{
    "host": "jail.intevia.cloud",
    "generated": "2026-08-27T11:33:04+02:00",
    "summary": {
        "PASS": 32,
        "FAIL": 1,
        "WARN": 8,
        "INFO": 12
    },
    "containment": "BREACHED",
    "results": [
        {
            "id": "id.uid",
            "cat": "Identity",
            "title": "Process runs as unprivileged user",
            "verdict": "PASS",
            "detail": "uid=1249 euid=1249 user=s_intevia.cloud_jail",
            "sev": ""
        },
        {
            "id": "id.caps",
            "cat": "Identity",
            "title": "Linux capabilities dropped",
            "verdict": "PASS",
            "detail": "CapEff=0000000000000000 CapBnd=0000000000000000",
            "sev": ""
        },
        {
            "id": "id.nnp",
            "cat": "Identity",
            "title": "NoNewPrivs set (no setuid escalation)",
            "verdict": "PASS",
            "detail": "NoNewPrivs=1",
            "sev": ""
        },
        {
            "id": "id.seccomp",
            "cat": "Identity",
            "title": "Seccomp syscall filter active",
            "verdict": "PASS",
            "detail": "Seccomp=2 (filtered(BPF))",
            "sev": ""
        },
        {
            "id": "fs.tenant0",
            "cat": "Filesystem",
            "title": "Cross-tenant path hidden: /srv/www/d_intevia.cz/s_www/wwwroot/wp-config.php",
            "verdict": "PASS",
            "detail": "not visible in namespace",
            "sev": ""
        },
        {
            "id": "fs.tenant1",
            "cat": "Filesystem",
            "title": "Cross-tenant path hidden: /srv/www/d_taxana.cz/s_www/wwwroot/wp-config.php",
            "verdict": "PASS",
            "detail": "not visible in namespace",
            "sev": ""
        },
        {
            "id": "fs.tenant2",
            "cat": "Filesystem",
            "title": "Cross-tenant path hidden: /storage/volume1/www/d_polna.cz",
            "verdict": "PASS",
            "detail": "not visible in namespace",
            "sev": ""
        },
        {
            "id": "fs.tenant3",
            "cat": "Filesystem",
            "title": "Cross-tenant path hidden: /srv/www/d_intevia.cloud/admin",
            "verdict": "PASS",
            "detail": "not visible in namespace",
            "sev": ""
        },
        {
            "id": "fs.2fe8599cb25a0c790213d39b3be97c27",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /etc/shadow",
            "verdict": "PASS",
            "detail": "fopen(/etc/shadow): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.07b421e5f5e0300b1a0fd6cc22745306",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /etc/ssh/sshd_config",
            "verdict": "PASS",
            "detail": "fopen(/etc/ssh/sshd_config): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.f3fba8529ab9ed59beb42d3b76be6aa0",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /etc/caddy/Caddyfile",
            "verdict": "PASS",
            "detail": "fopen(/etc/caddy/Caddyfile): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.e0c6f296ed5eb6781288a0970a4826bd",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /srv/scripts",
            "verdict": "PASS",
            "detail": "fopen(/srv/scripts): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.c69121b5f0a16932374552bd1497f277",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /root/.ssh/id_rsa",
            "verdict": "PASS",
            "detail": "fopen(/root/.ssh/id_rsa): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.91e83421573951a54b94534fa31ce401",
            "cat": "Filesystem",
            "title": "Sensitive host path blocked: /root/.bash_history",
            "verdict": "PASS",
            "detail": "fopen(/root/.bash_history): Failed to open stream: Permission denied",
            "sev": ""
        },
        {
            "id": "fs.passwd",
            "cat": "Filesystem",
            "title": "/etc/passwd exposure (info)",
            "verdict": "INFO",
            "detail": "readable \u2014 enumerates system users",
            "sev": ""
        },
        {
            "id": "fs.write0",
            "cat": "Filesystem",
            "title": "Write blocked outside jail: /etc/_jail_probe_282058",
            "verdict": "PASS",
            "detail": "read-only / not present",
            "sev": ""
        },
        {
            "id": "fs.write1",
            "cat": "Filesystem",
            "title": "Write blocked outside jail: /srv/www/d_intevia.cz/_jail_probe",
            "verdict": "PASS",
            "detail": "read-only / not present",
            "sev": ""
        },
        {
            "id": "fs.write2",
            "cat": "Filesystem",
            "title": "Write blocked outside jail: /usr/_jail_probe",
            "verdict": "PASS",
            "detail": "read-only / not present",
            "sev": ""
        },
        {
            "id": "fs.write3",
            "cat": "Filesystem",
            "title": "Write blocked outside jail: /var/_jail_probe",
            "verdict": "PASS",
            "detail": "read-only / not present",
            "sev": ""
        },
        {
            "id": "fs.write_in",
            "cat": "Filesystem",
            "title": "Write allowed inside jail wwwroot (expected)",
            "verdict": "INFO",
            "detail": "writable (expected)",
            "sev": ""
        },
        {
            "id": "fs.symlink",
            "cat": "Filesystem",
            "title": "Symlink out of jail cannot be dereferenced",
            "verdict": "PASS",
            "detail": "symlink made but target unreadable (ns blocks it)",
            "sev": ""
        },
        {
            "id": "fs.openbasedir",
            "cat": "Filesystem",
            "title": "open_basedir setting (info)",
            "verdict": "INFO",
            "detail": "not set (relying on kernel mount namespace instead)",
            "sev": ""
        },
        {
            "id": "ps.protectproc",
            "cat": "Process",
            "title": "No other-user processes visible (ProtectProc/hidepid)",
            "verdict": "PASS",
            "detail": "only own pool PIDs visible (same uid, 9)",
            "sev": ""
        },
        {
            "id": "ps.privtmp",
            "cat": "Process",
            "title": "PrivateTmp isolates /tmp",
            "verdict": "PASS",
            "detail": "/tmp entries: 0",
            "sev": ""
        },
        {
            "id": "ps.dev.ae0a04bdc267358d3ee1a45ea54ee303",
            "cat": "Process",
            "title": "Device node absent: /dev/mem",
            "verdict": "PASS",
            "detail": "not present",
            "sev": ""
        },
        {
            "id": "ps.dev.eaea9081eee6950af5661cdcfc71c523",
            "cat": "Process",
            "title": "Device node absent: /dev/sda",
            "verdict": "PASS",
            "detail": "not present",
            "sev": ""
        },
        {
            "id": "ps.dev.c25877d21d4cc63d2ad23f0d60862487",
            "cat": "Process",
            "title": "Device node absent: /dev/kmsg",
            "verdict": "PASS",
            "detail": "not present",
            "sev": ""
        },
        {
            "id": "ps.dev.4aa0a41460e8d5ee69da23d18a154d00",
            "cat": "Process",
            "title": "Device node absent: /dev/kcore",
            "verdict": "PASS",
            "detail": "not present",
            "sev": ""
        },
        {
            "id": "ps.mounts",
            "cat": "Process",
            "title": "Mount table (info)",
            "verdict": "INFO",
            "detail": "visible mount lines: 86",
            "sev": ""
        },
        {
            "id": "exec.disabled",
            "cat": "Command exec",
            "title": "disable_functions coverage",
            "verdict": "INFO",
            "detail": "disabled: exec,passthru,shell_exec,system,pcntl_exec,pcntl_fork,proc_nice,dl | still callable: popen,proc_open,mail",
            "sev": ""
        },
        {
            "id": "exec.reachable",
            "cat": "Command exec",
            "title": "Shell reachable via proc_open (not in disable_functions)",
            "verdict": "WARN",
            "detail": "id => uid=1249(s_intevia.cloud_jail) gid=1258(s_intevia.cloud_jail) groups=1258(s_intevia.cloud_jail),1007(sftp-users)",
            "sev": "medium"
        },
        {
            "id": "exec.confined",
            "cat": "Command exec",
            "title": "exec()d child stays inside mount namespace",
            "verdict": "PASS",
            "detail": "child sees only jail (ls /srv/www => 'd_intevia.cloud')",
            "sev": ""
        },
        {
            "id": "net.ext.692f1a7bfceb0a4115b75116fa187139",
            "cat": "Network",
            "title": "Egress \u2014 DNS/TCP to internet (1.1.1.1:53)",
            "verdict": "WARN",
            "detail": "CONNECTED \u2014 outbound egress permitted (SSRF/exfil surface)",
            "sev": "medium"
        },
        {
            "id": "net.ext.822443c7763c915981792c6c97a1bab2",
            "cat": "Network",
            "title": "Egress \u2014 HTTPS/TCP to internet (1.1.1.1:443)",
            "verdict": "WARN",
            "detail": "CONNECTED \u2014 outbound egress permitted (SSRF/exfil surface)",
            "sev": "medium"
        },
        {
            "id": "net.metadata",
            "cat": "Network",
            "title": "Cloud metadata endpoint unreachable",
            "verdict": "PASS",
            "detail": "unreachable (Connection timed out (110))",
            "sev": ""
        },
        {
            "id": "net.lo.3306",
            "cat": "Network",
            "title": "Internal service reachable \u2014 MySQL (127.0.0.1:3306)",
            "verdict": "INFO",
            "detail": "closed (Connection refused (111))",
            "sev": ""
        },
        {
            "id": "net.lo.5432",
            "cat": "Network",
            "title": "Internal service reachable \u2014 Postgres (127.0.0.1:5432)",
            "verdict": "INFO",
            "detail": "closed (Connection refused (111))",
            "sev": ""
        },
        {
            "id": "net.lo.6379",
            "cat": "Network",
            "title": "Internal service reachable \u2014 Redis (127.0.0.1:6379)",
            "verdict": "WARN",
            "detail": "CONNECTED \u2014 reachable from jail (no PrivateNetwork)",
            "sev": "high"
        },
        {
            "id": "net.lo.2019",
            "cat": "Network",
            "title": "Internal service reachable \u2014 Caddy admin API (127.0.0.1:2019)",
            "verdict": "WARN",
            "detail": "CONNECTED \u2014 reachable from jail (no PrivateNetwork)",
            "sev": "high"
        },
        {
            "id": "net.lo.9100",
            "cat": "Network",
            "title": "Internal service reachable \u2014 node_exporter (127.0.0.1:9100)",
            "verdict": "INFO",
            "detail": "closed (Connection refused (111))",
            "sev": ""
        },
        {
            "id": "net.lo.3000",
            "cat": "Network",
            "title": "Internal service reachable \u2014 Grafana (127.0.0.1:3000)",
            "verdict": "WARN",
            "detail": "CONNECTED \u2014 reachable from jail (no PrivateNetwork)",
            "sev": "medium"
        },
        {
            "id": "net.lo.3100",
            "cat": "Network",
            "title": "Internal service reachable \u2014 Loki (127.0.0.1:3100)",
            "verdict": "INFO",
            "detail": "closed (Connection refused (111))",
            "sev": ""
        },
        {
            "id": "net.fpmsock",
            "cat": "Network",
            "title": "Other tenants' PHP-FPM sockets not connectable",
            "verdict": "PASS",
            "detail": "86 foreign sockets visible but none connectable",
            "sev": ""
        },
        {
            "id": "net.dns",
            "cat": "Network",
            "title": "DNS resolution (info)",
            "verdict": "INFO",
            "detail": "resolves (104.20.23.154)",
            "sev": ""
        },
        {
            "id": "res.cgroup",
            "cat": "Resources",
            "title": "cgroup limits enforced (read-only, not stress-tested)",
            "verdict": "INFO",
            "detail": "MemoryMax=n/a  MemoryHigh=n/a  TasksMax=n/a  CPUQuota=n/a",
            "sev": ""
        },
        {
            "id": "res.phpmem",
            "cat": "Resources",
            "title": "PHP memory_limit",
            "verdict": "INFO",
            "detail": "memory_limit=128M max_execution_time=30s",
            "sev": ""
        },
        {
            "id": "svc.redis",
            "cat": "Shared svc",
            "title": "Redis requires auth (no cross-tenant cache access)",
            "verdict": "FAIL",
            "detail": "PING => '+PONG' \u2014 UNAUTH access to shared Redis (cross-tenant cache/session read-write)",
            "sev": "high"
        },
        {
            "id": "svc.mysql",
            "cat": "Shared svc",
            "title": "MySQL not reachable",
            "verdict": "PASS",
            "detail": "closed (Connection refused)",
            "sev": ""
        },
        {
            "id": "svc.caddyadmin",
            "cat": "Shared svc",
            "title": "Caddy admin API not usable from jail",
            "verdict": "WARN",
            "detail": "reachable ('HTTP/1.0 403 Forbidden') \u2014 reconfig surface; move admin to a unix socket",
            "sev": "high"
        },
        {
            "id": "svc.lan",
            "cat": "Shared svc",
            "title": "No internal LAN reachability (SSRF depth)",
            "verdict": "PASS",
            "detail": "sampled RFC1918 gateways unreachable",
            "sev": ""
        },
        {
            "id": "leak.env",
            "cat": "Info leak",
            "title": "Environment variables free of secrets",
            "verdict": "WARN",
            "detail": "suspicious env keys: AUTH_TYPE",
            "sev": "medium"
        },
        {
            "id": "leak.errors",
            "cat": "Info leak",
            "title": "display_errors off (no verbose errors to client)",
            "verdict": "PASS",
            "detail": "display_errors=0",
            "sev": ""
        },
        {
            "id": "leak.ffi",
            "cat": "Info leak",
            "title": "No FFI extension (native memory / exec bypass)",
            "verdict": "PASS",
            "detail": "ffi not loaded (present: imagick)",
            "sev": ""
        }
    ]
}