accesscontrol

package
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 19, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

Package accesscontrol describes read-only security configuration and state. Neither declarations nor state snapshots are individual enforcement decisions.

Index

Constants

View Source
const StateSchema = "agentprovenance.access_control_state/v1"

Variables

This section is empty.

Functions

func ValidateSnapshot

func ValidateSnapshot(s Snapshot) error

Types

type Declaration

type Declaration struct {
	Mechanism        string  `json:"mechanism"`
	EvidenceKind     string  `json:"evidence_kind"`
	Status           string  `json:"status"`
	Source           string  `json:"source"`
	ResourceVersion  string  `json:"resource_version,omitempty"`
	ObservedAt       string  `json:"observed_at"`
	ProfileType      string  `json:"profile_type,omitempty"`
	LocalhostProfile string  `json:"localhost_profile,omitempty"`
	AnnotationValue  *string `json:"annotation_value,omitempty"`
}

Declaration records the API field that was observed, including absence. The source path and resource version refer to configuration, not kernel state.

type Options

type Options struct {
	AppArmor bool
	Seccomp  bool
}

type Snapshot

type Snapshot struct {
	SchemaVersion string       `json:"schema_version"`
	EvidenceKind  string       `json:"evidence_kind"`
	Source        string       `json:"source"`
	HostID        string       `json:"host_id,omitempty"`
	BootID        string       `json:"boot_id,omitempty"`
	StartedAt     string       `json:"started_at"`
	ObservedAt    string       `json:"observed_at"`
	Identity      TaskIdentity `json:"identity"`
	AppArmor      State        `json:"apparmor"`
	Seccomp       State        `json:"seccomp"`
}

func ReadTask

func ReadTask(pid, tid int, opts Options) Snapshot

ReadTask pins a procfs task directory for the duration of the read, avoiding reopening a reused numeric PID between files. Its identity is procfs-native; it is deliberately not rewritten into a kernel-event lifetime ID.

type State

type State struct {
	Status      string `json:"status"`
	Source      string `json:"source,omitempty"`
	Reason      string `json:"reason,omitempty"`
	Label       string `json:"label,omitempty"`
	Mode        string `json:"mode,omitempty"`
	ModeNumber  *int   `json:"mode_number,omitempty"`
	FilterCount *int   `json:"filter_count,omitempty"`
	NoNewPrivs  *int   `json:"no_new_privs,omitempty"`
}

type TaskIdentity

type TaskIdentity struct {
	Status       string `json:"status"`
	Reason       string `json:"reason,omitempty"`
	PID          int    `json:"pid"`
	TID          int    `json:"tid"`
	StartTicks   string `json:"start_ticks,omitempty"`
	PIDNamespace string `json:"pid_namespace,omitempty"`
	CgroupID     string `json:"cgroup_id,omitempty"`
	CgroupPath   string `json:"cgroup_path,omitempty"`
	CgroupReason string `json:"cgroup_reason,omitempty"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL