Audit — v0.1.0
Source-level audit for the first tagged release.
Vendor: axboe/fio @
fio-3.41 (commit ed675d3, March 2025).
Severity scale
| Level | Definition |
|---|---|
| HIGH | Local root / RCE / data loss reachable from default config without auth |
| MEDIUM | Requires local user OR untrusted input; bounded blast radius |
| LOW | Hardening / hardening-adjacent; no realistic exploit |
| INFO | Documented trade-off, vendor stance, or positive finding |
Vendor integrity
The vendored tree at upstream/fio/ is a byte-for-byte copy of
axboe/fio @ tag fio-3.41
(commit ed675d3), verified by:
$ git subtree add --prefix=upstream/fio axboe-fio fio-3.41 --squash
Added dir 'upstream/fio' # 153 files, 12 MBTo re-verify against upstream HEAD on a fresh checkout:
cd ljh-sh/fio
git remote add axboe-fio https://github.com/axboe/fio.git # if not present
git fetch --depth=1 axboe-fio tag fio-3.41
diff -rq upstream/fio <(git archive axboe-fio/fio-3.41 | tar -x -C /tmp/ref)
# (silence = byte-for-byte match)Findings
Severity is per the table above. See the raw AUDIT file in the source repo for the full audit with rationale.
| # | Level | Finding |
|---|---|---|
| #1 | INFO | Vendor stability (Jens Axboe, 20+ years, kernel maintainer) |
| #2 | INFO | Self-contained static binaries (zero system library surface) |
| #3 | INFO | --build-static rule carve-out (fio's configure has no --disable-shared) |
| #4 | INFO | --disable-shm (we set this) |
| #5 | INFO | 12 optional engines disabled (libaio, libpmem, librbd, etc.) |
| #6 | LOW | --output path is operator-chosen, no canonicalization |
| #7 | LOW | Job files can reference any filesystem path the operator has |
| #8 | INFO | posixaio needs -lrt on glibc<2.34 (no impact on our musl build) |
| #9 | INFO | Build determinism caveat (same toolchain major = byte-identical) |
| #10 | INFO | Engine registration via ELF constructors (relies on vendored source trust) |
Summary.
- 0 HIGH findings for our build/packaging layer.
- 0 MEDIUM findings for our build/packaging layer.
- 2 LOW findings (#6, #7) — both standard benchmark-tool caveats documented for operator awareness.
- 8 INFO findings — vendor stability + carve-outs + design trade-offs documented above.
This audit covers the wrapper layer (scripts/,
.github/, docs, NOTICE, LICENSE) and the
static-build configuration. It does not re-audit
fio itself — that's the upstream maintainers' job, and we
inherit their security posture by pinning fio-3.41
and refusing to modify the vendored source.
Audit history
| Date | Release | Vendored commit | HIGH | MEDIUM | LOW | INFO |
|---|---|---|---|---|---|---|
| 2026-07-15 | v0.1.0 | ed675d3 (fio-3.41) | 0 | 0 | 2 | 8 |