configsurface

Documentation

Overview

Package configsurface collects the host's persistence and privilege configuration: cron jobs, systemd timers and services, SUID binaries, scheduled tasks and autoruns.

Everything here is a local read - no execution, no probing, no network - which preserves the property that makes the collector deployable in OT, medical and air-gapped estates. A CVE mapping says "you have a defect that enables this technique"; this says "this technique has a surface here"; neither says "you are compromised". Keeping those claims apart is the consumer's job, and keeping the facts collectable is this package's.

Index

• Constants
• func AttachOwners(entries []model.ConfigEntry, owners map[string][]string)
• func Collect(ctx context.Context, opts Options) []model.ConfigEntry
• func ExecutablePaths(entries []model.ConfigEntry) []string
• func ValidateScope(s string) error
• type Options

Constants

const (
	ScopeStandard = "standard"
	ScopeAll      = "all"
	ScopeOff      = "off"
)

Scope values, following the --elf-scope precedent: the default covers the cheap, high-signal set; the exhaustive walk is opt-in; off is off.

Functions

func AttachOwners

func AttachOwners(entries []model.ConfigEntry, owners map[string][]string)

AttachOwners fills each entry's PURL from the ownership probe's answers, the same map the listening services join against. The first owner wins; a file two packages both claim is a packaging bug this record is not the place to litigate.

func Collect

func Collect(ctx context.Context, opts Options) []model.ConfigEntry

Collect reads the configuration surface of the tree at opts.Root.

func ExecutablePaths

func ExecutablePaths(entries []model.ConfigEntry) []string

ExecutablePaths lists the executables the entries name, for the package ownership probe - the same join the listening services use, so a cron job resolves to the package that installed its program, and an entry with no owner stays visibly unowned.

func ValidateScope

func ValidateScope(s string) error

ValidateScope rejects a scope the collector does not have.

Types

type Options

type Options struct {
	// Root is the tree to read, "/" for the running host. Everything is
	// resolved under it, so an image mounted at --root is described as
	// itself rather than as the machine doing the scanning.
	Root string

	// Scope is ScopeStandard, ScopeAll or ScopeOff. Standard walks the same
	// binary directories the ELF probe walks for SUID bits; all walks the
	// whole tree, which is the expensive part.
	Scope string

	// IncludeCommands keeps full command lines. Off under
	// --no-service-command: command lines carry passwords and tokens, and
	// an inventory file is usually copied somewhere else. Executable paths
	// are kept either way - a path is joinable and carries no secrets.
	IncludeCommands bool

	// Excludes are the operator's --exclude patterns. The SUID walk honours
	// the ./-anchored subtree form, the same rule the symlink preflight
	// applies; the fixed-path readers (cron, systemd) are not walks and are
	// unaffected. This stopped being optional when a CI runner's /opt held
	// a toolchain cache that took the walk six minutes to lstat through -
	// while the run's own command line said --exclude './opt/**' the whole
	// time.
	Excludes []string
}

Options configures one collection.