Skip to content

Security

Reporting a vulnerability

Do not open a public GitHub issue for a security vulnerability. Report it privately via GitHub's private vulnerability reporting ("Report a vulnerability" under the repository's Security tab), including a description of the impact, reproduction steps or a proof of concept, and the affected version(s). Expect an initial acknowledgement within a few days; a fix ships as a new release, with a GitHub Security Advisory where appropriate.

Security fixes are applied to the latest released version only — make sure you're running the current release before reporting.

Scope

Per SECURITY.md, the following are all in scope: the exporter's handling of untrusted input, its privilege usage, and dependency vulnerabilities.

What this exporter is trusted with

  • CAP_NET_ADMIN (or root) — required to read transceiver EEPROM over ethtool ioctls. See Permissions for exactly what this grants and how to scope it as tightly as possible (capability-only, not full root, wherever your deployment mechanism supports it).
  • Read-only in practice. The exporter only issues ethtool operations to read driver info and EEPROM; it does not configure interfaces or write module state. CAP_NET_ADMIN is a broader grant than that narrow need — Linux does not expose a finer-grained capability for these particular ioctls — so treat the grant as "this process could, in principle, reconfigure networking on this host," not as scoped strictly to reads, when reasoning about blast radius.

What this exporter exposes

  • /metrics is unauthenticated, by design — the exporter has no built-in auth, TLS, or access control of any kind. SECURITY.md states this explicitly: operators are responsible for network-level access control (bind to a management interface, firewall port 9458, or restrict access with a reverse proxy or service-mesh policy).
  • The data exposed is hardware/vendor metadata and optical telemetry — vendor names, serial numbers, part numbers, temperatures, voltages, and optical power levels for the host's transceivers. This is operationally sensitive (it reveals your physical network topology and hardware inventory) but is not credential material.
  • Read-only host filesystem is safe. Both the shipped container image and Compose file run with read_only: true — the exporter writes nothing to disk at runtime.

Supply chain

Release binaries are cross-compiled and cosign-signed (keyless, GitHub OIDC) with SBOMs attached to every archive — verify checksums.txt and its .sigstore.json bundle before trusting a downloaded binary. Container images go through the shared container-publish reusable workflow (SBOM, provenance attestation, Trivy scanning). OpenSSF Scorecard results are published for the repository — see the badge on the project README.

Licensing note

This project is AGPL-3.0. If you deploy a modified copy of this exporter as a network service, the AGPL-3.0 obliges you to make your modified source available to users interacting with that service over a network — a different obligation than most permissively-licensed exporters carry. See the licence for the exact terms.