SettingsPage.hpp

1. Overview

The SettingsPage.hpp header defines the SettingsPage class, a GTKmm (GTK4) configuration UI responsible for managing BastionGuard runtime settings and security modules. The page is structured as a multi-tab notebook and exposes both “base” configuration (quarantine, on-access paths, real-time toggle) and advanced/operational controls (anti-ransomware, anti-phishing, firewall integration, services management, ClamAV DB inspection, localization, and web configuration).

Functionally, SettingsPage provides:

  • Real-time antivirus (clamonacc) status UI and configuration persistence
  • Quarantine path selection and on-access monitored folders management
  • Advanced scan options mapped to ClamdConfig and written to clamd.conf
  • Anti-Ransomware controls, YARA rules management, scanner scheduler configuration
  • Anti-Phishing controls including auto-update, Google Safe Browsing support, and firewall IP blocking
  • Whitelist management for Anti-Phishing
  • “Secure Payments” domain list editor with JSON persistence
  • User/system service toggles via systemctl --user and pkexec systemctl
  • ClamAV database signatures listing from /var/lib/clamav
  • Language selection and service restart flow
  • Web configuration (distro selection + internal HTTP/HTTPS ports + Nginx apply script)

2. Dependencies and Includes

#include <gtkmm.h>
#include "ClamdConfig.hpp"
#include <map>
#include <vector>
#include <string>
  • gtkmm.h – GTK4 widgets, models, signals, dialogs
  • ClamdConfig.hpp – configuration abstraction for clamd scan options and on-access paths
  • <map> – UI option maps and toggle state tracking
  • <vector> – lists of directories/services and data collections
  • <string> – labels, paths, domain entries, service names

3. Class Declaration and Scope

class SettingsPage : public Gtk::Box

The class derives from Gtk::Box and is designed to be embedded in the main UI. It composes multiple tabs via a Gtk::Notebook, and coordinates state between UI controls and persistent/system configuration using helper methods and privileged actions where needed.

4. Public Interface

4.1 Constructor

explicit SettingsPage(ClamdConfig& config);

Initializes all notebook tabs, binds signal handlers, loads persisted configuration, and maps initial state to UI widgets. Receives a reference to ClamdConfig to read/write antivirus scan options and on-access path configuration.

5. Data Models and Column Records

5.1 Samba List Model Columns

struct SambaColumns : public Gtk::TreeModel::ColumnRecord {
    SambaColumns() { add(col_path); add(col_color); }
    Gtk::TreeModelColumn<Glib::ustring> col_path;
    Gtk::TreeModelColumn<Glib::ustring> col_color;
};

Defines the TreeModel schema for Samba directory entries, including a path and a color column used for UI highlighting/status feedback.

5.2 YARA Rule Columns

class RuleColumns : public Gtk::TreeModel::ColumnRecord {
public:
    RuleColumns() { add(name); }
    Gtk::TreeModelColumn<Glib::ustring> name;
};

Defines the model used by the YARA rule list view.

5.3 Phishing List Columns

class PhishColumns : public Gtk::TreeModel::ColumnRecord {
public:
    PhishColumns() { add(source); }
    Gtk::TreeModelColumn<Glib::ustring> source;
};

Defines the list store schema for phishing blacklist sources/status lines.

5.4 Anti-Ransomware Allowlist Columns

struct AllowlistCols : public Gtk::TreeModel::ColumnRecord {
    AllowlistCols() { add(col_hash); add(col_rule); }
    Gtk::TreeModelColumn<Glib::ustring> col_hash;
    Gtk::TreeModelColumn<Glib::ustring> col_rule;
};

Represents SHA256 allowlist entries and optional rule labels to reduce false positives.

6. Core UI Structure

6.1 Notebook Container

Gtk::Notebook notebook;

Top-level tab container. Each feature area (Base, Avanzate, Anti-Ransomware, Anti-Phishing, Services, etc.) is built through a dedicated build_* method.

6.2 Base Page Widgets (Real-time + Quarantine + On-Access Paths)

Gtk::Switch  clamonaccSwitch;
Gtk::Label   realtimeLabel;
Gtk::Label   quarantineLabel;
Gtk::Button  quarantineButton;
Gtk::ListBox listbox_paths;

Gtk::Button  btn_addPath;
Gtk::Button  btn_removePath;
  • clamonaccSwitch – enables/disables real-time scanning UI state
  • realtimeLabel – current status text (enabled/disabled)
  • quarantineLabel – displays current quarantine folder
  • quarantineButton – opens folder chooser
  • listbox_paths – list of monitored directories for on-access scanning
  • btn_addPath / btn_removePath – modify monitored folders list

6.3 Scan Options Mapping (Advanced ClamdConfig)

Gtk::Box box_scanOptions{Gtk::Orientation::VERTICAL};
std::map<std::string, Gtk::CheckButton*> checkOptions;

Gtk::Switch toggleAllSwitch;
Gtk::Label  toggleAllLabel;

Gtk::Button btn_save;

Advanced scan options are presented as checkbuttons stored in a map keyed by option name. A “toggle all” switch supports bulk enabling/disabling with controlled state tracking.

7. Feature Tabs and Related Controls

7.1 Secure Payments Tab

void build_secure_payments_tab();

Builds a UI for editing a domain/URL allowlist used for “Secure Payments” browsing. Persistence is expected via a JSON file under BastionGuard user config scope.

7.2 ClamAV DB Tab

void build_clamav_db_tab();
void refresh_clamav_db_list(Gtk::Box* listBox);
Gtk::Label* clamdb_count_label_ = nullptr;

Displays the signature files found in /var/lib/clamav and updates a counter label.

7.3 Web Configuration (Distro + HTTP/HTTPS Ports + Apply)

Gtk::ComboBoxText combo_os_;
Gtk::Entry entry_http_port_;
Gtk::Entry entry_https_port_;
bool http_updating_ = false;
bool https_updating_ = false;
Gtk::Button btn_apply_webconfig_;

Provides OS selection (or auto-detection), port configuration inputs, and an “apply” action expected to generate/update server configuration (e.g., Nginx) using elevated privileges.

7.4 Anti-Ransomware Tab

Gtk::Switch antiransomSwitch;
Gtk::Label  antiransomStatus;

Glib::RefPtr<Gtk::ListStore> rulesStore;
Gtk::TreeView rulesView;

Gtk::CheckButton chk_enableYara;
Gtk::CheckButton chk_enableSanesecurity;
Gtk::ListBox     listbox_scanPaths;
Gtk::Button      btn_addScanPath;
Gtk::Button      btn_removeScanPath;
Gtk::SpinButton  spin_interval;

Controls Anti-Ransomware service state and scanner parameters: YARA enablement, optional DB sources, scan interval and scan directories, plus visualization of loaded YARA rules.

7.5 Samba Scan Controls

SambaColumns sambaCols;
Glib::RefPtr<Gtk::ListStore> sambaStore;
Gtk::TreeView sambaView;
Gtk::CheckButton chk_enableSamba;
Gtk::Button btnAddSamba, btnRemSamba, btnScanNow;
Gtk::Switch switchEnableSamba;

bool enable_samba = false;
std::vector<std::string> samba_dirs;

UI surface for managing Samba directories, enabling/disabling Samba scanning, and manual scan triggers. Includes validation and collection helpers for list store content.

7.6 Anti-Phishing Tab + Google Safe Browsing

Gtk::Switch antiphishSwitch;
Gtk::Label  antiphishStatus;

Glib::RefPtr<Gtk::ListStore> phishStore;
Gtk::TreeView phishView;

Gtk::Switch googleSafeSwitch;
Gtk::Entry  googleSafeKeyEntry;

Provides a system-level anti-phishing status toggle and list inspection, with optional Google Safe Browsing integration controlled by switch + API key entry.

7.7 Anti-Phishing Whitelist UI

Glib::RefPtr<Gtk::SingleSelection> whitelistSelection;
Glib::RefPtr<Gtk::StringList> whitelistStore;
Gtk::ListView whitelistView;

void build_whitelist_tab();

Manages a domain whitelist for anti-phishing false positive reduction. Uses a StringList + SingleSelection list view model.

7.8 Language / Localization Tab

Gtk::ComboBoxText combo_language_;
Gtk::Button       btn_apply_language_;

Allows selecting UI language and applying changes, typically requiring service restarts or UI reload.

7.9 Services Tabs (User + System)

void build_user_services_tab();
void build_system_services_tab();

void build_services_section(Gtk::Box& parent,
    const std::vector<std::tuple<std::string, Glib::ustring, Glib::ustring>>& services,
    bool system_units);

Provides toggles for both systemd user services and privileged system services, building a uniform grid-based UI section with enable/disable semantics.

8. User Actions (Callbacks)

void onQuarantineClicked();
void onAddPath();
void onRemovePath();
void onSave();
void onRealtimeToggled();

void onAntiransomToggled();
void refreshAntiransomRules();
void loadYaraRules();

void onAntiphishToggled();
void refreshPhishLists();
void loadPhishLists();

void onAddSambaDir();
void onRemoveSambaDir();
void onScanNowSamba();
  • Base actions: quarantine selection and on-access path management
  • ClamdConfig persistence: save advanced scan options and apply configuration
  • Anti-Ransomware: service toggle and rule list refresh
  • Anti-Phishing: service toggle and blacklist refresh
  • Samba: add/remove directories and execute manual scan

9. Configuration Persistence and Advanced Filters

9.1 Anti-Ransomware Advanced Filters

Gtk::CheckButton* chkSuspOnly = nullptr;
Gtk::Entry* txtIgnPaths = nullptr;
Gtk::Entry* txtCompany = nullptr;
Gtk::Entry* txtIgnExt = nullptr;
Gtk::Entry* txtSuspExt = nullptr;

UI inputs used to refine scanner scope and reduce false positives: suspicious-only mode, ignored paths, ignored extensions, and suspicious extensions.

void saveAdvancedConfig(bool suspicious_only,
                        const Glib::ustring& ignore_paths,
                        const Glib::ustring& ignore_ext,
                        const Glib::ustring& suspicious_ext);

void loadAdvancedConfig();

Loads and saves advanced configuration into user-scoped configuration files, preserving durable behavior across sessions.

9.2 Allowlist SHA256 (False Positive Mitigation)

void loadAllowlistUI();
void saveAllowlistUI();

Glib::RefPtr<Gtk::ListStore> allowStore;
Gtk::TreeView allowView;

Provides a SHA256 allowlist editor supporting optional “rule labels” to document intent.

10. Service Control Helpers

10.1 User Services (systemd –user)

bool is_user_service_enabled(const std::string& service_name);
bool enable_user_service(const std::string& service_name);
bool disable_user_service(const std::string& service_name);

Manages enable/disable semantics for user units. Typical behavior is: enable + start when toggled on, stop + disable when toggled off.

10.2 System Services (pkexec systemctl)

bool is_system_service_enabled(const std::string& unit_name);
bool enable_system_service(const std::string& unit_name);
bool disable_system_service(const std::string& unit_name);

bool pkexec_systemctl(const std::vector<std::string>& args,
                      std::string* out_stdout = nullptr);

Privileged unit control via pkexec and systemctl. Intended for system-level security services requiring admin authorization.

10.3 Command Execution Utility

bool run_cmd(const std::vector<std::string>& argv,
             std::string* out_stdout = nullptr,
             bool silence_stderr = true);

Helper used to execute commands and optionally capture output, with configurable stderr handling for diagnostics.

10.4 Error Dialog Helper

static void show_service_error_dialog(
    const Glib::ustring& message,
    const std::string& service_name
);

Standardized UI error reporting for service enable/disable failures.

11. Toggle State Tracking

bool updatingToggle = false;
std::map<std::string, bool> toggleControlled;

Used to avoid feedback loops when applying bulk changes (toggle-all) and to track which options were programmatically enabled, allowing correct revert behavior without overriding user intent.

12. Runtime and Security Considerations

  • Privilege boundaries: system services and system file writes must use pkexec and provide clear success/failure feedback to the user.
  • Non-blocking UX: operations that may take time (downloads, updates, service restarts) should be asynchronous or executed off the GTK main loop.
  • Input validation: domains, paths, ports, and keys must be validated before persistence to prevent injection into configuration or command contexts.
  • Atomic writes: configuration persistence should use safe write patterns (temp + rename) to avoid corruption.
  • Consistency: UI state must reflect actual service state; “refresh” actions are provided to resynchronize toggles and labels.
Published on:
Last updated on: