oceans2alaska/Samsara
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retain infrastructure names and share/mount roots behind policy switches

Browse Source 
Add a `retain` block to privacy_policy.json (all on by default) so assessments
show software, services, processes, tasks, shares/mounts and private peer IPs.
Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset,
length, path depth). Accounts, command lines, child paths, filenames and public
peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated;
tests cover retention, withholding and all-switches-off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Not Dave
2026-11-04 19:03:49 -08:00
parent 610a3bb447
commit b4c0cf12ca
16 changed files with 189 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
powershell/Inventory.Common.ps1
View File

@@ -84,10 +84,22 @@ function Get-SamsaraPrivacyConfiguration {
}
}
function Test-SamsaraRetain {
# Mirrors the `retain` block of privacy_policy.json; Python re-validates every value.
param([string]$Flag, [string]$Value, [switch]$Path)
Get-SamsaraPrivacyConfiguration
if ($script:SamsaraPrivacy.retain.$Flag -ne $true -or [string]::IsNullOrEmpty($Value)) { return $false }
if ($Value -match '[0-9]{6,}' -or $Value -match '(^|[\\/])\.\.([\\/]|$)') { return $false }
if ($Path) { return ($Value.Length -le 260 -and $Value -match "^([A-Za-z]:)?[\\/A-Za-z0-9 ._()+#`$,&'-]*$") }
return ($Value.Length -le 120 -and $Value -match "^[A-Za-z0-9][A-Za-z0-9 ._()+#`$:,&'@-]*$")
}
function Get-SamsaraPublicName {
param([string]$Kind, [string]$Value, [int]$Index)
Get-SamsaraPrivacyConfiguration
$normalized = $Value.ToLowerInvariant() -replace '\.(exe|service)$', ''
$flag = switch ($Kind) { 'products' {'software_names'} 'processes' {'process_names'} default {'service_names'} }
if (Test-SamsaraRetain $flag $Value) { return $Value }
if ($Kind -eq 'services' -and $script:SamsaraPrivacy.approved_service_names -ccontains $Value) { return $Value }
if ($Kind -eq 'products') {
if ($script:SamsaraPrivacy.approved_software_names -ccontains $Value) { return $Value }
@@ -108,6 +120,7 @@ function Get-SamsaraPublicName {
function Get-SamsaraApprovedRoot {
param([string]$Value)
Get-SamsaraPrivacyConfiguration
if (Test-SamsaraRetain 'storage_names_and_roots' $Value -Path) { return $Value }
if ($Value -notmatch '^[A-Za-z]:\\' -or $Value -match '(^|[\\/])\.\.([\\/]|$)' -or $Value -match '[\x00-\x1f]') { return 'Omitted by privacy policy' }
foreach ($root in $script:SamsaraPrivacy.approved_share_roots) {
if ($root -match '^[A-Za-z]:\\' -and $Value.TrimEnd([char]'\').Equals(([string]$root).TrimEnd([char]'\'), [StringComparison]::OrdinalIgnoreCase)) { return $Value }