Privatae
38 lines
974 B
Go
38 lines
974 B
Go
//go:build !windows && !darwin
|
|
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"strings"
|
|
"syscall"
|
|
)
|
|
|
|
// anchorPolicyFile is the managed configuration an organisation deploys to a
|
|
// Linux machine (by its configuration management) for the bastion: root's,
|
|
// and writable by nobody else. A file anyone else could have written is not a
|
|
// policy.
|
|
var anchorPolicyFile = "/etc/privatae-bastion/policy.json"
|
|
|
|
func readAnchorPolicyOS() *anchorPolicy {
|
|
fi, err := os.Lstat(anchorPolicyFile)
|
|
if err != nil || !fi.Mode().IsRegular() || fi.Mode().Perm()&0o022 != 0 {
|
|
return nil
|
|
}
|
|
if st, ok := fi.Sys().(*syscall.Stat_t); !ok || st.Uid != 0 {
|
|
return nil
|
|
}
|
|
raw, err := os.ReadFile(anchorPolicyFile)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
var p struct {
|
|
AnchorHost string `json:"anchor_host"`
|
|
}
|
|
if json.Unmarshal(raw, &p) != nil || strings.TrimSpace(p.AnchorHost) == "" {
|
|
return nil
|
|
}
|
|
return &anchorPolicy{Host: p.AnchorHost, Source: anchorPolicyFile + " anchor_host"}
|
|
}
|