1.40.2 — MojoSec is a silent sensor again

2026-10-28

The MojoSec process-lineage proof that cost 20–46 % of every 2-vCPU node is gone. The sensor now recognises the application account's own firewall-broker sudo from the sudo record alone, reads journald filtered at the source, and bounds its per-poll housekeeping; steady state should be at or under 3 % of one vCPU. The next deploy retires the resolver and audit-health units and the exec audit rules on every enrolled node. The new al2023-web-v3 and al2023-content-v2 profiles are opt-in. Work item: https://maestromojo.com/app/#/board/37?item=9769

Changed

• On the next deploy of an enrolled node, convergence disables and removes mojosec-proc-identity.socket, mojosec-proc-identity.service, mojosec-audit-health.timer and mojosec-audit-health.service, the stable audit helper copy and the health sidecar, in either mode and with rollback. The kernel.yama.ptrace_scope sysctl stays in place, unmanaged.
• The managed Linux Audit policy is the sudo path watch alone. The four execve rules that recorded every root and app-user exec (about 800 kernel records a minute on a django-mojo node) are gone.
• The expected-automation check is a fixed predicate on the sudo record: exactly /usr/local/sbin/mojo-firewall-broker, target root, login UID equal to the configured app UID, no TTY, no SSH attribution. It is stamped app_user_firewall_broker_v1 and kept local; every near miss stays an ordinary auth.sudo_command Event. The jobman_firewall_operation_v1 classifier is retired.
• auth.sudo_command evidence no longer carries proof_status, origin_kind, lineage, lineage_sha256, operation_id, execution_id, job_id, job_function or receipt_semantics; historical receipts keep them.
• The journal collector filters at the source: journalctl is given match groups for sshd, sudo, the systemd PAM helper, PID 1, the kernel and the two Audit session records, and only the fields the detectors read.
• Per-poll housekeeping is bounded: the expected-change annotation pass runs only when a FIM change awaits it, the status file is written every 60 s or on a health transition instead of every 5 s, tiers scanning at least every 10 minutes keep their FIM baseline in memory, and a scan that changed nothing writes no baseline row.
• New packaged profiles al2023-web-v3 and al2023-content-v2 move /usr/local/lib (about 28k root-pip files) from the 60-second tier to the six-hour tier and set rpm.skip_host_tier_roots so no tree is walked twice. al2023-web-v1, al2023-web-v2 and al2023-content-v1 stay packaged for rollback identity.
• Expected steady-state sensor cost on a 2-vCPU AL2023 node: at or below 3 % of one vCPU, under 50 MB a minute of reads, resident memory well under 150 MiB. The sensor guide lists the commands that confirm it on a node.
• check_node --section mojosec fails while any retired unit or file remains or the active Audit rules still carry the retired exec keys; it no longer checks the resolver, Yama, sidecar or timer.
• prune_mojosec_broker_flood prunes tty-less broker sudos only; an interactive run of the broker is never pruned.

Fixed

• A state file written before this release is drained of any held broker observation through the ordinary path before the seven lineage tables are dropped, counting an unreadable row instead of crash-looping the sensor on startup.
• The daemon's in-memory FIM baseline drops itself when the baseline CLI re-seeds the baseline from another process.

Upgrade notes

• Nothing changes on a node until it is deployed. On that deploy the retired units and files are removed, the Audit policy is re-converged without exec rules, and on first start the sensor drops the lineage tables and vacuums its state file once.
• al2023-web-v3 and al2023-content-v2 are opt-in: set the profile in the fleet desired policy, deploy, then on each node preview every tier and initialize the exact printed digest. Until then the active profile stays whatever was last initialized, and after the policy change the integrity collector performs no FIM scan until the digest is initialized.
• An engine started from an SSH shell gives every broker sudo that shell's Audit session and raises one auth.sudo_command a minute until cron relaunches it. Let cron relaunch it, then prune the flood with prune_mojosec_broker_flood.