Documentation
¶
Overview ¶
Package account resolves a person to the system account a worker runs as: a uid, a primary gid and supplementary gids (docs/identity.md). It is the launcher's: the front never names a uid, it names a person, and this decides what that person is on this system -- or refuses.
The order: the directory first, through the attributes it already carries (uidNumber and gidNumber, RFC 2307, from the configuration file, LDAP or SQL alike; supplementary groups from the person's groups' gidNumber); then /etc/passwd and /etc/group by name. Nothing else: an identity provider's token carries no uid (OIDC Core §5.1 has no such claim), and none is guessed from a name.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrNoAccount: the person has no system account here -- neither the // directory nor /etc/passwd knows one. They are refused (docs/identity.md). ErrNoAccount = errors.New("no system account") // ErrRefused: the account exists, and the policy forbids running as it. ErrRefused = errors.New("refused by the identity policy") )
var DefaultPolicy = Policy{MinUID: 1000, MinGID: 1000}
DefaultPolicy is min_uid = min_gid = 1000, nothing else denied.
Functions ¶
Types ¶
type Account ¶
type Account struct {
Name string
UID uint32
GID uint32 // primary
Groups []uint32 // supplementary, the primary included, sorted, no duplicates
From string // where it was found: "the directory" or "/etc/passwd"
// Dropped are supplementary gids below the policy's MinGID, left out.
Dropped []uint32
}
Account is what a worker runs as.
type Passwd ¶
Passwd looks a name up in /etc/passwd and /etc/group: os/user, which with CGO_ENABLED=0 reads those two files on Linux and the BSDs, and asks the system on macOS -- never NSS, sssd or winbind.
type Policy ¶
type Policy struct {
// MinUID and MinGID: a uid or a primary gid below these is refused; a
// supplementary gid below MinGID is dropped (Account.Dropped).
MinUID, MinGID uint32
// DenyUIDs are refused whatever their value.
DenyUIDs []uint32
}
Policy says which accounts a worker may never run as.
type Resolver ¶
type Resolver struct {
// Find is the directory's identity of name, or nil if it has none.
Find func(name string) (*directory.Identity, error)
// GroupGID is the gidNumber of one of the person's directory groups;
// ok is false for a group that has none (it is no system group).
GroupGID func(group string) (gid uint32, ok bool, err error)
// MemberOf is the directory's groups that list name as a member (a
// configuration's group block, RFC 2307 memberUid). They are added to
// the groups the identity itself names (memberOf): a source says one or
// the other, and either makes a supplementary group. Nil asks nothing.
MemberOf func(name string) ([]string, error)
Passwd Passwd
Policy Policy
}
Resolver resolves names against a directory, then a Passwd.
Source Files