{{define "policy-page"}} Privatae bastion — what would be stopped

What would be stopped

A rule this machine runs against everything automated it can see, and a record of what it would have stopped while nobody was watching. It is a rehearsal: nothing here has any power to close a program.

← This machine · Automated programs running here

{{end}} {{define "policy"}} {{/* A build with no enumerator has to say so. "Nothing would be stopped" and "nothing looked" read identically otherwise, and the second is the machine you should worry about (agents_other.go, the README, "Observe"). */}} {{if .Blind}}

This machine cannot watch itself.

This build of the bastion has no way to list processes or connections on this platform. The rule below has nothing to run against, so read the empty list as "nothing looked", never as "nothing is running".

{{end}} {{/* A read that FAILED is not a machine with nothing on it. Every verdict below is unreachable while this is true, and no count is worth printing. */}} {{if .RegistryError}}

This machine cannot read its own record of what you marked as yours.

Every judgement below needs that record, so this rule cannot judge anything until it is fixed. It is not reporting that there is nothing to judge.

{{end}} {{/* A walk that FAILED for this render is Blind for one pass: the rows below are empty because nothing looked. Said before the rows, for the same reason. */}} {{if .WalkError}}

This machine could not read its processes just now.

The rule had nothing to run against on this render, so read the empty list as "nothing looked", never as "nothing would have been stopped". Reload to try again.

The record of what this rule would have stopped is not being written.

{{.CensusError}}{{if .CensusErrorAt}} · {{.CensusErrorAt}}{{end}}

The list further down is whatever was written before that started. Do not read it as up to date.

{{end}} {{/* ...and not under the walk banner: a failed walk must never draw the tick. */}} {{if not .Blind}}{{if not .RegistryError}}{{if not .WalkError}}

{{.WouldStop}} of {{.Observed}} would be stopped by this rule.

Nothing has been stopped. This is what the rule would do if it were ever allowed to act, listed so you can decide whether it would have been right.

Nothing running here would be stopped by this rule.

{{.Observed}} automated programs were looked at. Every one of them is either something a person is running, or something that has been vouched for.

Nothing automated is running on this machine.

This machine looked; it did not find anything for the rule to run against.

{{.CannotJudge}} of {{.Observed}} cannot be judged at all. A term this rule needs could not be read for them. That is a blind spot, not a clean bill of health.

This page cannot stop anything. There is no button here, and no route behind this page that closes a program. Stopping something on this machine is directed by your host. This rule is measured first so that whether it should ever act is a decision somebody makes with evidence.

{{/* The rule, in the same words for everyone who reads this page. It lives beside the code that implements it (policy.go policyRuleLines) so that changing a term and forgetting the sentence is one file's mistake. */}}

The rule

A program is proposed for stopping only when all four are true of it at once.

{{.Term}} {{.Detail}}

Right now

{{if .Signature}}{{.Signature}}{{else}}(unnamed){{end}} {{.Kind}} {{.Word}}

Process: {{.PID}}{{if .User}}, running as {{.User}}{{end}}
Started: {{.Origin}}
Command: {{.Cmdline}}
Talking to: {{range $i, $e := .Endpoints}}{{if $i}}, {{end}}{{$e}}{{end}}

{{/* Every term, not only the one that decided it. A verdict nobody can audit is a verdict nobody should trust, and the plane it reads from emits typed evidence rather than a bare answer for the same reason (agents.go:183-188). */}}

{{.Tier}} {{.Term}} {{.Detail}}

{{end}} {{/* ── the census ──────────────────────────────────────────────────────────── The question step 4 is waiting on is not "what would be stopped now" but "what would this have killed over a week, and would that have been wrong". A page that only rendered the current scan would answer neither. */}}

What this would have stopped

{{/* A read that FAILED is not a machine that never measured anything. The two were one branch until a review of this file caught it: an unparseable record would have rendered the most reassuring sentence on the page. */}} {{if .CensusUnreadable}}

This machine could not read that record, so nothing is listed here and the space below it is not an absence. The banner at the top of the page says why. Until that is fixed the honest answer is "not known".

This machine has not taken this measurement yet.

The record is written by the running bastion, once a minute. If the bastion is not running here, or has only just started, there is nothing to show — which is not the same as nothing having happened.

Measured since {{.CensusSince}} — {{.CensusWindow}}. Last looked {{.CensusLast}}. A program that appears and exits between two scans is not seen at all, and the times below are kept to about five minutes so that watching this does not mean writing to your disk every minute.

This measurement has stopped.

The last scan was {{.CensusLast}}, which is longer ago than it should be. What is below is history: it is not what this machine would do now.

{{.PastDropped}} older entries have been dropped to bound the file. The oldest go first.

{{end}} {{if .Past}} {{/* "Vouched for since" is read out of the mark registry, so a registry this machine could not load cannot produce that number — and a 0 there is the same reassuring lie the banner at the top exists to stop. The rows below still render; each one says it cannot be judged. */}} {{if .RegistryError}}

{{.PastTotal}} would have been stopped. How many were mistakes is not known.

Answering that needs the record of what you have marked as yours, which this machine could not read. The rows below are what would have been stopped; what became of each one is not something this page can say right now.

{{else if .WalkError}} {{/* The vouched count is read from the registry and is real; "still a candidate right now" is read from the walk, which did not happen. */}}

{{.PastTotal}} would have been stopped. Vouched for since: {{.PastVouched}}.

Every one in that second number is a program this rule would have taken away from you by mistake, and that number is what decides whether it should ever be allowed to act. Still a candidate right now: not known — this machine could not read its processes just now. If one of these is yours, say so on the automated programs page — this rule reads the same record.

{{.PastTotal}} would have been stopped. Vouched for since: {{.PastVouched}}.

Every one in that second number is a program this rule would have taken away from you by mistake, and that number is what decides whether it should ever be allowed to act. Still a candidate right now: {{.PastStill}}. If one of these is yours, say so on the automated programs page — this rule reads the same record.

{{.What}} {{if .Still}}still a candidate {{else if .Vouched}}vouched for since {{else}}{{.Status}}{{end}}

{{.Status}}{{if .Because}} — {{.Because}}{{end}}

First proposed: {{.FirstSeen}}
Last proposed: {{.LastSeen}}
Started: {{.Origin}}
Looked like: {{.Cmdline}}
Was talking to: {{range $i, $e := .Endpoints}}{{if $i}}, {{end}}{{$e}}{{end}}

Nothing has been proposed for stopping in that time. This machine looked and found nothing, which is a different sentence from the one above it.

Checked {{.CheckedAt}}. What this machine can see is deliberately soft: a program that does not want to be noticed can rename itself, and a mark is a convenience, not a lock. This rule inherits every one of those limits.