HOST-01: Sensitive file permissions on enclave host¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | runtime |
| Mode | Active: runs fixed read-only commands on the host. Skipped with --read-only. |
What it checks¶
It passes when:
- All sensitive files in /opt have restrictive permissions.
- No sensitive files found in /opt, or all properly restricted.
Example failures:
- … sensitive file(s) are world-readable. Unprivileged host processes can read secrets, keys, and enclave images.
- 3 sensitive file(s) are world-readable. Unprivileged host processes can read secrets, keys, and enclave images.
How to fix¶
- Set chmod 600 on key/secret/env files and chmod 700 on scripts. Set chmod 600 on the EIF to prevent offline reverse engineering. Run: find /opt -name '*.eif' -o -name '*.key' -o -name 'environment.conf' | xargs chmod 600
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ssm.get_command_invocation |
ssm:GetCommandInvocation |
read |
| AWS | ssm.send_command |
ssm:SendCommand |
run command |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: world_readable_files
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).