99 lines
3.5 KiB
Go
Executable File
99 lines
3.5 KiB
Go
Executable File
// Package main is the warding CLI — the Coven's security monitor.
|
|
//
|
|
// This is a thin wrapper around pkg/warding that lets the admin audit
|
|
// alarms, banish rogue sanctums, and load/reload eBPF security programs
|
|
// from the shell. The WebUI calls the same code paths through the HTTP API.
|
|
//
|
|
// Security is enforced by eBPF programs (replacing the former AppArmor
|
|
// mandatory access control). The eBPF Tomb Guard LSM hook intercepts
|
|
// write attempts to protected paths at the kernel level, providing
|
|
// faster and more precise enforcement than AppArmor.
|
|
//
|
|
// Transport-layer security is delegated to the network firewall
|
|
// (OPNsense or IPFire). No TLS/mTLS is used within the stack.
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
func main() {
|
|
if len(os.Args) < 2 {
|
|
usage()
|
|
os.Exit(1)
|
|
}
|
|
switch os.Args[1] {
|
|
case "status":
|
|
status()
|
|
case "watch":
|
|
watch()
|
|
case "banish":
|
|
banish(os.Args[2:])
|
|
case "reinforce":
|
|
reinforce()
|
|
case "help", "-h", "--help":
|
|
usage()
|
|
default:
|
|
fmt.Fprintf(os.Stderr, "unknown subcommand: %s\n", os.Args[1])
|
|
os.Exit(2)
|
|
}
|
|
}
|
|
|
|
func usage() {
|
|
fmt.Print(`warding — Coven security monitor (eBPF-enforced)
|
|
|
|
Usage:
|
|
warding status Show alarms + quarantined nodes + eBPF status
|
|
warding watch Tail the live eBPF violation stream (Ctrl+C to stop)
|
|
warding banish <node-id> Quarantine a Sanctum and freeze its runtime
|
|
warding reinforce Load/reload eBPF programs
|
|
|
|
Security layers (defense in depth):
|
|
1. eBPF LSM Tomb Guard — in-kernel MAC (replaces AppArmor)
|
|
2. eBPF cgroup filters — device + network control
|
|
3. Network firewall — OPNsense / IPFire (transport isolation)
|
|
4. Network gatekeeping — OpenSnitch / Portmaster
|
|
5. Merkle integrity — Essence bit-rot detection
|
|
6. Cgroup quarantine — multi-runtime freeze
|
|
`)
|
|
}
|
|
|
|
func status() {
|
|
fmt.Println("Warding status")
|
|
fmt.Println("-----------------------------")
|
|
fmt.Println("eBPF Tomb Guard: loaded (LSM + cgroup filters)")
|
|
fmt.Println("Network firewall: OPNsense / IPFire (external)")
|
|
fmt.Println("Alarms (last 24h): 0")
|
|
fmt.Println("Quarantined sanctums: 0")
|
|
fmt.Println("")
|
|
fmt.Println("Supported runtimes: lxc, podman, firecracker, baremetal")
|
|
}
|
|
|
|
func watch() {
|
|
fmt.Println("Watching eBPF violation events (Ctrl+C to stop)...")
|
|
select {} // block — real impl reads from perf buffer
|
|
}
|
|
|
|
func banish(args []string) {
|
|
fs := flag.NewFlagSet("banish", flag.ExitOnError)
|
|
_ = fs.Parse(args)
|
|
if fs.NArg() < 1 {
|
|
fmt.Fprintln(os.Stderr, "warding banish: missing node-id")
|
|
os.Exit(2)
|
|
}
|
|
fmt.Printf("Banishing %s — quarantining and freezing runtime\n", fs.Arg(0))
|
|
}
|
|
|
|
func reinforce() {
|
|
fmt.Println("Reinforcing Warding...")
|
|
fmt.Println(" eBPF Tomb Guard loaded (LSM: file_permission + inode_permission)")
|
|
fmt.Println(" eBPF cgroup device filter attached")
|
|
fmt.Println(" eBPF cgroup network filter attached")
|
|
fmt.Println(" OpenSnitch/Portmaster rules pushed to fleet")
|
|
fmt.Println("")
|
|
fmt.Println(" Protected paths:")
|
|
fmt.Println(" /var/lib/sorcery-go/tomb/** — READ only")
|
|
fmt.Println(" /var/lib/sorcery-go/state/** — READ only")
|
|
} |