bastion 0.63.1

client-go/anchorpolicy_other.go

@@ -0,0 +1,37 @@
+//go:build !windows && !darwin
+
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"syscall"
+)
+
+// anchorPolicyFile is the managed configuration an organisation deploys to a
+// Linux machine (by its configuration management) for the bastion: root's,
+// and writable by nobody else. A file anyone else could have written is not a
+// policy.
+var anchorPolicyFile = "/etc/privatae-bastion/policy.json"
+
+func readAnchorPolicyOS() *anchorPolicy {
+	fi, err := os.Lstat(anchorPolicyFile)
+	if err != nil || !fi.Mode().IsRegular() || fi.Mode().Perm()&0o022 != 0 {
+		return nil
+	}
+	if st, ok := fi.Sys().(*syscall.Stat_t); !ok || st.Uid != 0 {
+		return nil
+	}
+	raw, err := os.ReadFile(anchorPolicyFile)
+	if err != nil {
+		return nil
+	}
+	var p struct {
+		AnchorHost string `json:"anchor_host"`
+	}
+	if json.Unmarshal(raw, &p) != nil || strings.TrimSpace(p.AnchorHost) == "" {
+		return nil
+	}
+	return &anchorPolicy{Host: p.AnchorHost, Source: anchorPolicyFile + " anchor_host"}
+}