Andy Dixon
e61122961b
Bounded operations instead of a shell (ADR-0011): service.status, service.restart and logs.query run systemctl/journalctl from a fixed allow-list with no shell, a minimal environment, validated unit names and the unit as the derived policy target; logs mask e-mail and IP addresses and credential-like values by default. host.disk.usage, host.memory.status and host.process.list read the kernel directly and never read command lines. browser.navigate/read/links fetch through the SSRF-safe client, run no scripts, refuse cross-host redirects, use the host as the policy target and deliver content as low-trust observations. Writing browser operations are designed but not registered. The test harness takes a fake command runner so no test touches a real unit.
15 lines
318 B
Go
15 lines
318 B
Go
//go:build linux
|
|
|
|
package host
|
|
|
|
import "syscall"
|
|
|
|
func statfs(path string) (total, free uint64, err error) {
|
|
var st syscall.Statfs_t
|
|
if err := syscall.Statfs(path, &st); err != nil {
|
|
return 0, 0, err
|
|
}
|
|
bs := uint64(st.Bsize) // #nosec G115 -- block size is positive
|
|
return st.Blocks * bs, st.Bavail * bs, nil
|
|
}
|