securitypolicy

Jul 20, 2023

Changes in this version

+ const HostAMDCertFilename

+ const PolicyFilename

+ const ReferenceInfoFilename

+ const SecurityContextDirTemplate

+ var APICode = strings.Replace(apiCodeTemplate, "@@API_VERSION@@", apiVersion, 1)

+ var ErrInvalidOpenDoorPolicy = errors.New("allow_all cannot be set to 'true' when Containers are non-empty")

+ var FrameworkCode = strings.Replace(frameworkCodeTemplate, "@@FRAMEWORK_VERSION@@", frameworkVersion, 1)

+ func DefaultPrivilegedCapabilities() []string

+ func DefaultUnprivilegedCapabilities() []string

+ func EmptyCapabiltiesSet() []string

+ func ExtractPolicyDecision(errorMessage string) (string, error)

+ func MarshalFragment(namespace string, svn string, containers []*Container, ...) (string, error)

+ func MarshalPolicy(marshaller string, allowAll bool, containers []*Container, ...) (string, error)

+ func MeasureSeccompProfile(seccomp *specs.LinuxSeccomp) (string, error)

+ func NewSecurityPolicyDigest(base64policy string) ([]byte, error)

+ func WithPrivilegedMounts(mounts []oci.Mount) standardEnforcerOpt — linux/amd64

+ type AuthConfig struct

+ Password string

+ Username string

+ type CapabilitiesConfig struct

+ Ambient []string

+ Bounding []string

+ Effective []string

+ Inheritable []string

+ Permitted []string

type ClosedDoorSecurityPolicyEnforcer — linux/amd64

+ func (*ClosedDoorSecurityPolicyEnforcer) EnforcePlan9MountPolicy(context.Context, string) error

+ func (*ClosedDoorSecurityPolicyEnforcer) EnforcePlan9UnmountPolicy(context.Context, string) error

+ func (*ClosedDoorSecurityPolicyEnforcer) EnforceShutdownContainerPolicy(context.Context, string) error

+ func (*ClosedDoorSecurityPolicyEnforcer) EnforceSignalContainerProcessPolicy(context.Context, string, syscall.Signal, bool, []string) error

+ func (ClosedDoorSecurityPolicyEnforcer) EncodedSecurityPolicy() string

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceDumpStacksPolicy(context.Context) error

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceExecExternalProcessPolicy(context.Context, []string, []string, string) (EnvList, bool, error)

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceExecInContainerPolicy(context.Context, string, []string, []string, string, bool, IDName, []IDName, ...) (EnvList, *oci.LinuxCapabilities, bool, error)

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceGetPropertiesPolicy(context.Context) error

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceOverlayUnmountPolicy(context.Context, string) error

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceRuntimeLoggingPolicy(context.Context) error

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceScratchMountPolicy(context.Context, string, bool) error

+ func (ClosedDoorSecurityPolicyEnforcer) EnforceScratchUnmountPolicy(context.Context, string) error

+ func (ClosedDoorSecurityPolicyEnforcer) ExtendDefaultMounts(_ []oci.Mount) error

+ func (ClosedDoorSecurityPolicyEnforcer) GetUserInfo(containerID string, spec *oci.Process) (IDName, []IDName, string, error)

+ func (ClosedDoorSecurityPolicyEnforcer) LoadFragment(context.Context, string, string, string) error

type Container

+ AllowElevated bool

+ AllowStdioAccess bool

+ Capabilities *CapabilitiesConfig

+ ExecProcesses []ExecProcessConfig

+ Mounts Mounts

+ NoNewPrivileges bool

+ SeccompProfileSHA256 string

+ Signals []syscall.Signal

+ User UserConfig

+ WorkingDir string

+ func CreateContainerPolicy(command, layers []string, envRules []EnvRuleConfig, workingDir string, ...) (*Container, error)

+ type ContainerConfig struct

+ AllowElevated bool

+ AllowPrivilegeEscalation bool

+ AllowStdioAccess bool

+ Auth AuthConfig

+ Capabilities *CapabilitiesConfig

+ Command []string

+ EnvRules []EnvRuleConfig

+ ExecProcesses []ExecProcessConfig

+ ImageName string

+ Mounts []MountConfig

+ SeccompProfilePath string

+ Signals []syscall.Signal

+ User *UserConfig

+ WorkingDir string

+ type ContainerConfigOpt func(config *ContainerConfig) error

+ func WithAllowElevated(elevated bool) ContainerConfigOpt

+ func WithAllowPrivilegeEscalation(allow bool) ContainerConfigOpt

+ func WithAllowStdioAccess(stdio bool) ContainerConfigOpt

+ func WithCapabilities(capabilities *CapabilitiesConfig) ContainerConfigOpt

+ func WithCommand(cmd []string) ContainerConfigOpt

+ func WithEnvVarRules(envs []EnvRuleConfig) ContainerConfigOpt

+ func WithExecProcesses(execs []ExecProcessConfig) ContainerConfigOpt

+ func WithMountConstraints(mc []MountConfig) ContainerConfigOpt

+ func WithSeccompProfilePath(path string) ContainerConfigOpt

+ func WithUser(user UserConfig) ContainerConfigOpt

+ func WithWorkingDir(wd string) ContainerConfigOpt

+ type EnvList []string — linux/amd64

+ type EnvRuleConfig struct

+ Required bool

+ Rule string

+ Strategy EnvVarRule

+ func NewEnvVarRules(envVars []string, required bool) []EnvRuleConfig

+ type ExecProcessConfig struct

+ Command []string

+ Signals []syscall.Signal

+ type ExternalProcessConfig struct

+ AllowStdioAccess bool

+ Command []string

+ WorkingDir string

+ type FragmentConfig struct

+ Feed string

+ Includes []string

+ Issuer string

+ MinimumSVN string

+ type IDName struct

+ ID string

+ Name string

+ type IDNameConfig struct

+ Rule string

+ Strategy IDNameStrategy

+ type IDNameStrategy string

+ const IDNameStrategyAny

+ const IDNameStrategyID

+ const IDNameStrategyName

+ const IDNameStrategyRegex

+ type Mount struct

+ Destination string

+ Options Options

+ Source string

+ Type string

+ type MountConfig struct

+ ContainerPath string

+ HostPath string

+ Readonly bool

+ type Mounts struct

+ Elements map[string]Mount

+ Length int

+ func (m Mounts) MarshalJSON() ([]byte, error)

type OpenDoorSecurityPolicyEnforcer — linux/amd64

+ func (*OpenDoorSecurityPolicyEnforcer) EnforcePlan9MountPolicy(context.Context, string) error

+ func (*OpenDoorSecurityPolicyEnforcer) EnforcePlan9UnmountPolicy(context.Context, string) error

+ func (*OpenDoorSecurityPolicyEnforcer) EnforceShutdownContainerPolicy(context.Context, string) error

+ func (*OpenDoorSecurityPolicyEnforcer) EnforceSignalContainerProcessPolicy(context.Context, string, syscall.Signal, bool, []string) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceDumpStacksPolicy(context.Context) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceExecExternalProcessPolicy(_ context.Context, _ []string, envList []string, _ string) (EnvList, bool, error)

+ func (OpenDoorSecurityPolicyEnforcer) EnforceExecInContainerPolicy(_ context.Context, _ string, _ []string, envList []string, _ string, _ bool, ...) (EnvList, *oci.LinuxCapabilities, bool, error)

+ func (OpenDoorSecurityPolicyEnforcer) EnforceGetPropertiesPolicy(context.Context) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceOverlayUnmountPolicy(context.Context, string) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceRuntimeLoggingPolicy(context.Context) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceScratchMountPolicy(context.Context, string, bool) error

+ func (OpenDoorSecurityPolicyEnforcer) EnforceScratchUnmountPolicy(context.Context, string) error

+ func (OpenDoorSecurityPolicyEnforcer) ExtendDefaultMounts([]oci.Mount) error

+ func (OpenDoorSecurityPolicyEnforcer) GetUserInfo(containerID string, spec *oci.Process) (IDName, []IDName, string, error)

+ func (OpenDoorSecurityPolicyEnforcer) LoadFragment(context.Context, string, string, string) error

+ func (oe *OpenDoorSecurityPolicyEnforcer) EncodedSecurityPolicy() string

+ type Options StringArrayMap

+ func (o Options) MarshalJSON() ([]byte, error)

+ type PolicyConfig struct

+ AllowAll bool

+ AllowCapabilityDropping bool

+ AllowDumpStacks bool

+ AllowEnvironmentVariableDropping bool

+ AllowPropertiesAccess bool

+ AllowRuntimeLogging bool

+ AllowUnencryptedScratch bool

+ Containers []ContainerConfig

+ ExternalProcesses []ExternalProcessConfig

+ Fragments []FragmentConfig

+ func NewPolicyConfig(opts ...PolicyConfigOpt) (*PolicyConfig, error)

+ type PolicyConfigOpt func(config *PolicyConfig) error

+ func WithAllowCapabilityDropping(allow bool) PolicyConfigOpt

+ func WithAllowDumpStacks(allow bool) PolicyConfigOpt

+ func WithAllowEnvVarDropping(allow bool) PolicyConfigOpt

+ func WithAllowPropertiesAccess(allow bool) PolicyConfigOpt

+ func WithAllowRuntimeLogging(allow bool) PolicyConfigOpt

+ func WithAllowUnencryptedScratch(allow bool) PolicyConfigOpt

+ func WithContainers(containers []ContainerConfig) PolicyConfigOpt

+ func WithExternalProcesses(processes []ExternalProcessConfig) PolicyConfigOpt

type SecurityPolicy

+ func NewOpenDoorPolicy() *SecurityPolicy

+ func NewSecurityPolicy(allowAll bool, containers []*Container) *SecurityPolicy

+ func (sp *SecurityPolicy) EncodeToString() (string, error)

type SecurityPolicyEnforcer — linux/amd64

+ func CreateSecurityPolicyEnforcer(enforcer string, base64EncodedPolicy string, ...) (SecurityPolicyEnforcer, error)

+ EncodedSecurityPolicy func() string

+ EnforceDumpStacksPolicy func(ctx context.Context) error

+ EnforceExecExternalProcessPolicy func(ctx context.Context, argList []string, envList []string, workingDir string) (EnvList, bool, error)

+ EnforceExecInContainerPolicy func(ctx context.Context, containerID string, argList []string, envList []string, ...) (EnvList, *oci.LinuxCapabilities, bool, error)

+ EnforceGetPropertiesPolicy func(ctx context.Context) error

+ EnforceOverlayUnmountPolicy func(ctx context.Context, target string) (err error)

+ EnforcePlan9MountPolicy func(ctx context.Context, target string) (err error)

+ EnforcePlan9UnmountPolicy func(ctx context.Context, target string) (err error)

+ EnforceRuntimeLoggingPolicy func(ctx context.Context) (err error)

+ EnforceScratchMountPolicy func(ctx context.Context, scratchPath string, encrypted bool) (err error)

+ EnforceScratchUnmountPolicy func(ctx context.Context, scratchPath string) (err error)

+ EnforceShutdownContainerPolicy func(ctx context.Context, containerID string) error

+ EnforceSignalContainerProcessPolicy func(ctx context.Context, containerID string, signal syscall.Signal, ...) error

+ ExtendDefaultMounts func([]oci.Mount) error

+ GetUserInfo func(containerID string, spec *oci.Process) (IDName, []IDName, string, error)

+ LoadFragment func(ctx context.Context, issuer string, feed string, code string) error

type StandardSecurityPolicyEnforcer — linux/amd64

+ DefaultEnvs []EnvRuleConfig

+ DefaultMounts []mountInternal

+ func (*StandardSecurityPolicyEnforcer) EnforceDumpStacksPolicy(context.Context) error

+ func (*StandardSecurityPolicyEnforcer) EnforceExecExternalProcessPolicy(_ context.Context, _ []string, envList []string, _ string) (EnvList, bool, error)

+ func (*StandardSecurityPolicyEnforcer) EnforceExecInContainerPolicy(_ context.Context, _ string, _ []string, envList []string, _ string, _ bool, ...) (EnvList, *oci.LinuxCapabilities, bool, error)

+ func (*StandardSecurityPolicyEnforcer) EnforceGetPropertiesPolicy(context.Context) error

+ func (*StandardSecurityPolicyEnforcer) EnforceOverlayUnmountPolicy(context.Context, string) error

+ func (*StandardSecurityPolicyEnforcer) EnforcePlan9MountPolicy(context.Context, string) error

+ func (*StandardSecurityPolicyEnforcer) EnforcePlan9UnmountPolicy(context.Context, string) error

+ func (*StandardSecurityPolicyEnforcer) EnforceRuntimeLoggingPolicy(context.Context) error

+ func (*StandardSecurityPolicyEnforcer) EnforceShutdownContainerPolicy(context.Context, string) error

+ func (*StandardSecurityPolicyEnforcer) EnforceSignalContainerProcessPolicy(context.Context, string, syscall.Signal, bool, []string) error

+ func (*StandardSecurityPolicyEnforcer) LoadFragment(context.Context, string, string, string) error

+ func (StandardSecurityPolicyEnforcer) EnforceScratchMountPolicy(context.Context, string, bool) error

+ func (StandardSecurityPolicyEnforcer) EnforceScratchUnmountPolicy(context.Context, string) error

+ func (StandardSecurityPolicyEnforcer) GetUserInfo(containerID string, spec *oci.Process) (IDName, []IDName, string, error)

+ func (pe *StandardSecurityPolicyEnforcer) ExtendDefaultMounts(defaultMounts []oci.Mount) error

+ type StringArrayMap struct

+ Elements map[string]string

+ Length int

+ func (s StringArrayMap) MarshalJSON() ([]byte, error)

+ type UserConfig struct

+ GroupIDNames []IDNameConfig

+ Umask string

+ UserIDName IDNameConfig

Oct 6, 2021

Changes in this version

+ type ClosedDoorSecurityPolicyEnforcer struct

+ func (p *ClosedDoorSecurityPolicyEnforcer) EnforceCreateContainerPolicy(containerID string, argList []string, envList []string) (err error)

+ func (p *ClosedDoorSecurityPolicyEnforcer) EnforceDeviceMountPolicy(target string, deviceHash string) (err error)

+ func (p *ClosedDoorSecurityPolicyEnforcer) EnforceDeviceUnmountPolicy(target string) (err error)

+ func (p *ClosedDoorSecurityPolicyEnforcer) EnforceOverlayMountPolicy(containerID string, layerPaths []string) (err error)

+ type CommandArgs struct

+ Elements map[string]string

+ Length int

+ func (c CommandArgs) MarshalJSON() ([]byte, error)

+ type Container struct

+ Command CommandArgs

+ EnvRules EnvRules

+ Layers Layers

+ type Containers struct

+ Elements map[string]Container

+ Length int

+ func (c Containers) MarshalJSON() ([]byte, error)

+ type EncodedSecurityPolicy struct

+ SecurityPolicy string

+ type EnvRule struct

+ Rule string

+ Strategy EnvVarRule

+ type EnvRules struct

+ Elements map[string]EnvRule

+ Length int

+ func (e EnvRules) MarshalJSON() ([]byte, error)

+ type EnvVarRule string

+ const EnvVarRuleRegex

+ const EnvVarRuleString

+ type Layers struct

+ Elements map[string]string

+ Length int

+ func (l Layers) MarshalJSON() ([]byte, error)

+ type OpenDoorSecurityPolicyEnforcer struct

+ func (p *OpenDoorSecurityPolicyEnforcer) EnforceCreateContainerPolicy(containerID string, argList []string, envList []string) (err error)

+ func (p *OpenDoorSecurityPolicyEnforcer) EnforceDeviceMountPolicy(target string, deviceHash string) (err error)

+ func (p *OpenDoorSecurityPolicyEnforcer) EnforceDeviceUnmountPolicy(target string) (err error)

+ func (p *OpenDoorSecurityPolicyEnforcer) EnforceOverlayMountPolicy(containerID string, layerPaths []string) (err error)

+ type SecurityPolicy struct

+ AllowAll bool

+ Containers Containers

+ type SecurityPolicyEnforcer interface

+ EnforceCreateContainerPolicy func(containerID string, argList []string, envList []string) (err error)

+ EnforceDeviceMountPolicy func(target string, deviceHash string) (err error)

+ EnforceDeviceUnmountPolicy func(unmountTarget string) (err error)

+ EnforceOverlayMountPolicy func(containerID string, layerPaths []string) (err error)

+ func NewSecurityPolicyEnforcer(state SecurityPolicyState) (SecurityPolicyEnforcer, error)

+ type SecurityPolicyState struct

+ EncodedSecurityPolicy EncodedSecurityPolicy

+ func NewSecurityPolicyState(base64Policy string) (*SecurityPolicyState, error)

+ type StandardSecurityPolicyEnforcer struct

+ ContainerIndexToContainerIds map[int]map[string]struct{}

+ Containers []securityPolicyContainer

+ Devices [][]string

+ EncodedSecurityPolicy string

+ func NewStandardSecurityPolicyEnforcer(containers []securityPolicyContainer, encoded string) *StandardSecurityPolicyEnforcer

+ func (pe *StandardSecurityPolicyEnforcer) EnforceCreateContainerPolicy(containerID string, argList []string, envList []string) (err error)

+ func (pe *StandardSecurityPolicyEnforcer) EnforceDeviceMountPolicy(target string, deviceHash string) (err error)

+ func (pe *StandardSecurityPolicyEnforcer) EnforceDeviceUnmountPolicy(unmountTarget string) (err error)

+ func (pe *StandardSecurityPolicyEnforcer) EnforceOverlayMountPolicy(containerID string, layerPaths []string) (err error)