evaluate

Documentation

Index

• Constants
• Variables
• func ASLR()
• func BasicSysInfo()
• func CallAddedFunc()
• func CallBasics()
• func CheckAppArmor()
• func CheckCloudMetadataAPI()
• func CheckK8sAnonymousLogin() bool
• func CheckNamespaceIsolation()
• func CheckNetNamespace()
• func CheckPrivilegedK8sServiceAccount(tokenPath string) bool
• func CheckRouteLocalNetworkValue()
• func CheckSELinux()
• func CheckSeccompKernelSupport()
• func CheckSeccompStatus()
• func CommandAllow()
• func DNSBasedServiceDiscovery()
• func DumpCgroup()
• func FindSidFiles()
• func GetProcCapabilities() bool
• func MountEscape()
• func RegisterCheck(category CategorySpec, check Check, profiles ...string)
• func RegisterContextCheck(category CategorySpec, id, title string, fn CheckFunc, profiles ...string)
• func RegisterSimpleCheck(category CategorySpec, id, title string, fn func(), profiles ...string)
• func SearchAvailableCommands()
• func SearchLocalFilePath()
• func SearchSensitiveEnv()
• func SearchSensitiveService()
• type Category
• type CategorySpec
• type Check
• type CheckFunc
• type Context
  • func NewContext(logger *log.Logger) *Context
• type Evaluator
  • func NewEvaluator() *Evaluator
  • func (e *Evaluator) Profile(id string) (Profile, bool)
  • func (e *Evaluator) Profiles() []Profile
  • func (e *Evaluator) RegisterProfile(profile Profile)
  • func (e *Evaluator) RunProfile(id string, ctx *Context) error
• type Profile

Constants

const (
	ProfileBasic      = "basic"
	ProfileExtended   = "extended"
	ProfileAdditional = "additional"
)

Variables

var (
	CategorySystemInfo = CategorySpec{
		ID:              "information.system",
		Title:           "Information Gathering - System Info",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           100,
	}
	CategoryServices = CategorySpec{
		ID:              "information.services",
		Title:           "Information Gathering - Services",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           200,
	}
	CategoryCommands = CategorySpec{
		ID:              "information.commands",
		Title:           "Information Gathering - Commands and Capabilities",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           300,
	}
	CategoryMounts = CategorySpec{
		ID:              "information.mounts",
		Title:           "Information Gathering - Mounts",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           400,
	}
	CategoryNetNamespace = CategorySpec{
		ID:              "information.netns",
		Title:           "Information Gathering - Net Namespace",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           500,
	}
	CategorySysctl = CategorySpec{
		ID:              "information.sysctl",
		Title:           "Information Gathering - Sysctl Variables",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           600,
	}
	CategoryDNS = CategorySpec{
		ID:              "information.dns",
		Title:           "Information Gathering - DNS-Based Service Discovery",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           700,
	}
	CategoryK8sAPIServer = CategorySpec{
		ID:              "discovery.k8s_api",
		Title:           "Discovery - K8s API Server",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           800,
	}
	CategoryK8sServiceAccount = CategorySpec{
		ID:              "discovery.k8s_sa",
		Title:           "Discovery - K8s Service Account",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           900,
	}
	CategoryCloudMetadata = CategorySpec{
		ID:              "discovery.cloud_metadata",
		Title:           "Discovery - Cloud Provider Metadata API",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           1000,
	}
	CategoryKernel = CategorySpec{
		ID:              "exploit.kernel",
		Title:           "Exploit Pre - Kernel Exploits",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           1100,
	}
	CategorySensitiveFiles = CategorySpec{
		ID:              "information.sensitive_files",
		Title:           "Information Gathering - Sensitive Files",
		DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
		Order:           1200,
	}
	CategoryASLR = CategorySpec{
		ID:              "information.aslr",
		Title:           "Information Gathering - ASLR",
		DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
		Order:           1300,
	}
	CategoryCgroups = CategorySpec{
		ID:              "information.cgroups",
		Title:           "Information Gathering - Cgroups",
		DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
		Order:           1400,
	}
	CategorySecurity = CategorySpec{
		ID:              "information.security",
		Title:           "Information Gathering - Container Security",
		DefaultProfiles: []string{ProfileBasic, ProfileExtended},
		Order:           1500,
	}
)

var RouteLocalNetProcPath = "/proc/sys/net/ipv4/conf/all/route_localnet"

Functions

func ASLR

func ASLR()

func BasicSysInfo

func BasicSysInfo()

func CallAddedFunc

func CallAddedFunc()

CallAddedFunc executes the additional evaluation profile.

func CallBasics

func CallBasics()

CallBasics executes the baseline evaluation profile.

func CheckAppArmor

func CheckAppArmor()

CheckAppArmor inspects kernel compile options, boot parameters, runtime status, and the active AppArmor profile for the current process.

func CheckCloudMetadataAPI

func CheckCloudMetadataAPI()

func CheckK8sAnonymousLogin

func CheckK8sAnonymousLogin() bool

func CheckNamespaceIsolation

func CheckNamespaceIsolation()

CheckNamespaceIsolation compares /proc/1/ns/<ns> and /proc/self/ns/<ns> for each namespace type. If the symlink targets differ, the namespace is isolated.

func CheckNetNamespace

func CheckNetNamespace()

func CheckPrivilegedK8sServiceAccount

func CheckPrivilegedK8sServiceAccount(tokenPath string) bool

func CheckRouteLocalNetworkValue

func CheckRouteLocalNetworkValue()

func CheckSELinux

func CheckSELinux()

CheckSELinux detects whether SELinux is present and enforcing.

func CheckSeccompKernelSupport

func CheckSeccompKernelSupport()

CheckSeccompKernelSupport reports whether the running kernel was compiled with Seccomp support by checking for the Seccomp field in /proc/self/status and, optionally, the kernel config.

func CheckSeccompStatus

func CheckSeccompStatus()

CheckSeccompStatus reads the Seccomp field from /proc/self/status and reports whether Seccomp is disabled (0), strict (1), or filter (2) mode.

func CommandAllow

func CommandAllow()

CommandAllow check command allow to run

func DNSBasedServiceDiscovery

func DNSBasedServiceDiscovery()

https://github.com/kubernetes/dns/blob/master/docs/specification.md

func DumpCgroup

func DumpCgroup()

func FindSidFiles

func FindSidFiles()

FindSidFiles such as run `find /bin/. -perm -4000 -type f `

func GetProcCapabilities

func GetProcCapabilities() bool

func MountEscape

func MountEscape()

func RegisterCheck

func RegisterCheck(category CategorySpec, check Check, profiles ...string)

RegisterCheck registers a check with the given category and optional profile list.

func RegisterContextCheck

func RegisterContextCheck(category CategorySpec, id, title string, fn CheckFunc, profiles ...string)

RegisterContextCheck registers a check backed by a function that consumes Context.

func RegisterSimpleCheck

func RegisterSimpleCheck(category CategorySpec, id, title string, fn func(), profiles ...string)

RegisterSimpleCheck registers a check backed by a parameterless function.

func SearchAvailableCommands

func SearchAvailableCommands()

func SearchLocalFilePath

func SearchLocalFilePath()

func SearchSensitiveEnv

func SearchSensitiveEnv()

func SearchSensitiveService

func SearchSensitiveService()

Types

type Category

type Category struct {
	ID     string
	Title  string
	Checks []Check
}

Category groups related checks under a shared heading.

type CategorySpec

type CategorySpec struct {
	ID              string
	Title           string
	DefaultProfiles []string
	Order           int
}

CategorySpec describes where a check is shown and its display metadata.

type Check

type Check struct {
	ID          string
	Title       string
	Description string
	Run         CheckFunc
}

Check describes an actionable evaluation task.

type CheckFunc

type CheckFunc func(*Context) error

CheckFunc represents the executable unit for a security check.

type Context

type Context struct {
	Logger *log.Logger
}

Context carries shared dependencies for evaluation checks.

func NewContext

func NewContext(logger *log.Logger) *Context

NewContext constructs a Context instance with a default logger when none is provided.

type Evaluator

type Evaluator struct {
	// contains filtered or unexported fields
}

Evaluator coordinates profile registration and execution.

func NewEvaluator

func NewEvaluator() *Evaluator

NewEvaluator returns an Evaluator with the default profiles registered.

func (*Evaluator) Profile

func (e *Evaluator) Profile(id string) (Profile, bool)

Profile returns a copy of the profile and a boolean indicating whether it exists.

func (*Evaluator) Profiles

func (e *Evaluator) Profiles() []Profile

Profiles returns the registered profiles sorted by their identifier.

func (*Evaluator) RegisterProfile

func (e *Evaluator) RegisterProfile(profile Profile)

RegisterProfile adds or replaces a profile definition.

func (*Evaluator) RunProfile

func (e *Evaluator) RunProfile(id string, ctx *Context) error

RunProfile executes every category within the selected profile.

type Profile

type Profile struct {
	ID         string
	Title      string
	Categories []Category
}

Profile combines categories into a runnable unit.