bastionguard::rootguard::JsonEventSink Class Reference

#include <JsonEventSink.hpp>

Inheritance diagram for bastionguard::rootguard::JsonEventSink:

Public Member Functions
	JsonEventSink (const std::filesystem::path &path)
void	onEvent (const rg_event &event) noexcept override
Public Member Functions inherited from bastionguard::rootguard::IEventSink
virtual	~IEventSink ()=default

Static Private Member Functions
static std::string	escape (const char *value)

Private Attributes
std::ofstream	stream_
std::mutex	mutex_

Detailed Description

Definition at line 11 of file JsonEventSink.hpp.

Constructor & Destructor Documentation

JsonEventSink()

bastionguard::rootguard::JsonEventSink::JsonEventSink ( const std::filesystem::path & path )

explicit

Definition at line 73 of file JsonEventSink.cpp.

    : stream_(path, std::ios::app)
{
    if (!stream_)
        throw std::runtime_error("impossibile aprire il log JSON: " + path.string());
}

References stream_.

Member Function Documentation

escape()

std::string bastionguard::rootguard::JsonEventSink::escape ( const char * value )

staticprivate

Definition at line 80 of file JsonEventSink.cpp.

{
    std::ostringstream output;
    for (const unsigned char character : std::string(value ? value : "")) {
        switch (character) {
        case '"': output << "\\\""; break;
        case '\\': output << "\\\\"; break;
        case '\b': output << "\\b"; break;
        case '\f': output << "\\f"; break;
        case '\n': output << "\\n"; break;
        case '\r': output << "\\r"; break;
        case '\t': output << "\\t"; break;
        default:
            if (character < 0x20)
                output << "\\u" << std::hex << std::setw(4) << std::setfill('0')
                       << static_cast<unsigned int>(character) << std::dec;
            else
                output << static_cast<char>(character);
        }
    }
    return output.str();
}

Referenced by onEvent().

onEvent()

void bastionguard::rootguard::JsonEventSink::onEvent ( const rg_event & event )

overridevirtualnoexcept

Implements bastionguard::rootguard::IEventSink.

Definition at line 103 of file JsonEventSink.cpp.

{
    try {
        std::lock_guard lock(mutex_);
        stream_ << '{'
                << "\"received_at\":\"" << receivedAtUtc() << "\","
                << "\"kernel_monotonic_ns\":" << event.timestamp_ns << ','
                << "\"event\":\"" << eventName(event.event_type) << "\","
                << "\"verdict\":\"" << verdictName(event.verdict) << "\","
                << "\"pid\":" << event.pid << ','
                << "\"tgid\":" << event.tgid << ','
                << "\"ppid\":" << event.ppid << ','
                << "\"old_euid\":" << event.old_euid << ','
                << "\"new_euid\":" << event.new_euid << ','
                << "\"rule_id\":" << event.rule_id << ','
                << "\"reason_flags\":" << event.reason_flags << ','
                << "\"lsm_flags\":" << event.lsm_flags << ','
                << "\"auxiliary\":" << event.auxiliary << ','
                << "\"path_resolution\":\"" << pathResolutionName(event.path_resolution) << "\","
                << "\"device\":" << event.file.device << ','
                << "\"inode\":" << event.file.inode << ','
                << "\"actor_device\":" << event.actor_file.device << ','
                << "\"actor_inode\":" << event.actor_file.inode << ','
                << "\"parent_device\":" << event.parent_file.device << ','
                << "\"parent_inode\":" << event.parent_file.inode << ','
                << "\"actor_start_boottime_ns\":" << event.actor_start_boottime_ns << ','
                << "\"old_mode\":" << event.old_mode << ','
                << "\"new_mode\":" << event.new_mode << ','
                << "\"old_uid\":" << event.old_uid << ','
                << "\"new_uid\":" << event.new_uid << ','
                << "\"old_gid\":" << event.old_gid << ','
                << "\"new_gid\":" << event.new_gid << ','
                << "\"comm\":\"" << escape(event.comm) << "\","
                << "\"parent_comm\":\"" << escape(event.parent_comm) << "\","
                << "\"actor_executable\":\"" << escape(event.actor_executable) << "\","
                << "\"parent_executable\":\"" << escape(event.parent_executable) << "\","
                << "\"filename\":\"" << escape(event.filename) << "\","
                << "\"xattr_name\":\"" << escape(event.xattr_name) << "\""
                << "}\n";
        stream_.flush();
    } catch (...) {
        // Logging must never crash the security engine.
    }
}

References escape(), mutex_, and stream_.

Referenced by anonymous_namespace{ActionHelper.cpp}::logAction().

Member Data Documentation

mutex_

std::mutex bastionguard::rootguard::JsonEventSink::mutex_

private

Definition at line 20 of file JsonEventSink.hpp.

Referenced by onEvent().

stream_

std::ofstream bastionguard::rootguard::JsonEventSink::stream_

private

Definition at line 19 of file JsonEventSink.hpp.

Referenced by JsonEventSink(), and onEvent().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/include/rootguard/JsonEventSink.hpp
• BastionGuard/src/rootguard/src/JsonEventSink.cpp