Andy Dixon
e61122961b
Bounded operations instead of a shell (ADR-0011): service.status, service.restart and logs.query run systemctl/journalctl from a fixed allow-list with no shell, a minimal environment, validated unit names and the unit as the derived policy target; logs mask e-mail and IP addresses and credential-like values by default. host.disk.usage, host.memory.status and host.process.list read the kernel directly and never read command lines. browser.navigate/read/links fetch through the SSRF-safe client, run no scripts, refuse cross-host redirects, use the host as the policy target and deliver content as low-trust observations. Writing browser operations are designed but not registered. The test harness takes a fake command runner so no test touches a real unit.
10 lines
171 B
Go
10 lines
171 B
Go
//go:build !linux
|
|
|
|
package host
|
|
|
|
import "errors"
|
|
|
|
func statfs(string) (uint64, uint64, error) {
|
|
return 0, 0, errors.New("host.disk.usage is only implemented on Linux")
|
|
}
|