Documentation
¶
Overview ¶
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data. The file is opened O_APPEND, mode 0600 in a 0700 directory of the console account's state: the agent account cannot read or alter it, while the console account and root can. There is no hash chain; on Linux, chattr +a makes it append-only for the console account too.
Index ¶
Constants ¶
View Source
const ( EventLogin = "login" EventPolicy = "policy" // policy change, applied or refused (see Decision) EventRefused = "refused" // plan refused by the classifier, the tier or the weight check EventApproved = "approved" // the human approved EventDenied = "denied" // the human denied EventTimeout = "timeout" // approval timed out EventAbandoned = "abandoned" // the client left while its approval was pending EventAuto = "auto" // auto-approved under auto mode // EventRun is the outcome of an approved or auto-approved statement // (rows, affected, duration; Decision ok or failed). It follows the // approval record, which is written before anything runs. EventRun = "run" EventCatalog = "catalog" // catalog read // EventMode, EventResults and EventUnmask are the console's switches, // changed from its keyboard: Decision is the new state (manual or // auto; shown or hidden; allowed or off). EventMode = "mode" EventResults = "results" EventUnmask = "unmask" EventLogout = "logout" )
Events, spec §15.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Log ¶
type Log struct {
// contains filtered or unexported fields
}
Log appends records to <stateDir>/locksql/audit.log. The file is opened in append mode for each record, so it is never truncated and never held open.
type Record ¶
type Record struct {
Event string `json:"event"`
Profile string `json:"profile,omitempty"`
Engine string `json:"engine,omitempty"`
Host string `json:"host,omitempty"`
DB string `json:"db,omitempty"`
DBUser string `json:"db_user,omitempty"`
SSHHost string `json:"ssh_host,omitempty"`
SSHHostKey string `json:"ssh_host_key,omitempty"`
Class string `json:"class,omitempty"`
SQL string `json:"sql,omitempty"`
Verdict string `json:"verdict,omitempty"`
Decision string `json:"decision,omitempty"`
Error string `json:"error,omitempty"`
// Code is the refusal code of a refused record (package refusal), and
// Span where the refusal points in the statement, when known.
Code string `json:"code,omitempty"`
Span *refusal.Span `json:"span,omitempty"`
Rows int64 `json:"rows,omitempty"`
Affected int64 `json:"affected,omitempty"`
DurationMS int64 `json:"duration_ms,omitempty"`
Truncated bool `json:"truncated,omitempty"`
Unmasked bool `json:"unmasked,omitempty"`
Warnings []string `json:"warnings,omitempty"`
// Intent is the agent's one-line reason for a plan (untrusted text,
// like SQL), kept on every record of that plan.
Intent string `json:"intent,omitempty"`
// Reason is the human's reason for a denial, escaped.
Reason string `json:"reason,omitempty"`
// The client behind a request, from the kernel's peer credentials:
// set on the records of client requests only. PeerUID is nil when
// unknown (uid 0 is root); PeerUser is the account name when it
// resolves. The process name is the agent's choice and is not kept.
PeerUID *int `json:"peer_uid,omitempty"`
PeerPID int `json:"peer_pid,omitempty"`
PeerUser string `json:"peer_user,omitempty"`
}
Record is one audit event. It has no field able to hold a password or row data: Error must already be sanitised by the caller.
Source Files
Click to show internal directories.
Click to hide internal directories.