Add a read-only mounts module: no tool could read a machine's fstab, mount units or exports

2026-10-08 18:36:01 +02:00
parent 0ad8f02fab
commit 3251758340
11 changed files with 1239 additions and 0 deletions
@@ -0,0 +1,55 @@
+package main
+
+import (
+	"strings"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+// Tools is the module's tools over one machine. Every one only reads.
+func Tools(m *Machine) []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "mounts_list",
+			Description: "This machine's mounts as fstab and the service manager know them, joined by mount point: each /etc/fstab line " +
+				"(source, type, options, dump and pass), its mount and automount units (state, result, timeout, and whether generated " +
+				"from fstab or a unit file), and whether it is mounted now (from /proc/self/mountinfo, never by touching the mount point, " +
+				"so a server that is away cannot hang the call). Network filesystems (NFS, SMB, sshfs) are marked, and a network mount " +
+				"without automount or nofail is said. Credentials in options are never answered. Each mount is said in a line under " +
+				"`said`. Replaces cat /etc/fstab, findmnt and systemctl list-units --type=mount. (r)",
+			Input: map[string]any{
+				"network": map[string]any{"type": "boolean", "description": "only network filesystems (default false)"},
+				"match":   map[string]any{"type": "string", "description": "only mounts whose mount point or source contains this"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				return m.List(flag(args, "network"), text(args, "match")), nil
+			},
+		},
+		{
+			Name: "mounts_exports",
+			Description: "What this machine shares over the network: every NFS export in /etc/exports and /etc/exports.d (path, client, " +
+				"options, file), the kernel's live export table, the ZFS sharenfs and sharesmb properties where ZFS is present, the " +
+				"Samba shares in smb.conf (path, valid users, read only or writable, force user — never a password), and whether " +
+				"nfs-server and smb are active. An export that is declared and not live, or live and declared nowhere, is said. " +
+				"Replaces cat /etc/exports, exportfs -v, zfs get sharenfs and testparm -s. (r)",
+			Run: func(map[string]any) (any, error) {
+				return m.Exports(), nil
+			},
+		},
+	}
+}
+
+func text(args map[string]any, key string) string {
+	s, _ := args[key].(string)
+	return strings.TrimSpace(s)
+}
+
+func flag(args map[string]any, key string) bool {
+	switch v := args[key].(type) {
+	case bool:
+		return v
+	case string:
+		return v == "true"
+	}
+	return false
+}