security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 18 Wiki Activity

state: store launch method instead of launcher path

Browse Source 
Launcher path is constant for each launch method on the same system.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra 2024-10-18 22:25:09 +09:00
parent ecce832d93
commit 55bb348d5f
Signed by: cat
SSH Key Fingerprint: SHA256:vQhTOP4tHcsFb0365dxe6HJBKpv7PZ0KZNFx2AjBnRI
4 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
internal/app/seal.go
View File

@ -21,6 +21,11 @@ const (
LaunchMethodMachineCtl LaunchMethodMachineCtl
) )
var method = [...]string{
LaunchMethodSudo: "sudo",
LaunchMethodMachineCtl: "systemd",
}
var ( var (
ErrConfig = errors.New("no configuration to seal") ErrConfig = errors.New("no configuration to seal")
ErrUser = errors.New("unknown user") ErrUser = errors.New("unknown user")
@ -65,7 +70,7 @@ func (a *app) Seal(config *Config) error {
// parses launch method text and looks up tool path // parses launch method text and looks up tool path
switch config.Method { switch config.Method {
case "sudo": case method[LaunchMethodSudo]:
seal.launchOption = LaunchMethodSudo seal.launchOption = LaunchMethodSudo
if sudoPath, err := exec.LookPath("sudo"); err != nil { if sudoPath, err := exec.LookPath("sudo"); err != nil {
return fmsg.WrapError(ErrSudo, return fmsg.WrapError(ErrSudo,
@ -73,7 +78,7 @@ func (a *app) Seal(config *Config) error {
} else { } else {
seal.toolPath = sudoPath seal.toolPath = sudoPath
} }
case "systemd": case method[LaunchMethodMachineCtl]:
seal.launchOption = LaunchMethodMachineCtl seal.launchOption = LaunchMethodMachineCtl
if !internal.SdBootedV { if !internal.SdBootedV {
return fmsg.WrapError(ErrSystemd, return fmsg.WrapError(ErrSystemd,

2
internal/app/start.go
View File

@ -94,7 +94,7 @@ func (a *app) Start() error {
PID: a.cmd.Process.Pid, PID: a.cmd.Process.Pid,
Command: a.seal.command, Command: a.seal.command,
Capability: a.seal.et, Capability: a.seal.et,
Launcher: a.seal.toolPath, Method: method[a.seal.launchOption],
Argv: a.cmd.Args, Argv: a.cmd.Args,
Time: startTime, Time: startTime,
} }

4
internal/state/print.go
View File

@ -68,7 +68,7 @@ func (s *simpleStore) mustPrintLauncherState(w **tabwriter.Writer, now time.Time
// write header when initialising // write header when initialising
if !verbose.Get() { if !verbose.Get() {
_, _ = fmt.Fprintln(*w, "\tUID\tPID\tUptime\tEnablements\tLauncher\tCommand") _, _ = fmt.Fprintln(*w, "\tUID\tPID\tUptime\tEnablements\tMethod\tCommand")
} else { } else {
// argv is emitted in body when verbose // argv is emitted in body when verbose
_, _ = fmt.Fprintln(*w, "\tUID\tPID\tArgv") _, _ = fmt.Fprintln(*w, "\tUID\tPID\tArgv")
@ -98,7 +98,7 @@ func (s *simpleStore) mustPrintLauncherState(w **tabwriter.Writer, now time.Time
if !verbose.Get() { if !verbose.Get() {
_, _ = fmt.Fprintf(*w, "\t%s\t%d\t%s\t%s\t%s\t%s\n", _, _ = fmt.Fprintf(*w, "\t%s\t%d\t%s\t%s\t%s\t%s\n",
s.path[len(s.path)-1], state.PID, now.Sub(state.Time).Round(time.Second).String(), strings.TrimPrefix(ets.String(), ", "), state.Launcher, s.path[len(s.path)-1], state.PID, now.Sub(state.Time).Round(time.Second).String(), strings.TrimPrefix(ets.String(), ", "), state.Method,
state.Command) state.Command)
} else { } else {
// emit argv instead when verbose // emit argv instead when verbose

4
internal/state/state.go
View File

@ -33,8 +33,8 @@ type State struct {
// capability enablements applied to child // capability enablements applied to child
Capability system.Enablements Capability system.Enablements
// resolved launcher path // user switch method
Launcher string Method string
// full argv whe launching // full argv whe launching
Argv []string Argv []string
// process start time // process start time