Policy.hpp

1. Overview

The Policy.hpp header defines RootGuard’s in-memory policy model, including engine mode/actions, global metadata controls, integrity monitoring, service containment, event logging, and all path-based rule collections.

The file integrates the following components, APIs, or runtime concepts:

  • PolicyLoader – populates and validates this model
  • RootGuardEngine – translates the model into BPF maps and runtime behavior
  • ActionHelper – edits selected fields and rule sections

2. Mode and Action Enums

  • Mode::Audit / Mode::Enforce – global engine operating mode
  • Action::Audit / Action::Block – per-policy response choice

3. PolicyPath

PolicyPath assigns an integer rule ID to a path and records whether the entry is mandatory and whether it applies recursively.

4. Engine Defaults

Policy ABI version defaults to 2. The default mode and actions are audit. Global privilege metadata monitoring and metadata-burst detection are enabled, while global metadata blocking is not the normal model.

Burst defaults are sample limit 3, threshold 32 events, a 5000 ms window, and a 300000 ms cooldown. /run global metadata suppression and trusted-event logging default to enabled.

5. Containment and Integrity

autoBlockSystemServices defaults to true, blockUserHome defaults to false, and integrity polling defaults to 5 seconds. Trusted executables can automatically become protected identities when protectTrustedExecutables is true.

6. Logging and Rule Collections

The default event log is /var/log/bastionguard/rootguard-events.jsonl. Rule vectors separately represent trusted applications, privilege-trusted executables, denied executables, protected paths, and ignored paths.

7. String Conversion Helpers

toString(Mode) and toString(Action) provide canonical lowercase values used in status output and diagnostics.

8. Runtime and Security Considerations

  • User-home policy is explicit: default behavior leaves user home outside immediate metadata blocking.
  • Global metadata surveillance is distinct from explicit protection: policy has separate fields for broad observation and protected identity enforcement.
Published on:
Last updated on: