self_defense

Immutable control-plane protection for config and hook artifacts.

What it mitigates

• Persistence attempts that rewrite radius.yaml or hook wiring
• Silent policy drift between requests
• In-session tampering meant to survive restarts

Recommended defaults

Minimal config

moduleConfig:
  self_defense:
    enabled: true
    immutablePaths:
      - "./radius.yaml"
      - "./.radius/**"
    onWriteAttempt: deny
    onHashMismatch: kill_switch

Operational notes

• Keep includeDiscoveredConfig and includeHookArtifacts enabled unless you have a custom control-plane layout.
• Use unlock.mode: token_file only for controlled maintenance windows.
• If onHashMismatch: kill_switch, configure killSwitchFilePath on durable storage.

Related modules

• fs_guard
• tripwire_guard
• kill_switch