ConsoleEventSink.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/ConsoleEventSink.hpp"
 
#include <iomanip>
#include <iostream>
 
namespace bastionguard::rootguard {
 
const char* ConsoleEventSink::eventName(const __u32 type) noexcept
{
    switch (type) {
    case RG_EVENT_SETUID: return "setuid";
    case RG_EVENT_EXEC_PRIV: return "exec-priv";
    case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
    case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
    case RG_EVENT_OWNER_CHANGE: return "owner-change";
    case RG_EVENT_XATTR_CHANGE: return "xattr-change";
    case RG_EVENT_ACL_CHANGE: return "acl-change";
    case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
    case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
    case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
    case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
    case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
    case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
    case RG_EVENT_FILE_RESTORED: return "file-restored";
    case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
    case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
    default: return "unknown";
    }
}
 
const char* ConsoleEventSink::verdictName(const __u32 verdict) noexcept
{
    switch (verdict) {
    case RG_VERDICT_AUDIT: return "AUDIT";
    case RG_VERDICT_AUTHORIZED: return "AUTHORIZED";
    case RG_VERDICT_BLOCKED: return "BLOCKED";
    case RG_VERDICT_TRUSTED: return "TRUSTED";
    case RG_VERDICT_ALERT: return "ALERT";
    case RG_VERDICT_RESTORED: return "RESTORED";
    default: return "UNKNOWN";
    }
}
 
namespace {
 
const char* pathResolutionName(const __u32 resolution) noexcept
{
    switch (resolution) {
    case RG_PATH_PROTECTED_BASELINE: return "protected-baseline";
    case RG_PATH_PROC_FD: return "proc-fd";
    case RG_PATH_PROCESS_CWD: return "process-cwd";
    case RG_PATH_KERNEL_EXACT: return "kernel-exact";
    case RG_PATH_LSM_EXACT: return "lsm-exact";
    case RG_PATH_BASENAME:
    default: return "basename-only";
    }
}
 
} // namespace
 
void ConsoleEventSink::onEvent(const rg_event& event) noexcept
{
    try {
        std::cout << '[' << verdictName(event.verdict) << "] "
                  << "type=" << eventName(event.event_type)
                  << " pid=" << event.pid
                  << " tgid=" << event.tgid
                  << " ppid=" << event.ppid
                  << " comm=" << event.comm
                  << " parent-comm=" << event.parent_comm
                  << " actor-dev=" << event.actor_file.device
                  << " actor-ino=" << event.actor_file.inode
                  << " parent-dev=" << event.parent_file.device
                  << " parent-ino=" << event.parent_file.inode
                  << " actor-start=" << event.actor_start_boottime_ns
                  << " euid=" << event.old_euid << "->" << event.new_euid
                  << " rule=" << event.rule_id
                  << " reason=0x" << std::hex << event.reason_flags << std::dec
                  << " aux=" << event.auxiliary
                  << " dev=" << event.file.device
                  << " ino=" << event.file.inode;
 
        if (event.old_mode != 0 || event.new_mode != 0) {
            std::cout << " mode=" << std::oct << event.old_mode
                      << "->" << event.new_mode << std::dec;
        }
        if (event.old_uid != 0 || event.new_uid != 0 ||
            event.old_gid != 0 || event.new_gid != 0) {
            std::cout << " owner=" << event.old_uid << ':' << event.old_gid
                      << "->" << event.new_uid << ':' << event.new_gid;
        }
        if (event.xattr_name[0] != '\0')
            std::cout << " xattr=" << event.xattr_name;
        std::cout << " file="
                  << (event.filename[0] != '\0' ? event.filename : "-")
                  << " path-resolution=" << pathResolutionName(event.path_resolution);
        if (event.actor_executable[0] != '\0')
            std::cout << " actor=" << event.actor_executable;
        if (event.parent_executable[0] != '\0')
            std::cout << " parent-exe=" << event.parent_executable;
        std::cout << '\n';
        std::cout.flush();
    } catch (...) {
        // Never allow an exception to cross the libbpf callback boundary.
    }
}
 
} // namespace bastionguard::rootguard