Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Careful handling when loading files
This commit attempts to provide a common API so that the decision of when to follow symlinks is a conscious decision.
Because Teleport (particularly the agent) runs in a privilege context, there is risk that following symlinks may allow information disclosure.
After review of the cases covered in this commit (and some additional cases where this API was not a natural fit), this does not appear to be a broad problem. This commit however does fix the one known flaw described in the issue https://github.com/gravitational/teleport-private/issues/1009
* Apply PR feedback to rename OpenFile
* fs.go: Fix symlink evaluation
* fs.go: Fix for rebuilding absolute paths in symlink check
* fs_test.go: Add symlink testing
* Apply suggestions from code review
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* fs_test.go: Fix build for err reference
* fs.go: Apply PR feedback and consider Hardlinks
After PR discussion it was highlighted that MacOS does not guard against hardlinks in the same way linux does. For that reason this implementation has been updated with OS conditional logic to validate against hardlinks.
* fs.go: Switch loop to range over components instead of index
* Minor improvements from PR feedback
* fs_test.go: Test public OpenFile API's and include OS specific validation
* Fix windows build
Make hardlink count lookup code build conditional to avoid undefined syscall.Stat_t.
* utils.getHardLinkCount result order update from PR feedback
* fs_windows.go: Comment improvements from PR feedback
* fs: Fix build for OSX
* Disable lint error due to unecessary cast on linux
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
Added package cgroup to orchestrate cgroups. Only support for cgroup2
was added to utilize because cgroup2 cgroups have unique IDs that can be
used correlated with BPF events.
Added bpf package that contains three BPF programs: execsnoop,
opensnoop, and tcpconnect. The bpf package starts and stops these
programs as well correlating their output with Teleport sessions
and emitting them to the audit log.
Added support for Teleport to re-exec itself before launching a shell.
This allows Teleport to start a child process, capture it's PID, place
the PID in a cgroup, and then continue to process. Once the process is
continued it can be tracked by it's cgroup ID.
Reduced the total number of connections to a host so Teleport does not
quickly exhaust all file descriptors. Exhausting all file descriptors
happens very quickly when disk events are emitted to the audit log which
are emitted at a very high rate.
Added tarballs for exec sessions. Updated session.start and session.end
events with additional metadata. Updated the format of session tarballs
to include enhanced events.
Added file configuration for enhanced session recording. Added code to
startup enhanced session recording and pass package to SSH nodes.
rosstimothy