Documentation
¶
Overview ¶
Package permission implements glob-based command permission checking.
Matching semantics ¶
Rules are evaluated against three normalized projections of every shell command found anywhere in the input — including pipelines, command substitution ($(...) / `...`), process substitution (<(...) / >(...)), arithmetic expansion ($((...))), and redirect targets:
- The full normalized command (env-prefix included), e.g. "KUBECONFIG=x kubectl get pods".
- The same command with leading variable assignments stripped, e.g. "kubectl get pods". This prevents trivial bypass via env prefix and prevents false-deny when a rule lists only the program form.
- Redirect targets are projected as synthetic commands (">/path", ">>/path", "&>/path", "&>>/path", ">|/path") so that rules can gate writes the same way they gate executions. Read redirects (<, <<, <<<, <>, here-docs) are not checked beyond their inner command (here-doc body and here-string undergo expansion).
Both rule patterns and the command projections are run through the shell printer's canonical formatter, so "kubectl get pods" matches the rule "kubectl get pods" regardless of spacing.
Precedence ¶
Rules are evaluated in specificity order, and the first match wins. Specificity is "longer literal prefix before any '*' wins"; the catch-all "*" is always tried last. A deny rule that matches first beats a more general allow rule, and vice-versa.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultRules ¶
DefaultRules returns a set of default rules that trust model capabilities.
func KubernetesReadOnlyRules ¶
KubernetesReadOnlyRules returns rules for read-only Kubernetes operations.
func SafeReadOnlyRules ¶
SafeReadOnlyRules returns rules that allow common read-only operations.
Notably absent compared to a naive list:
- "find *" — allowed `find . -delete` and `find . -exec rm`. Specific safe variants are listed instead, none of which can mutate state.
- "echo *" — allowed `echo x > /etc/passwd`. Write redirects are now gated by checkRedirect, but plain "echo" is rarely needed for diagnostics, so it is dropped to stay tight by default.
Write redirects are denied unless an explicit allow rule for the synthetic "> target" form is added (e.g. "> /tmp/*").
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker checks command permissions against configured rules.
func NewChecker ¶
NewChecker creates a new permission checker from a map of patterns to actions. Rules are sorted so that the most specific rule (longest literal prefix before any '*') is tried first; "*" is always the fallback.
Source Files