Documentation
¶
Overview ¶
Package accesschk parses the text output of the Sysinternals AccessChk tool (https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk) into a structured representation. AccessChk has no machine-readable output mode, so the parser is intentionally tolerant: anything it cannot recognize is preserved verbatim and, for inputs below RawRetentionLimit, the full original text is retained in Raw so a policy can fall back to string matching regardless of the output mode used.
The parser streams the input line by line rather than building a normalized full-text copy, and it size-gates the verbatim fallback fields (Raw and the per-object RawLines). Both measures keep peak memory bounded: a several-hundred-MB material would otherwise pin multiple copies of itself in memory and double the JSON document handed to the policy engine, which has OOM-killed CI runners during client-side policy evaluation.
Index ¶
Constants ¶
const RawRetentionLimit = 10 * 1024 * 1024 // 10 MiB
RawRetentionLimit is the maximum input size (in bytes) for which Parse retains the verbatim fallback fields Raw and RawLines. Above it these fields are omitted: they are not part of the attestation (only the original file's digest is attested) and no policy reads them, so trimming them for oversized inputs does not change the recorded evidence or any current evaluation — it only prevents the transient JSON projection handed to the policy engine from ballooning to multiples of the original file size.
const ToolName = "AccessChk"
ToolName is the canonical tool name recorded for AccessChk materials.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ACE ¶
type ACE struct {
Index int `json:"index"`
AceType string `json:"ace_type,omitempty"`
Principal string `json:"principal"`
AceFlags []string `json:"ace_flags"`
Rights []string `json:"rights"`
}
ACE is a single access control entry from a security descriptor reported by the -l output mode (DACL or SACL).
type AccessEntry ¶
type AccessEntry struct {
Access string `json:"access"`
Principal string `json:"principal"`
Rights []string `json:"rights"`
}
AccessEntry is a single principal and the access it was granted on an object, as reported by the compact default (R/W) output mode.
type Object ¶
type Object struct {
Name string `json:"name"`
DescriptorFlags []string `json:"descriptor_flags,omitempty"`
Owner string `json:"owner,omitempty"`
DACL []ACE `json:"dacl,omitempty"`
SACL []ACE `json:"sacl,omitempty"`
AccessEntries []AccessEntry `json:"access_entries"`
RawLines []string `json:"raw_lines"`
}
Object is a single securable object reported by AccessChk.
AccessEntries is populated by the compact default mode; DescriptorFlags, Owner, DACL and SACL are populated by the -l (full security descriptor) mode. RawLines always holds every indented line verbatim regardless of mode.
type Report ¶
type Report struct {
Tool Tool `json:"tool"`
Objects []Object `json:"objects"`
Raw string `json:"raw"`
// contains filtered or unexported fields
}
Report is the structured projection of an AccessChk run.
Raw holds the full original text for inputs below RawRetentionLimit and is empty otherwise; descriptorMarker records whether an SDDL/descriptor marker was seen during parsing so LooksLikeAccessChk stays reliable even when Raw is omitted for oversized inputs.
func Parse ¶
Parse converts AccessChk text output into a Report. It only returns an error when the input is not valid UTF-8 text; well-formed text always parses, with any unrecognized content preserved in the per-object RawLines and the top-level Raw field for inputs below RawRetentionLimit (see the package doc).
func (*Report) LooksLikeAccessChk ¶
LooksLikeAccessChk reports whether the parsed report resembles genuine AccessChk output. It is deliberately lenient: a recognizable banner, at least one parsed access entry, or an SDDL/descriptor marker is enough.
Source Files