Documentation
¶
Overview ¶
Package source feeds files to the engine from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.
Every regular file is read in full unless Options.Read narrows it down. The decision is made from the path and the file's first bytes, so detectors that only care about executables or a few named files never pay for the rest.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ContainerStorage = []string{"/var/lib/docker/", "/var/lib/containerd/", "/var/lib/containers/", "/var/snap/docker/common/var-lib-docker/"}
ContainerStorage holds container image layers. Lower layers keep files that the running image replaced, so scanning them as a filesystem reports copies nothing uses. Scan the images themselves instead.
var DefaultExcludes = []string{"/proc/", "/sys/", "/dev/"}
DefaultExcludes are pseudo-filesystems, applied when scanning a system root. Pseudo-filesystems mounted anywhere else are also detected by type (pseudoFS).
Functions ¶
This section is empty.
Types ¶
type File ¶
type File struct {
Path string
Data []byte
// Executable is true when the file starts like an ELF, Mach-O or PE file.
Executable bool
}
File is one regular file's absolute path (within the scanned root) and content.
type Options ¶
type Options struct {
// MaxFileSize: files larger than this are skipped and recorded.
MaxFileSize int64
// Exclude lists absolute path prefixes inside the root to skip entirely.
Exclude []string
// Uncounted (Tar) lists path prefixes whose files are still read but not
// counted as scanned: an image's /proc, /sys and /dev, which some
// detectors skip and others read.
Uncounted []string
// Read decides from a file's path, first bytes and executable flag whether
// to read it in full. Nil reads every file.
Read func(abs string, head []byte, executable bool) bool
// IsExecutable decides from a file's first bytes whether it is an executable.
IsExecutable func(head []byte) bool
// Symlink receives every symbolic link (absolute path, target as written).
Symlink func(abs, target string)
// Hardlink receives every tar hard link (absolute path, absolute path of the
// file it names, which appeared earlier in the stream).
Hardlink func(abs, target string)
}
Options control what is read.
type Skip ¶
type Skip struct {
Path string `json:"path"`
Reason string `json:"reason"`
// Excluded is true for deliberate exclusions (pseudo-filesystems, container
// storage), which do not make a scan incomplete.
Excluded bool `json:"excluded,omitempty"`
// DetectorFailed is true when a detector crashed on the file. It is
// always a coverage gap.
DetectorFailed bool `json:"detector_failed,omitempty"`
}
Skip records a file or directory that was not scanned, and why.
func Dir ¶
Dir walks root without following symlinks. Paths passed to visit are absolute within root ("/etc/ssl/certs/ca-certificates.crt" for root "/" and for an extracted image at "./rootfs"). A single file keeps its real absolute path.
Source Files