targetos

Documentation

Overview

Package targetos identifies the operating system of the image being collected from, so that artifacts declaring supported_os can be filtered.

UAC answers this with `uname -s`, which reports the *examiner's* system. That is correct on a live collection and wrong on a mounted image, which is why UAC makes you pass -s offline. Here the image is inspected for marker files instead, and the host is used only when collecting from / itself. An explicit flag still overrides everything.

Index

• Variables
• func Names() string
• func Supports(supported []string, target OS) bool
• func Valid(s string) bool
• type InvalidOSError
  • func (e *InvalidOSError) Error() string
• type OS
  • func Detect(root string) (OS, string)
  • func DetectFS(fsys fs.FS) (OS, string)
  • func Host() OS
  • func Resolve(override, mountPoint string) (OS, string, error)

Variables

var All = []OS{AIX, ESXi, FreeBSD, Linux, MacOS, NetBSD, NetScaler, OpenBSD, Solaris}

All lists every value an artifact may name, for flag validation and help.

Functions

func Names

func Names() string

func Supports

func Supports(supported []string, target OS) bool

Supports reports whether an artifact declaring these supported_os values applies to target. An empty list means the artifact does not say, which UAC treats as applying everywhere.

func Valid

func Valid(s string) bool

Valid reports whether s names a supported operating system.

Types

type InvalidOSError

type InvalidOSError struct{ Name string }

InvalidOSError reports an unusable -s value.

func (*InvalidOSError) Error

func (e *InvalidOSError) Error() string

type OS

type OS string

OS is one of the operating system names UAC's artifacts use in supported_os.

const (
	AIX       OS = "aix"
	ESXi      OS = "esxi"
	FreeBSD   OS = "freebsd"
	Linux     OS = "linux"
	MacOS     OS = "macos"
	NetBSD    OS = "netbsd"
	NetScaler OS = "netscaler"
	OpenBSD   OS = "openbsd"
	Solaris   OS = "solaris"

	// Unknown means detection failed and no override was given.
	Unknown OS = ""
)

func Detect

func Detect(root string) (OS, string)

Detect identifies the operating system of the tree at root, returning the marker that decided it. An empty OS means nothing matched, which is common for a partial image or an arbitrary directory.

Markers are checked with containment: a symlink pointing out of the image must not count as evidence that the image is anything, or a hostile image could steer the whole artifact selection by planting one.

func DetectFS

func DetectFS(fsys fs.FS) (OS, string)

DetectFS is Detect over any filesystem, which is what makes it testable without building a fake image on disk.

func Host

func Host() OS

Host reports the operating system uacscan is running on, named the way UAC's artifacts do.

func Resolve

func Resolve(override, mountPoint string) (OS, string, error)

Resolve decides which operating system to filter artifacts against and explains how it got there, because that decision changes what is collected and belongs in the run log.

An explicit override always wins. Collecting from / means the host is the image. Otherwise the image is inspected, and if that is inconclusive the result is Unknown -- never the examiner's own operating system.

Assuming the host would be actively harmful: a partial macOS image examined on a Linux workstation would have every macOS artifact filtered out, and the collection would look complete. Unknown disables the filter instead, so an unidentified image is over-collected rather than silently under-collected.