Documentation
¶
Overview ¶
Package sysconf reads a product's machine-wide setup that separates the console from the agent: the console runs as a dedicated account (the product's, used in its own login session) that alone holds the credentials, and the agent's account reaches it through a socket that a group grants access to. The kernel enforces the boundary.
The file is written by the product's `install` and must be owned by root and writable by root only: an agent that could edit it could point clients at a console of its own or widen the socket's access.
Index ¶
- Constants
- Variables
- func File(p kit.Product) string
- func InGroup(uid int, group string) bool
- func LegacyTIOCSTI() (on, known bool)
- func LoginUID() (int, bool)
- func MachinectlShellUIDs() ([]int, bool)
- func PtraceScope() (int, bool)
- func SessionRelay() string
- func TerminalOwner(f *os.File) (int, bool)
- type Config
- type Display
- type Proc
Constants ¶
const ( DisplayWayland = "wayland" DisplayX11 = "x11" DisplayTTY = "tty" // no graphical session (a text console or SSH) DisplayQuartz = "quartz" // macOS DisplayUnknown = "unknown" )
Display kinds.
const ( // RelayMachinectl is `machinectl shell <account>@`: machined runs the // shell in a container-shell@N.service unit, and the machinectl // process that forwards the terminal runs as the caller. RelayMachinectl = "machinectl shell" // RelaySSHLoopback is an SSH login from this machine: the ssh client // runs in an account the console cannot identify. RelaySSHLoopback = "ssh from this machine" )
Relays: a session of the console account opened from another account's terminal, which then carries every keystroke. loginuid and the terminal owner both name the console account there, so the console must look at how the session was opened.
const ( X11Warn = "warn" X11Refuse = "refuse" )
X11 policies.
const CommLen = 15
CommLen is the length of a process name as the kernel keeps it (TASK_COMM_LEN - 1): /proc/<pid>/status shows longer names truncated.
Variables ¶
var DesktopEmulators = []string{"foot", "gnome-terminal-server"}
DesktopEmulators are the terminal emulators the product's `window` command starts; the console accepts desktop mode only below one of them, owned by the console account. Their full names: a name longer than CommLen appears in Proc.Comm truncated ("gnome-terminal-"), and matches by its prefix.
var Path = ""
Path, when set, replaces every product's system configuration file (tests only).
var SkipOwnerCheck = false
SkipOwnerCheck disables the root-ownership check (tests only).
Functions ¶
func InGroup ¶
InGroup reports whether the account uid belongs to group (as its primary group or a supplementary one).
func LegacyTIOCSTI ¶
func LegacyTIOCSTI() (on, known bool)
LegacyTIOCSTI reports whether the kernel still lets a process push characters into the input of a terminal it can open (TIOCSTI). It is off by default since Linux 6.2 (dev.tty.legacy_tiocsti = 0).
func LoginUID ¶
LoginUID returns the account that opened the login session of the process (Linux audit loginuid), which sudo and su do not change. A console running as the product account whose loginuid is another account was started from that account's session: it shares its terminal and display.
func MachinectlShellUIDs ¶
MachinectlShellUIDs returns the real uids of the running `machinectl shell` processes (those forwarding a terminal into a machinectl session), and false when /proc cannot be listed.
func PtraceScope ¶
PtraceScope is the Yama ptrace scope (0: any process of the same user may attach to another), when the kernel has Yama.
func SessionRelay ¶
func SessionRelay() string
SessionRelay reports whether the current process runs in a session opened through a relay (RelayMachinectl, RelaySSHLoopback), or "".
Types ¶
type Config ¶
type Config struct {
// ServiceUser is the account the console runs as.
ServiceUser string `toml:"service_user"`
// ClientGroup's members may connect to the console sockets.
ClientGroup string `toml:"client_group"`
// SocketDir holds the sockets: owned by ServiceUser, group
// ClientGroup, mode 0710 or 0750, setgid on Linux.
SocketDir string `toml:"socket_dir"`
// AllowedUIDs may connect besides the group's members.
AllowedUIDs []int `toml:"allowed_uids"`
// X11 is what the console does in an X11 session, where any client can
// read the keyboard and the screen of the others: "warn" (the default)
// or "refuse". Production profiles always refuse.
X11 string `toml:"x11"`
// Finger is the fprintd name of the finger enrolled for the console
// account and for nothing else on this machine ("left-index-finger");
// desktop mode names it in its prompt. Empty: "finger".
Finger string `toml:"finger"`
}
Config is the system setup.
func Load ¶
Load reads the system configuration of p. It returns nil and no error when the file does not exist (same-user mode). Missing keys take p's defaults: account, clients group, shared socket directory.
func (*Config) ClientAllowed ¶
ClientAllowed reports whether uid may connect: listed in AllowedUIDs or a member of the client group.
func (*Config) ServiceUID ¶
ServiceUID returns the uid of the service account.
type Display ¶
Display is the graphical session a process runs in.
func DetectDisplay ¶
func DetectDisplay() Display
DetectDisplay reports the graphical session of the current process. On Linux an X11 session (or an X display without Wayland) lets any client read the keyboard and the screen of every other client, and send them synthetic input; Wayland isolates clients from each other.
Source Files