envfilter

Documentation

Overview

Package envfilter implements environment variable filtering for remote exec.

The C hook library sets MPROXY_CHANGED_ENVS with the names of variables that were added or modified after the hook was loaded. These are always forwarded. Other variables are filtered through configurable keep/remove patterns (similar to sudo's env_keep).

Patterns are either globs (filepath.Match syntax) or regexes delimited by slashes (e.g. /^AWS_/).

Index

• func Filter(env []string, keep []string, remove []string) []string
• func Remove(env []string, remove []string) []string
• func StripPathSegment(env []string, dir string) []string

Functions

func Filter

func Filter(env []string, keep []string, remove []string) []string

Filter returns a filtered copy of env suitable for sending to the remote.

Rules (applied in order):

1. MPROXY_CHANGED_ENVS is always stripped from the output.
2. If a var name matches any remove pattern → drop.
3. If a var name is in the changed set (from MPROXY_CHANGED_ENVS) → keep.
4. If a var name matches any keep pattern → keep.
5. Otherwise → drop.

func Remove

func Remove(env []string, remove []string) []string

Remove returns a copy of env with variables matching any remove pattern stripped. Unlike Filter, there is no keep list — all non-matching vars are preserved.

func StripPathSegment

func StripPathSegment(env []string, dir string) []string

StripPathSegment returns a copy of env with `dir` removed from any PATH= entry. Useful when forwarding env to a remote process that has no use for a local-only directory (e.g. the path-stub mount). If the segment isn't present, env is returned unchanged. If removing it empties PATH, the PATH entry is dropped entirely.