What DAV can and cannot do on the host
Security and privilege model
The detection engine runs without root, without a shell, and without the ability to change itself. One small, validated helper performs the only privileged action.
The service account
| Property | Value |
|---|---|
| Account | davco, a locked system account with no login shell |
| Groups | Only its own group |
| sudo, monitor-only mode | None |
| sudo, with enforcement | Exactly one rule: run /usr/libexec/dav-ngwaf/davco-ip-enforce as root, nothing else |
| Log access | Read access to the web server log through file ACLs |
| Writes | Its own detection logs and state files only |
The account cannot install software, compile code, modify its binaries, its systemd units or the privileged helper, or start and stop its own service. The server's administrator installs dependencies through the package manager and controls the service.
The privileged helper
- Owned by root and not writable by the service account.
- Validates every argument and acts only on DAV's own sets.
- Uses fixed paths and set names, executes tools without a shell, and logs each action.
- Refuses protected and private addresses unless the administrator's policy file allows them.
Root services
The firewall loader and, if enabled, the XDP loader and reconciliation timer run as root, because loading nftables tables and attaching XDP programs requires it. They act only on DAV's own table and pinned map.
SELinux
- Tested with SELinux in enforcing mode, targeted policy.
- DAV ships no custom SELinux policy modules. Its services run in the standard domains systemd assigns to installed daemons.
- With the optional DAV SOC, NGINX proxies to the local API on a loopback port, which requires the standard
httpd_can_network_connectboolean.
Files and locations
| Location | Contents |
|---|---|
/usr/bin/davco_ids | Detection engine |
/usr/libexec/dav-ngwaf/ | Enforcement helper, firewall loader, ingestion, XDP loader and control tools |
/etc/davco/ | Engine, database and enforcement policy configuration |
/etc/sysconfig/ | Firewall mode setting |
/usr/share/dav-ngwaf/ | Model checksums and database schema files |
/var/lib/dav-ngwaf-install/ | Build information and installer backups |
/var/log/davco/ | Detection, event and enforcement logs |
Builds and licensing
Each customer build is compiled and tested on a matching environment and bound to the licensed server's network identity, with a build expiry. Source code is not shipped.