mounts

Documentation

Overview

Package mounts reads the mount table, so that artifacts declaring exclude_file_system can be honoured.

UAC's shipped configuration excludes network and pseudo filesystems -- nfs, cifs, sysfs, fuse and friends -- and several artifacts exclude proc on their own. Without this, a live bodyfile walks into /proc and a collection on a machine with an NFS mount silently tries to traverse the network.

It matters far less offline, where a mounted image usually has no pseudo filesystems inside it and the device-boundary check already stops the walk at the edge. It is a live-collection correctness fix more than an offline one.

Index

• type Mount
• type Table
  • func Load() Table
  • func (t Table) PointsForTypes(types []string) []string
  • func (t Table) Under(root string) Table

Types

type Mount

type Mount struct {
	Point  string // mount point, as the kernel reports it
	FSType string // filesystem type, e.g. proc, sysfs, nfs4
	Source string // device or remote path
}

Mount is one entry from the mount table.

type Table

type Table []Mount

Table is the parsed mount table.

func Load

func Load() Table

Load reads the running system's mount table. An empty table is not an error: the platform may not expose one, in which case exclude_file_system simply cannot be applied and the walk proceeds.

func (Table) PointsForTypes

func (t Table) PointsForTypes(types []string) []string

PointsForTypes returns the mount points whose filesystem type is named in types, deepest first so that a nested mount is pruned before its parent.

Matching is case-insensitive because the names artifacts use do not always match the kernel's spelling, and a "proc"/"procfs" pair appears in the corpus.

func (Table) Under

func (t Table) Under(root string) Table

Under narrows the table to mounts at or beneath root, returning their points relative to it.

Collecting from a mounted image means the interesting mounts are the ones inside it; the examiner's own /proc is irrelevant and its path would not even be meaningful in the output, which records image-relative paths.