: redact host paths, env, network topology, and other

app/configs/gitlab-runner.yaml

@@ -147,8 +147,8 @@ request_body:
     # is still denied; the runner never requests it in normal operation.
     allow_privileged: false
     # Most official CI images (alpine, ubuntu, node, python) run job scripts
-    # as root. Set allow_root_user: false and provide allowed_users if your
-    # pipeline enforces a non-root image standard.
+    # as root. Set allow_root_user: false if your pipeline enforces a non-root
+    # image standard; pair with allowed_commands to pin the permitted argv.
     allow_root_user: true
 
   image_pull:

app/internal/cmd/serve.go

@@ -1186,7 +1186,10 @@ func newAdminHTTPServer(handler http.Handler) *http.Server {
 // for parsing and expose policy metadata — are reachable by any host that can
 // route to the port, with neither authentication nor an IP backstop (#21). The
 // CIDR guard in buildAdminHandlerChain closes the gap when clients.allowed_cidrs
-// is set; this warning covers the remaining case where it is empty.
+// is set. Config validation now rejects this shape outright unless
+// admin.listen.insecure_allow_wide_open acknowledges it, so by the time this
+// warning fires the operator has explicitly opted in — it keeps the exposure
+// visible in the logs rather than gating startup.
 func warnIfAdminListenerWideOpen(cfg *config.Config, logger *slog.Logger) {
 	listen := cfg.Admin.Listen
 	if listen.Address == "" || listen.TLS.Complete() {

app/internal/cmd/serve_policy_bundle_test.go

@@ -266,6 +266,41 @@ func TestPolicyBundleReload_ParsesVerifiedBytesNotFile(t *testing.T) {
 	}
 }
 
+func TestPolicyBundleReload_ResolvesSignaturePathFromCandidate(t *testing.T) {
+	// Regression: verifyBundle must load the bundle entity from the CANDIDATE
+	// config's signature_path, not the last-applied config's. signature_path is
+	// reload-mutable so an operator can rotate the bundle; reading it from
+	// activeCfg loaded the wrong (old) bundle for the new YAML and — because
+	// activeCfg only advances on success — wedged every subsequent reload.
+	initial := policyBundleInitialConfig()
+	initial.PolicyBundle.SignaturePath = "/old/sig.bundle.json"
+
+	verifier := &stubBundleVerifier{res: policybundle.VerifyResult{Signer: "keyed:x", DigestHex: "ab"}}
+	f := newPolicyBundleFixture(t, initial, verifier)
+
+	// The candidate (parsed from the verified bytes) points at the rotated path.
+	candidate := config.Defaults()
+	candidate.PolicyBundle.Enabled = true
+	candidate.PolicyBundle.SignaturePath = "/new/sig.bundle.json"
+	candidate.PolicyBundle.AllowedSigningKeys = []config.PolicyBundleSigningKey{{PEM: "stub"}}
+	f.loadCfg = &candidate
+
+	var gotPath string
+	f.coordinator.deps.loadBundleEntity = func(p string) (verify.SignedEntity, error) {
+		gotPath = p
+		return &stubEntity{}, nil
+	}
+
+	f.coordinator.reload()
+
+	if gotPath != "/new/sig.bundle.json" {
+		t.Fatalf("loadBundleEntity path = %q, want the candidate's /new/sig.bundle.json (not active /old)", gotPath)
+	}
+	if got, ok := metricsReloadCount(t, f.registry, "ok"); !ok || got != 1 {
+		t.Fatalf("ok count = %d (found=%v), want 1", got, ok)
+	}
+}
+
 // ---------------------------------------------------------------------------
 // verifyPolicyBundleAtStartup — exhaustive branch coverage.
 // Every failure branch of the signature gate aborts startup, so each one

app/internal/cmd/serve_reload.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"log/slog"
 	"path/filepath"
@@ -273,14 +274,28 @@ func (c *reloadCoordinator) verifyBundle() (*policybundle.VerifyResult, []byte,
 	if c.bundleVerifier == nil || !c.activeCfg.PolicyBundle.Enabled {
 		return nil, nil, nil
 	}
-	if c.activeCfg.PolicyBundle.SignaturePath == "" {
-		return nil, nil, errors.New("policy_bundle.signature_path is empty")
-	}
 	yamlBytes, err := c.deps.readConfigBytes(c.cfgFile)
 	if err != nil {
 		return nil, nil, err
 	}
-	entity, err := c.deps.loadBundleEntity(c.activeCfg.PolicyBundle.SignaturePath)
+	// Resolve the bundle path from the CANDIDATE config, not c.activeCfg.
+	// signature_path is intentionally reload-mutable (reload/diff.go) so an
+	// operator can rotate the bundle file; reading it from the last-applied
+	// config would load the wrong (old) bundle for the new YAML, fail the
+	// digest check, and — because activeCfg only advances on success — leave
+	// every subsequent reload permanently stuck on the stale path until a
+	// restart. The trust root that actually authenticates the bundle is
+	// reload-immutable, so taking the path from the unverified candidate adds
+	// no trust: a forged path still needs a bundle signed by the pinned key.
+	candidate, err := c.deps.loadConfigBytes(yamlBytes)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parse candidate config for signature_path: %w", err)
+	}
+	signaturePath := candidate.PolicyBundle.SignaturePath
+	if signaturePath == "" {
+		return nil, nil, errors.New("policy_bundle.signature_path is empty")
+	}
+	entity, err := c.deps.loadBundleEntity(signaturePath)
 	if err != nil {
 		return nil, nil, err
 	}

app/internal/config/admin_listener_test.go

@@ -95,9 +95,14 @@ func TestValidateAdminListenAcceptsNonLoopbackWithBothOptIns(t *testing.T) {
 	cfg.Admin.Listen.Address = "0.0.0.0:9000"
 	cfg.Admin.Listen.InsecureAllowPlainTCP = true
 	cfg.Admin.Listen.InsecureAllowUnauthenticatedClients = true
+	// The plaintext opt-ins are necessary but no longer sufficient for the
+	// admin listener: a wide-open admin surface (no CIDR allowlist) needs the
+	// third explicit acknowledgment now that it is a validation error rather
+	// than a startup warning. See validate_admin_wideopen_test.go.
+	cfg.Admin.Listen.InsecureAllowWideOpen = true
 
 	if err := Validate(&cfg); err != nil {
-		t.Fatalf("Validate() = %v, want nil with both admin insecure opt-ins", err)
+		t.Fatalf("Validate() = %v, want nil with both admin insecure opt-ins + wide-open ack", err)
 	}
 }
 

app/internal/config/config.go

@@ -564,6 +564,16 @@ type AdminConfig struct {
 // When false the admin endpoints fall back to riding the main listener.
 type AdminListenConfig struct {
 	ListenConfig `mapstructure:",squash"`
+	// InsecureAllowWideOpen is the third acknowledgment a wide-open admin
+	// listener requires. The embedded insecure_allow_plain_tcp /
+	// insecure_allow_unauthenticated_clients flags opt a non-loopback TCP
+	// admin listener out of TLS, but unlike the main listener — where
+	// unauthenticated requests still face the full policy filter chain — the
+	// admin endpoints accept candidate YAML and expose policy metadata with
+	// client CIDRs as their ONLY admission control. A non-loopback plaintext
+	// admin listener with no clients.allowed_cidrs is therefore a validation
+	// error unless this flag explicitly accepts that exposure.
+	InsecureAllowWideOpen bool `mapstructure:"insecure_allow_wide_open"`
 }
 
 // Configured reports whether an admin listener address has been requested.

app/internal/config/load.go

@@ -107,6 +107,7 @@ func setLoadDefaults(v *viper.Viper, defaults Config) {
 	v.SetDefault("request_body.container_create.allowed_apparmor_profiles", defaults.RequestBody.ContainerCreate.AllowedAppArmorProfiles)
 	v.SetDefault("request_body.container_create.deny_unconfined_apparmor", defaults.RequestBody.ContainerCreate.DenyUnconfinedAppArmor)
 	v.SetDefault("request_body.container_create.allow_host_userns", defaults.RequestBody.ContainerCreate.AllowHostUserNS)
+	v.SetDefault("request_body.container_create.allow_sysctls", defaults.RequestBody.ContainerCreate.AllowSysctls)
 	v.SetDefault("request_body.container_create.required_labels", defaults.RequestBody.ContainerCreate.RequiredLabels)
 	v.SetDefault("request_body.container_create.allowed_runtimes", defaults.RequestBody.ContainerCreate.AllowedRuntimes)
 	v.SetDefault("request_body.exec.allow_privileged", defaults.RequestBody.Exec.AllowPrivileged)
@@ -159,7 +160,9 @@ func setLoadDefaults(v *viper.Viper, defaults Config) {
 	v.SetDefault("request_body.service.allowed_capabilities", defaults.RequestBody.Service.AllowedCapabilities)
 	v.SetDefault("request_body.service.allow_sysctls", defaults.RequestBody.Service.AllowSysctls)
 	v.SetDefault("request_body.container_create.image_trust.require_rekor_inclusion", defaults.RequestBody.ContainerCreate.ImageTrust.RequireRekorInclusion)
+	v.SetDefault("request_body.container_create.image_trust.verify_timeout", defaults.RequestBody.ContainerCreate.ImageTrust.VerifyTimeout)
 	v.SetDefault("request_body.service.image_trust.require_rekor_inclusion", defaults.RequestBody.Service.ImageTrust.RequireRekorInclusion)
+	v.SetDefault("request_body.service.image_trust.verify_timeout", defaults.RequestBody.Service.ImageTrust.VerifyTimeout)
 	v.SetDefault("request_body.swarm.allow_force_new_cluster", defaults.RequestBody.Swarm.AllowForceNewCluster)
 	v.SetDefault("request_body.swarm.allow_external_ca", defaults.RequestBody.Swarm.AllowExternalCA)
 	v.SetDefault("request_body.swarm.allowed_join_remote_addrs", defaults.RequestBody.Swarm.AllowedJoinRemoteAddrs)