AutomaticResponseSink.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/AutomaticResponseSink.hpp"
 
#include "rootguard/SystemServiceControl.hpp"
 
#include <algorithm>
#include <cstring>
 
namespace bastionguard::rootguard {
namespace {
 
bool isActionableMetadataEvent(const rg_event& event) noexcept
{
    switch (event.event_type) {
    case RG_EVENT_PERMISSION_CHANGE:
    case RG_EVENT_OWNER_CHANGE:
    case RG_EVENT_XATTR_CHANGE:
    case RG_EVENT_ACL_CHANGE:
    case RG_EVENT_PROTECTED_UNLINK:
    case RG_EVENT_PROTECTED_RENAME:
    case RG_EVENT_PROTECTED_HARDLINK:
    case RG_EVENT_INTEGRITY_DRIFT:
        break;
    default:
        return false;
    }
 
    /*
     * Automatic containment is a state-changing operation and must never run
     * for audit/alert events. It is allowed only after the kernel has denied
     * the metadata change and reported RG_VERDICT_BLOCKED.
     */
    return event.verdict == RG_VERDICT_BLOCKED;
}
 
void copyString(char* destination, const std::size_t size,
                const std::string& source) noexcept
{
    if (!destination || size == 0)
        return;
    const auto count = std::min(size - 1, source.size());
    std::memcpy(destination, source.data(), count);
    destination[count] = '\0';
}
 
} // namespace
 
AutomaticResponseSink::AutomaticResponseSink(IEventSink& downstream,
                                             const bool autoBlockSystemServices)
    : downstream_(downstream),
      autoBlockSystemServices_(autoBlockSystemServices),
      worker_(&AutomaticResponseSink::workerLoop, this)
{
}
 
AutomaticResponseSink::~AutomaticResponseSink()
{
    {
        std::lock_guard lock(mutex_);
        stopping_ = true;
    }
    condition_.notify_one();
    if (worker_.joinable())
        worker_.join();
}
 
void AutomaticResponseSink::setAutoBlockSystemServices(const bool enabled) noexcept
{
    autoBlockSystemServices_.store(enabled, std::memory_order_release);
}
 
void AutomaticResponseSink::onEvent(const rg_event& event) noexcept
{
    try {
        downstream_.onEvent(event);
 
        if (!autoBlockSystemServices_.load(std::memory_order_acquire) ||
            !isActionableMetadataEvent(event))
            return;
 
        const std::filesystem::path path(event.filename);
        const auto target = identifySystemService(path);
        if (!target)
            return;
 
        /*
         * The LSM denied the operation, therefore the service definition
         * remains unchanged. Stopping it cannot execute attacker-controlled
         * replacement content.
         */
        enqueueService(path, event);
    } catch (...) {
        // Automatic reaction must never terminate RootGuard.
    }
}
 
void AutomaticResponseSink::enqueueService(const std::filesystem::path& path,
                                           const rg_event& source) noexcept
{
    try {
        const std::string key = path.lexically_normal().string();
        std::lock_guard lock(mutex_);
        if (stopping_ || !queuedPaths_.insert(key).second)
            return;
        queue_.push_back(PendingService{path, source});
        condition_.notify_one();
    } catch (...) {
    }
}
 
void AutomaticResponseSink::workerLoop() noexcept
{
    for (;;) {
        PendingService pending;
        {
            std::unique_lock lock(mutex_);
            condition_.wait(lock, [this] { return stopping_ || !queue_.empty(); });
            if (stopping_ && queue_.empty())
                break;
            pending = std::move(queue_.front());
            queue_.pop_front();
        }
 
        const auto result = blockSystemService(pending.path);
        emitServiceResult(pending.path, pending.source, result.success);
 
        std::lock_guard lock(mutex_);
        queuedPaths_.erase(pending.path.lexically_normal().string());
    }
}
 
void AutomaticResponseSink::emitServiceResult(const std::filesystem::path& path,
                                              const rg_event& source,
                                              const bool success) noexcept
{
    try {
        rg_event event = source;
        event.event_type = RG_EVENT_SERVICE_BLOCKED;
        event.verdict = success ? RG_VERDICT_BLOCKED : RG_VERDICT_ALERT;
        copyString(event.comm, sizeof(event.comm), "rootguard-react");
        copyString(event.filename, sizeof(event.filename), path.string());
        downstream_.onEvent(event);
    } catch (...) {
    }
}
 
} // namespace bastionguard::rootguard