Documentation
¶
Overview ¶
Package hostfacts holds what `locklog profile add` and `locklog doctor` know of the machine the agent runs on: its account (euid, groups, sudo), Docker's reach, the log files and journals, the containers and the installed agents.
The launcher (scripts/locklog) gathers them on the host, where the agent runs, and passes them to the image in a facts file (Parse): profile add and doctor run in a container that would otherwise see only itself. Without the launcher (the binary copied into an agent's own image, or a test), Gather reads them where the binary runs.
Facts are names, paths, ids and states only: never a log line, a response body or a secret.
Index ¶
Constants ¶
const ( SudoAbsent = "absent" // no sudo command SudoPassword = "password" // sudo asks for a password (sudo -n fails) SudoNoPasswd = "nopasswd" // sudo -n true succeeds )
Sudo states.
const ( DockerAbsent = "absent" // no docker command and no socket DockerUnreachable = "unreachable" // a client, but no engine answers DockerReachable = "reachable" // an engine answers this account )
Docker states.
const Header = "locklog-facts 1"
Header is the first line of a facts file.
const PSFormat = `{{.Names}} {{.Image}} {{with .Label "com.docker.compose.service"}}{{.}}{{else}}-{{end}} ` +
`{{with .Label "com.docker.compose.project"}}{{.}}{{else}}-{{end}} {{with .Networks}}{{.}}{{else}}-{{end}}`
PSFormat is the `docker ps --format` template of a container fact (the launcher uses the same one).
Variables ¶
var CredFiles = []string{".aws/credentials", ".config/gcloud/application_default_credentials.json",
".azure/msal_token_cache.json", ".azure/accessTokens.json"}
CredFiles are the cloud credential files doctor looks for, under the home directory.
var JournalDirs = []string{"/var/log/journal", "/run/log/journal"}
JournalDirs are where journald keeps its files.
var SensitivePaths = []string{"/var/log/journal", "/var/lib/docker"}
SensitivePaths are the directories doctor checks the account cannot read: the journal and Docker's state (every container's logs and configuration).
Functions ¶
This section is empty.
Types ¶
type Container ¶
Container is one container `docker ps` lists, with its Compose labels ("" when unset) and its networks.
type Env ¶
type Env struct {
// LogRoots are walked for log files (default /var/log).
LogRoots []string
Home string
Getenv func(string) string
LookPath func(string) (string, error)
// Run runs a command and returns its standard output.
Run func(name string, args ...string) ([]byte, error)
// DockerSocket is the engine's socket (default /var/run/docker.sock).
DockerSocket string
}
Env is where Gather looks. Zero fields take the running process's.
type Facts ¶
type Facts struct {
// EUID is the effective uid (-1: unknown).
EUID int
// Groups are the account's group names. GroupsAmbiguous is set when
// they come from id -Gn's line and a name may hold a space (SSSD, AD:
// "docker users@corp.example" reads as "docker" and a piece): a name
// of Groups may then be a piece of another.
Groups []string
GroupsAmbiguous bool
// Sudo is one of the Sudo states ("" unknown).
Sudo string
// Docker is one of the Docker states ("" unknown); DockerHost is set
// when DOCKER_HOST is (its value is never kept).
Docker string
DockerHost bool
// Readable and Unreadable are the sensitive paths checked.
Readable, Unreadable []string
// CredFiles are cloud credential files present (shown with ~).
CredFiles []string
// IPCShareable are containers with IpcMode "shareable"; Swarm is the
// swarm state ("active", "inactive"...; "" unknown).
Swarm string
// Agents are the installed agents (agentwire's names).
Agents []string
// Journals are the journal directories present.
Journals []string
// Containers are the running containers.
Containers []Container
// Logs are log file paths under the allowed roots.
Logs []string
}
Facts are what the checks read. A zero field is unknown, never "fine".
func Parse ¶
Parse reads a facts file. Unknown keys are skipped (a newer launcher); a malformed value of a known key is an error. Everything after "logs0" is log paths, NUL-delimited (find -print0): a newline in a file or directory name cannot forge a path, and such a path is dropped. After "logs" (an older launcher), every line is a log path: a path that would break a line can only add log paths, which profile add checks like any other.
Source Files