RootGuardPage

1. Overview

The RootGuardPage.hpp header declares the GTKmm page that presents RootGuard service status, protection controls, incidents, event history, application-rule management, and incident-response actions inside BastionGuard.

The file integrates the following components, APIs, or runtime concepts:

  • RootGuardClient – asynchronous snapshots and privileged action requests
  • GTKmm – page layout, switches, buttons, stacks, lists, text views, and alert windows
  • sigc++ – client update and periodic refresh connections

2. Page Responsibilities

The class owns status labels for service/mode/init/PID, a top-level Gtk::Stack with switcher navigation, the immediate-protection switch, service lifecycle controls, incident and event views, nested application-rule editors, and a status-feedback label.

3. Snapshot Rendering Methods

  • on_snapshot() – synchronize all page state from a client snapshot
  • render_incidents() – build unresolved observation/incident rows
  • render_events() – render recent textual history
  • queue_new_alerts() / show_next_alert() – control high-signal popup notifications

4. Incident Actions and Dismissal

The class tracks dismissed event fingerprints and incident keys, and exposes restore/quarantine calls only through private methods that delegate to RootGuardClient. A queue and a single current_alert_ window prevent uncontrolled popup accumulation.

5. Application Rule Editing

Three list/entry pairs represent trusted applications, privilege-trusted executables, and denied executables. Helper methods add normalized absolute paths, remove selected entries, collect/sort/deduplicate rule values, populate from snapshots, mark unsaved edits, and request persistence.

6. Lifecycle State

Internal flags distinguish programmatic switch updates from user changes, initial snapshot behavior, dirty/saving rule state, and active component lifetime. The page also retains a copy of the most recent snapshot to support immediate local event filtering.

7. Runtime and Security Considerations

  • Destructive UI actions are private: callers cannot bypass the page’s availability checks and client abstraction through this header.
  • Notification deduplication: sets track seen, dismissed, and already-notified incidents.
  • Lifetime guard: an atomic shared flag protects deferred idle cleanup after page destruction.
Published on:
Last updated on: