Security Hardening
Relevant source files
The following files were used as context for generating this wiki page:
FluentDo Agent is a downstream distribution of Fluent Bit that is explicitly designed to be hardened, stable, and secure by default. The security hardening approach is a core tenet of the project, providing enterprise-grade security for production deployments. This involves a multi-layered strategy that includes build-time hardening, secure default configurations, continuous validation, and a clear process for vulnerability management.
The agent is built with a smaller footprint by including only production-essential plugins, which inherently reduces the potential attack surface. Combined with compiler optimizations and a strict security lifecycle, FluentDo Agent aims to provide a reliable and secure data-forwarding solution.
Sources: README.md
Key Security Pillars
The security posture of FluentDo Agent is built on several key pillars, each contributing to a robust and secure final product.
| Feature | Description |
|---|---|
| Build-Time Hardening | The agent is compiled with security-focused flags like FORTIFY_SOURCE and stack protection to mitigate common vulnerabilities. |
| Secure Defaults | Out of the box, remote interfaces are disabled, authentication is required, and 17 vendor-specific plugins are disabled to minimize exposure. |
| FIPS-Compliant Builds | Offers FIPS-compliant builds using OpenSSL in FIPS mode for environments requiring federal security standards. |
| Continuous Validation | Employs daily security scans, memory safety validation (Valgrind/AddressSanitizer), and a full regression testing suite. |
| Supply Chain Security | Includes a process for syncing with upstream and managing dependency security, including image signing with Cosign. |
| Vulnerability Management | A defined process for responsibly reporting and handling security issues. |
Sources: README.md
Build-Time Hardening
Security is integrated directly into the build process. The agent's binaries are compiled with specific flags and configurations to make them more resilient to attacks.
Sources: README.md, source/lib/monkey/CMakeLists.txt
Compiler Flags and Protections
FluentDo Agent enables several compiler-level protections to harden the resulting binary.
FORTIFY_SOURCE: This flag adds checks to detect buffer overflows in common functions.- Stack Protection: Helps prevent stack-based buffer overflows.
- Interprocedural Optimization (IPO/LTO): Used for size-focused builds, which can help reduce the attack surface by eliminating dead code.
- Windows Security Flags: For Windows builds, flags like
_CRT_SECURE_NO_WARNINGSare used to encourage the use of more secure CRT functions.
Sources: README.md, source/lib/monkey/CMakeLists.txt:100-101
The following diagram illustrates the secure build process.
FIPS Compliance
For environments that require adherence to the Federal Information Processing Standards (FIPS), FluentDo Agent can be built in a FIPS-compliant mode. This is achieved by compiling with OpenSSL configured to operate in FIPS mode, ensuring that all cryptographic operations meet the required federal standards.
Sources: README.md
Memory Safety Validation
The build system for dependencies like mbedTLS, which is used for TLS functionality, includes configurations for memory safety analysis. These build modes are critical for identifying and fixing memory-related bugs before they become security vulnerabilities.
- ASan (AddressSanitizer): Instruments code to check for memory errors like use-after-free, buffer overflows, and memory leaks.
- MemSan (MemorySanitizer): Instruments code to check for reads of uninitialized memory.
These tools are used during development and testing to ensure a high level of memory safety.
Sources: source/lib/monkey/deps/mbedtls-2.4.2/README.md, README.md
Secure by Default Configuration
FluentDo Agent is configured to be secure out of the box, minimizing the need for initial security-tuning by the user.
- Disabled Remote Interfaces: All remote interfaces are disabled by default to prevent unauthorized access.
- Authentication Required: Where remote interfaces are enabled, authentication is mandatory.
- Minimal Plugin Set: 17 vendor-specific plugins are disabled by default, reducing the overall attack surface and complexity of the agent.
Sources: README.md
Supply Chain and Dependency Security
The security of FluentDo Agent extends to its dependencies and the process for keeping them updated.
Upstream Synchronization
A script, create-sync-pr.sh, is used to generate pull requests when syncing with the upstream Fluent Bit repository. The PR template generated by this script includes a "Testing Checklist" and a "FluentDo Customizations Verified" section, which explicitly contains a "Security hardening preserved" item. This ensures that security features are consciously re-verified during every upstream sync.
Sources: scripts/create-sync-pr.sh:163-172
This diagram shows the upstream sync workflow, emphasizing the security check.
Dependency Security Policies
The project incorporates dependencies that have their own defined security policies. This demonstrates an awareness of supply chain security.
- Zstandard: Security issues are reported privately via the Meta Bug Bounty program, not through public GitHub issues.
- mruby: Security concerns are directed to a specific email address (
matz@ruby.or.jp). The policy defines what is considered a vulnerability, such as remote code execution or crashes from valid scripts.
Sources: source/lib/zstd-1.5.7/SECURITY.md, source/lib/nghttp2-1.65.0/third-party/mruby/SECURITY.md
Image Signing
Container images are signed using Cosign. The public key is provided in the repository, and users can follow Sigstore documentation to verify the integrity and authenticity of the images they pull.
Sources: README.md
Vulnerability Management
FluentDo Agent has a clear and responsible process for handling security vulnerabilities.
Reporting a Vulnerability
Security researchers are instructed NOT to create public GitHub issues for potential vulnerabilities. Instead, they should report them directly via email to security@fluent.do.
The report should include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fixes (if any)
The project follows a responsible disclosure model and works with reporters to address issues promptly.
Sources: README.md
This sequence diagram illustrates the vulnerability reporting process.
Conclusion
The security hardening of FluentDo Agent is a comprehensive, defense-in-depth strategy. It begins at the build level with compiler protections, extends to a secure-by-default runtime configuration, and is maintained through rigorous testing, continuous scanning, and a structured supply chain management process. The clear and private vulnerability reporting channel further solidifies its posture as an enterprise-ready, security-conscious distribution of Fluent Bit.
Sources: README.md