Post-apply automated restart — threat model (v1)¶
This document summarizes the security model for post-apply shell steps (app restart, cache clears, post-patch tests, etc., after a successful patch) on Python, Node.js, and PHP connector targets. It complements the user guide App restart automation and the in-app risk confirmation.
Scope¶
- In scope: Manifest YAML delivered over signed API responses, cryptographic hash checks on the manifest, rolling rate limits, opt-in and automation disable semantics, and workspace isolation via your connector OAuth Bearer token (scoped per target).
- Out of scope for v1: A separate post-restart health probe pipeline that auto-disables automation on new errors or health failures. v1 relies on status reports from the connector after each run (failed steps, etc.) and review in the dashboard; future health integration may extend this.
Trust boundaries¶
| Component | Trust assumption |
|---|---|
| Patcherly API | Issues signed manifests; stores a hash for verification; enforces your plan limits and hourly restart caps. |
| Connector agent | Runs as an OS user; executes run strings exactly as configured. Compromise of the agent host = ability to run those commands. |
| You (dashboard user) | Writes the manifest; confirms risk before save. |
Threats and mitigations¶
- Tampering / stale cache: Manifest is fetched over a signed response; connectors verify signatures and compare a hash to the value from Patcherly before executing steps.
- Unauthorized execution: steps only run after a successful fix apply, when automation is enabled, your plan includes the App Auto-Restart feature, opt-in is recorded, and hourly caps allow a restart.
- Denial of service / runaway restarts: Rolling max restarts per hour (limits configured in Patcherly) and auto-disable after failed runs reduce repeated harmful attempts.
- Credential leakage: Commands inherit the agent process environment; do not embed secrets in YAML — use environment variables already on the server (see Restarting apps). The connector's OAuth access token and per-token HMAC secret are stored in
~/.patcherly/credentials.json; restrict that file's permissions and never include it in code or YAML manifests.
Residual risks¶
- Shell injection is possible if the manifest or server-side content is attacker-controlled; manifest editing is authenticated and changes are audited.
- Multi-process agents on one host are not coordinated by a single lock; server-side dedupe and per-process per-error success tracking reduce duplicate restarts but do not replace OS-level isolation.
For operational detail, see Restarting apps, App restart automation, and the dashboard App restart flow.