sysknife-daemon 0.29.0

Policy-enforced, audit-logged Linux action daemon for SysKnife
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

[package]
name = "sysknife-daemon"
version = "0.29.0"
edition.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
description = "Policy-enforced, audit-logged Linux action daemon for SysKnife"
readme = "README.md"
keywords = ["linux", "sysadmin", "daemon", "security"]
categories = ["command-line-utilities", "os::linux-apis"]

[features]
# Unlocks `AttributionCensus::from_counts_for_tests` for the CLI's rendering
# tests. Off by default so a census cannot be conjured in production code, which
# is the invariant the type's private fields exist to protect.
test-support = []

[lints.rust]
# cargo-fuzz builds with `--cfg fuzzing`; declare it so the `#[cfg(fuzzing)]`
# fuzz hooks do not trip `unexpected_cfgs` (and `-D warnings`) in normal builds.
unexpected_cfgs = { level = "warn", check-cfg = ["cfg(fuzzing)"] }

[dependencies]
sysknife-core = { path = "../sysknife-core", version = "0.29.0" }
sysknife-types = { path = "../sysknife-types", version = "0.29.0" }
rusqlite = { version = "0.40", features = ["bundled"] }
serde = { workspace = true, features = ["derive"] }
serde_json = { workspace = true }
thiserror = { workspace = true }
async-trait = "0.1"
tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "process", "rt-multi-thread", "signal"] }
uuid = { version = "1", features = ["serde", "v4"] }
sha2 = "0.11"
hmac = "0.13"
hkdf = "0.13"
ed25519-dalek = { version = "3", features = ["zeroize"] }
hex = "0.4"
subtle = "2"
zeroize = { version = "1", features = ["derive"] }
tokio-vsock = "0.7.2"
# SO_PEERPIDFD getsockopt + pidfd_send_signal for race-free peer-role resolution
# on the Unix socket (see dispatcher::resolve_caller_role). Linux-only path.
libc = "0.2"

# Postgres backend (#147). Cloud-provider compatible via rustls + webpki-roots.
# Audit-log writes use the same wire-format-compatible URL across AWS RDS,
# GCP Cloud SQL, Azure Database for PostgreSQL Flexible Server, Supabase,
# Neon, and self-hosted PostgreSQL. Statement cache is configurable
# so the same binary works behind transaction-mode PgBouncer (Supabase
# pooler).
# We pull `sqlx-postgres` and `sqlx-core` directly (not the umbrella `sqlx`
# crate) so we don't drag in the `sqlx-sqlite` transitive dep. Its bundled
# `libsqlite3-sys` would clash with `rusqlite`'s at the cargo
# `links = "sqlite3"` level (only one crate may link the native `sqlite3`).
sqlx-core = { version = "0.9", default-features = false, features = [
    "_rt-tokio",
    "_tls-rustls-ring-webpki",
    "json",
    "uuid",
    "chrono",
] }
sqlx-postgres = { version = "0.9", default-features = false, features = [
    "json",
    "uuid",
    "chrono",
] }
chrono = { version = "0.4", features = ["serde"] }

[dev-dependencies]
sysknife-brain = { path = "../sysknife-brain", version = "0.29.0" }
# `test-util` provides the paused test clock, so deadline tests assert on the
# timer firing instead of sleeping for the real duration.
tokio = { version = "1", features = ["test-util"] }
serde_json = { workspace = true }
syslog_loose = "0.23"
tempfile = "3"