File access and POSIX ACLs

Since 0.0.69, check access for an explicit container identity, including POSIX ACLs managed with setfacl.

1. Configure paths and identity

dir-groups:
  app:
    paths: [/data, /etc/app/settings.json]
    access:
      uid: 1000
      gid: 1000
      groups: [1000]

IDs belong to the container namespace. List every expected group, including the primary GID. The probe verifies its actual identity and groups and rejects effective or permitted capabilities. It never silently falls back to root.

2. Request access checks

monit-docker -c monit-docker.yml stats --rsc 'fs_readable[app]' --rsc 'fs_writable[app]' --rsc 'fs_executable[app]'

Each result is 1 (allowed) or 0 (denied). For a directory, executable means search/traversal. Python 3 must exist inside each target container. The isolated standard-library probe uses kernel os.access, because shell permission tests such as BusyBox’s can ignore ACL entries. Missing prerequisites or unverifiable identities fail collection rather than report healthy access. No files or ACLs are modified.

3. Understand ACLs and limitations

Real Docker tests cover named users/groups, masks, default ACLs, files and directories. An ACL mask can remove write access granted to a named user; default ACLs affect newly created children, not access to the parent itself. Symlinks are followed. This is an access prediction for the probe: it does not prove that an application can create, write, delete or execute a file. Quotas, mount flags, sticky bits, security contexts and later changes can affect the operation.

SELinux/AppArmor application contexts and NFSv4/SMB server ACL semantics are not reproduced or certified. The public demo does not enable these probes across its mixed container images; use the configuration on your own compatible targets.

4. Use rules and metrics

monit-docker -c monit-docker.yml cron --state-file /var/lib/monit-docker/state.json --dry-run --cmd-if 'fs_writable[app] == 0 ? restart'

A group matches when at least one path satisfies its conditions. To detect any unwritable path, test == 0; == 1 does not assert that all paths are writable. Rules accept equality/inequality with 0 or 1. Prometheus exposes monit_docker_container_fs_readable, monit_docker_container_fs_writable and monit_docker_container_fs_executable with container, group and path labels. Start with a dry run before enabling remediation.