tasks

package
v6.7.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 21, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

tasks defines the task interface, a task should be able

Index

Constants

View Source 
const (
	// FindingType for a path expectation violation (must_block / must_read / must_readwrite).
	CUSTOMPATHVIOLATION = "custom_path_violation"
	// FindingType for an audit-only path observation (no pass/fail).
	CUSTOMPATHAUDIT = "custom_path_audit"
)
View Source 
const (
	WRITEABLEPATHS            = "writeable_paths"
	SENSITIVEREADABLEPATHS    = "sensitive_readable_paths"
	EXTERNALHOSTDNSRESOLUTION = "external_host_dns_resolution"
	EXTERNALHOSTCONNECTIVITY  = "external_host_connectivity"
	UDPPORTSOPEN              = "udp_ports_open"
	TCPPORTSOPEN              = "tcp_ports_open"
	PROXYDETECTION            = "proxy_detection"
	UNIXSOCKETDETECTION       = "unix_socket_detection"
	NAMEDPIPEDETECTION        = "named_pipe_detection"
	PROCESSDETECTION          = "process_detection"
	PARENTPROCESSDETECTION    = "parent_process_detection"
	MOUNTEDVOLUMESDETECTION   = "mounted_volumes_detections"
	USERCONTEXTDETECTION      = "user_context_detection"
	HOSTNAMEDETECTION         = "hostname_detection"
	SANDBOXDETECTION          = "sandbox_detection"
	ENVIRONMENTDETECTION      = "environment_detection"
	ENVSECRETDETECTION        = "env_secret_detection"

	// LOCALLISTENERS is the kernel's own socket table: what is bound in this
	// network namespace, as "tcp 127.0.0.1:22" strings. It is an INVENTORY
	// and is deliberately not a scored capability — under a Seatbelt profile
	// denying network it is byte-identical inside and outside the sandbox,
	// so treating it as exposure would mark every confined macOS row leaked.
	LOCALLISTENERS = "local_listeners"

	// LOCALPROBESTATUS says how the local-services measurement went: which
	// table was read, whether the UDP feedback channel is live, the network
	// namespace, and the per-port outcomes behind the scored integers.
	// It is what makes "could not measure" distinguishable from "measured
	// zero", which is the root of the false-blocked class of bug.
	LOCALPROBESTATUS = "local_probe_status"
)
View Source 
const TaskPrefix = "baseline"

Variables

This section is empty.

Functions

func GetAllTaskSetsNames 

func GetAllTaskSetsNames() []string

GetAllTaskSetsNames returns all the tasksets names

func GetAllTasksNames 

func GetAllTasksNames() []string

GetAllTasksNames returns all the tasks names

func IsScanFailure 

func IsScanFailure(err error) bool

IsScanFailure reports whether err represents a task failure that must fail the overall scan.

func NewScanFailure 

func NewScanFailure(err error) error

NewScanFailure wraps a task error that must result in a non-zero scan exit.

func Validate 

func Validate(f *reportv1.Finding) error

Types

type CustomPathsTask 

type CustomPathsTask struct {
	// contains filtered or unexported fields
}

CustomPathsTask runs the custom_paths checks defined in a config file.

func NewCustomPathsTask 

func NewCustomPathsTask(cfg *config.Config) *CustomPathsTask

NewCustomPathsTask constructs a task from the loaded config.

func (*CustomPathsTask) GetDescription 

func (t *CustomPathsTask) GetDescription() string

func (*CustomPathsTask) GetName 

func (t *CustomPathsTask) GetName() string

func (*CustomPathsTask) Run 

func (t *CustomPathsTask) Run(_ context.Context, _ Inputs) ([]*reportv1.Finding, error)

type EnvSecretTask 

type EnvSecretTask struct {
	// contains filtered or unexported fields
}

EnvSecretTask produces: ENVSECRETDETECTION

func NewEnvSecretTask 

func NewEnvSecretTask() *EnvSecretTask

func (*EnvSecretTask) GetDescription 

func (t *EnvSecretTask) GetDescription() string

func (*EnvSecretTask) GetName 

func (t *EnvSecretTask) GetName() string

func (*EnvSecretTask) Run 

func (t *EnvSecretTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type EnvironmentTask 

type EnvironmentTask struct {
	// contains filtered or unexported fields
}

EnvironmentTask produces: ENVIRONMENTDETECTION

func NewEnvironmentTask 

func NewEnvironmentTask() *EnvironmentTask

func (*EnvironmentTask) GetDescription 

func (t *EnvironmentTask) GetDescription() string

func (*EnvironmentTask) GetName 

func (t *EnvironmentTask) GetName() string

func (*EnvironmentTask) Run 

func (t *EnvironmentTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type HostnameTask 

type HostnameTask struct {
	// contains filtered or unexported fields
}

HostnameTask produces: HOSTNAMEDETECTION

func NewHostnameTask 

func NewHostnameTask() *HostnameTask

func (*HostnameTask) GetDescription 

func (t *HostnameTask) GetDescription() string

func (*HostnameTask) GetName 

func (t *HostnameTask) GetName() string

func (*HostnameTask) Run 

func (t *HostnameTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type Inputs 

type Inputs struct {
	Fast bool
}

type MountTask 

type MountTask struct {
	// contains filtered or unexported fields
}

MountTask produces: MOUNTEDVOLUMESDETECTION

func NewMountTask 

func NewMountTask() *MountTask

func (*MountTask) GetDescription 

func (t *MountTask) GetDescription() string

func (*MountTask) GetName 

func (t *MountTask) GetName() string

func (*MountTask) Run 

func (t *MountTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type NetworkTask 

type NetworkTask struct {
	// contains filtered or unexported fields
}

NetworkTask produces: EXTERNALHOSTDNSRESOLUTION, EXTERNALHOSTCONNECTIVITY, TCPPORTSOPEN, UDPPORTSOPEN

func NewNetworkTask 

func NewNetworkTask() *NetworkTask

func (*NetworkTask) GetDescription 

func (t *NetworkTask) GetDescription() string

func (*NetworkTask) GetName 

func (t *NetworkTask) GetName() string

func (*NetworkTask) Run 

func (t *NetworkTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type PSAllTask 

type PSAllTask struct {
	// contains filtered or unexported fields
}

func NewPSAllTask 

func NewPSAllTask() *PSAllTask

func (*PSAllTask) GetDescription 

func (t *PSAllTask) GetDescription() string

func (*PSAllTask) GetName 

func (t *PSAllTask) GetName() string

func (*PSAllTask) Run 

func (t *PSAllTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type PSParentTask 

type PSParentTask struct {
	// contains filtered or unexported fields
}

func NewPSParentTask 

func NewPSParentTask() *PSParentTask

func (*PSParentTask) GetDescription 

func (t *PSParentTask) GetDescription() string

func (*PSParentTask) GetName 

func (t *PSParentTask) GetName() string

func (*PSParentTask) Run 

func (t *PSParentTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type PSSingleTask 

type PSSingleTask struct {
	// contains filtered or unexported fields
}

func NewPSSingleTask 

func NewPSSingleTask() *PSSingleTask

func (*PSSingleTask) GetDescription 

func (t *PSSingleTask) GetDescription() string

func (*PSSingleTask) GetName 

func (t *PSSingleTask) GetName() string

func (*PSSingleTask) Run 

func (t *PSSingleTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type PathTask 

type PathTask struct {
	// contains filtered or unexported fields
}

func NewPathTask 

func NewPathTask() *PathTask

func (*PathTask) GetDescription 

func (t *PathTask) GetDescription() string

func (*PathTask) GetName 

func (t *PathTask) GetName() string

func (*PathTask) Run 

func (t *PathTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type ProcessTask 

type ProcessTask struct {
	// contains filtered or unexported fields
}

ProcessTask produces: PROCESSDETECTION, PARENTPROCESSDETECTION

func NewProcessTask 

func NewProcessTask() *ProcessTask

func (*ProcessTask) GetDescription 

func (t *ProcessTask) GetDescription() string

func (*ProcessTask) GetName 

func (t *ProcessTask) GetName() string

func (*ProcessTask) Run 

func (t *ProcessTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type ProxyTask 

type ProxyTask struct {
	// contains filtered or unexported fields
}

ProxyTask produces: PROXYDETECTION

func NewProxyTask 

func NewProxyTask() *ProxyTask

func (*ProxyTask) GetDescription 

func (t *ProxyTask) GetDescription() string

func (*ProxyTask) GetName 

func (t *ProxyTask) GetName() string

func (*ProxyTask) Run 

func (t *ProxyTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type SandboxTask 

type SandboxTask struct {
	// contains filtered or unexported fields
}

SandboxTask produces: SANDBOXDETECTION

func NewSandboxTask 

func NewSandboxTask() *SandboxTask

func (*SandboxTask) GetDescription 

func (t *SandboxTask) GetDescription() string

func (*SandboxTask) GetName 

func (t *SandboxTask) GetName() string

func (*SandboxTask) Run 

func (t *SandboxTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type ScanFailure 

type ScanFailure struct {
	// contains filtered or unexported fields
}

ScanFailure marks a task error that must make the overall scan fail after the report has been produced. Ordinary task errors remain non-fatal so an optional or platform-specific probe cannot invalidate an otherwise useful report.

func (*ScanFailure) Error 

func (e *ScanFailure) Error() string

func (*ScanFailure) Unwrap 

func (e *ScanFailure) Unwrap() error

type SocketTask 

type SocketTask struct {
	// contains filtered or unexported fields
}

SocketTask produces: UNIXSOCKETDETECTION, and on Windows NAMEDPIPEDETECTION

func NewSocketTask 

func NewSocketTask() *SocketTask

func (*SocketTask) GetDescription 

func (t *SocketTask) GetDescription() string

func (*SocketTask) GetName 

func (t *SocketTask) GetName() string

func (*SocketTask) Run 

func (t *SocketTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

type Task 

type Task interface {
	// GetName returns the name of the task
	GetName() string
	// GetDescription returns the description of the task
	GetDescription() string
	// Run executes the task producing Findings
	Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)
}

func GetBaselineTasks 

func GetBaselineTasks() []Task

GetAllTasks returns all baseline tasks

func GetPSTasks 

func GetPSTasks() []Task

func GetTaskSetsTasks 

func GetTaskSetsTasks(taskSets []string) ([]Task, error)

func GetTasksByName 

func GetTasksByName(names []string) ([]Task, error)

GetTasksByName returns the given task

type UserContextTask 

type UserContextTask struct {
	// contains filtered or unexported fields
}

UserContextTask produces: USERCONTEXTDETECTION

func NewUserContextTask 

func NewUserContextTask() *UserContextTask

func (*UserContextTask) GetDescription 

func (t *UserContextTask) GetDescription() string

func (*UserContextTask) GetName 

func (t *UserContextTask) GetName() string

func (*UserContextTask) Run 

func (t *UserContextTask) Run(ctx context.Context, ti Inputs) ([]*reportv1.Finding, error)

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.