Documentation
¶
Overview ¶
Package command checks the argv an agent asks the console to run, turns it into the remote command line, and matches it against a profile's allow rules. The agent never writes shell syntax: every argument is quoted for a POSIX shell, so ";", "|" or "$(...)" stay literal arguments.
Index ¶
Constants ¶
const ( MaxArgs = 64 MaxArgBytes = 4096 MaxBytes = 16 << 10 )
Bounds of one argv.
Variables ¶
This section is empty.
Functions ¶
func Canonical ¶
Canonical is the canonical text of each rule text that parses; others are kept as they are (ParseRules refuses them).
func Check ¶
Check validates argv: 1 to MaxArgs arguments, valid UTF-8, no NUL and no control or format character but tab, argv[0] not empty. Its errors name the argument's position, never its text.
func Display ¶
Display is argv for a screen: arguments that need quoting are quoted, the others shown as they are.
Types ¶
type Rule ¶
type Rule struct {
// contains filtered or unexported fields
}
Rule is one allow rule: an argv pattern.
func ParseRule ¶
ParseRule parses an allow rule: tokens separated by spaces. A token with *, ? or [ is a glob over one argument (path.Match: * and ? never match "/"); a last token ** matches zero or more remaining arguments. The first token is the program: it is a literal (no glob), so that a rule never opens another program. Its errors never quote the rule.
type Rules ¶
type Rules []Rule
Rules is a list of allow rules.
func ParseRules ¶
ParseRules parses each rule; the error names the rule's position.
Source Files