Documentation
¶
Overview ¶
Package accesschk parses the text output of the Sysinternals AccessChk tool (https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk) into a structured representation. AccessChk has no machine-readable output mode, so the parser is intentionally tolerant: anything it cannot recognize is preserved verbatim and, for inputs below RawRetentionLimit, the full original text is retained in Raw so a policy can fall back to string matching regardless of the output mode used.
Parse reads from an io.Reader and streams the input line by line rather than buffering the whole material in memory or building a normalized full-text copy, and it size-gates the verbatim fallback fields (Raw and the per-object RawLines). Together these keep peak memory bounded: a large material would otherwise pin multiple copies of itself in memory and inflate the JSON document handed to the policy engine to multiples of the input size.
Index ¶
Constants ¶
const RawRetentionLimit = 10 * 1024 * 1024 // 10 MiB
RawRetentionLimit is the maximum input size (in bytes) for which Parse retains the verbatim fallback fields Raw and RawLines. Above it these fields are omitted: they are not part of the attestation (only the original file's digest is attested) and no policy reads them, so trimming them for oversized inputs does not change the recorded evidence or any current evaluation — it only prevents the transient JSON projection handed to the policy engine from ballooning to multiples of the original file size.
const ToolName = "AccessChk"
ToolName is the canonical tool name recorded for AccessChk materials.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ACE ¶
type ACE struct {
Index int `json:"index"`
AceType string `json:"ace_type,omitempty"`
Principal string `json:"principal"`
AceFlags []string `json:"ace_flags"`
Rights []string `json:"rights"`
}
ACE is a single access control entry from a security descriptor reported by the -l output mode (DACL or SACL).
type AccessEntry ¶
type AccessEntry struct {
Access string `json:"access"`
Principal string `json:"principal"`
Rights []string `json:"rights"`
}
AccessEntry is a single principal and the access it was granted on an object, as reported by the compact default (R/W) output mode.
type Object ¶
type Object struct {
Name string `json:"name"`
DescriptorFlags []string `json:"descriptor_flags,omitempty"`
Owner string `json:"owner,omitempty"`
DACL []ACE `json:"dacl,omitempty"`
SACL []ACE `json:"sacl,omitempty"`
AccessEntries []AccessEntry `json:"access_entries"`
RawLines []string `json:"raw_lines"`
}
Object is a single securable object reported by AccessChk.
AccessEntries is populated by the compact default mode; DescriptorFlags, Owner, DACL and SACL are populated by the -l (full security descriptor) mode. RawLines always holds every indented line verbatim regardless of mode.
type Report ¶
type Report struct {
Tool Tool `json:"tool"`
Objects []Object `json:"objects"`
Raw string `json:"raw"`
// contains filtered or unexported fields
}
Report is the structured projection of an AccessChk run.
Raw holds the full original text for inputs below RawRetentionLimit and is empty otherwise; descriptorMarker records whether an SDDL/descriptor marker was seen during parsing so LooksLikeAccessChk stays reliable even when Raw is omitted for oversized inputs. rawOmitted records whether the verbatim fallback fields were dropped because the input exceeded RawRetentionLimit, so callers can warn without knowing the input size upfront (see RawOmitted).
func Parse ¶
Parse converts AccessChk text output read from r into a Report. It streams r and never buffers the whole input, so it can parse a file handle directly without an intermediate full-file copy. It only returns an error when the input is not valid UTF-8 text or r fails; well-formed text always parses, with any unrecognized content preserved in the per-object RawLines and the top-level Raw field for inputs below RawRetentionLimit (see the package doc).
func (*Report) LooksLikeAccessChk ¶
LooksLikeAccessChk reports whether the parsed report resembles genuine AccessChk output. It is deliberately lenient: a recognizable banner, at least one parsed access entry, or an SDDL/descriptor marker is enough.
func (*Report) RawOmitted ¶ added in v1.106.0
RawOmitted reports whether the verbatim fallback fields (Raw and the per-object RawLines) were dropped because the input exceeded RawRetentionLimit. It lets a streaming caller warn about the omission without measuring the input itself.
Source Files