PolicyLoader

1. Overview

The PolicyLoader.cpp implementation parses RootGuard’s INI-style policy format, assigns rule IDs, enforces supported section/key semantics, and rejects configurations that could create unsafe or internally contradictory enforcement behavior.

The file integrates the following components, APIs, or runtime concepts:

  • PolicySecurity – safe file reading
  • Policy – destination model
  • std::filesystem – lexical path normalization

2. Lexical Parsing Helpers

Whitespace trimming, lowercase normalization, and optional single/double quote removal are applied before values are interpreted. Boolean values accept true/yes/1 and false/no/0 forms. Mode accepts audit/enforce; action accepts audit/block.

3. Engine Section

The [engine] section recognizes version, mode, unknown/metadata/global-metadata/credential actions, missing-path policy, trusted-executable ownership protection, trusted-executable protection, global metadata monitoring, burst controls, /run suppression, trusted logging, automatic service blocking, user-home blocking, integrity interval, and event-log path.

Unknown engine keys are rejected with a line-numbered error rather than silently ignored.

4. Path Rule Sections

Supported sections are [trusted-applications], [trusted-executables], [denied-executables], [protected-paths], and [ignored-paths]. Entries use path, required_path, recursive_path, or required_recursive_path.

Recursive rules are accepted only for protected and ignored paths. Every accepted path rule receives the next sequential rule ID.

5. Global Validation

  • Policy version must be exactly 2.
  • integrity_poll_seconds must be between 0 and 3600.
  • global_metadata_sample_limit must not exceed 64.
  • Metadata burst threshold must be 8–100000; window 250–60000 ms; cooldown must be at least the window and at most 3600000 ms.
  • global_metadata_action=block is rejected; global surveillance is intentionally audit-only.
  • Enforcement that blocks unknown or credential-anomaly elevation requires at least one trusted executable.
  • Duplicate paths within a list are rejected after lexical normalization.
  • Trusted/denied executable conflicts and trusted-application/denied conflicts are rejected.

6. Error Context

Validation exceptions are wrapped with the supplied source path, while syntax/key errors include line numbers. This makes both daemon startup and administrative validation failures actionable.

7. Runtime and Security Considerations

  • Fail-closed schema: unknown sections/keys and malformed values are rejected.
  • Global blocking safety: broad global metadata surveillance cannot be configured as blocking.
  • Privilege enforcement prerequisite: blocking elevation is refused when no trusted executable is available.
  • Rule consistency: duplicate and trusted/denied conflicts are detected before engine application.
Published on:
Last updated on: