Documentation
¶
Overview ¶
Package accesscontrol describes read-only security configuration and state. Neither declarations nor state snapshots are individual enforcement decisions.
Index ¶
Constants ¶
View Source
const StateSchema = "agentprovenance.access_control_state/v1"
Variables ¶
This section is empty.
Functions ¶
func ValidateSnapshot ¶
Types ¶
type Declaration ¶
type Declaration struct {
Mechanism string `json:"mechanism"`
EvidenceKind string `json:"evidence_kind"`
Status string `json:"status"`
Source string `json:"source"`
ResourceVersion string `json:"resource_version,omitempty"`
ObservedAt string `json:"observed_at"`
ProfileType string `json:"profile_type,omitempty"`
LocalhostProfile string `json:"localhost_profile,omitempty"`
AnnotationValue *string `json:"annotation_value,omitempty"`
}
Declaration records the API field that was observed, including absence. The source path and resource version refer to configuration, not kernel state.
type Snapshot ¶
type Snapshot struct {
SchemaVersion string `json:"schema_version"`
EvidenceKind string `json:"evidence_kind"`
Source string `json:"source"`
HostID string `json:"host_id,omitempty"`
BootID string `json:"boot_id,omitempty"`
StartedAt string `json:"started_at"`
ObservedAt string `json:"observed_at"`
Identity TaskIdentity `json:"identity"`
AppArmor State `json:"apparmor"`
Seccomp State `json:"seccomp"`
}
type State ¶
type State struct {
Status string `json:"status"`
Source string `json:"source,omitempty"`
Reason string `json:"reason,omitempty"`
Label string `json:"label,omitempty"`
Mode string `json:"mode,omitempty"`
ModeNumber *int `json:"mode_number,omitempty"`
FilterCount *int `json:"filter_count,omitempty"`
NoNewPrivs *int `json:"no_new_privs,omitempty"`
}
type TaskIdentity ¶
type TaskIdentity struct {
Status string `json:"status"`
Reason string `json:"reason,omitempty"`
PID int `json:"pid"`
TID int `json:"tid"`
StartTicks string `json:"start_ticks,omitempty"`
PIDNamespace string `json:"pid_namespace,omitempty"`
CgroupID string `json:"cgroup_id,omitempty"`
CgroupPath string `json:"cgroup_path,omitempty"`
CgroupReason string `json:"cgroup_reason,omitempty"`
}
Click to show internal directories.
Click to hide internal directories.