Documentation
¶
Overview ¶
Package sysconf reads the machine-wide locksql setup that separates the console from the agent: the console runs as a dedicated account (locksql, used in its own login session) that alone holds the database credentials, and the agent's account reaches it through a socket that a group grants access to. The kernel enforces the boundary.
The file is written by `locksql install` and must be owned by root and writable by root only: an agent that could edit it could point clients at a console of its own or widen the socket's access.
Index ¶
- Constants
- Variables
- func DefaultSocketDir() string
- func InGroup(uid int, group string) bool
- func LegacyTIOCSTI() (on, known bool)
- func LoginUID() (int, bool)
- func MachinectlShellUIDs() ([]int, bool)
- func PtraceScope() (int, bool)
- func SessionRelay() string
- func TerminalOwner(f *os.File) (int, bool)
- type Config
- type Display
Constants ¶
const ( DisplayWayland = "wayland" DisplayX11 = "x11" DisplayTTY = "tty" // no graphical session (a text console or SSH) DisplayQuartz = "quartz" // macOS DisplayUnknown = "unknown" )
Display kinds.
const ( // RelayMachinectl is `machinectl shell locksql@`: machined runs the // shell in a container-shell@N.service unit, and the machinectl // process that forwards the terminal runs as the caller. RelayMachinectl = "machinectl shell" // RelaySSHLoopback is an SSH login from this machine: the ssh client // runs in an account the console cannot identify. RelaySSHLoopback = "ssh from this machine" )
Relays: a session of the console account opened from another account's terminal, which then carries every keystroke. loginuid and the terminal owner both name the console account there, so the console must look at how the session was opened.
const ( DefaultServiceUser = "locksql" DefaultClientGroup = "locksql-clients" )
Defaults written by locksql install.
const ( X11Warn = "warn" X11Refuse = "refuse" )
X11 policies.
Variables ¶
var Path = "/etc/locksql/system.toml"
Path is the system configuration file. Tests may point it elsewhere.
var SkipOwnerCheck = false
SkipOwnerCheck disables the root-ownership check (tests only).
Functions ¶
func DefaultSocketDir ¶
func DefaultSocketDir() string
DefaultSocketDir is where shared sockets live.
func InGroup ¶
InGroup reports whether the account uid belongs to group (as its primary group or a supplementary one).
func LegacyTIOCSTI ¶
func LegacyTIOCSTI() (on, known bool)
LegacyTIOCSTI reports whether the kernel still lets a process push characters into the input of a terminal it can open (TIOCSTI). It is off by default since Linux 6.2 (dev.tty.legacy_tiocsti = 0).
func LoginUID ¶
LoginUID returns the account that opened the login session of the process (Linux audit loginuid), which sudo and su do not change. A console running as locksql whose loginuid is another account was started from that account's session: it shares its terminal and display.
func MachinectlShellUIDs ¶ added in v0.5.1
MachinectlShellUIDs returns the real uids of the running `machinectl shell` processes (those forwarding a terminal into a machinectl session), and false when /proc cannot be listed.
func PtraceScope ¶
PtraceScope is the Yama ptrace scope (0: any process of the same user may attach to another), when the kernel has Yama.
func SessionRelay ¶ added in v0.5.1
func SessionRelay() string
SessionRelay reports whether the current process runs in a session opened through a relay (RelayMachinectl, RelaySSHLoopback), or "".
Types ¶
type Config ¶
type Config struct {
// ServiceUser is the account the console runs as.
ServiceUser string `toml:"service_user"`
// ClientGroup's members may connect to the console sockets.
ClientGroup string `toml:"client_group"`
// SocketDir holds the sockets: owned by ServiceUser, group
// ClientGroup, mode 0710 or 0750, setgid on Linux.
SocketDir string `toml:"socket_dir"`
// AllowedUIDs may connect besides the group's members.
AllowedUIDs []int `toml:"allowed_uids"`
// X11 is what the console does in an X11 session, where any client can
// read the keyboard and the screen of the others: "warn" (the default)
// or "refuse". Production profiles always refuse.
X11 string `toml:"x11"`
}
Config is the system setup.
func Load ¶
Load reads the system configuration. It returns nil and no error when the file does not exist (same-user mode).
func (*Config) ClientAllowed ¶
ClientAllowed reports whether uid may connect: listed in AllowedUIDs or a member of the client group.
func (*Config) ServiceUID ¶
ServiceUID returns the uid of the service account.
type Display ¶
Display is the graphical session a process runs in.
func DetectDisplay ¶
func DetectDisplay() Display
DetectDisplay reports the graphical session of the current process. On Linux an X11 session (or an X display without Wayland) lets any client read the keyboard and the screen of every other client, and send them synthetic input; Wayland isolates clients from each other.
Source Files