depcaps - map capabilities of dependencies against a set of allowed capabilities

depcaps maps capabilities of dependencies agains a set of allowed capabilities.

List of reported capabilities:

• CAPABILITY_UNSPECIFIED
• CAPABILITY_SAFE
• CAPABILITY_FILES
• CAPABILITY_NETWORK
• CAPABILITY_RUNTIME
• CAPABILITY_READ_SYSTEM_STATE
• CAPABILITY_MODIFY_SYSTEM_STATE
• CAPABILITY_OPERATING_SYSTEM
• CAPABILITY_SYSTEM_CALLS
• CAPABILITY_ARBITRARY_EXECUTION
• CAPABILITY_CGO
• CAPABILITY_UNANALYZED
• CAPABILITY_UNSAFE_POINTER
• CAPABILITY_REFLECT
• CAPABILITY_EXEC

Installation

Download depcaps from the releases or get the latest version from source with:

go get github.com/breml/depcaps/cmd/depcaps

Usage

Shell

Check everything:

depcaps ./...

Config JSON file

The config JSON file allows to define a set of accepted capabilities. Capabilities can be accepted globally or on a per package level.

The config JSON file has the following structure (github.com/google/uuid just serves as an example package):

{
  "GlobalAllowedCapabilities": {
    "CAPABILITY_UNSPECIFIED": true
  },
  "PackageAllowedCapabilities": {
    "github.com/google/uuid": {
      "CAPABILITY_RUNTIME": true
    }
  }
}

Reference file

A reference file can be generated by using capslock:

capslock -noisy -output json -packages ./... > reference.json

In order to verify against a capslock reference file the following command can be used:

depcaps -reference reference.json ./...

A reference file and a config file might be combined. In this case, the actual capabilities are first compared against the reference. The remaining offending capabilites are then compared against the allowed capabilites in the config JSON. Only the remaining offending capabilities after both comparisons are reported.

Inspiration

• capslock
• Capslock: What is your code really capable of?