RootGuardEventTests.cpp File Reference

Go to the source code of this file.

Functions
int	main ()

Function Documentation

main()

int main

(

void

)

Definition at line 8 of file RootGuardEventTests.cpp.

{
    using namespace BastionGuard::RootGuard;
 
    const std::string json =
        R"({"received_at":"2026-08-03T08:00:00Z","event":"permission-change","verdict":"blocked","pid":42,"tgid":42,"ppid":1,"old_euid":0,"new_euid":0,"rule_id":7,"reason_flags":32768,"device":8388609,"inode":1234,"actor_device":8388609,"actor_inode":777,"parent_device":8388609,"parent_inode":778,"actor_start_boottime_ns":123456789,"old_mode":493,"new_mode":2541,"old_uid":0,"new_uid":0,"old_gid":0,"new_gid":0,"comm":"chmod","parent_comm":"sudo","actor_executable":"/usr/bin/chmod","parent_executable":"/usr/bin/sudo","filename":"/etc/systemd/system/example.service","path_resolution":"protected-baseline","xattr_name":""})";
 
    const auto event = parse_event_json(json);
    assert(event.has_value());
    assert(event->pid == 42);
    assert(event->device == 8388609);
    assert(event->inode == 1234);
    assert(event->actor_device == 8388609);
    assert(event->actor_inode == 777);
    assert(event->parent_inode == 778);
    assert(event->parent_comm == "sudo");
    assert(event->parent_executable == "/usr/bin/sudo");
    assert(event->old_mode == 493);
    assert(event->new_mode == 2541);
    assert(classify_event(*event) == EventSeverity::Incident);
    assert(is_security_observation(*event));
    assert(is_actionable_incident(*event));
    assert(event->actor_executable == "/usr/bin/chmod");
    assert(event->path_resolution == "protected-baseline");
    assert(is_system_service_path(event->filename));
    assert(is_system_service_path("/etc/conf.d/sshd"));
    assert(!event_fingerprint(*event).empty());
    assert(format_event(*event).find("mode=755->4755") != std::string::npos);
 
    const auto legacyGlobal = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":4194304,"device":42,"inode":99,"old_mode":420,"new_mode":384,"comm":"chmod","parent_comm":"sudo","actor_device":42,"actor_inode":100,"actor_executable":"/usr/bin/chmod","filename":"/var/tmp/permission-test","path_resolution":"lsm-exact"})");
    assert(legacyGlobal.has_value());
    // Historical broad-surveillance records remain Events-only telemetry.
    assert(classify_event(*legacyGlobal) == EventSeverity::Telemetry);
    assert(!is_security_observation(*legacyGlobal));
    assert(!is_actionable_incident(*legacyGlobal));
    assert(legacyGlobal->path_resolution == "lsm-exact");
    assert(legacyGlobal->parent_comm == "sudo");
    assert(format_event(*legacyGlobal).find("actor=/usr/bin/chmod") != std::string::npos);
    assert(format_event(*legacyGlobal).find("actor-identity=42:100") != std::string::npos);
    assert(format_event(*legacyGlobal).find("path-resolution=lsm-exact") != std::string::npos);
    assert(format_event(*legacyGlobal).find("identity=42:99") != std::string::npos);
 
    const auto setidAdded = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":163840,"old_mode":493,"new_mode":2541,"old_uid":0,"new_uid":0,"comm":"chmod","filename":"/tmp/helper","path_resolution":"lsm-exact"})");
    assert(setidAdded.has_value());
    assert((setidAdded->reason_flags & RG_REASON_SETID_ADDED) != 0);
    assert(classify_event(*setidAdded) == EventSeverity::Observation);
    assert(is_security_observation(*setidAdded));
    assert(!is_actionable_incident(*setidAdded));
 
    const auto ownerToRoot = parse_event_json(
        R"({"event":"owner-change","verdict":"audit","rule_id":0,"reason_flags":196608,"old_mode":420,"new_mode":420,"old_uid":1000,"new_uid":0,"comm":"chown","filename":"/usr/share/example.dat","path_resolution":"lsm-exact"})");
    assert(ownerToRoot.has_value());
    assert((ownerToRoot->reason_flags & RG_REASON_OWNER_TO_ROOT) != 0);
    assert(classify_event(*ownerToRoot) == EventSeverity::Observation);
    assert(is_security_observation(*ownerToRoot));
    assert(!is_actionable_incident(*ownerToRoot));
 
    const auto nonExecutableRootWrite = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":8519680,"old_mode":420,"new_mode":436,"old_uid":0,"new_uid":0,"comm":"chmod","filename":"/var/lib/example/state.db","path_resolution":"lsm-exact"})");
    assert(nonExecutableRootWrite.has_value());
    assert((nonExecutableRootWrite->reason_flags & RG_REASON_ROOT_OWNED_WRITE_EXPOSURE) != 0);
    assert(classify_event(*nonExecutableRootWrite) == EventSeverity::Observation);
    assert(!is_actionable_incident(*nonExecutableRootWrite));
 
    const auto sensitiveGroupWriteExecutable = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":8519680,"old_mode":493,"new_mode":509,"old_uid":0,"new_uid":0,"comm":"chmod","filename":"/usr/local/bin/tool","path_resolution":"lsm-exact"})");
    assert(sensitiveGroupWriteExecutable.has_value());
    assert(classify_event(*sensitiveGroupWriteExecutable) == EventSeverity::Observation);
    assert(!is_actionable_incident(*sensitiveGroupWriteExecutable));
 
    const auto collaborativeGroupWriteExecutable = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":8519680,"old_mode":493,"new_mode":509,"old_uid":0,"new_uid":0,"comm":"chmod","filename":"/srv/build/tool","path_resolution":"lsm-exact"})");
    assert(collaborativeGroupWriteExecutable.has_value());
    assert(classify_event(*collaborativeGroupWriteExecutable) == EventSeverity::Observation);
    assert(!is_actionable_incident(*collaborativeGroupWriteExecutable));
 
    const auto worldWriteExecutable = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":8519680,"old_mode":493,"new_mode":495,"old_uid":0,"new_uid":0,"comm":"chmod","filename":"/srv/build/tool","path_resolution":"lsm-exact"})");
    assert(worldWriteExecutable.has_value());
    assert(classify_event(*worldWriteExecutable) == EventSeverity::Observation);
    assert(!is_actionable_incident(*worldWriteExecutable));
 
    const auto executableCapability = parse_event_json(
        R"({"event":"xattr-change","verdict":"audit","rule_id":0,"reason_flags":131328,"lsm_flags":0,"auxiliary":1,"old_mode":493,"new_mode":493,"old_uid":0,"new_uid":0,"comm":"setcap","filename":"/usr/local/bin/helper","path_resolution":"basename-only"})");
    assert(executableCapability.has_value());
    assert((executableCapability->reason_flags & RG_REASON_SECURITY_CAPABILITY) != 0);
    assert(classify_event(*executableCapability) == EventSeverity::Observation);
    assert(!is_actionable_incident(*executableCapability));
 
    const auto capabilityRemoval = parse_event_json(
        R"({"event":"xattr-change","verdict":"audit","rule_id":0,"reason_flags":131328,"lsm_flags":-1,"auxiliary":1,"old_mode":493,"new_mode":493,"old_uid":0,"new_uid":0,"comm":"setcap","filename":"/usr/local/bin/helper","path_resolution":"basename-only"})");
    assert(capabilityRemoval.has_value());
    assert(capabilityRemoval->lsm_flags == -1);
    assert(classify_event(*capabilityRemoval) == EventSeverity::Observation);
    assert(!is_actionable_incident(*capabilityRemoval));
 
    const auto nonExecutableCapability = parse_event_json(
        R"({"event":"xattr-change","verdict":"audit","rule_id":0,"reason_flags":131328,"lsm_flags":0,"auxiliary":1,"old_mode":420,"new_mode":420,"old_uid":0,"new_uid":0,"comm":"setcap","filename":"/var/lib/example/blob","path_resolution":"basename-only"})");
    assert(nonExecutableCapability.has_value());
    assert(classify_event(*nonExecutableCapability) == EventSeverity::Observation);
    assert(!is_actionable_incident(*nonExecutableCapability));
 
 
    const auto metadataBurst = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":0,"reason_flags":16908288,"auxiliary":64,"old_mode":420,"new_mode":384,"old_uid":1000,"new_uid":1000,"comm":"chmod","filename":"/home/user/document","path_resolution":"lsm-exact"})");
    assert(metadataBurst.has_value());
    assert((metadataBurst->reason_flags & RG_REASON_METADATA_BURST) != 0);
    assert(classify_event(*metadataBurst) == EventSeverity::Incident);
    assert(is_actionable_incident(*metadataBurst));
 
    const auto protectedAudit = parse_event_json(
        R"({"event":"permission-change","verdict":"audit","rule_id":9,"reason_flags":64,"device":42,"inode":102,"old_mode":420,"new_mode":384,"old_uid":0,"new_uid":0,"old_gid":0,"new_gid":0,"comm":"chmod","actor_executable":"/usr/bin/chmod","filename":"/etc/sudoers","path_resolution":"protected-baseline"})");
    assert(protectedAudit.has_value());
    assert(classify_event(*protectedAudit) == EventSeverity::Incident);
    assert(is_actionable_incident(*protectedAudit));
 
    const auto trusted = parse_event_json(
        R"({"event":"setuid","verdict":"trusted","filename":"/usr/bin/sudo"})");
    assert(trusted.has_value());
    assert(classify_event(*trusted) == EventSeverity::Telemetry);
    assert(!is_actionable_incident(*trusted));
 
    std::cout << "RootGuardEventTests: OK\n";
    return 0;
}

References BastionGuard::RootGuard::classify_event(), BastionGuard::RootGuard::event_fingerprint(), BastionGuard::RootGuard::format_event(), BastionGuard::RootGuard::Incident, BastionGuard::RootGuard::is_actionable_incident(), BastionGuard::RootGuard::is_security_observation(), BastionGuard::RootGuard::is_system_service_path(), main(), BastionGuard::RootGuard::Observation, BastionGuard::RootGuard::parse_event_json(), RG_REASON_METADATA_BURST, RG_REASON_OWNER_TO_ROOT, RG_REASON_ROOT_OWNED_WRITE_EXPOSURE, RG_REASON_SECURITY_CAPABILITY, RG_REASON_SETID_ADDED, and BastionGuard::RootGuard::Telemetry.