walk

Documentation

Overview

Package walk traverses the image once and dispatches every path to every collector.

UAC runs one find(1) per artifact entry -- around 490 of them, twenty of which start at / and traverse the whole tree. This walker visits each inode once, resolves it once, and lets all the rules look at the same record.

Index

• type Stats
• type Walker
  • func (w *Walker) Stats() Stats
  • func (w *Walker) Walk() error

Types

type Stats

type Stats struct {
	Files       int64
	Dirs        int64
	SkippedDirs int64
	// Errors counts traversal failures.
	Errors int64
	// Recorded counts per-file problems written to the errors spool, which are
	// not traversal failures and would otherwise go unmentioned.
	Recorded int64
}

Stats summarises a completed walk.

type Walker

type Walker struct {
	// Root is the mount point. Recorded paths are relative to it, so results
	// read /etc/passwd no matter where the image happened to be mounted.
	Root string

	Cache  *fsref.Cache
	Broker *content.Broker
	Set    *rules.Set

	Collectors []collector.Collector

	// ExcludePaths prunes globally: excluded filesystems, anything the operator
	// asked to skip. Unlike a rule's own exclusions these really do stop the
	// descent, because no rule can want what is behind them.
	ExcludePaths []rules.Glob

	// SkipReal holds absolute, symlink-resolved paths that must never be
	// entered -- above all the run's own output directory.
	//
	// A glob cannot do this job. The output path is chosen by the operator, so
	// it can contain glob metacharacters ("-o ./[out]" matched nothing as a
	// pattern), and it may be given relative while the walk sees absolute
	// paths. Comparing resolved paths is the only way that holds for every
	// destination, including one inside the image being collected.
	SkipReal map[string]bool

	// CrossDevice allows the walk to leave the root filesystem. Off by default:
	// on a mounted image, crossing a device boundary means leaving the evidence.
	CrossDevice bool

	// OnError receives traversal problems. They are reported, never fatal.
	OnError func(path string, err error)

	// Progress, if set, is called once per directory entered.
	Progress func(path string, files int64)

	// Recorded, if set, reports how many per-file problems collectors recorded.
	Recorded func() int64
	// contains filtered or unexported fields
}

Walker performs the single pass.

func (*Walker) Stats

func (w *Walker) Stats() Stats

func (*Walker) Walk

func (w *Walker) Walk() error

Walk traverses the tree. It returns an error only when a collector reports that it is broken; per-file problems are routed to OnError and the walk continues, because unreadable files are normal on real images.