Documentation
¶
Overview ¶
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data. The file is opened O_APPEND, mode 0600 in a 0700 directory of the console account's state: the agent account cannot read or alter it, while the console account and root can. There is no hash chain; on Linux, chattr +a makes it append-only for the console account too.
Index ¶
Constants ¶
const ( EventLogin = "login" EventPolicy = "policy" // policy change, applied or refused (see Decision) EventRefused = "refused" // request refused by the policy EventApproved = "approved" // the human approved EventDenied = "denied" // the human denied EventTimeout = "timeout" // approval timed out EventAbandoned = "abandoned" // the client left while its approval was pending EventAuto = "auto" // auto-approved under auto mode // EventRun is the outcome of an approved or auto-approved request // (Decision ok or failed). It follows the approval record, which is // written before anything runs. EventRun = "run" EventCatalog = "catalog" // catalog read // EventMode, EventResults and EventUnmask are the console's switches, // changed from its keyboard: Decision is the new state (manual or // auto; shown or hidden; allowed or off). EventMode = "mode" EventResults = "results" EventUnmask = "unmask" EventLogout = "logout" )
Events of the console.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Base ¶
type Base struct {
Event string `json:"event"`
Profile string `json:"profile,omitempty"`
Decision string `json:"decision,omitempty"`
Error string `json:"error,omitempty"`
// Code is the refusal code of a refused record (package refusal), and
// Span where the refusal points in the request, when known.
Code string `json:"code,omitempty"`
Span *refusal.Span `json:"span,omitempty"`
Warnings []string `json:"warnings,omitempty"`
// Intent is the agent's one-line reason for a request (untrusted
// text), kept on every record of that request.
Intent string `json:"intent,omitempty"`
// Reason is the human's reason for a denial, escaped.
Reason string `json:"reason,omitempty"`
// Approval is how the human approved: "session" (typed in a login
// session of the console account), "desktop+typed" (typed in a desktop
// window, level 1) or "desktop+fingerprint" (level 2).
Approval string `json:"approval,omitempty"`
// The client behind a request, from the kernel's peer credentials:
// set on the records of client requests only. PeerUID is nil when
// unknown (uid 0 is root); PeerUser is the account name when it
// resolves. The process name is the agent's choice and is not kept.
PeerUID *int `json:"peer_uid,omitempty"`
PeerPID int `json:"peer_pid,omitempty"`
PeerUser string `json:"peer_user,omitempty"`
}
Base is the product-neutral record: a product with no fields of its own writes it as is; another declares its own struct (with the same JSON names for these fields) and implements Record.
type Log ¶
type Log struct {
// contains filtered or unexported fields
}
Log appends records to <stateDir>/<product>/audit.log. The file is opened in append mode for each record, so it is never truncated and never held open.
func Open ¶
Open prepares the audit log of p under stateDir (kit.StateBase() in production): the directory <stateDir>/<p.Name> is 0700 and the file 0600 (Unix), created if missing; existing content is kept.
type Record ¶
type Record interface {
AuditEvent() string
}
Record is one audit event of a product. Its JSON encoding must be an object whose fields hold no password and no row or message data: Error and every free text must already be sanitised by the caller. AuditEvent is the record's event name, never empty.
Source Files