1package app
2
3import (
4 "fmt"
5
6 "github.com/spf13/viper"
7
8 "github.com/bnema/gordon/internal/domain"
9)
10
11// AppCapabilityPolicy is one administrative Linux capability grant declared
12// under [app_capabilities.<name>]. The map key is the stable logical name an
13// app manifest `capabilities` list references. Add holds the explicit
14// capability names added on top of Gordon's default set (only the safe set
15// documented in domain.AllowedAppCapabilities is accepted). AllowedApps and
16// AllowedServices are exact, non-empty allowlists.
17type AppCapabilityPolicy struct {
18 Add []string `mapstructure:"add"`
19 AllowedApps []string `mapstructure:"allowed_apps"`
20 AllowedServices []string `mapstructure:"allowed_services"`
21}
22
23// knownAppCapabilityKeys is the allowlist of [app_capabilities.<name>]
24// sub-keys. Unknown keys (for example a typo like "adds") fail closed
25// instead of silently dropping a grant.
26var knownAppCapabilityKeys = map[string]struct{}{
27 "add": {},
28 "allowed_apps": {},
29 "allowed_services": {},
30}
31
32// validateAppCapabilityKeys rejects unknown sub-keys inside
33// [app_capabilities.*]. Viper unmarshals leniently, so a typo would
34// otherwise drop the grant silently.
35func validateAppCapabilityKeys(caps map[string]any) error {
36 for name, raw := range caps {
37 entry, ok := raw.(map[string]any)
38 if !ok {
39 return fmt.Errorf("invalid app_capabilities.%s: entry must be a table", name)
40 }
41 for key := range entry {
42 if _, ok := knownAppCapabilityKeys[key]; !ok {
43 return fmt.Errorf("invalid app_capabilities.%s: unknown key %q (allowed: add, allowed_apps, allowed_services)", name, key)
44 }
45 }
46 }
47 return nil
48}
49
50// buildAppCapabilityPolicies converts configured capability grants into
51// validated domain policies. Config errors keep the field-level reason and
52// the offending capability name (a public Linux name, not host inventory) so
53// the operator can fix the list; app and service names are redacted.
54func buildAppCapabilityPolicies(cfg Config) (map[string]domain.AppCapabilityPolicy, error) {
55 policies := make(map[string]domain.AppCapabilityPolicy, len(cfg.AppCapabilities))
56 for name, grant := range cfg.AppCapabilities {
57 policy := domain.AppCapabilityPolicy{
58 Name: name,
59 Add: append([]string(nil), grant.Add...),
60 AllowedApps: append([]string(nil), grant.AllowedApps...),
61 AllowedServices: append([]string(nil), grant.AllowedServices...),
62 }
63 if err := policy.Validate(); err != nil {
64 return nil, fmt.Errorf("invalid app_capabilities.%s: %w: %s", name, domain.ErrCapabilityPolicy, capabilityPolicyReason(err, policy))
65 }
66 policies[name] = policy
67 }
68 return policies, nil
69}
70
71// capabilityPolicyReason keeps the actionable reason of a validation error.
72// Capability names in the grant are public Linux names, so a rejected
73// capability keeps its name and the allowed list; every other quoted value
74// (app and service names) is stripped.
75func capabilityPolicyReason(err error, policy domain.AppCapabilityPolicy) string {
76 if capErr := domain.ValidateAddableCapabilities(policy.Add); capErr != nil && len(policy.Add) > 0 {
77 return capErr.Error()
78 }
79 return redactedDevicePolicyReason(err)
80}
81
82// validateCapabilityConfig validates the [app_capabilities] subtree:
83// unknown keys fail closed, then the decoded policies validate.
84func validateCapabilityConfig(v *viper.Viper, cfg Config) error {
85 if err := validateAppCapabilityKeys(v.GetStringMap("app_capabilities")); err != nil {
86 return err
87 }
88 _, err := buildAppCapabilityPolicies(cfg)
89 return err
90}