securitypolicy

type AuthConfig struct {
	Username string `json:"username" toml:"username"`
	Password string `json:"password" toml:"password"`
}

type CapabilitiesConfig struct {
	Bounding    []string `json:"bounding" toml:"bounding"`
	Effective   []string `json:"effective" toml:"effective"`
	Inheritable []string `json:"inheritable" toml:"inheritable"`
	Permitted   []string `json:"permitted" toml:"permitted"`
	Ambient     []string `json:"ambient" toml:"ambient"`
}

type ClosedDoorSecurityPolicyEnforcer struct{}

type CommandArgs StringArrayMap

type Container struct {
	Command              CommandArgs         `json:"command"`
	EnvRules             EnvRules            `json:"env_rules"`
	Layers               Layers              `json:"layers"`
	WorkingDir           string              `json:"working_dir"`
	Mounts               Mounts              `json:"mounts"`
	AllowElevated        bool                `json:"allow_elevated"`
	ExecProcesses        []ExecProcessConfig `json:"-"`
	Signals              []syscall.Signal    `json:"-"`
	AllowStdioAccess     bool                `json:"-"`
	NoNewPrivileges      bool                `json:"-"`
	User                 UserConfig          `json:"-"`
	Capabilities         *CapabilitiesConfig `json:"-"`
	SeccompProfileSHA256 string              `json:"-"`
}

type ContainerConfig struct {
	ImageName                string              `json:"image_name" toml:"image_name"`
	Command                  []string            `json:"command" toml:"command"`
	Auth                     AuthConfig          `json:"auth" toml:"auth"`
	EnvRules                 []EnvRuleConfig     `json:"env_rules" toml:"env_rule"`
	WorkingDir               string              `json:"working_dir" toml:"working_dir"`
	Mounts                   []MountConfig       `json:"mounts" toml:"mount"`
	AllowElevated            bool                `json:"allow_elevated" toml:"allow_elevated"`
	ExecProcesses            []ExecProcessConfig `json:"exec_processes" toml:"exec_process"`
	Signals                  []syscall.Signal    `json:"signals" toml:"signals"`
	AllowStdioAccess         bool                `json:"allow_stdio_access" toml:"allow_stdio_access"`
	AllowPrivilegeEscalation bool                `json:"allow_privilege_escalation" toml:"allow_privilege_escalation"`
	User                     *UserConfig         `json:"user" toml:"user"`
	Capabilities             *CapabilitiesConfig `json:"capabilities" toml:"capabilities"`
	SeccompProfilePath       string              `json:"seccomp_profile_path" toml:"seccomp_profile_path"`
}

type ContainerConfigOpt func(config *ContainerConfig) error

type ContainerInterface interface {
	ToInternalContainer() (interface{}, error)
}

type Containers struct {
	Length   int                  `json:"length"`
	Elements map[string]Container `json:"elements"`
}

type CreateContainerOptions struct {
	SandboxID            string
	Privileged           *bool
	NoNewPrivileges      *bool
	Groups               []IDName
	Umask                string
	Capabilities         *oci.LinuxCapabilities
	SeccompProfileSHA256 string
	// IsSandboxContainer is true when the container being created is the cri
	// pod sandbox container (usually it is the "pause" image).
	IsSandboxContainer bool
	LinuxDevices       []oci.LinuxDevice
}

type EncodedSecurityPolicy struct {
	SecurityPolicy string `json:"SecurityPolicy,omitempty"`
}

type EnvList []string

type EnvRuleConfig struct {
	Strategy EnvVarRule `json:"strategy" toml:"strategy"`
	Rule     string     `json:"rule" toml:"rule"`
	Required bool       `json:"required" toml:"required"`

	// If UseNameValue is true, the marshalled Rego will use rules with name and
	// value separately, and ignore .Rule and .Strategy.
	UseNameValue  bool
	Name          string
	NameStrategy  EnvVarRule
	Value         string
	ValueStrategy EnvVarRule
}

type EnvRules struct {
	Length   int                      `json:"length"`
	Elements map[string]EnvRuleConfig `json:"elements"`
}

type EnvVarRule string

type ExecOptions struct {
	Groups          []IDName               // optional: empty slice or nil
	Umask           string                 // optional: "" means unspecified
	Capabilities    *oci.LinuxCapabilities // optional: nil means "none"
	NoNewPrivileges *bool                  // optional: nil means "not set"
}

type ExecProcessConfig struct {
	Command []string         `json:"command" toml:"command"`
	Signals []syscall.Signal `json:"signals" toml:"signals"`
}

type ExternalProcessConfig struct {
	Command          []string `json:"command" toml:"command"`
	WorkingDir       string   `json:"working_dir" toml:"working_dir"`
	AllowStdioAccess bool     `json:"allow_stdio_access" toml:"allow_stdio_access"`
}

type FragmentConfig struct {
	Issuer     string   `json:"issuer" toml:"issuer"`
	Feed       string   `json:"feed" toml:"feed"`
	MinimumSVN string   `json:"minimum_svn" toml:"minimum_svn"`
	Includes   []string `json:"includes" toml:"include"`
}

type IDName struct {
	ID   string
	Name string
}

type IDNameConfig struct {
	Strategy IDNameStrategy `json:"strategy" toml:"strategy"`
	Rule     string         `json:"rule" toml:"rule"`
}

type IDNameStrategy string

type Layers StringArrayMap

type LoadFragmentOptions struct {
	Issuer string
	Feed   string
	// If the fragment's COSE envelope contains a CWT Claims with a SVN, pass it
	// in HeaderSVN.
	HeaderSVN *int64
	// Rego is the fragment's Rego payload.
	Rego string
	// Receipts are the COSE transparency receipts attached to the fragment's
	// COSE envelope, if any.  Validation is handled by the enforcer, caller
	// does not have to validate them.
	Receipts []cosesign1.ParsedCOSEReceipt
}

type LoadTransparencyTrustListOptions struct {
	// Issuer of the signed Transparency Trust List (TTL).
	Issuer string
	// Subject of the TTL.
	Subject string
	// SVN carried in the TTL's COSE header.
	SVN int64
	// ParsedTTL maps each ledger name (receipt issuer) to that ledger's kid ->
	// public key map.  This is the return value of cosesign1.ParseTTLPayload.
	ParsedTTL map[string]map[string]crypto.PublicKey
}

type Mount struct {
	Source      string  `json:"source"`
	Destination string  `json:"destination"`
	Type        string  `json:"type"`
	Options     Options `json:"options"`
}

type MountConfig struct {
	HostPath      string `json:"host_path" toml:"host_path"`
	ContainerPath string `json:"container_path" toml:"container_path"`
	Readonly      bool   `json:"readonly" toml:"readonly"`
}

type Mounts struct {
	Length   int              `json:"length"`
	Elements map[string]Mount `json:"elements"`
}

type OSAwareMarshalFunc func(
	allowAll bool,
	linuxContainers []*Container,
	windowsContainers []*WindowsContainer,
	osType string,
	externalProcesses []ExternalProcessConfig,
	fragments []FragmentConfig,
	allowPropertiesAccess bool,
	allowDumpStacks bool,
	allowRuntimeLogging bool,
	allowHostNetwork bool,
	allowEnvironmentVariableDropping bool,
	allowUnencryptedScratch bool,
	allowCapabilityDropping bool,
	allowLogProviderDropping bool,
) (string, error)

type OpenDoorSecurityPolicyEnforcer struct {
	// contains filtered or unexported fields
}

type Options StringArrayMap

type PolicyConfig struct {
	AllowAll                         bool                     `json:"allow_all" toml:"allow_all"`
	Containers                       []ContainerConfig        `json:"containers" toml:"container"`
	WindowsContainers                []WindowsContainerConfig `json:"windows_containers" toml:"windows_container"`
	ExternalProcesses                []ExternalProcessConfig  `json:"external_processes" toml:"external_process"`
	Fragments                        []FragmentConfig         `json:"fragments" toml:"fragment"`
	AllowPropertiesAccess            bool                     `json:"allow_properties_access" toml:"allow_properties_access"`
	AllowDumpStacks                  bool                     `json:"allow_dump_stacks" toml:"allow_dump_stacks"`
	AllowRuntimeLogging              bool                     `json:"allow_runtime_logging" toml:"allow_runtime_logging"`
	AllowHostNetwork                 bool                     `json:"allow_hostnetwork" toml:"allow_hostnetwork"`
	AllowEnvironmentVariableDropping bool                     `json:"allow_environment_variable_dropping" toml:"allow_environment_variable_dropping"`
	// AllowUnencryptedScratch is a global policy configuration that allows
	// all containers within a pod to be run without scratch encryption.
	AllowUnencryptedScratch bool `json:"allow_unencrypted_scratch" toml:"allow_unencrypted_scratch"`
	AllowCapabilityDropping bool `json:"allow_capability_dropping" toml:"allow_capability_dropping"`
	// AllowLogProviderDropping controls how EnforceLogProviderPolicy handles
	// requested ETW providers that are not on the allow-list. When false
	// (default, fail-close) any disallowed provider causes the entire
	// modifyServiceSettings call to be denied. When true, disallowed providers
	// are silently dropped and the call continues with the kept subset.
	AllowLogProviderDropping bool `json:"allow_log_provider_dropping" toml:"allow_log_provider_dropping"`
}

type PolicyConfigOpt func(config *PolicyConfig) error

type SecurityOptions struct {
	// state required for the security policy enforcement
	PolicyEnforcer               SecurityPolicyEnforcer
	PolicyEnforcerSet            bool
	UvmReferenceInfo             string
	UvmHashEnvelopeReferenceInfo string
	// contains filtered or unexported fields
}

type SecurityPolicy struct {
	// Flag that when set to true allows for all checks to pass. Currently, used
	// to run with security policy enforcement "running dark"; checks can be in
	// place but the default policy that is created on startup has AllowAll set
	// to true, thus making policy enforcement effectively "off" from a logical
	// standpoint. Policy enforcement isn't actually off as the policy is "allow
	// everything".
	AllowAll bool `json:"allow_all"`
	// One or more containers that are allowed to run
	Containers        Containers        `json:"containers"`
	WindowsContainers WindowsContainers `json:"windows_containers"`
}

type SecurityPolicyEnforcer interface {
	EnforceDeviceMountPolicy(ctx context.Context, target string, deviceHash string) (err error)
	EnforceRWDeviceMountPolicy(ctx context.Context, target string, encrypted, ensureFilesystem bool, filesystem string) (err error)
	EnforceMountBlockDevicePolicy(ctx context.Context, target string) (err error)
	EnforceDeviceUnmountPolicy(ctx context.Context, unmountTarget string) (err error)
	EnforceRWDeviceUnmountPolicy(ctx context.Context, unmountTarget string) (err error)
	EnforceUnmountBlockDevicePolicy(ctx context.Context, unmountTarget string) (err error)
	EnforceOverlayMountPolicy(ctx context.Context, containerID string, layerPaths []string, target string) (err error)
	EnforceOverlayUnmountPolicy(ctx context.Context, target string) (err error)
	EnforceCreateContainerPolicy(
		ctx context.Context,
		sandboxID string,
		containerID string,
		argList []string,
		envList []string,
		workingDir string,
		mounts []oci.Mount,
		privileged bool,
		noNewPrivileges bool,
		user IDName,
		groups []IDName,
		umask string,
		capabilities *oci.LinuxCapabilities,
		seccompProfileSHA256 string,
	) (EnvList, *oci.LinuxCapabilities, bool, error)
	EnforceCreateContainerPolicyV2(
		ctx context.Context,
		containerID string,
		argList []string,
		envList []string,
		workingDir string,
		mounts []oci.Mount,
		user IDName,
		opts *CreateContainerOptions,
	) (EnvList, *oci.LinuxCapabilities, bool, error)
	ExtendDefaultMounts([]oci.Mount) error
	EncodedSecurityPolicy() string
	EnforceExecInContainerPolicy(
		ctx context.Context,
		containerID string,
		argList []string,
		envList []string,
		workingDir string,
		noNewPrivileges bool,
		user IDName,
		groups []IDName,
		umask string,
		capabilities *oci.LinuxCapabilities,
	) (EnvList, *oci.LinuxCapabilities, bool, error)
	EnforceExecInContainerPolicyV2(
		ctx context.Context,
		containerID string,
		argList []string,
		envList []string,
		workingDir string,
		user IDName,
		opts *ExecOptions,
	) (EnvList, *oci.LinuxCapabilities, bool, error)
	EnforceExecExternalProcessPolicy(ctx context.Context, argList []string, envList []string, workingDir string) (EnvList, bool, error)
	EnforceShutdownContainerPolicy(ctx context.Context, containerID string) error
	EnforceSignalContainerProcessPolicy(ctx context.Context, containerID string, signal syscall.Signal, isInitProcess bool, startupArgList []string) error
	EnforceSignalContainerProcessPolicyV2(ctx context.Context, containerID string, opts *SignalContainerOptions) error
	EnforcePlan9MountPolicy(ctx context.Context, target string) (err error)
	EnforcePlan9UnmountPolicy(ctx context.Context, target string) (err error)
	EnforceGetPropertiesPolicy(ctx context.Context) error
	EnforceDumpStacksPolicy(ctx context.Context) error
	EnforceRuntimeLoggingPolicy(ctx context.Context) (err error)
	EnforceHostNetworkPolicy(ctx context.Context) error
	LoadFragment(ctx context.Context, opts LoadFragmentOptions) error
	LoadTransparencyTrustList(ctx context.Context, opts LoadTransparencyTrustListOptions) error
	EnforceScratchMountPolicy(ctx context.Context, scratchPath string, encrypted bool) (err error)
	EnforceScratchUnmountPolicy(ctx context.Context, scratchPath string) (err error)
	GetUserInfo(spec *oci.Process, rootPath string) (IDName, []IDName, string, error)
	EnforceVerifiedCIMsPolicy(ctx context.Context, containerID string, layerHashes []string, mountedCim []string) (err error)
	EnforceRegistryChangesPolicy(ctx context.Context, containerID string, registryValues interface{}) error
	// EnforceLogProviderPolicy validates a batch of requested ETW provider
	// names against the policy's allowed_log_providers list. It returns the
	// subset of provider names that the caller should forward to the inbox
	// GCS, plus any policy error. When the policy has
	// allow_log_provider_dropping := true, providers not on the allow-list are
	// silently dropped from the returned slice; otherwise the whole call is
	// denied (returning a non-nil error) if any provider is not allowed.
	EnforceLogProviderPolicy(ctx context.Context, providerNames []string) ([]string, error)
	WithMetadataRollback(fn func() error) error
}

type SignalContainerOptions struct {
	IsInitProcess bool
	// One of these will be set depending on platform
	LinuxSignal   syscall.Signal
	WindowsSignal guestrequest.SignalValueWCOW

	LinuxStartupArgs []string
	WindowsCommand   []string
}

type StringArrayMap struct {
	Length   int               `json:"length"`
	Elements map[string]string `json:"elements"`
}

type UserConfig struct {
	UserIDName   IDNameConfig   `json:"user_idname" toml:"user_idname"`
	GroupIDNames []IDNameConfig `json:"group_idnames" toml:"group_idname"`
	Umask        string         `json:"umask" toml:"umask"`
}

type WindowsContainer struct {
	Command          CommandArgs                    `json:"command"`
	EnvRules         EnvRules                       `json:"env_rules"`
	Layers           Layers                         `json:"layers"`
	MountedCim       []string                       `json:"mounted_cim"`
	WorkingDir       string                         `json:"working_dir"`
	ExecProcesses    []WindowsExecProcessConfig     `json:"-"`
	Signals          []guestrequest.SignalValueWCOW `json:"-"`
	AllowStdioAccess bool                           `json:"-"`
	User             string                         `json:"-"`
}

type WindowsContainerConfig struct {
	ImageName        string                         `json:"image_name" toml:"image_name"`
	Auth             AuthConfig                     `json:"auth" toml:"auth"`
	Command          []string                       `json:"command" toml:"command"`
	EnvRules         []EnvRuleConfig                `json:"env_rules" toml:"env_rule"`
	WorkingDir       string                         `json:"working_dir" toml:"working_dir"`
	ExecProcesses    []WindowsExecProcessConfig     `json:"exec_processes" toml:"exec_process"`
	Signals          []guestrequest.SignalValueWCOW `json:"signals" toml:"signals"`
	AllowStdioAccess bool                           `json:"allow_stdio_access" toml:"allow_stdio_access"`
	User             string                         `json:"user" toml:"user"`
}

type WindowsContainerConfigOpt func(config *WindowsContainerConfig) error

type WindowsContainers struct {
	Length   int                         `json:"length"`
	Elements map[string]WindowsContainer `json:"elements"`
}

type WindowsExecProcessConfig struct {
	Command string                         `json:"command" toml:"command"`
	Signals []guestrequest.SignalValueWCOW `json:"signals" toml:"signals"`
}