David Chisnall (*Now with 50% more sarcasm!*) on Nostr: I came across a reference to #Wazuh in another thread. It looks interesting: an ...

I came across a reference to #Wazuh in another thread. It looks interesting: an open-source thing that can manage a bunch of compliance requirements.

So I went looking for information about their agent's security. Things I did find:<li>Installing it requires root and it appears to run as root.</li>

Things I did not find:<li>Any security audit of the agent.</li><li>Any documentation on how they do privilege separation in the agent.</li><li>Any design docs for the agent.</li><li>Any threat model docs for the agent.</li>

Are these things somewhere I missed? Anyone familiar with the project know how they avoid their network-connected-and-highly-privileged thing being an attack vector for client devices? Is it possible to run it sandboxed with read-only access to the system (for reporting violations but not automatically trying to fix them)?