Documentation
¶
Overview ¶
Package doctor is `locklog doctor`: an advisory check of what the agent's account can reach where it runs, around the console. It is not a boundary: a clean report does not make a placement safe, and the console enforces nothing doctor says.
Findings are what the agent could use to read logs, or the console's secrets, without the console: the Docker engine, the log groups, sudo, root, the journal and Docker's state, a backend that answers without credentials, the cloud's metadata credentials. Residuals are the console's own weak spots (Landlock, a shareable IPC namespace, swarm mode). On a production profile the findings are red and doctor exits non-zero.
No probe's response body is ever printed: a status code, and whether the API was recognised, only.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Metadata = []Endpoint{ {Cloud: "AWS", Method: http.MethodGet, URL: "http://169.254.169.254/latest/meta-data/iam/security-credentials/", Remedy: "block the metadata service for the agent (a firewall rule, IMDSv2 with hop limit 1, no instance identity) or run it where it is not reachable"}, {Cloud: "GCP", Method: http.MethodGet, URL: "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/", Header: map[string]string{"Metadata-Flavor": "Google"}, Remedy: "block the metadata server for the agent (a firewall rule to 169.254.169.254, or a VM without a service account) or run it where it is not reachable"}, {Cloud: "Azure", Method: http.MethodGet, URL: "http://169.254.169.254/metadata/instance?api-version=2021-02-01", Header: map[string]string{"Metadata": "true"}, What: "metadata service", Answers: "the Azure metadata service answers (status %d): an identity may be available to the agent (a managed identity's tokens come from it)", Remedy: "block the instance metadata service for the agent (a firewall rule to 169.254.169.254, or no managed identity on the VM) or run it where it is not reachable"}, }
Metadata are the clouds' metadata paths: a 200 means this account can list the instance's credentials (AWS, GCP), or reach the service that hands out its identity's tokens (Azure: its instance document, which issues nothing).
Functions ¶
Types ¶
type Endpoint ¶
type Endpoint struct {
Cloud string
Method string
URL string
Header map[string]string
// What names what the path serves in the report's lines (default
// "metadata credentials").
What string
// Answers is the finding when it answers 200 (default: its
// credentials are handed out).
Answers string
// Remedy is the finding's remedy, the cloud's own.
Remedy string
}
Endpoint is a cloud metadata path probed without credentials. No probe asks for a token: it would mint one.
type Item ¶
type Item struct {
// Finding is something the agent can use; a non-finding is "ok" (or
// "info" when unknown).
Finding bool
Unknown bool
Text string
Remedy string
}
Item is one line of the report.
type Options ¶
type Options struct {
Facts hostfacts.Facts
// Profiles are the configured profiles; Profile pins one ("" : all,
// production when any is).
Profiles map[string]config.Profile
Profile string
// Landlock returns the ABI and, when 0, why (landlock.ABI).
Landlock func() (int, string)
// Metadata are the endpoints probed (default Metadata).
Metadata []Endpoint
// Timeout of one probe (default 2 s).
Timeout time.Duration
// Project is the project root ("" for none): the TLS files of the
// remote sources are checked against what the console can read.
Project string
}
Options of one doctor run.
Source Files