sysknife-daemon 0.17.0

Policy-enforced, audit-logged Linux action daemon for SysKnife
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

//! certbot / ACME certificate actions.
//!
//! `GetCertificates` (`certbot certificates`) is read-only. `ObtainCertificate`
//! and `RenewCertificates` run `certbot` directly (scoped argv). Every input is
//! validated before it reaches `certbot`.
//!
//! Network-gated: `certbot` is not on the base cloud image and ACME issuance
//! needs outbound network + a DNS/HTTP challenge, so these could not be
//! live-validated in the sandbox — only the argv construction (unit tests).

use super::{command_mechanism, ActionSpec};
use sysknife_types::RiskLevel;

pub fn specs() -> Vec<ActionSpec> {
    vec![
        get_certificates(),
        obtain_certificate(
            &["example.com".to_string()],
            "admin@example.com",
            "standalone",
        ),
        renew_certificates(),
    ]
}

/// List managed certificates (`certbot certificates`). Read-only.
pub fn get_certificates() -> ActionSpec {
    ActionSpec {
        action_name: "GetCertificates",
        mechanism: command_mechanism("certbot", ["certificates"]),
        risk_level: RiskLevel::Low,
        reboot_required: false,
        rollback_available: false,
    }
}

/// Obtain a certificate non-interactively. `domains` is a pre-validated list;
/// `challenge` is one of `standalone`/`nginx`/`apache` (validated upstream).
pub fn obtain_certificate(domains: &[String], email: &str, challenge: &str) -> ActionSpec {
    let mut args = vec![
        "certbot".to_string(),
        "certonly".to_string(),
        "--non-interactive".to_string(),
        "--agree-tos".to_string(),
        format!("--{challenge}"),
        "-m".to_string(),
        email.to_string(),
    ];
    for d in domains {
        args.push("-d".to_string());
        args.push(d.clone());
    }
    ActionSpec {
        action_name: "ObtainCertificate",
        mechanism: command_mechanism("sudo", args),
        risk_level: RiskLevel::High,
        reboot_required: false,
        rollback_available: false,
    }
}

/// Renew all due certificates (`certbot renew`).
pub fn renew_certificates() -> ActionSpec {
    ActionSpec {
        action_name: "RenewCertificates",
        mechanism: command_mechanism("sudo", ["certbot", "renew"]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::actions::ActionMechanism;

    fn args_of(spec: &ActionSpec) -> (&'static str, Vec<String>) {
        match &spec.mechanism {
            ActionMechanism::Command { program, args } => (program, args.clone()),
            other => panic!("expected Command, got {other:?}"),
        }
    }

    #[test]
    fn get_certs_read_only() {
        let (program, args) = args_of(&get_certificates());
        assert_eq!(program, "certbot");
        assert_eq!(args, vec!["certificates"]);
        assert_eq!(get_certificates().risk_level, RiskLevel::Low);
    }

    #[test]
    fn obtain_builds_multi_domain_argv() {
        let (program, args) = args_of(&obtain_certificate(
            &["a.example.com".to_string(), "b.example.com".to_string()],
            "ops@example.com",
            "standalone",
        ));
        assert_eq!(program, "sudo");
        assert_eq!(
            args,
            vec![
                "certbot",
                "certonly",
                "--non-interactive",
                "--agree-tos",
                "--standalone",
                "-m",
                "ops@example.com",
                "-d",
                "a.example.com",
                "-d",
                "b.example.com",
            ]
        );
        assert_eq!(
            obtain_certificate(&["x.io".to_string()], "e@x.io", "nginx").risk_level,
            RiskLevel::High
        );
    }

    #[test]
    fn renew_shape() {
        let (program, args) = args_of(&renew_certificates());
        assert_eq!(program, "sudo");
        assert_eq!(args, vec!["certbot", "renew"]);
    }
}