rootguard.bpf.c File Reference

Go to the source code of this file.

Classes
struct	rg_task_state
struct	rg_exec_context
struct	rg_pending_path
struct	rg_metadata_domain_key
struct	rg_metadata_domain_state

Macros
#define	EPERM   1
#define	ATTR_MODE   (1U << 0)
#define	ATTR_UID   (1U << 1)
#define	ATTR_GID   (1U << 2)
#define	S_ISUID   0004000
#define	S_ISGID   0002000
#define	S_IWGRP   0000020
#define	S_IWOTH   0000002
#define	S_IRUSR   0000400
#define	S_IWUSR   0000200
#define	RG_METADATA_DECISION_SAMPLE   (1U << 0)
#define	RG_METADATA_DECISION_BURST   (1U << 1)

Enumerations
enum	rg_pending_operation { RG_PENDING_NONE = 0 , RG_PENDING_CHMOD = 1 , RG_PENDING_CHOWN = 2 }

Functions
char LICENSE[]	SEC ("license")
int	bpf_path_d_path (const struct path *path, char *buf, size_t buf__sz) __weak __ksym
struct { ... }	SEC (".maps")
	__uint (type, BPF_MAP_TYPE_RINGBUF)
	__uint (max_entries, 1<< 22)
	__uint (type, BPF_MAP_TYPE_HASH)
	__uint (max_entries, 4096)
	__type (key, __u32)
	__type (value, struct rg_auth_token)
	__uint (type, BPF_MAP_TYPE_ARRAY)
	__uint (max_entries, 1)
	__type (value, struct rg_kernel_config)
	__uint (max_entries, 2048)
	__type (key, struct rg_file_key)
	__type (value, struct rg_rule_value)
	__uint (max_entries, 8192)
	__type (value, struct rg_protected_value)
	__uint (max_entries, 32768)
	__type (key, struct rg_metadata_domain_key)
	__type (value, struct rg_metadata_domain_state)
	__uint (type, BPF_MAP_TYPE_LRU_HASH)
	__uint (max_entries, 65536)
	__type (value, struct rg_exec_context)
	__uint (max_entries, 16384)
	__type (key, __u64)
	__type (value, struct rg_pending_path)
	__type (value, struct rg_task_state)
static __always_inline __u32	cred_uid (const struct cred *cred)
static __always_inline __u32	cred_euid (const struct cred *cred)
static __always_inline const struct cred *	current_cred_ptr (void)
static __always_inline __u32	current_euid_value (void)
static __always_inline void	current_ids (__u32 *pid, __u32 *tgid, __u32 *ppid)
static __always_inline const struct rg_kernel_config *	kernel_config (void)
static __always_inline bool	current_executable_key (struct rg_file_key *key)
static __always_inline bool	parent_executable_key (struct rg_file_key *key)
static __always_inline __u32	observe_unprotected_metadata (bool count_burst_candidate, bool request_sample, __u32 *burst_count)
static __always_inline int	lsm_result_from_verdict (__u32 verdict)
static __always_inline bool	file_key_from_inode (const struct inode *inode, struct rg_file_key *key)
static __always_inline bool	file_key_from_file (const struct file *file, struct rg_file_key *key)
static __always_inline bool	file_key_from_dentry (const struct dentry *dentry, struct rg_file_key *key)
static __always_inline const char *	dentry_name_ptr (const struct dentry *dentry)
static __always_inline bool	file_key_equal (const struct rg_file_key *left, const struct rg_file_key *right)
static __always_inline void	copy_map_string (char *destination, const char *source, __u32 size)
static __always_inline void	capture_exec_context (struct linux_binprm *bprm, const struct rg_file_key *key)
static __always_inline bool	runtime_path_is_run (const char *path)
static __always_inline bool	pending_path_is_under_run (const struct rg_file_key *file_key)
static __always_inline void	discard_pending_path (void)
static __always_inline void	record_pending_path (const struct path *path, __u32 operation)
static __always_inline bool	consume_pending_path (const struct rg_file_key *file_key, char *destination, __u32 *path_resolution)
static __always_inline void	enrich_event_actor (struct rg_event *event)
static __always_inline __u64	task_key (const struct task_struct *task)
static __always_inline void	observe_task (struct task_struct *task, __u32 uid, __u32 euid)
static __always_inline void	observe_current_task (const struct cred *cred)
static __always_inline void	mark_current_authorized_root (void)
static __always_inline bool	consume_token_for (__u32 tgid, __u32 ppid, __u32 target_euid)
static __always_inline __u32	decide_escalation (const struct rg_file_key *file_key, bool have_file_key, bool authorized, __u32 *reason_flags, __u32 *rule_id)
static __always_inline __u32	metadata_verdict (bool protected_change, bool protected_audit_only, bool global_change)
static __always_inline void	emit_event (__u32 type, __u32 verdict, __u32 reason_flags, __u32 rule_id, __u32 old_euid, __u32 new_euid, __s32 flags, __u32 auxiliary, const struct rg_file_key *file_key, const char *kernel_filename, const char *kernel_xattr, __u32 old_mode, __u32 new_mode, __u32 old_uid, __u32 new_uid, __u32 old_gid, __u32 new_gid)
static __always_inline int	xattr_kind (const char *name)
static __always_inline void	inode_metadata (const struct inode *inode, __u32 *mode, __u32 *uid, __u32 *gid)
int	BPF_PROG (rg_task_alloc, struct task_struct *task, unsigned long clone_flags, int ret)
int	BPF_PROG (rg_task_fix_setuid, struct cred *new, const struct cred *old, int flags, int ret)
int	BPF_PROG (rg_bprm_check_security, struct linux_binprm *bprm, int ret)
static __always_inline int	guard_current_root_provenance (__u32 auxiliary, __s32 operation_flags, const struct rg_file_key *file_key)
int	BPF_PROG (rg_capable, const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts, int ret)
int	BPF_PROG (rg_inode_permission, struct inode *inode, int mask, int ret)
int	BPF_PROG (rg_file_open, struct file *file, int ret)
int	BPF_PROG (rg_path_chmod, const struct path *path, umode_t mode, int ret)
int	BPF_PROG2 (rg_path_chown, const struct path *, path, kuid_t, uid, kgid_t, gid, int, ret)
int	BPF_PROG (rg_inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry, struct iattr *attr, int ret)
static __always_inline int	handle_xattr_change (struct dentry *dentry, const char *name, int operation_flags)
int	BPF_PROG (rg_inode_setxattr, struct mnt_idmap *idmap, struct dentry *dentry, const char *name, const void *value, size_t size, int flags, int ret)
int	BPF_PROG (rg_inode_removexattr, struct mnt_idmap *idmap, struct dentry *dentry, const char *name, int ret)
int	BPF_PROG (rg_inode_set_acl, struct mnt_idmap *idmap, struct dentry *dentry, const char *acl_name, struct posix_acl *kacl, int ret)
int	BPF_PROG (rg_inode_remove_acl, struct mnt_idmap *idmap, struct dentry *dentry, const char *acl_name, int ret)
int	BPF_PROG (rg_inode_unlink, struct inode *dir, struct dentry *dentry, int ret)
int	BPF_PROG (rg_inode_rename, struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry, int ret)
int	rg_sched_process_exit (struct trace_event_raw_sched_process_template *ctx)
int	BPF_PROG (rg_inode_link, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, int ret)

Variables
struct rg_task_state	SEC

Macro Definition Documentation

ATTR_GID

#define ATTR_GID   (1U << 2)

Definition at line 14 of file rootguard.bpf.c.

Referenced by BPF_PROG().

ATTR_MODE

#define ATTR_MODE   (1U << 0)

Definition at line 12 of file rootguard.bpf.c.

Referenced by BPF_PROG().

ATTR_UID

#define ATTR_UID   (1U << 1)

Definition at line 13 of file rootguard.bpf.c.

Referenced by BPF_PROG().

EPERM

#define EPERM   1

Definition at line 9 of file rootguard.bpf.c.

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG2(), and lsm_result_from_verdict().

RG_METADATA_DECISION_BURST

#define RG_METADATA_DECISION_BURST   (1U << 1)

Definition at line 149 of file rootguard.bpf.c.

Referenced by BPF_PROG(), and observe_unprotected_metadata().

RG_METADATA_DECISION_SAMPLE

#define RG_METADATA_DECISION_SAMPLE   (1U << 0)

Definition at line 148 of file rootguard.bpf.c.

Referenced by BPF_PROG(), handle_xattr_change(), and observe_unprotected_metadata().

S_IRUSR

#define S_IRUSR   0000400

Definition at line 25 of file rootguard.bpf.c.

Referenced by BPF_PROG(), and anonymous_namespace{Backend.cpp}::create_secure_firewall_input().

S_ISGID

#define S_ISGID   0002000

Definition at line 18 of file rootguard.bpf.c.

Referenced by BPF_PROG().

S_ISUID

#define S_ISUID   0004000

Definition at line 17 of file rootguard.bpf.c.

Referenced by BPF_PROG(), and running_confined().

S_IWGRP

#define S_IWGRP   0000020

Definition at line 21 of file rootguard.bpf.c.

Referenced by BPF_PROG(), anonymous_namespace{Backend.cpp}::create_secure_firewall_input(), anonymous_namespace{bastionguard_privhelper.cpp}::ensure_state_directory(), anonymous_namespace{bastionguard-firewall.cpp}::open_input_securely(), bastionguard::rootguard::PolicySecurity::read(), bastionguard::rootguard::FileIdentityResolver::resolve(), and anonymous_namespace{bastionguard_privhelper.cpp}::runtime_dir_is_safe().

S_IWOTH

#define S_IWOTH   0000002

Definition at line 22 of file rootguard.bpf.c.

Referenced by BPF_PROG(), anonymous_namespace{Backend.cpp}::create_secure_firewall_input(), anonymous_namespace{bastionguard_privhelper.cpp}::ensure_state_directory(), anonymous_namespace{bastionguard-firewall.cpp}::open_input_securely(), bastionguard::rootguard::PolicySecurity::read(), bastionguard::rootguard::FileIdentityResolver::resolve(), and anonymous_namespace{bastionguard_privhelper.cpp}::runtime_dir_is_safe().

S_IWUSR

#define S_IWUSR   0000200

Definition at line 26 of file rootguard.bpf.c.

Referenced by BPF_PROG(), and anonymous_namespace{Backend.cpp}::create_secure_firewall_input().

Enumeration Type Documentation

rg_pending_operation

enum rg_pending_operation

Enumerator
RG_PENDING_NONE
RG_PENDING_CHMOD
RG_PENDING_CHOWN

Definition at line 92 of file rootguard.bpf.c.

                          {
    RG_PENDING_NONE = 0,
    RG_PENDING_CHMOD = 1,
    RG_PENDING_CHOWN = 2,
};

Function Documentation

__type() [1/12]

__type	(	key	,
		__u32	)

__type() [2/12]

__type	(	key	,
		__u64	)

__type() [3/12]

__type	(	key	,
		struct rg_file_key	)

__type() [4/12]

@104065326213267065077204246042154202176115111033::__type	(	key	,
		struct rg_metadata_domain_key	)

__type() [5/12]

@224373156225346300110351153213010171132137273270::__type	(	value	,
		struct rg_auth_token	)

__type() [6/12]

@203143041140227040067334045072204174231203054350::__type	(	value	,
		struct rg_exec_context	)

__type() [7/12]

@352161370213374271236245174007307224210154071310::__type	(	value	,
		struct rg_kernel_config	)

__type() [8/12]

@104065326213267065077204246042154202176115111033::__type	(	value	,
		struct rg_metadata_domain_state	)

__type() [9/12]

@130147134071022107251232371157261274371323016044::__type	(	value	,
		struct rg_pending_path	)

__type() [10/12]

@245134012353276161305305227332024146131121156167::__type	(	value	,
		struct rg_protected_value	)

__type() [11/12]

__type	(	value	,
		struct rg_rule_value	)

__type() [12/12]

@071173234047075171020256176074174110064126225056::__type	(	value	,
		struct rg_task_state	)

__uint() [1/12]

@352161370213374271236245174007307224210154071310::__uint	(	max_entries	,
		1	)

__uint() [2/12]

@130147134071022107251232371157261274371323016044::__uint	(	max_entries	,
		16384	)

__uint() [3/12]

@046352274040072010274252261242260131256021005134::__uint	(	max_entries	,
		1<<	22 )

__uint() [4/12]

__uint	(	max_entries	,
		2048	)

__uint() [5/12]

@104065326213267065077204246042154202176115111033::__uint	(	max_entries	,
		32768	)

__uint() [6/12]

@224373156225346300110351153213010171132137273270::__uint	(	max_entries	,
		4096	)

__uint() [7/12]

__uint	(	max_entries	,
		65536	)

__uint() [8/12]

@072270030377323145125163337314057176140314073041::__uint	(	max_entries	,
		8192	)

__uint() [9/12]

@352161370213374271236245174007307224210154071310::__uint	(	type	,
		BPF_MAP_TYPE_ARRAY	)

__uint() [10/12]

__uint	(	type	,
		BPF_MAP_TYPE_HASH	)

__uint() [11/12]

@072270030377323145125163337314057176140314073041::__uint	(	type	,
		BPF_MAP_TYPE_LRU_HASH	)

__uint() [12/12]

@314017302272111134376103221067163065253031234061::__uint	(	type	,
		BPF_MAP_TYPE_RINGBUF	)

Referenced by bpf_path_d_path().

bpf_path_d_path()

int bpf_path_d_path ( const struct path * path, char * buf, size_t buf__sz )

extern

References __uint(), and bpf_path_d_path().

Referenced by bpf_path_d_path(), and record_pending_path().

BPF_PROG() [1/15]

int BPF_PROG	(	rg_bprm_check_security	,
		struct linux_binprm *	bprm,
		int	ret )

Definition at line 937 of file rootguard.bpf.c.

{
    struct task_struct *task;
    const struct cred *old_cred;
    const struct cred *new_cred;
    const struct file *file;
    const char *filename;
    struct rg_file_key file_key = {};
    __u32 old_euid, new_euid, pid, tgid, ppid;
    __u32 reason_flags, rule_id, verdict;
    bool authorized, have_file_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    old_cred = BPF_CORE_READ(task, cred);
    observe_current_task(old_cred);
    new_cred = BPF_CORE_READ(bprm, cred);
    old_euid = cred_euid(old_cred);
    new_euid = cred_euid(new_cred);
 
    /*
     * Capture every exec, not only privilege transitions. Short-lived tools
     * such as chmod/chown may exit before userspace can read /proc/<pid>/exe.
     */
    file = BPF_CORE_READ(bprm, file);
    have_file_key = file_key_from_file(file, &file_key);
    capture_exec_context(bprm, have_file_key ? &file_key : 0);
 
    if (new_euid != 0) {
        observe_task(task, cred_uid(new_cred), new_euid);
        return 0;
    }
    if (old_euid == 0)
        return 0;
 
    current_ids(&pid, &tgid, &ppid);
    authorized = consume_token_for(tgid, ppid, new_euid);
    verdict = decide_escalation(&file_key, have_file_key, authorized,
                                &reason_flags, &rule_id);
    filename = BPF_CORE_READ(bprm, filename);
 
    if (verdict == RG_VERDICT_AUTHORIZED || verdict == RG_VERDICT_TRUSTED)
        mark_current_authorized_root();
 
    emit_event(RG_EVENT_EXEC_PRIV, verdict, reason_flags, rule_id,
               old_euid, new_euid, 0, 0,
               have_file_key ? &file_key : 0, filename, 0,
               0, 0, 0, 0, 0, 0);
 
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), capture_exec_context(), consume_token_for(), cred_euid(), cred_uid(), current_ids(), decide_escalation(), emit_event(), EPERM, file_key_from_file(), lsm_result_from_verdict(), mark_current_authorized_root(), observe_current_task(), observe_task(), RG_EVENT_EXEC_PRIV, RG_VERDICT_AUTHORIZED, and RG_VERDICT_TRUSTED.

BPF_PROG() [2/15]

int BPF_PROG	(	rg_capable	,
		const struct cred *	cred,
		struct user_namespace *	ns,
		int	cap,
		unsigned int	opts,
		int	ret )

Definition at line 1064 of file rootguard.bpf.c.

{
    const struct cred *current_cred;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    current_cred = current_cred_ptr();
    if (cred != current_cred)
        return 0;
 
    return guard_current_root_provenance((__u32)cap, (__s32)opts, 0);
}

References BPF_PROG(), current_cred_ptr(), EPERM, and guard_current_root_provenance().

BPF_PROG() [3/15]

int BPF_PROG	(	rg_file_open	,
		struct file *	file,
		int	ret )

Definition at line 1102 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    bool have_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    have_key = file_key_from_file(file, &key);
    return guard_current_root_provenance(0, 0,
                                         have_key ? &key : 0);
}

References BPF_PROG(), EPERM, file_key_from_file(), and guard_current_root_provenance().

BPF_PROG() [4/15]

int BPF_PROG	(	rg_inode_link	,
		struct dentry *	old_dentry,
		struct inode *	dir,
		struct dentry *	new_dentry,
		int	ret )

Definition at line 1529 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(old_dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_HARDLINK))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_HARDLINK, verdict,
               RG_REASON_PROTECTED_HARDLINK, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(old_dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), dentry_name_ptr(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), lsm_result_from_verdict(), metadata_verdict(), RG_EVENT_PROTECTED_HARDLINK, RG_PROTECT_AUDIT_ONLY, RG_PROTECT_HARDLINK, and RG_REASON_PROTECTED_HARDLINK.

BPF_PROG() [5/15]

int BPF_PROG	(	rg_inode_permission	,
		struct inode *	inode,
		int	mask,
		int	ret )

Definition at line 1086 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    bool have_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    have_key = file_key_from_inode(inode, &key);
    return guard_current_root_provenance((__u32)mask, mask,
                                         have_key ? &key : 0);
}

References BPF_PROG(), EPERM, file_key_from_inode(), guard_current_root_provenance(), and rg_file_key::inode.

BPF_PROG() [6/15]

int BPF_PROG	(	rg_inode_remove_acl	,
		struct mnt_idmap *	idmap,
		struct dentry *	dentry,
		const char *	acl_name,
		int	ret )

Definition at line 1421 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected && (protected->flags & RG_PROTECT_ACL)) {
        verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
        emit_event(RG_EVENT_ACL_CHANGE, verdict, RG_REASON_PROTECTED_ACL,
                   protected->rule_id, 0, 0, -1, 0,
                   &key, dentry_name_ptr(dentry), acl_name,
                   0, 0, 0, 0, 0, 0);
    } else {
        /* Unprotected ACL removals are intentionally silent for the same reason. */
        return 0;
    }
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), dentry_name_ptr(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), lsm_result_from_verdict(), metadata_verdict(), RG_EVENT_ACL_CHANGE, RG_PROTECT_ACL, RG_PROTECT_AUDIT_ONLY, and RG_REASON_PROTECTED_ACL.

BPF_PROG() [7/15]

int BPF_PROG	(	rg_inode_removexattr	,
		struct mnt_idmap *	idmap,
		struct dentry *	dentry,
		const char *	name,
		int	ret )

Definition at line 1374 of file rootguard.bpf.c.

{
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    return handle_xattr_change(dentry, name, -1);
}

References BPF_PROG(), EPERM, and handle_xattr_change().

BPF_PROG() [8/15]

int BPF_PROG	(	rg_inode_rename	,
		struct inode *	old_dir,
		struct dentry *	old_dentry,
		struct inode *	new_dir,
		struct dentry *	new_dentry,
		int	ret )

Definition at line 1483 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected = 0;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    if (file_key_from_dentry(old_dentry, &key))
        protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected && file_key_from_dentry(new_dentry, &key))
        protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_RENAME))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_RENAME, verdict,
               RG_REASON_PROTECTED_RENAME, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(old_dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), dentry_name_ptr(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), lsm_result_from_verdict(), metadata_verdict(), RG_EVENT_PROTECTED_RENAME, RG_PROTECT_AUDIT_ONLY, RG_PROTECT_RENAME, and RG_REASON_PROTECTED_RENAME.

BPF_PROG() [9/15]

int BPF_PROG	(	rg_inode_set_acl	,
		struct mnt_idmap *	idmap,
		struct dentry *	dentry,
		const char *	acl_name,
		struct posix_acl *	kacl,
		int	ret )

Definition at line 1384 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected && (protected->flags & RG_PROTECT_ACL)) {
        verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
        emit_event(RG_EVENT_ACL_CHANGE, verdict, RG_REASON_PROTECTED_ACL,
                   protected->rule_id, 0, 0, 1, 0,
                   &key, dentry_name_ptr(dentry), acl_name,
                   0, 0, 0, 0, 0, 0);
    } else {
        /*
         * Do not emit every global ACL edit.  The hook does not provide a
         * low-noise semantic verdict here, so unprotected ACL activity remains
         * silent instead of generating production false positives.
         */
        return 0;
    }
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), dentry_name_ptr(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), lsm_result_from_verdict(), metadata_verdict(), RG_EVENT_ACL_CHANGE, RG_PROTECT_ACL, RG_PROTECT_AUDIT_ONLY, and RG_REASON_PROTECTED_ACL.

BPF_PROG() [10/15]

int BPF_PROG	(	rg_inode_setattr	,
		struct mnt_idmap *	idmap,
		struct dentry *	dentry,
		struct iattr *	attr,
		int	ret )

Definition at line 1148 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    const struct rg_kernel_config *cfg;
    struct inode *inode;
    __u32 old_mode, new_mode, old_uid, new_uid, old_gid, new_gid;
    __u32 valid, reasons = 0, protected_reasons = 0, global_reasons = 0;
    __u32 verdict, event_type, metadata_decision = 0, burst_count = 0;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    inode_metadata(inode, &old_mode, &old_uid, &old_gid);
    valid = BPF_CORE_READ(attr, ia_valid);
    new_mode = old_mode;
    new_uid = old_uid;
    new_gid = old_gid;
 
    if (valid & ATTR_MODE)
        new_mode = BPF_CORE_READ(attr, ia_mode) & 07777U;
    if (valid & ATTR_UID) {
        kuid_t uid = {};
        BPF_CORE_READ_INTO(&uid, attr, ia_uid);
        new_uid = uid.val;
    }
    if (valid & ATTR_GID) {
        kgid_t gid = {};
        BPF_CORE_READ_INTO(&gid, attr, ia_gid);
        new_gid = gid.val;
    }
 
    /*
     * Production filtering: ordinary chmod/chown traffic is not a security
     * incident and must not flood a desktop system.  Global events are emitted
     * only for privilege-relevant transitions.  Full metadata monitoring and
     * enforcement remain available for identities explicitly loaded into
     * protected_inodes.
     */
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected) {
        if ((valid & ATTR_MODE) &&
            (protected->flags & RG_PROTECT_MODE) &&
            new_mode != protected->baseline_mode)
            protected_reasons |= RG_REASON_PROTECTED_MODE;
        if (((valid & ATTR_UID) || (valid & ATTR_GID)) &&
            (protected->flags & RG_PROTECT_OWNER) &&
            (new_uid != protected->baseline_uid ||
             new_gid != protected->baseline_gid))
            protected_reasons |= RG_REASON_PROTECTED_OWNER;
    }
 
    cfg = kernel_config();
 
    /*
     * Do not feed the ring buffer with unprotected chmod/chown traffic below
     * /run. BastionGuard Backup mounts temporary backup filesystems there and
     * restoring file metadata would otherwise look like a stream of global
     * privilege changes. Explicit protected identities always take precedence.
     * Credential provenance was checked above and is not bypassed.
     */
    if (!protected && cfg && cfg->ignore_run_global_metadata &&
        pending_path_is_under_run(&key)) {
        discard_pending_path();
        return 0;
    }
 
    if (cfg && cfg->monitor_global_privilege_metadata) {
        /* A newly added setuid/setgid bit can create a direct privilege path. */
        if ((valid & ATTR_MODE) &&
            ((new_mode & (S_ISUID | S_ISGID)) &
             ~(old_mode & (S_ISUID | S_ISGID))))
            global_reasons |= RG_REASON_SETID_ADDED | RG_REASON_GLOBAL_METADATA;
 
        /* Changing a previously non-root object to UID 0 is security-relevant. */
        if ((valid & ATTR_UID) && old_uid != 0 && new_uid == 0)
            global_reasons |= RG_REASON_OWNER_TO_ROOT | RG_REASON_GLOBAL_METADATA;
 
        /*
         * Alert when an object that was already root-owned gains write access
         * for group or other users.
         */
        if ((valid & ATTR_MODE) && old_uid == 0 && new_uid == 0 &&
            ((new_mode & (S_IWGRP | S_IWOTH)) &
             ~(old_mode & (S_IWGRP | S_IWOTH))))
            global_reasons |= RG_REASON_ROOT_OWNED_WRITE_EXPOSURE |
                              RG_REASON_GLOBAL_METADATA;
    }
 
    if (!protected && cfg &&
        ((valid & ATTR_MODE) || (valid & ATTR_UID) || (valid & ATTR_GID))) {
        bool burst_candidate = false;
 
        /*
         * Backups and package managers legitimately replay huge numbers of
         * chmod/chown operations.  A ransomware-style lockout is materially
         * different: it removes the owner's ability to access the object, or
         * promotes ownership to root.  Count only those destructive patterns
         * for burst escalation; routine metadata replay does not consume the
         * burst budget.
         */
        if ((valid & ATTR_MODE) &&
            (old_mode & (S_IRUSR | S_IWUSR)) != 0 &&
            (new_mode & (S_IRUSR | S_IWUSR)) == 0)
            burst_candidate = true;
        if ((valid & ATTR_UID) && old_uid != 0 && new_uid == 0)
            burst_candidate = true;
 
        metadata_decision = observe_unprotected_metadata(
            burst_candidate, global_reasons != 0, &burst_count);
        if (metadata_decision & RG_METADATA_DECISION_BURST)
            reasons |= RG_REASON_METADATA_BURST | RG_REASON_GLOBAL_METADATA;
        if (global_reasons &&
            !(metadata_decision & RG_METADATA_DECISION_SAMPLE))
            global_reasons = 0;
    }
 
    reasons |= global_reasons | protected_reasons;
    if (!reasons)
        return 0;
 
    verdict = metadata_verdict(
        protected_reasons != 0,
        protected && (protected->flags & RG_PROTECT_AUDIT_ONLY),
        (reasons & RG_REASON_GLOBAL_METADATA) != 0);
    event_type = (((valid & ATTR_UID) && new_uid != old_uid) ||
                  ((valid & ATTR_GID) && new_gid != old_gid))
                     ? RG_EVENT_OWNER_CHANGE
                     : RG_EVENT_PERMISSION_CHANGE;
 
    {
        __u32 actor_euid = current_euid_value();
        emit_event(event_type, verdict, reasons,
                   protected ? protected->rule_id : 0,
                   actor_euid, actor_euid,
                   (int)valid, burst_count, &key, dentry_name_ptr(dentry), 0,
                   old_mode, new_mode, old_uid, new_uid, old_gid, new_gid);
    }
 
    return lsm_result_from_verdict(verdict);
}

References ATTR_GID, ATTR_MODE, ATTR_UID, BPF_PROG(), current_euid_value(), dentry_name_ptr(), discard_pending_path(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), rg_kernel_config::ignore_run_global_metadata, inode_metadata(), kernel_config(), lsm_result_from_verdict(), metadata_verdict(), rg_kernel_config::monitor_global_privilege_metadata, observe_unprotected_metadata(), pending_path_is_under_run(), RG_EVENT_OWNER_CHANGE, RG_EVENT_PERMISSION_CHANGE, RG_METADATA_DECISION_BURST, RG_METADATA_DECISION_SAMPLE, RG_PROTECT_AUDIT_ONLY, RG_PROTECT_MODE, RG_PROTECT_OWNER, RG_REASON_GLOBAL_METADATA, RG_REASON_METADATA_BURST, RG_REASON_OWNER_TO_ROOT, RG_REASON_PROTECTED_MODE, RG_REASON_PROTECTED_OWNER, RG_REASON_ROOT_OWNED_WRITE_EXPOSURE, RG_REASON_SETID_ADDED, S_IRUSR, S_ISGID, S_ISUID, S_IWGRP, S_IWOTH, and S_IWUSR.

BPF_PROG() [11/15]

int BPF_PROG	(	rg_inode_setxattr	,
		struct mnt_idmap *	idmap,
		struct dentry *	dentry,
		const char *	name,
		const void *	value,
		size_t	size,
		int	flags,
		int	ret )

Definition at line 1363 of file rootguard.bpf.c.

{
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    return handle_xattr_change(dentry, name, flags);
}

References BPF_PROG(), EPERM, and handle_xattr_change().

BPF_PROG() [12/15]

int BPF_PROG	(	rg_inode_unlink	,
		struct inode *	dir,
		struct dentry *	dentry,
		int	ret )

Definition at line 1453 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_UNLINK))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_UNLINK, verdict,
               RG_REASON_PROTECTED_UNLINK, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), dentry_name_ptr(), emit_event(), EPERM, file_key_from_dentry(), guard_current_root_provenance(), lsm_result_from_verdict(), metadata_verdict(), RG_EVENT_PROTECTED_UNLINK, RG_PROTECT_AUDIT_ONLY, RG_PROTECT_UNLINK, and RG_REASON_PROTECTED_UNLINK.

BPF_PROG() [13/15]

int BPF_PROG	(	rg_path_chmod	,
		const struct path *	path,
		umode_t	mode,
		int	ret )

Definition at line 1117 of file rootguard.bpf.c.

{
    if (ret)
        return -EPERM;
    record_pending_path(path, RG_PENDING_CHMOD);
    return 0;
}

References BPF_PROG(), EPERM, record_pending_path(), and RG_PENDING_CHMOD.

BPF_PROG() [14/15]

int BPF_PROG	(	rg_task_alloc	,
		struct task_struct *	task,
		unsigned long	clone_flags,
		int	ret )

Definition at line 856 of file rootguard.bpf.c.

{
    struct task_struct *current;
    const struct cred *cred;
    struct rg_task_state state = {};
    struct rg_task_state *parent_state;
    __u64 parent_key, child_key;
 
    /*
     * The chained LSM result arrives through a u64 tracing-context slot.
     * Some Clang/verifier combinations lose the signed 32-bit range when
     * returning that dynamic value directly.  Never override a previous
     * denial: normalize it to a verifier-safe negative errno instead.
     */
    if (ret)
        return -EPERM;
 
    current = (struct task_struct *)bpf_get_current_task_btf();
    parent_key = task_key(current);
    child_key = task_key(task);
    parent_state = bpf_map_lookup_elem(&task_states, &parent_key);
    if (parent_state) {
        state = *parent_state;
    } else {
        cred = BPF_CORE_READ(current, cred);
        state.observed_nonroot = cred_euid(cred) != 0;
        state.baseline_uid = cred_uid(cred);
    }
 
    bpf_map_update_elem(&task_states, &child_key, &state, BPF_ANY);
    return 0;
}

References rg_task_state::baseline_uid, BPF_PROG(), cred_euid(), cred_uid(), EPERM, rg_task_state::observed_nonroot, and task_key().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), and BPF_PROG().

BPF_PROG() [15/15]

int BPF_PROG	(	rg_task_fix_setuid	,
		struct cred *	new,
		const struct cred *	old,
		int	flags,
		int	ret )

Definition at line 892 of file rootguard.bpf.c.

{
    struct rg_file_key file_key = {};
    __u32 old_euid, new_euid, pid, tgid, ppid;
    __u32 reason_flags, rule_id, verdict;
    bool authorized, have_file_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    observe_current_task(old);
    old_euid = cred_euid(old);
    new_euid = cred_euid(new);
 
    /* A root service dropping to a user must establish a non-root baseline. */
    if (new_euid != 0) {
        struct task_struct *task =
            (struct task_struct *)bpf_get_current_task_btf();
        observe_task(task, cred_uid(new), new_euid);
        return 0;
    }
    if (old_euid == 0)
        return 0;
 
    current_ids(&pid, &tgid, &ppid);
    authorized = consume_token_for(tgid, ppid, new_euid);
    have_file_key = current_executable_key(&file_key);
    verdict = decide_escalation(&file_key, have_file_key, authorized,
                                &reason_flags, &rule_id);
 
    if (verdict == RG_VERDICT_AUTHORIZED || verdict == RG_VERDICT_TRUSTED)
        mark_current_authorized_root();
 
    emit_event(RG_EVENT_SETUID, verdict, reason_flags, rule_id,
               old_euid, new_euid, flags, 0,
               have_file_key ? &file_key : 0, 0, 0,
               0, 0, 0, 0, 0, 0);
 
    return lsm_result_from_verdict(verdict);
}

References BPF_PROG(), consume_token_for(), cred_euid(), cred_uid(), current_executable_key(), current_ids(), decide_escalation(), emit_event(), EPERM, lsm_result_from_verdict(), mark_current_authorized_root(), observe_current_task(), observe_task(), RG_EVENT_SETUID, RG_VERDICT_AUTHORIZED, and RG_VERDICT_TRUSTED.

BPF_PROG2()

int BPF_PROG2	(	rg_path_chown	,
		const struct path *	,
		path	,
		kuid_t	,
		uid	,
		kgid_t	,
		gid	,
		int	,
		ret	)

Definition at line 1126 of file rootguard.bpf.c.

{
    /* kuid_t/kgid_t are small struct-by-value arguments.  BPF_PROG performs
     * scalar casts from ctx[] and therefore cannot materialise them.  Use
     * BPF_PROG2, which accounts for aggregate arguments in the trampoline
     * context.  The values are not needed here; inode_setattr records the
     * resulting owner metadata change.
     */
    (void)uid;
    (void)gid;
 
    if (ret)
        return -EPERM;
    record_pending_path(path, RG_PENDING_CHOWN);
    return 0;
}

References BPF_PROG2(), EPERM, record_pending_path(), and RG_PENDING_CHOWN.

Referenced by BPF_PROG2().

capture_exec_context()

__always_inline void capture_exec_context ( struct linux_binprm * bprm, const struct rg_file_key * key )

static

Definition at line 447 of file rootguard.bpf.c.

{
    struct rg_exec_context context = {};
    struct task_struct *task;
    const char *filename;
    __u64 ids;
    __u32 tgid;
 
    if (!bprm)
        return;
 
    ids = bpf_get_current_pid_tgid();
    tgid = (__u32)(ids >> 32);
    if (tgid == 0)
        return;
 
    if (key)
        context.executable = *key;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (task)
        context.start_boottime_ns = BPF_CORE_READ(task, start_boottime);
 
    /*
     * bprm->filename is captured synchronously at exec time. The executable
     * device/inode above remains the authoritative identity even when this
     * string is relative or later renamed.
     */
    filename = BPF_CORE_READ(bprm, filename);
    if (filename)
        bpf_probe_read_kernel_str(context.executable_path,
                                  sizeof(context.executable_path),
                                  filename);
    bpf_map_update_elem(&exec_contexts, &tgid, &context, BPF_ANY);
}

References capture_exec_context(), rg_exec_context::executable, rg_exec_context::executable_path, and rg_exec_context::start_boottime_ns.

Referenced by BPF_PROG(), and capture_exec_context().

consume_pending_path()

__always_inline bool consume_pending_path ( const struct rg_file_key * file_key, char * destination, __u32 * path_resolution )

static

Definition at line 536 of file rootguard.bpf.c.

{
    __u64 ids = bpf_get_current_pid_tgid();
    struct rg_pending_path *pending =
        bpf_map_lookup_elem(&pending_paths, &ids);
 
    if (!pending)
        return false;
 
    if (!file_key_equal(file_key, &pending->file)) {
        bpf_map_delete_elem(&pending_paths, &ids);
        return false;
    }
 
    __builtin_memcpy_inline(destination, pending->path, RG_FILENAME_LEN);
    *path_resolution = RG_PATH_LSM_EXACT;
    bpf_map_delete_elem(&pending_paths, &ids);
    return true;
}

References consume_pending_path(), rg_pending_path::file, file_key_equal(), rg_pending_path::path, RG_FILENAME_LEN, and RG_PATH_LSM_EXACT.

Referenced by consume_pending_path(), and emit_event().

consume_token_for()

__always_inline bool consume_token_for ( __u32 tgid, __u32 ppid, __u32 target_euid )

static

Definition at line 675 of file rootguard.bpf.c.

{
    __u64 now = bpf_ktime_get_ns();
    struct rg_auth_token *token;
    bool valid;
 
    token = bpf_map_lookup_elem(&auth_tokens, &tgid);
    if (token) {
        valid = token->expires_ns >= now && token->target_euid == target_euid;
        bpf_map_delete_elem(&auth_tokens, &tgid);
        if (valid)
            return true;
    }
 
    token = bpf_map_lookup_elem(&auth_tokens, &ppid);
    if (token) {
        valid = token->expires_ns >= now && token->target_euid == target_euid;
        bpf_map_delete_elem(&auth_tokens, &ppid);
        if (valid)
            return true;
    }
 
    return false;
}

References consume_token_for(), rg_auth_token::expires_ns, and rg_auth_token::target_euid.

Referenced by BPF_PROG(), BPF_PROG(), and consume_token_for().

copy_map_string()

__always_inline void copy_map_string ( char * destination, const char * source, __u32 size )

static

Definition at line 435 of file rootguard.bpf.c.

{
    if (!destination || !source || size == 0)
        return;
    if (size == RG_FILENAME_LEN)
        __builtin_memcpy_inline(destination, source, RG_FILENAME_LEN);
    else if (size == RG_COMM_LEN)
        __builtin_memcpy_inline(destination, source, RG_COMM_LEN);
}

References copy_map_string(), RG_COMM_LEN, and RG_FILENAME_LEN.

Referenced by copy_map_string(), and enrich_event_actor().

cred_euid()

__always_inline __u32 cred_euid ( const struct cred * cred )

static

Definition at line 197 of file rootguard.bpf.c.

{
    kuid_t euid = {};
 
    if (!cred)
        return (__u32)-1;
 
    BPF_CORE_READ_INTO(&euid, cred, euid);
    return euid.val;
}

References cred_euid().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), cred_euid(), current_euid_value(), guard_current_root_provenance(), and observe_current_task().

cred_uid()

__always_inline __u32 cred_uid ( const struct cred * cred )

static

Definition at line 186 of file rootguard.bpf.c.

{
    kuid_t uid = {};
 
    if (!cred)
        return (__u32)-1;
 
    BPF_CORE_READ_INTO(&uid, cred, uid);
    return uid.val;
}

References cred_uid().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), cred_uid(), guard_current_root_provenance(), and observe_current_task().

current_cred_ptr()

__always_inline const struct cred * current_cred_ptr ( void )

static

Definition at line 208 of file rootguard.bpf.c.

{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
 
    return BPF_CORE_READ(task, cred);
}

References current_cred_ptr().

Referenced by BPF_PROG(), current_cred_ptr(), and current_euid_value().

current_euid_value()

__always_inline __u32 current_euid_value ( void )

static

Definition at line 216 of file rootguard.bpf.c.

{
    return cred_euid(current_cred_ptr());
}

References cred_euid(), current_cred_ptr(), and current_euid_value().

Referenced by BPF_PROG(), and current_euid_value().

current_executable_key()

__always_inline bool current_executable_key ( struct rg_file_key * key )

static

Definition at line 391 of file rootguard.bpf.c.

{
    struct task_struct *task;
    struct mm_struct *mm;
    struct file *file;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    mm = BPF_CORE_READ(task, mm);
    if (!mm)
        return false;
 
    file = BPF_CORE_READ(mm, exe_file);
    return file_key_from_file(file, key);
}

References current_executable_key(), and file_key_from_file().

Referenced by BPF_PROG(), current_executable_key(), enrich_event_actor(), guard_current_root_provenance(), and observe_unprotected_metadata().

current_ids()

__always_inline void current_ids ( __u32 * pid, __u32 * tgid, __u32 * ppid )

static

Definition at line 221 of file rootguard.bpf.c.

{
    __u64 id = bpf_get_current_pid_tgid();
    struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
    struct task_struct *parent = BPF_CORE_READ(task, real_parent);
 
    *pid = (__u32)id;
    *tgid = (__u32)(id >> 32);
    *ppid = parent ? (__u32)BPF_CORE_READ(parent, tgid) : 0;
}

References current_ids().

Referenced by BPF_PROG(), BPF_PROG(), current_ids(), and emit_event().

decide_escalation()

__always_inline __u32 decide_escalation ( const struct rg_file_key * file_key, bool have_file_key, bool authorized, __u32 * reason_flags, __u32 * rule_id )

static

Definition at line 701 of file rootguard.bpf.c.

{
    const struct rg_kernel_config *cfg;
    struct rg_rule_value *rule;
 
    *reason_flags = RG_REASON_NONE;
    *rule_id = 0;
 
    if (authorized) {
        *reason_flags = RG_REASON_AUTH_TOKEN;
        return RG_VERDICT_AUTHORIZED;
    }
 
    if (!have_file_key) {
        *reason_flags = RG_REASON_FILE_ID_UNAVAILABLE | RG_REASON_UNKNOWN_EXEC;
    } else {
        rule = bpf_map_lookup_elem(&denied_execs, file_key);
        if (rule) {
            *reason_flags = RG_REASON_DENIED_EXEC;
            *rule_id = rule->rule_id;
            cfg = kernel_config();
            return cfg && cfg->mode == RG_MODE_ENFORCE
                       ? RG_VERDICT_BLOCKED
                       : RG_VERDICT_AUDIT;
        }
 
        rule = bpf_map_lookup_elem(&trusted_execs, file_key);
        if (rule) {
            *reason_flags = RG_REASON_TRUSTED_EXEC;
            *rule_id = rule->rule_id;
            return RG_VERDICT_TRUSTED;
        }
 
        *reason_flags = RG_REASON_UNKNOWN_EXEC;
    }
 
    cfg = kernel_config();
    if (cfg && cfg->mode == RG_MODE_ENFORCE &&
        cfg->unknown_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
 
    return RG_VERDICT_AUDIT;
}

References decide_escalation(), kernel_config(), rg_kernel_config::mode, RG_ACTION_BLOCK, RG_MODE_ENFORCE, RG_REASON_AUTH_TOKEN, RG_REASON_DENIED_EXEC, RG_REASON_FILE_ID_UNAVAILABLE, RG_REASON_NONE, RG_REASON_TRUSTED_EXEC, RG_REASON_UNKNOWN_EXEC, RG_VERDICT_AUDIT, RG_VERDICT_AUTHORIZED, RG_VERDICT_BLOCKED, RG_VERDICT_TRUSTED, rg_rule_value::rule_id, and rg_kernel_config::unknown_action.

Referenced by BPF_PROG(), BPF_PROG(), and decide_escalation().

dentry_name_ptr()

__always_inline const char * dentry_name_ptr ( const struct dentry * dentry )

static

Definition at line 384 of file rootguard.bpf.c.

{
    if (!dentry)
        return 0;
    return (const char *)BPF_CORE_READ(dentry, d_name.name);
}

References dentry_name_ptr().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), dentry_name_ptr(), and handle_xattr_change().

discard_pending_path()

__always_inline void discard_pending_path ( void )

static

Definition at line 507 of file rootguard.bpf.c.

{
    __u64 ids = bpf_get_current_pid_tgid();
    bpf_map_delete_elem(&pending_paths, &ids);
}

References discard_pending_path().

Referenced by BPF_PROG(), and discard_pending_path().

emit_event()

__always_inline void emit_event ( __u32 type, __u32 verdict, __u32 reason_flags, __u32 rule_id, __u32 old_euid, __u32 new_euid, __s32 flags, __u32 auxiliary, const struct rg_file_key * file_key, const char * kernel_filename, const char * kernel_xattr, __u32 old_mode, __u32 new_mode, __u32 old_uid, __u32 new_uid, __u32 old_gid, __u32 new_gid )

static

Definition at line 763 of file rootguard.bpf.c.

{
    const struct rg_kernel_config *cfg;
    struct rg_event *event;
 
    if (verdict == RG_VERDICT_TRUSTED) {
        cfg = kernel_config();
        if (cfg && cfg->log_trusted == 0)
            return;
    }
 
    event = bpf_ringbuf_reserve(&events, sizeof(*event), 0);
    if (!event)
        return;
 
    __builtin_memset(event, 0, sizeof(*event));
    event->timestamp_ns = bpf_ktime_get_ns();
    current_ids(&event->pid, &event->tgid, &event->ppid);
    event->old_euid = old_euid;
    event->new_euid = new_euid;
    event->event_type = type;
    event->verdict = verdict;
    event->reason_flags = reason_flags;
    event->rule_id = rule_id;
    event->lsm_flags = flags;
    event->auxiliary = auxiliary;
    event->old_mode = old_mode;
    event->new_mode = new_mode;
    event->old_uid = old_uid;
    event->new_uid = new_uid;
    event->old_gid = old_gid;
    event->new_gid = new_gid;
    if (file_key)
        event->file = *file_key;
    bpf_get_current_comm(event->comm, sizeof(event->comm));
    enrich_event_actor(event);
 
    if (!consume_pending_path(file_key, event->filename,
                              &event->path_resolution) &&
        kernel_filename) {
        bpf_probe_read_kernel_str(event->filename,
                                  sizeof(event->filename),
                                  kernel_filename);
        event->path_resolution = RG_PATH_BASENAME;
    }
    if (kernel_xattr)
        bpf_probe_read_kernel_str(event->xattr_name,
                                  sizeof(event->xattr_name),
                                  kernel_xattr);
 
    bpf_ringbuf_submit(event, 0);
}

References rg_event::auxiliary, rg_event::comm, consume_pending_path(), current_ids(), emit_event(), enrich_event_actor(), rg_event::filename, kernel_config(), rg_kernel_config::log_trusted, rg_event::new_euid, rg_event::new_gid, rg_event::new_mode, rg_event::new_uid, rg_event::old_euid, rg_event::old_gid, rg_event::old_mode, rg_event::old_uid, rg_event::path_resolution, rg_event::pid, rg_event::ppid, rg_event::reason_flags, RG_PATH_BASENAME, RG_VERDICT_TRUSTED, rg_event::rule_id, rg_event::tgid, rg_event::verdict, and rg_event::xattr_name.

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), emit_event(), guard_current_root_provenance(), and handle_xattr_change().

enrich_event_actor()

__always_inline void enrich_event_actor ( struct rg_event * event )

static

Definition at line 558 of file rootguard.bpf.c.

{
    struct task_struct *task;
    struct task_struct *parent;
    struct rg_exec_context *context;
    struct rg_exec_context *parent_context;
    __u32 tgid;
 
    if (!event)
        return;
 
    tgid = event->tgid;
    if (current_executable_key(&event->actor_file)) {
        /* Exact executable identity is always captured at event time. */
    }
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (task) {
        event->actor_start_boottime_ns =
            BPF_CORE_READ(task, start_boottime);
        parent = BPF_CORE_READ(task, real_parent);
        if (parent)
            bpf_core_read_str(event->parent_comm,
                              sizeof(event->parent_comm),
                              &parent->comm);
    }
 
    context = bpf_map_lookup_elem(&exec_contexts, &tgid);
    if (context) {
        if (event->actor_file.inode == 0)
            event->actor_file = context->executable;
        if (event->actor_start_boottime_ns == 0)
            event->actor_start_boottime_ns = context->start_boottime_ns;
        copy_map_string(event->actor_executable, context->executable_path,
                        RG_FILENAME_LEN);
    }
 
    if (event->ppid == 0)
        return;
    parent_context = bpf_map_lookup_elem(&exec_contexts, &event->ppid);
    if (!parent_context)
        return;
    event->parent_file = parent_context->executable;
    copy_map_string(event->parent_executable,
                    parent_context->executable_path,
                    RG_FILENAME_LEN);
}

References rg_event::actor_executable, rg_event::actor_file, rg_event::actor_start_boottime_ns, copy_map_string(), current_executable_key(), enrich_event_actor(), rg_exec_context::executable, rg_exec_context::executable_path, rg_file_key::inode, rg_event::parent_comm, rg_event::parent_executable, rg_event::ppid, RG_FILENAME_LEN, and rg_exec_context::start_boottime_ns.

Referenced by emit_event(), and enrich_event_actor().

file_key_equal()

__always_inline bool file_key_equal ( const struct rg_file_key * left, const struct rg_file_key * right )

static

Definition at line 427 of file rootguard.bpf.c.

{
    return left && right &&
           left->device == right->device &&
           left->inode == right->inode;
}

References rg_file_key::device, file_key_equal(), and rg_file_key::inode.

Referenced by consume_pending_path(), file_key_equal(), and pending_path_is_under_run().

file_key_from_dentry()

__always_inline bool file_key_from_dentry ( const struct dentry * dentry, struct rg_file_key * key )

static

Definition at line 372 of file rootguard.bpf.c.

{
    struct inode *inode;
 
    if (!dentry || !key)
        return false;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    return file_key_from_inode(inode, key);
}

References file_key_from_dentry(), and file_key_from_inode().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), file_key_from_dentry(), handle_xattr_change(), and record_pending_path().

file_key_from_file()

__always_inline bool file_key_from_file ( const struct file * file, struct rg_file_key * key )

static

Definition at line 360 of file rootguard.bpf.c.

{
    struct inode *inode;
 
    if (!file || !key)
        return false;
 
    inode = BPF_CORE_READ(file, f_inode);
    return file_key_from_inode(inode, key);
}

References file_key_from_file(), and file_key_from_inode().

Referenced by BPF_PROG(), BPF_PROG(), current_executable_key(), file_key_from_file(), and parent_executable_key().

file_key_from_inode()

__always_inline bool file_key_from_inode ( const struct inode * inode, struct rg_file_key * key )

static

Definition at line 343 of file rootguard.bpf.c.

{
    struct super_block *superblock;
 
    if (!inode || !key)
        return false;
 
    superblock = BPF_CORE_READ(inode, i_sb);
    if (!superblock)
        return false;
 
    key->inode = BPF_CORE_READ(inode, i_ino);
    key->device = BPF_CORE_READ(superblock, s_dev);
    return key->inode != 0;
}

References rg_file_key::device, file_key_from_inode(), and rg_file_key::inode.

Referenced by BPF_PROG(), file_key_from_dentry(), file_key_from_file(), and file_key_from_inode().

guard_current_root_provenance()

__always_inline int guard_current_root_provenance ( __u32 auxiliary, __s32 operation_flags, const struct rg_file_key * file_key )

static

Definition at line 998 of file rootguard.bpf.c.

{
    struct task_struct *task;
    const struct cred *cred;
    struct rg_task_state *state;
    const struct rg_kernel_config *cfg;
    __u64 key;
    __u32 uid, euid, verdict;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    cred = BPF_CORE_READ(task, cred);
    uid = cred_uid(cred);
    euid = cred_euid(cred);
 
    if (euid != 0) {
        observe_task(task, uid, euid);
        return 0;
    }
 
    key = task_key(task);
    state = bpf_map_lookup_elem(&task_states, &key);
    if (!state || !state->observed_nonroot || state->authorized_root)
        return 0;
 
    /*
     * File-based setuid credentials can already be active before
     * bprm_check_security observes the final EUID.  Resolve the current
     * executable here as a verifier-safe fallback.  The userspace loader
     * admits only exact, root-owned, non-writable device+inode identities.
     */
    {
        struct rg_file_key executable_key = {};
        struct rg_rule_value *trusted_rule;
 
        if (current_executable_key(&executable_key)) {
            trusted_rule = bpf_map_lookup_elem(&trusted_execs,
                                               &executable_key);
            if (trusted_rule) {
                state->authorized_root = 1;
                state->anomaly_reported = 0;
                return 0;
            }
        }
    }
 
    cfg = kernel_config();
    verdict = cfg && cfg->mode == RG_MODE_ENFORCE &&
                      cfg->credential_action == RG_ACTION_BLOCK
                  ? RG_VERDICT_BLOCKED
                  : RG_VERDICT_AUDIT;
 
    if (!state->anomaly_reported) {
        state->anomaly_reported = 1;
        emit_event(RG_EVENT_CREDENTIAL_ANOMALY, verdict,
                   RG_REASON_DIRECT_CRED_ANOMALY, 0,
                   state->baseline_uid, euid, operation_flags,
                   auxiliary, file_key, 0, 0,
                   0, 0, uid, uid, 0, 0);
    }
 
    return lsm_result_from_verdict(verdict);
}

References rg_task_state::anomaly_reported, rg_task_state::authorized_root, rg_task_state::baseline_uid, cred_euid(), cred_uid(), rg_kernel_config::credential_action, current_executable_key(), emit_event(), guard_current_root_provenance(), kernel_config(), lsm_result_from_verdict(), rg_kernel_config::mode, observe_task(), rg_task_state::observed_nonroot, RG_ACTION_BLOCK, RG_EVENT_CREDENTIAL_ANOMALY, RG_MODE_ENFORCE, RG_REASON_DIRECT_CRED_ANOMALY, RG_VERDICT_AUDIT, RG_VERDICT_BLOCKED, and task_key().

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), guard_current_root_provenance(), and handle_xattr_change().

handle_xattr_change()

__always_inline int handle_xattr_change ( struct dentry * dentry, const char * name, int operation_flags )

static

Definition at line 1299 of file rootguard.bpf.c.

{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    const struct rg_kernel_config *cfg;
    struct inode *inode;
    __u32 current_mode = 0, current_uid = 0, current_gid = 0;
    __u32 reasons = 0, protected_reasons = 0, verdict, metadata_decision = 0;
    int kind;
 
    int guard = guard_current_root_provenance(0, operation_flags, 0);
    if (guard)
        return guard;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    inode_metadata(inode, &current_mode, &current_uid, &current_gid);
 
    kind = xattr_kind(name);
    if (!kind)
        return 0;
 
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected) {
        if (kind == 1 &&
            (protected->flags & RG_PROTECT_CAPABILITY_XATTR))
            protected_reasons |= RG_REASON_SECURITY_CAPABILITY;
        else if (kind == 2 &&
                 (protected->flags & RG_PROTECT_INTEGRITY_XATTR))
            protected_reasons |= RG_REASON_INTEGRITY_XATTR;
        else if (kind == 3 &&
                 (protected->flags & RG_PROTECT_SECURITY_LABEL))
            protected_reasons |= RG_REASON_SECURITY_LABEL;
    }
 
    cfg = kernel_config();
    if (!protected && kind == 1 && operation_flags >= 0 && cfg &&
        cfg->monitor_global_privilege_metadata)
        metadata_decision = observe_unprotected_metadata(false, true, 0);
    if (kind == 1 && cfg && cfg->monitor_global_privilege_metadata &&
        (protected || (metadata_decision & RG_METADATA_DECISION_SAMPLE)))
        reasons |= RG_REASON_SECURITY_CAPABILITY | RG_REASON_GLOBAL_METADATA;
 
    reasons |= protected_reasons;
    if (!reasons)
        return 0;
 
    verdict = metadata_verdict(
        protected_reasons != 0,
        protected && (protected->flags & RG_PROTECT_AUDIT_ONLY),
        (reasons & RG_REASON_GLOBAL_METADATA) != 0);
    emit_event(RG_EVENT_XATTR_CHANGE, verdict, reasons,
               protected ? protected->rule_id : 0,
               0, 0, operation_flags, (__u32)kind,
               &key, dentry_name_ptr(dentry), name,
               current_mode, current_mode,
               current_uid, current_uid, current_gid, current_gid);
    return lsm_result_from_verdict(verdict);
}

References dentry_name_ptr(), emit_event(), file_key_from_dentry(), guard_current_root_provenance(), handle_xattr_change(), inode_metadata(), kernel_config(), lsm_result_from_verdict(), metadata_verdict(), rg_kernel_config::monitor_global_privilege_metadata, observe_unprotected_metadata(), RG_EVENT_XATTR_CHANGE, RG_METADATA_DECISION_SAMPLE, RG_PROTECT_AUDIT_ONLY, RG_PROTECT_CAPABILITY_XATTR, RG_PROTECT_INTEGRITY_XATTR, RG_PROTECT_SECURITY_LABEL, RG_REASON_GLOBAL_METADATA, RG_REASON_INTEGRITY_XATTR, RG_REASON_SECURITY_CAPABILITY, RG_REASON_SECURITY_LABEL, and xattr_kind().

Referenced by BPF_PROG(), BPF_PROG(), and handle_xattr_change().

inode_metadata()

__always_inline void inode_metadata ( const struct inode * inode, __u32 * mode, __u32 * uid, __u32 * gid )

static

Definition at line 841 of file rootguard.bpf.c.

{
    kuid_t inode_uid = {};
    kgid_t inode_gid = {};
 
    *mode = BPF_CORE_READ(inode, i_mode) & 07777U;
    BPF_CORE_READ_INTO(&inode_uid, inode, i_uid);
    BPF_CORE_READ_INTO(&inode_gid, inode, i_gid);
    *uid = inode_uid.val;
    *gid = inode_gid.val;
}

References inode_metadata().

Referenced by BPF_PROG(), handle_xattr_change(), and inode_metadata().

kernel_config()

__always_inline const struct rg_kernel_config * kernel_config ( void )

static

Definition at line 232 of file rootguard.bpf.c.

{
    __u32 key = 0;
    return bpf_map_lookup_elem(&rg_config_map, &key);
}

References kernel_config().

Referenced by BPF_PROG(), decide_escalation(), emit_event(), guard_current_root_provenance(), handle_xattr_change(), kernel_config(), metadata_verdict(), and observe_unprotected_metadata().

lsm_result_from_verdict()

__always_inline int lsm_result_from_verdict ( __u32 verdict )

static

Definition at line 333 of file rootguard.bpf.c.

{
    if (verdict == RG_VERDICT_BLOCKED) {
        asm volatile("" ::: "memory");
        return -EPERM;
    }
 
    return 0;
}

References EPERM, lsm_result_from_verdict(), and RG_VERDICT_BLOCKED.

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), guard_current_root_provenance(), handle_xattr_change(), and lsm_result_from_verdict().

mark_current_authorized_root()

__always_inline void mark_current_authorized_root ( void )

static

Definition at line 659 of file rootguard.bpf.c.

{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
    __u64 key = task_key(task);
    struct rg_task_state state = {};
    struct rg_task_state *existing =
        bpf_map_lookup_elem(&task_states, &key);
 
    if (existing)
        state = *existing;
    state.authorized_root = 1;
    state.anomaly_reported = 0;
    bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
}

References rg_task_state::anomaly_reported, rg_task_state::authorized_root, mark_current_authorized_root(), and task_key().

Referenced by BPF_PROG(), BPF_PROG(), and mark_current_authorized_root().

metadata_verdict()

__always_inline __u32 metadata_verdict ( bool protected_change, bool protected_audit_only, bool global_change )

static

Definition at line 747 of file rootguard.bpf.c.

{
    const struct rg_kernel_config *cfg = kernel_config();
 
    if (!cfg || cfg->mode != RG_MODE_ENFORCE)
        return RG_VERDICT_AUDIT;
    if (protected_change && !protected_audit_only &&
        cfg->metadata_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
    if (global_change && cfg->global_metadata_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
    return RG_VERDICT_AUDIT;
}

References rg_kernel_config::global_metadata_action, kernel_config(), rg_kernel_config::metadata_action, metadata_verdict(), rg_kernel_config::mode, RG_ACTION_BLOCK, RG_MODE_ENFORCE, RG_VERDICT_AUDIT, and RG_VERDICT_BLOCKED.

Referenced by BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), BPF_PROG(), handle_xattr_change(), and metadata_verdict().

observe_current_task()

__always_inline void observe_current_task ( const struct cred * cred )

static

Definition at line 652 of file rootguard.bpf.c.

{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
    observe_task(task, cred_uid(cred), cred_euid(cred));
}

References cred_euid(), cred_uid(), observe_current_task(), and observe_task().

Referenced by BPF_PROG(), BPF_PROG(), and observe_current_task().

observe_task()

__always_inline void observe_task ( struct task_struct * task, __u32 uid, __u32 euid )

static

Definition at line 611 of file rootguard.bpf.c.

{
    __u64 key;
    struct rg_task_state state = {};
    struct rg_task_state *existing;
 
    if (!task)
        return;
 
    key = task_key(task);
    existing = bpf_map_lookup_elem(&task_states, &key);
 
    if (euid != 0) {
        /*
         * The effective UID determines whether the task can exercise root
         * privileges.  A legitimate setuid-root process normally keeps the
         * caller's real UID, so testing uid != 0 here would erase an
         * authorization immediately after sudo/pkexec gained EUID 0.
         */
        /* inode_permission is hot: avoid rewriting an unchanged state. */
        if (existing && existing->observed_nonroot &&
            !existing->authorized_root &&
            existing->baseline_uid == uid)
            return;
 
        if (existing)
            state = *existing;
        state.observed_nonroot = 1;
        state.authorized_root = 0;
        state.anomaly_reported = 0;
        state.baseline_uid = uid;
        bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
        return;
    }
 
    /* Root tasks are inserted by task_alloc/authorized transitions only. */
    if (!existing)
        bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
}

References rg_task_state::anomaly_reported, rg_task_state::authorized_root, rg_task_state::baseline_uid, observe_task(), rg_task_state::observed_nonroot, and task_key().

Referenced by BPF_PROG(), BPF_PROG(), guard_current_root_provenance(), observe_current_task(), and observe_task().

observe_unprotected_metadata()

__always_inline __u32 observe_unprotected_metadata ( bool count_burst_candidate, bool request_sample, __u32 * burst_count )

static

Definition at line 248 of file rootguard.bpf.c.

{
    const struct rg_kernel_config *cfg = kernel_config();
    struct rg_metadata_domain_state initial = {};
    struct rg_metadata_domain_state *state;
    struct rg_metadata_domain_key key = {};
    __u64 now, window_ns, cooldown_ns;
    __u32 monitor_global, detect_bursts, sample_limit, burst_threshold;
    __u32 decision = 0;
 
    if (burst_count)
        *burst_count = 0;
    if (!cfg)
        return 0;
 
    /* Copy config scalars before taking a map-value spin lock. */
    monitor_global = cfg->monitor_global_privilege_metadata;
    detect_bursts = cfg->detect_global_metadata_bursts;
    sample_limit = cfg->global_metadata_sample_limit;
    burst_threshold = cfg->metadata_burst_threshold;
    window_ns = (__u64)cfg->metadata_burst_window_ms * 1000000ULL;
    cooldown_ns = (__u64)cfg->metadata_burst_cooldown_ms * 1000000ULL;
    if (!monitor_global && !detect_bursts)
        return 0;
 
    key.cgroup_id = bpf_get_current_cgroup_id();
    if (!current_executable_key(&key.actor))
        key.tgid_fallback = (__u32)(bpf_get_current_pid_tgid() >> 32);
    (void)parent_executable_key(&key.parent);
    now = bpf_ktime_get_ns();
    if (window_ns == 0)
        window_ns = 5000000000ULL;
    if (cooldown_ns < window_ns)
        cooldown_ns = window_ns;
 
    state = bpf_map_lookup_elem(&metadata_domain_states, &key);
    if (!state) {
        initial.window_start_ns = now;
        bpf_map_update_elem(&metadata_domain_states, &key, &initial, BPF_NOEXIST);
        state = bpf_map_lookup_elem(&metadata_domain_states, &key);
        if (!state)
            return 0;
    }
 
    /* Multiple workers in one service/cgroup may run on different CPUs. */
    bpf_spin_lock(&state->lock);
 
    if (state->window_start_ns == 0 ||
        now - state->window_start_ns >= window_ns) {
        state->window_start_ns = now;
        state->destructive_count = 0;
        state->sampled_events = 0;
    }
 
    if (request_sample && monitor_global &&
        state->sampled_events < sample_limit) {
        ++state->sampled_events;
        decision |= RG_METADATA_DECISION_SAMPLE;
    }
 
    if (count_burst_candidate && detect_bursts) {
        if (state->destructive_count != (__u32)-1)
            ++state->destructive_count;
        if (state->destructive_count >= burst_threshold &&
            (state->last_burst_ns == 0 ||
             now - state->last_burst_ns >= cooldown_ns)) {
            state->last_burst_ns = now;
            decision |= RG_METADATA_DECISION_BURST;
            if (burst_count)
                *burst_count = state->destructive_count;
        }
    }
 
    bpf_spin_unlock(&state->lock);
    return decision;
}

References rg_metadata_domain_key::actor, rg_metadata_domain_key::cgroup_id, current_executable_key(), rg_metadata_domain_state::destructive_count, rg_kernel_config::detect_global_metadata_bursts, rg_kernel_config::global_metadata_sample_limit, kernel_config(), rg_metadata_domain_state::last_burst_ns, rg_metadata_domain_state::lock, rg_kernel_config::metadata_burst_cooldown_ms, rg_kernel_config::metadata_burst_threshold, rg_kernel_config::metadata_burst_window_ms, rg_kernel_config::monitor_global_privilege_metadata, observe_unprotected_metadata(), rg_metadata_domain_key::parent, parent_executable_key(), RG_METADATA_DECISION_BURST, RG_METADATA_DECISION_SAMPLE, rg_metadata_domain_state::sampled_events, rg_metadata_domain_key::tgid_fallback, and rg_metadata_domain_state::window_start_ns.

Referenced by BPF_PROG(), handle_xattr_change(), and observe_unprotected_metadata().

parent_executable_key()

__always_inline bool parent_executable_key ( struct rg_file_key * key )

static

Definition at line 406 of file rootguard.bpf.c.

{
    struct task_struct *task, *parent;
    struct mm_struct *mm;
    struct file *file;
 
    if (!key)
        return false;
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (!task)
        return false;
    parent = BPF_CORE_READ(task, real_parent);
    if (!parent)
        return false;
    mm = BPF_CORE_READ(parent, mm);
    if (!mm)
        return false;
    file = BPF_CORE_READ(mm, exe_file);
    return file_key_from_file(file, key);
}

References file_key_from_file(), and parent_executable_key().

Referenced by observe_unprotected_metadata(), and parent_executable_key().

pending_path_is_under_run()

__always_inline bool pending_path_is_under_run ( const struct rg_file_key * file_key )

static

Definition at line 494 of file rootguard.bpf.c.

{
    __u64 ids = bpf_get_current_pid_tgid();
    struct rg_pending_path *pending =
        bpf_map_lookup_elem(&pending_paths, &ids);
 
    if (!pending || !file_key_equal(file_key, &pending->file))
        return false;
 
    return runtime_path_is_run(pending->path);
}

References rg_pending_path::file, file_key_equal(), rg_pending_path::path, pending_path_is_under_run(), and runtime_path_is_run().

Referenced by BPF_PROG(), and pending_path_is_under_run().

record_pending_path()

__always_inline void record_pending_path ( const struct path * path, __u32 operation )

static

Definition at line 513 of file rootguard.bpf.c.

{
    struct rg_pending_path pending = {};
    __u64 ids;
 
    if (!path || !bpf_path_d_path)
        return;
    if (!file_key_from_dentry(BPF_CORE_READ(path, dentry), &pending.file))
        return;
    /*
     * Older BTF declares the first argument as struct path *, while newer
     * kernels const-qualify it.  A mutable pointer is accepted by both forms.
     */
    if (bpf_path_d_path((struct path *)path, pending.path,
                        sizeof(pending.path)) <= 0)
        return;
 
    pending.operation = operation;
    ids = bpf_get_current_pid_tgid();
    bpf_map_update_elem(&pending_paths, &ids, &pending, BPF_ANY);
}

References bpf_path_d_path(), rg_pending_path::file, file_key_from_dentry(), rg_pending_path::operation, rg_pending_path::path, and record_pending_path().

Referenced by BPF_PROG(), BPF_PROG2(), and record_pending_path().

rg_sched_process_exit()

int rg_sched_process_exit

(

struct trace_event_raw_sched_process_template *

ctx

)

Definition at line 1516 of file rootguard.bpf.c.

{
    __u64 ids = bpf_get_current_pid_tgid();
    __u32 pid = (__u32)ids;
    __u32 tgid = (__u32)(ids >> 32);
 
    if (pid == tgid)
        bpf_map_delete_elem(&exec_contexts, &tgid);
    bpf_map_delete_elem(&pending_paths, &ids);
    return 0;
}

References rg_sched_process_exit().

Referenced by rg_sched_process_exit().

runtime_path_is_run()

__always_inline bool runtime_path_is_run ( const char * path )

static

Definition at line 484 of file rootguard.bpf.c.

{
    if (!path)
        return false;
 
    /* Match /run and /run/... but not /runtime, /runner, etc. */
    return path[0] == '/' && path[1] == 'r' && path[2] == 'u' &&
           path[3] == 'n' && (path[4] == '\0' || path[4] == '/');
}

References runtime_path_is_run().

Referenced by pending_path_is_under_run(), and runtime_path_is_run().

SEC() [1/2]

struct @046352274040072010274252261242260131256021005134 SEC

(

".maps"

)

SEC() [2/2]

char LICENSE[] SEC

(

"license"

)

References SEC.

task_key()

__always_inline __u64 task_key ( const struct task_struct * task )

static

Definition at line 606 of file rootguard.bpf.c.

{
    return (__u64)(unsigned long)task;
}

References task_key().

Referenced by BPF_PROG(), guard_current_root_provenance(), mark_current_authorized_root(), observe_task(), and task_key().

xattr_kind()

__always_inline int xattr_kind ( const char * name )

static

Definition at line 821 of file rootguard.bpf.c.

{
    char value[RG_XATTR_NAME_LEN] = {};
 
    if (!name)
        return 0;
    if (bpf_probe_read_kernel_str(value, sizeof(value), name) <= 0)
        return 0;
 
    if (__builtin_memcmp(value, "security.capability", 20) == 0)
        return 1;
    if (__builtin_memcmp(value, "security.ima", 13) == 0 ||
        __builtin_memcmp(value, "security.evm", 13) == 0)
        return 2;
    if (__builtin_memcmp(value, "security.selinux", 17) == 0 ||
        __builtin_memcmp(value, "security.apparmor", 18) == 0)
        return 3;
    return 0;
}

References RG_XATTR_NAME_LEN, and xattr_kind().

Referenced by handle_xattr_change(), and xattr_kind().

Variable Documentation

SEC

struct { ... } SEC

Referenced by SEC().