NAME

ort-audit — audit ort role access

SYNOPSIS

DESCRIPTION

Accepts ort(5) config files, defaulting to standard input, and generates an audit report on standard output. Its arguments are as follows:

-v

Instead of printing once whether a structure is reachable, print for each query and path to the reachable structure.

-r role

Audit the named role.

By default, the all role is audited.

Output consists of three space-separated columns. The first column is the type of operation, the second is the component accessable along with extra information, and the third is the location in the configuration where the component was parsed.

The types of operation are count, delete, insert, iterate, list, read, readwrite, search, and update. All of these correspond to operations except for read and readwrite, which refer to whether a structure is reachable through a query (read); and if so (readwrite), whether it may be exported. If -v is used, reachable structures are shown for each query and path possible.

The component (and source) depends upon the operation:

• If the operation is an insert, the component and source are the structure and insert position.
• If an update or delete, it's the operation's structure, name, and position. If anonymous, a hyphen ‘-’ is shown instead of the name. The structure and operation name are separated by a colon.
• For queries, the structure and name of the query (or a hyphen, if anonymous) and position.
• For reachable structures, the structure name and position unless -v is specified, in which case it's the structure name, the originating query type and name, and the path to the structure along nested structures, with each path component separated by a period. If the structure is reachable at the query origin, the path is a hyphen. The source is the query position.

The position is listed as the originating file, line, and column.

EXIT STATUS

The ort-audit utility exits 0 on success, and >0 if an error occurs.

EXAMPLES

Consider the following db.ort:

roles {
        role foo;
        role bar;
};
struct baz {
        field id int rowid;
};
struct bar {
	field baz struct bazid;
	field bazid:baz.id int;
        field id int rowid;
        insert;
        iterate: name id;
        roles foo { insert; };
        roles bar { iterate id; };
};

When audited, this produces the following:

% ort-audit -r foo db.ort
insert      bar  db.ort:8:7
% ort-audit -vr bar db.ort
iterate     bar:id              db.ort:13:15
readwrite   bar:iterate:id:-    db.ort:13:15
readwrite   baz:iterate:id:baz  db.ort:13:15

From this, it's clear that the "foo" role has no access to the "baz" or "bar" structures at all, and can only insert.

SEE ALSO

ort(5)