Documentation
¶
Overview ¶
Package cliutil holds tiny env/flag helpers shared by Wardyn's cmd/* main packages, plus ScrubChildEnv, the one env denylist shared by every host-exec'd third-party CLI child.
Index ¶
- Constants
- func CheckSSHProxyCommand(v string) error
- func CheckSecretFileMode(setting, path string, perm os.FileMode, owner, euid int) error
- func EnvAlias(newEnv, oldEnv string) (aliased, ignored bool)
- func EnvBool(name string, def bool) bool
- func EnvDuration(name string, def time.Duration) time.Duration
- func EnvOr(key, def string) string
- func FlagBool(name, env string, def bool, usage string) *bool
- func FlagDuration(name, env string, def time.Duration, usage string) *time.Duration
- func FlagEnv(name, env, def, usage string) *string
- func FlagIntEnv(name, env string, def int, usage string) *int
- func ReadSecretFile(setting, path string) ([]byte, error)
- func ScrubChildEnv(env []string) []string
- func SplitCSV(s string) []string
Constants ¶
const MaxSSHProxyCommandBytes = 512
MaxSSHProxyCommandBytes bounds WARDYN_SSH_PROXY_COMMAND.
Variables ¶
This section is empty.
Functions ¶
func CheckSSHProxyCommand ¶ added in v0.8.8
CheckSSHProxyCommand is the one rule for an advertised SSH ProxyCommand, shared by wardynd's boot refusal and the CLI's refusal of a value a skewed daemon publishes anyway. The value is pasted inside single quotes into a shell one-liner and onto one ssh_config line, so a single quote, a newline or any other control character would break out of either.
func CheckSecretFileMode ¶ added in v0.8.0
CheckSecretFileMode is the mode rule, split out so every delivery shape is testable without chown. owner is the file's uid (-1 when unknown).
Group- or world-WRITABLE is always refused: anyone in that set could swap the secret before the next read, and no supported delivery produces it.
Other-READABLE is refused only on a file the process's own non-root uid owns — the hand-made host file, which `chmod 640` fixes. It stays allowed everywhere a supported mechanism produces it, which is why this differs from WARDYN_DAEMON_PROXY_SECRET's 0600 rule: a Secret volume is root-owned 0440 (group-read added by the kubelet under the chart's fsGroup), a Secrets Store CSI file is root-owned 0644 and reachable by a non-root reader only through the other-read bit, and Vault Agent writes 0644 as its own uid by default.
func EnvAlias ¶ added in v0.8.0
EnvAlias lets a deprecated env var name go on working for one deprecation window while a new name takes over. Empty counts as unset for both. If newEnv is unset and oldEnv set, copies oldEnv into newEnv and reports aliased. If both are set, newEnv wins; a differing value reports ignored, since a dropped old value can be a longer deny list the operator still believes is in force. Must run before ANY flag parse or other read of either name.
func EnvBool ¶ added in v0.3.1
EnvBool reads a bool directly from an env var, no flag registered, for sites after flag.Parse(). Same token set and loudness contract as FlagBool.
func EnvDuration ¶ added in v0.3.1
EnvDuration is the non-flag twin of FlagDuration for post-flag.Parse() sites.
func FlagBool ¶
FlagBool defines a bool flag whose default is overridden by an env var. 1/true/yes/on is true, 0/false/no/off is false (case-insensitive, trimmed); unset/empty keeps the default. Anything else exits 2 — a value that's neither truthy nor falsey states no intent this helper can honor.
func FlagDuration ¶
FlagDuration defines a time.Duration flag whose default is overridden by an env var. Unset/empty keeps the default; an unparseable value exits 2 rather than silently reinstating it.
func FlagEnv ¶
FlagEnv defines a string flag whose default is overridden by an env var. Unset/empty keeps the default; the escape hatch for a genuinely-intended blank is `-name=`.
SECURITY: the env value is applied to the flag's VARIABLE, never its registered DEFAULT — PrintDefaults renders a non-empty default as `(default "…")` on every parse error, so seeding the default from the env would write secrets like WARDYN_AGE_KEY verbatim to stderr on one typo'd flag. Writing through the returned pointer keeps the same precedence while usage shows only the compiled default.
func FlagIntEnv ¶
FlagIntEnv defines an int flag whose default is overridden by an env var. Unset/empty keeps the default; an unparseable value exits 2 (see FlagDuration).
func ReadSecretFile ¶ added in v0.8.0
ReadSecretFile reads the secret file path that setting names and returns its raw bytes; each caller trims them its own way. The mode is checked on the OPENED descriptor (CheckSecretFileMode), so the file checked is the file read, however often the caller re-reads a rotated file. Every error names setting and path, never the content.
func ScrubChildEnv ¶ added in v0.4.4
ScrubChildEnv returns env, without mutating the input, minus variables a third-party CLI child must never receive: ANTHROPIC_API_KEY and every WARDYN_* (the daemon's own config, including secrets like WARDYN_AGE_KEY and WARDYN_ADMIN_TOKEN).
Denylist, not allowlist: these children legitimately need whatever HTTPS_PROXY/NO_PROXY/AWS_* the shell carries, and a prefix covers every future WARDYN_* secret for free.
SECURITY, HONEST RESIDUAL: defense-in-depth and consistency, NOT containment — a host-exec'd child runs as the same uid as wardynd and can read /proc/<ppid>/environ regardless. One documented exception (enforced by childenv_guard_test.go): `docker compose config` in supportbundle.go, whose output goes through redactSecrets first.
Types ¶
This section is empty.
Source Files