tasks

Documentation

Index

• Constants
• Variables
• func DnsQuery(name string) ([]net.IP, error)
• func GetBubbleWrap(pid int) (bool, error)
• func GetHostName() (string, error)
• func GetProxy() (*models.ProxyConfig, error)
• func GetProxyFromEnv() (*models.ProxyConfig, error)
• func GetRunningParentProcess(pid int) (*models.Process, error)
• func GetRunningProcess(pid int) (*models.Process, error)
• func GetRunningProcesses() ([]*models.Process, error)
• func GetSockets(startPath string, fast bool) ([]string, error)
• func GetUserGroupInfo() (*models.UserIdentity, error)
• func ProbeForLandlock() (bool, error)
• func ProbeLandlockSelfDepth() (int, error)
• func ScanTCP(host string) []int
• func ScanUDP(host string) []int
• func Walk(root string, fast bool, walkFn func(path string, typ os.FileMode) error) error
• type ContainerRuntime
  • func GetContainerRuntime(tgid, pid int) ContainerRuntime
• type Mount
  • func GetHostMounts() ([]Mount, error)
• type PathPermissions
  • func ScanTargetedPaths() *PathPermissions
• type ProbeSubCmdData
• type SensitivePath

Constants

const (
	LANDLOCK_MAX_DEPTH = 16
)

Variables

var ErrSkipFiles = errors.New("fastwalk: skip remaining files in directory")

ErrSkipFiles is a used as a return value from WalkFuncs to indicate that the callback should not be called for any other files in the current directory. Child directories will still be traversed.

var ErrTraverseLink = errors.New("fastwalk: traverse symlink, assuming target is a directory")

ErrTraverseLink is used as a return value from WalkFuncs to indicate that the symlink named in the call may be traversed.

var SystemWritePaths = []string{

	"/etc",
	"/boot",
	"/usr",
	"/usr/bin",
	"/usr/sbin",
	"/usr/lib",
	"/bin",
	"/sbin",
	"/lib",
	"/lib64",

	"/sys",
	"/proc",
	"/dev",

	"/var",
	"/var/log",
	"/var/lib",
	"/opt",
}

System directories to check for write permissions (should typically be read-only)

Functions

func DnsQuery

func DnsQuery(name string) ([]net.IP, error)

func GetBubbleWrap

func GetBubbleWrap(pid int) (bool, error)

GetBubbleWrap tries to detect if the system is running in bwrap

func GetHostName

func GetHostName() (string, error)

func GetProxy

func GetProxy() (*models.ProxyConfig, error)

func GetProxyFromEnv

func GetProxyFromEnv() (*models.ProxyConfig, error)

func GetRunningParentProcess

func GetRunningParentProcess(pid int) (*models.Process, error)

func GetRunningProcess

func GetRunningProcess(pid int) (*models.Process, error)

func GetRunningProcesses

func GetRunningProcesses() ([]*models.Process, error)

func GetSockets

func GetSockets(startPath string, fast bool) ([]string, error)

func GetUserGroupInfo

func GetUserGroupInfo() (*models.UserIdentity, error)

func ProbeForLandlock

func ProbeForLandlock() (bool, error)

func ProbeLandlockSelfDepth

func ProbeLandlockSelfDepth() (int, error)

func ScanTCP

func ScanTCP(host string) []int

func ScanUDP

func ScanUDP(host string) []int

TODO: this method is not the best to get UDP ports exposed it fails for some ports that don't repond to empty queries develop OS specific method in the future

func Walk

func Walk(root string, fast bool, walkFn func(path string, typ os.FileMode) error) error

Types

type ContainerRuntime

type ContainerRuntime int

ContainerRuntime represents the container runtime type

const (
	RuntimeNotFound ContainerRuntime = iota
	RuntimeDocker
	RuntimePodman
	RuntimeLXC
	RuntimeOpenVZ
	RuntimeGVisor
	RuntimeWSL
	RuntimeFirejail
	RuntimeSeatbelt
	RuntimeLandlock
	// add other runtimes as needed
	RuntimeUnknown
)

func GetContainerRuntime

func GetContainerRuntime(tgid, pid int) ContainerRuntime

GetContainerRuntime detects the container runtime for a given process note it will only work for Linux based systems

type Mount

type Mount struct {
	Source string
	Target string
	FSType string
}

func GetHostMounts

func GetHostMounts() ([]Mount, error)

type PathPermissions

type PathPermissions struct {
	WritablePaths []string
	ReadablePaths []string
}

PathPermissions holds lists of writable and readable paths

func ScanTargetedPaths

func ScanTargetedPaths() *PathPermissions

ScanTargetedPaths performs targeted security enumeration by checking specific sensitive paths instead of walking the entire filesystem. Returns separate lists for readable sensitive paths and writable system paths.

type ProbeSubCmdData

type ProbeSubCmdData struct {
	LockdownDepth int `json:"lockdownDepth"`
}

type SensitivePath

type SensitivePath struct {
	// contains filtered or unexported fields
}

SensitivePath describes a path to check for readability, with an optional content predicate. If contains is non-empty the file is only reported when its content includes that substring (case-insensitive).