Protection Score¶

The protection score is a numeric summary of which defense mechanisms are active for a CloudTaser-protected process. It provides a quick, auditable measure of security posture and makes it immediately clear when a deployment is running below recommended levels.

Score Breakdown¶

Currently Active Mechanisms¶

Check	Points	What It Proves
`memfd_secret`	15	Secret pages physically removed from kernel direct map (Linux 5.14+)
`mlock`	10	Secret pages pinned in RAM, cannot be swapped to disk
`MADV_DONTDUMP`	10	Secret pages excluded from core dumps
`PR_SET_DUMPABLE(0)`	10	Process is non-dumpable; /proc access restricted, ptrace blocked
`token_protected`	10	Vault authentication token stored in protected memory (not on disk or in env)
`ebpf_connected`	10	eBPF enforcement agent is active and monitoring this process
`kprobes_active`	10	Synchronous syscall blocking via kprobe override (not just reactive kill)

Maximum current score: 75 points

Future Mechanisms¶

Check	Points	What It Proves	Status
`ld_preload_active`	10	LD_PRELOAD interposer active; getenv() returns memfd pointers, no heap copies	Planned
`confidential_computing`	20	Confidential computing hardware active (AMD SEV-SNP, Intel TDX, ARM CCA); hypervisor cannot read VM memory	Planned

Maximum future score: 105 points

Score Interpretation¶

Score Range	Assessment	Recommendation
70--75	Full protection	Production ready. All available defenses active on 5.14+ kernel with kprobe support.
55--69	Strong protection	One or two mechanisms unavailable. Check which and evaluate risk.
40--54	Partial protection	Key mechanisms missing (likely memfd_secret or eBPF). Not recommended for regulated workloads.
Below 40	Insufficient	Multiple critical mechanisms inactive. Investigate immediately.

A score below 55 means secrets are vulnerable to a root attacker

Without memfd_secret (15 points) and eBPF enforcement (10 + 10 points), a determined root attacker can read process memory through standard kernel interfaces. These are the three most critical components.

Point Allocation Rationale¶

The point values reflect the relative security impact of each mechanism:

memfd_secret: 15 points (highest)¶

This is the only mechanism that provides a hardware-backed guarantee against root. All other mechanisms can theoretically be bypassed by a root attacker with kernel module access. memfd_secret cannot, because the pages are physically absent from the kernel direct map. It earns the highest single-mechanism score.

mlock, MADV_DONTDUMP, PR_SET_DUMPABLE: 10 points each¶

These are essential defense-in-depth mechanisms. Each closes a specific attack vector (swap, core dumps, /proc + ptrace). None alone stops a determined root attacker, but together they force the attacker through increasingly narrow paths that the eBPF agent monitors.

token_protected: 10 points¶

The Vault authentication token is the keys to the kingdom. If the token is stored in an environment variable or a file, an attacker can steal it and fetch secrets directly from the vault. Storing the token in memfd_secret-protected memory ensures the token itself is as protected as the secrets it retrieves.

ebpf_connected: 10 points¶

The eBPF agent provides runtime enforcement against all known attack vectors. Without it, the wrapper's memory protections are the only defense. With it, every attempt to read memory, exfiltrate data, or escalate privileges is blocked and logged.

kprobes_active: 10 points¶

Synchronous kprobe blocking stops attacks before the syscall executes. Without kprobe override, the agent falls back to reactive kill (SIGKILL after tracepoint detection), which has a theoretical gap between syscall execution and process termination.

LD_PRELOAD interposer: 10 points (future)¶

Eliminates the last software-level gap where secrets can leak: the application runtime heap copy created when getenv() is called. Without the interposer, dynamically linked applications hold an unprotected copy of each secret on the heap.

Confidential computing: 20 points (future, highest)¶

Closes the hypervisor gap -- the only remaining attack surface after all software protections are in place. Worth 20 points because it is the difference between "protected from everything except the cloud provider's hypervisor" and "protected from everything."

Checking the Score¶

Wrapper Logs¶

The wrapper logs the protection score at startup:

[cloudtaser-wrapper] Protection score: 75/75
[cloudtaser-wrapper]   memfd_secret:     OK  (+15)
[cloudtaser-wrapper]   mlock:            OK  (+10)
[cloudtaser-wrapper]   madv_dontdump:    OK  (+10)
[cloudtaser-wrapper]   pr_set_dumpable:  OK  (+10)
[cloudtaser-wrapper]   token_protected:  OK  (+10)
[cloudtaser-wrapper]   ebpf_connected:   OK  (+10)
[cloudtaser-wrapper]   kprobes_active:   OK  (+10)

A degraded startup shows which mechanisms failed:

[cloudtaser-wrapper] Protection score: 50/75
[cloudtaser-wrapper]   memfd_secret:     FAIL (+0)  kernel 5.10 < 5.14
[cloudtaser-wrapper]   mlock:            OK   (+10)
[cloudtaser-wrapper]   madv_dontdump:    OK   (+10)
[cloudtaser-wrapper]   pr_set_dumpable:  OK   (+10)
[cloudtaser-wrapper]   token_protected:  OK   (+10)
[cloudtaser-wrapper]   ebpf_connected:   OK   (+10)
[cloudtaser-wrapper]   kprobes_active:   FAIL (+0)  CONFIG_BPF_KPROBE_OVERRIDE not set

CLI Status Command¶

cloudtaser status --pod my-app-7d8f9c6b4-xk2mn --namespace production

Pod: my-app-7d8f9c6b4-xk2mn
Namespace: production
Node: gke-prod-pool-a1b2c3d4

Protection Score: 75/75

  memfd_secret      OK   15/15   Kernel 5.15.0 supports memfd_secret
  mlock             OK   10/10   CAP_IPC_LOCK granted, pages locked
  madv_dontdump     OK   10/10   Core dump exclusion active
  pr_set_dumpable   OK   10/10   Process non-dumpable
  token_protected   OK   10/10   Vault token in memfd_secret
  ebpf_connected    OK   10/10   Agent pod cloudtaser-ebpf-4f7a on same node
  kprobes_active    OK   10/10   Synchronous blocking enabled

Enforcement: 23 vectors active (kprobe override)
eBPF Agent: cloudtaser-ebpf-4f7a (Running, 14h uptime)
Vault: vault.eu-central.example.com:8200 (connected, lease TTL 3540s)

Kubernetes Events¶

The wrapper emits Kubernetes events on the pod for score changes:

Events:
  Type     Reason              Message
  ----     ------              -------
  Normal   ProtectionActive    Protection score: 75/75 (all defenses active)
  Warning  ProtectionDegraded  Protection score: 50/75 (memfd_secret unavailable)

Alerting on Low Scores¶

Prometheus Metrics¶

The wrapper exposes the protection score as a Prometheus metric:

# HELP cloudtaser_protection_score Current protection score
# TYPE cloudtaser_protection_score gauge
cloudtaser_protection_score{pod="my-app-7d8f9c6b4-xk2mn",namespace="production"} 75

# HELP cloudtaser_protection_max Maximum possible protection score
# TYPE cloudtaser_protection_max gauge
cloudtaser_protection_max{pod="my-app-7d8f9c6b4-xk2mn",namespace="production"} 75

Example Alert Rule¶

groups:
  - name: cloudtaser
    rules:
      - alert: CloudTaserProtectionDegraded
        expr: cloudtaser_protection_score < 55
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "CloudTaser protection score below threshold"
          description: >
            Pod {{ $labels.pod }} in namespace {{ $labels.namespace }}
            has protection score {{ $value }}/75.
            Secrets may be vulnerable to root-level extraction.

Enforcing Minimum Scores¶

Use the CLOUDTASER_MIN_PROTECTION_SCORE environment variable to prevent the wrapper from starting if the score is too low:

env:
  - name: CLOUDTASER_MIN_PROTECTION_SCORE
    value: "55"   # Refuse to start below this score

Recommended minimum scores by environment

Environment	Minimum Score	Rationale
Production (regulated)	70	All mechanisms except edge cases
Production (general)	55	memfd_secret + eBPF minimum
Staging	40	Allow testing on older kernels
Development	0	No enforcement

:octicons-arrow-right-24: Security Model | :octicons-arrow-right-24: Memory Protection | :octicons-arrow-right-24: eBPF Enforcement