1. Overview
The RootGuardEventTests.cpp executable verifies JSON event parsing, textual formatting, service-path recognition, fingerprints, and the desktop-oriented severity policy that separates protected incidents, global observations, metadata bursts, legacy telemetry, and trusted records.
The file integrates the following components, APIs, or runtime concepts:
- RootGuardEvent
- rootguard_shared.h reason flags
2. Protected Blocked Incident
A detailed blocked permission-change record on a systemd service definition is parsed and checked for process IDs, target/actor/parent identities, parent executable, mode values, protected-baseline provenance, nonempty fingerprint, incident severity, actionable status, and octal mode formatting.
3. System Service Paths
Both a systemd unit path and an OpenRC /etc/conf.d path are asserted to be service definitions.
4. Legacy Global Telemetry
A historical broad-surveillance global permission record remains Telemetry, not a security observation or actionable incident, while actor/path/identity formatting remains available in the Events view.
5. Global Metadata Observations
Set-ID addition, owner-to-root change, root-owned write exposure, executable write-exposure cases, and security-capability xattr changes are checked as Observation rather than actionable incidents when they are unprotected rule-0 events.
6. Metadata Burst Escalation
A rule-0 global permission event carrying RG_REASON_METADATA_BURST is asserted to become an Incident and therefore actionable for notification purposes.
7. Protected Audit Incident
A protected /etc/sudoers audit event with nonzero rule ID is still classified as an incident, preserving high visibility for explicit protected identities even when the operation was not blocked.
8. Trusted Telemetry
A setuid record with verdict trusted stays telemetry and is not actionable.
9. Runtime and Security Considerations
- Noise-policy regression: the test suite encodes exactly which global metadata records should remain observations instead of popup incidents.
- Protected-rule precedence: explicit rule IDs preserve incident severity.