compliance

package
v0.0.0-...-551a65d Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 11, 2021 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Overview

Package compliance defines common interfaces and types for Compliance Agent

Index

Constants

View Source 
const (
	// KindInvalid is set in case resource is invalid
	KindInvalid = ResourceKind("invalid")
	// KindFile is used for a file resource
	KindFile = ResourceKind("file")
	// KindProcess is used for a Process resource
	KindProcess = ResourceKind("process")
	// KindGroup is used for a Group resource
	KindGroup = ResourceKind("group")
	// KindCommand is used for a Command resource
	KindCommand = ResourceKind("command")
	// KindDocker is used for a DockerResource resource
	KindDocker = ResourceKind("docker")
	// KindAudit is used for an Audit resource
	KindAudit = ResourceKind("audit")
	// KindKubernetes is used for a KubernetesResource
	KindKubernetes = ResourceKind("kubernetes")
	// KindCustom is used for a Custom check
	KindCustom = ResourceKind("custom")
)
View Source 
const (
	FileFieldPath        = "file.path"
	FileFieldPermissions = "file.permissions"
	FileFieldUser        = "file.user"
	FileFieldGroup       = "file.group"

	FileFuncJQ     = "file.jq"
	FileFuncYAML   = "file.yaml"
	FileFuncRegexp = "file.regexp"
)

Fields & functions available for File

View Source 
const (
	ProcessFieldName    = "process.name"
	ProcessFieldExe     = "process.exe"
	ProcessFieldCmdLine = "process.cmdLine"

	ProcessFuncFlag    = "process.flag"
	ProcessFuncHasFlag = "process.hasFlag"
)

Fields & functions available for Process

View Source 
const (
	KubeResourceFieldName      = "kube.resource.name"
	KubeResourceFieldGroup     = "kube.resource.group"
	KubeResourceFieldVersion   = "kube.resource.version"
	KubeResourceFieldNamespace = "kube.resource.namespace"
	KubeResourceFieldKind      = "kube.resource.kind"

	KubeResourceFuncJQ = "kube.resource.jq"
)

Fields & functions available for KubernetesResource

View Source 
const (
	GroupFieldName  = "group.name"
	GroupFieldUsers = "group.users"
	GroupFieldID    = "group.id"
)

Fields & functions available for Group

View Source 
const (
	CommandFieldExitCode = "command.exitCode"
	CommandFieldStdout   = "command.stdout"
)

Fields & functions available for Command

View Source 
const (
	AuditFieldPath        = "audit.path"
	AuditFieldEnabled     = "audit.enabled"
	AuditFieldPermissions = "audit.permissions"
)

Fields & functions available for Audit

View Source 
const (
	DockerImageFieldID   = "image.id"
	DockerImageFieldTags = "image.tags"

	DockerContainerFieldID    = "container.id"
	DockerContainerFieldName  = "container.name"
	DockerContainerFieldImage = "container.image"

	DockerNetworkFieldID   = "network.id"
	DockerNetworkFieldName = "network.name"

	DockerVersionFieldVersion       = "docker.version"
	DockerVersionFieldAPIVersion    = "docker.apiVersion"
	DockerVersionFieldPlatform      = "docker.platform"
	DockerVersionFieldExperimental  = "docker.experimental"
	DockerVersionFieldOS            = "docker.os"
	DockerVersionFieldArch          = "docker.arch"
	DokcerVersionFieldKernelVersion = "docker.kernelVersion"

	DockerFuncTemplate = "docker.template"
)

Fields & functions available for Docker

Variables

View Source 
var ErrUnsupportedSchemaVersion = errors.New("schema version not supported")

ErrUnsupportedSchemaVersion is returned for a schema version not supported by this version of the agent

Functions

func CheckName added in v0.9.0 

func CheckName(ruleID string, description string) string

CheckName returns a canonical name of a check for a rule ID and description

Types

type Audit 

type Audit struct {
	Path string `yaml:"path"`
}

Audit describes an audited file resource

func (*Audit) Validate 

func (a *Audit) Validate() error

Validate validates audit resource

type BinaryCmd 

type BinaryCmd struct {
	Name string   `yaml:"name"`
	Args []string `yaml:"args,omitempty"`
}

BinaryCmd describes a command in form of a name + args

func (*BinaryCmd) String 

func (c *BinaryCmd) String() string

type Check added in v0.9.0 

type Check check.Check

Check is the interface for compliance checks

type CheckStatus added in v0.9.0 

type CheckStatus struct {
	RuleID      string
	Name        string
	Description string
	Version     string
	Framework   string
	Source      string
	InitError   error
	LastEvent   *event.Event
}

CheckStatus describes current status for a check

type CheckStatusList added in v0.9.0 

type CheckStatusList []*CheckStatus

CheckStatusList describes status for all configured checks

type CheckVisitor 

type CheckVisitor func(rule *Rule, check Check, err error) bool

CheckVisitor defines a visitor func for compliance checks

type Command 

type Command struct {
	BinaryCmd      *BinaryCmd `yaml:"binary,omitempty"`
	ShellCmd       *ShellCmd  `yaml:"shell,omitempty"`
	TimeoutSeconds int        `yaml:"timeout,omitempty"`
}

Command describes a command resource usually reporting exit code or output

func (*Command) String 

func (c *Command) String() string

type Custom added in v0.9.0 

type Custom struct {
	Name      string            `yaml:"name"`
	Variables map[string]string `yaml:"variables,omitempty"`
}

Custom is a special resource handled by a dedicated function

type DockerResource 

type DockerResource struct {
	Kind string `yaml:"kind"`
}

DockerResource describes a resource from docker daemon

type Fallback added in v0.9.0 

type Fallback struct {
	Condition string   `yaml:"condition,omitempty"`
	Resource  Resource `yaml:"resource"`
}

Fallback specifies optional fallback configuration for a resource

type File 

type File struct {
	Path string `yaml:"path"`
}

File describes a file resource

type Group 

type Group struct {
	Name string `yaml:"name"`
}

Group describes a group membership resource

type KubeUnstructuredResource added in v0.9.0 

type KubeUnstructuredResource struct {
	unstructured.Unstructured
}

KubeUnstructuredResource describes a Kubernetes Unstructured that implements the ReportResource interface

func NewKubeUnstructuredResource added in v0.9.0 

func NewKubeUnstructuredResource(obj unstructured.Unstructured) *KubeUnstructuredResource

NewKubeUnstructuredResource instantiates a new KubeUnstructuredResource

func (*KubeUnstructuredResource) ID added in v0.9.0 

func (kr *KubeUnstructuredResource) ID() string

ID returns the resource identifier

func (*KubeUnstructuredResource) Type added in v0.9.0 

func (kr *KubeUnstructuredResource) Type() string

Type returns the resource type

type KubernetesAPIRequest 

type KubernetesAPIRequest struct {
	Verb         string `yaml:"verb"`
	ResourceName string `yaml:"resourceName,omitempty"`
}

KubernetesAPIRequest defines it check applies to a single object or a list

type KubernetesResource 

type KubernetesResource struct {
	Kind      string `yaml:"kind"`
	Version   string `yaml:"version,omitempty"`
	Group     string `yaml:"group,omitempty"`
	Namespace string `yaml:"namespace,omitempty"`

	// A selector to restrict the list of returned objects by their labels.
	// Defaults to everything.
	LabelSelector string `yaml:"labelSelector,omitempty"`
	// A selector to restrict the list of returned objects by their fields.
	// Defaults to everything.
	FieldSelector string `yaml:"fieldSelector,omitempty"`

	APIRequest KubernetesAPIRequest `yaml:"apiRequest"`
}

KubernetesResource describes any object in Kubernetes (incl. CRDs)

func (*KubernetesResource) String 

func (kr *KubernetesResource) String() string

String returns human-friendly information string about the KubernetesResource

type Process 

type Process struct {
	Name string `yaml:"name"`
}

Process describes a process resource

type Report added in v0.9.0 

type Report struct {
	// Data contains arbitrary data linked to check evaluation
	Data event.Data
	// Resource associated with the report
	Resource ReportResource
	// Passed defines whether check was successful or not
	Passed bool
	// Aggregated defines whether check was aggregated or not
	Aggregated bool
	// Error of th check evaluation
	Error error
}

Report contains the result of a compliance check

func BuildReportForError added in v0.9.0 

func BuildReportForError(err error) *Report

BuildReportForError returns a report for the given error

func BuildReportForUnstructured added in v0.9.0 

func BuildReportForUnstructured(passed, aggregated bool, obj *KubeUnstructuredResource) *Report

BuildReportForUnstructured returns default Report for Kubernetes objects

type ReportResource added in v0.9.0 

type ReportResource struct {
	ID   string
	Type string
}

ReportResource holds the id and type of the resource associated with a report

type Resource 

type Resource struct {
	File          *File               `yaml:"file,omitempty"`
	Process       *Process            `yaml:"process,omitempty"`
	Group         *Group              `yaml:"group,omitempty"`
	Command       *Command            `yaml:"command,omitempty"`
	Audit         *Audit              `yaml:"audit,omitempty"`
	Docker        *DockerResource     `yaml:"docker,omitempty"`
	KubeApiserver *KubernetesResource `yaml:"kubeApiserver,omitempty"`
	Custom        *Custom             `yaml:"custom,omitempty"`
	Condition     string              `yaml:"condition"`
	Fallback      *Fallback           `yaml:"fallback,omitempty"`
}

Resource describes supported resource types observed by a Rule

func (*Resource) Kind 

func (r *Resource) Kind() ResourceKind

Kind returns ResourceKind of the resource

type ResourceKind 

type ResourceKind string

ResourceKind represents resource kind

type Rule 

type Rule struct {
	ID           string        `yaml:"id"`
	Description  string        `yaml:"description,omitempty"`
	Scope        RuleScopeList `yaml:"scope,omitempty"`
	HostSelector string        `yaml:"hostSelector,omitempty"`
	ResourceType string        `yaml:"resourceType,omitempty"`
	Resources    []Resource    `yaml:"resources,omitempty"`
}

Rule defines a rule in a compliance config

type RuleScope added in v0.9.0 

type RuleScope string

RuleScope defines scope for applicability of a rule 

const (
	// DockerScope const
	DockerScope RuleScope = "docker"
	// KubernetesNodeScope const
	KubernetesNodeScope RuleScope = "kubernetesNode"
	// KubernetesClusterScope const
	KubernetesClusterScope RuleScope = "kubernetesCluster"
)

type RuleScopeList added in v0.9.0 

type RuleScopeList []RuleScope

RuleScopeList is a set of RuleScopes

func (RuleScopeList) Includes added in v0.9.0 

func (l RuleScopeList) Includes(ruleScope RuleScope) bool

Includes returns true if RuleScopeList includes the specified RuleScope value

type ShellCmd 

type ShellCmd struct {
	Run   string     `yaml:"run"`
	Shell *BinaryCmd `yaml:"shell,omitempty"`
}

ShellCmd describes a command to be run through a shell

func (*ShellCmd) String 

func (c *ShellCmd) String() string

type Suite 

type Suite struct {
	Meta  SuiteMeta `yaml:",inline"`
	Rules []Rule    `yaml:"rules,omitempty"`
}

Suite represents a set of compliance checks reporting events

func ParseSuite 

func ParseSuite(config string) (*Suite, error)

ParseSuite loads a single compliance suite

type SuiteMeta 

type SuiteMeta struct {
	Schema    SuiteSchema `yaml:"schema,omitempty"`
	Name      string      `yaml:"name,omitempty"`
	Framework string      `yaml:"framework,omitempty"`
	Version   string      `yaml:"version,omitempty"`
	Tags      []string    `yaml:"tags,omitempty"`
	Source    string      `yaml:"-"`
}

SuiteMeta contains metadata for a compliance suite

type SuiteSchema added in v0.9.0 

type SuiteSchema struct {
	Version string `yaml:"version"`
}

SuiteSchema defines versioning for a compliance suite

Source Files

View all Source files

Directories

Path Synopsis
Package agent implements the Compliance Agent entrypoint
 Package agent implements the Compliance Agent entrypoint
Package checks implements Compliance Agent checks
 Package checks implements Compliance Agent checks
custom
env

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.