ActionHelper.cpp File Reference

Go to the source code of this file.

Classes
struct	anonymous_namespace{ActionHelper.cpp}::Options

Namespaces
namespace	anonymous_namespace{ActionHelper.cpp}

Functions
void	anonymous_namespace{ActionHelper.cpp}::fail (const std::string &message)
std::uint64_t	anonymous_namespace{ActionHelper.cpp}::parseUnsigned (const std::string &value, const char *label, const int base=10)
Options	anonymous_namespace{ActionHelper.cpp}::parseOptions (const int argc, char *argv[])
bool	anonymous_namespace{ActionHelper.cpp}::pathStartsWith (const fs::path &path, const fs::path &prefix)
fs::path	anonymous_namespace{ActionHelper.cpp}::normalizedAbsolute (const fs::path &path)
bool	anonymous_namespace{ActionHelper.cpp}::isIgnoredPath (const Policy &policy, const fs::path &requested)
bool	anonymous_namespace{ActionHelper.cpp}::isProtectedPath (const Policy &policy, const fs::path &requested)
void	anonymous_namespace{ActionHelper.cpp}::requireProtectedPath (const Policy &policy, const fs::path &path)
std::string	anonymous_namespace{ActionHelper.cpp}::timestamp ()
void	anonymous_namespace{ActionHelper.cpp}::copyString (char *destination, const std::size_t size, const std::string &source)
void	anonymous_namespace{ActionHelper.cpp}::logAction (const Policy &policy, const fs::path &path, const std::uint32_t eventType, const std::uint32_t verdict, const struct stat *before=nullptr, const struct stat *after=nullptr)
Policy	anonymous_namespace{ActionHelper.cpp}::loadPolicy (const fs::path &path)
std::string	anonymous_namespace{ActionHelper.cpp}::trim (std::string value)
void	anonymous_namespace{ActionHelper.cpp}::rewriteProtectionPolicy (const fs::path &policyPath, const bool enabled)
std::vector< fs::path >	anonymous_namespace{ActionHelper.cpp}::normalizeApplicationEntries (const std::vector< fs::path > &entries, const char *label)
void	anonymous_namespace{ActionHelper.cpp}::writePolicyAtomically (const fs::path &policyPath, const std::vector< std::string > &lines, const struct stat &metadata)
void	anonymous_namespace{ActionHelper.cpp}::rewriteApplicationRules (const Options &options)
void	anonymous_namespace{ActionHelper.cpp}::restoreFile (const Options &options, const Policy &policy)
void	anonymous_namespace{ActionHelper.cpp}::quarantineFile (const Options &options, const Policy &policy)
int	main (const int argc, char *argv[])

Variables
constexpr const char *	anonymous_namespace{ActionHelper.cpp}::kDefaultPolicy = "/etc/bastionguard/rootguard.conf"
constexpr const char *	anonymous_namespace{ActionHelper.cpp}::kQuarantineDir = "/var/lib/bastionguard/rootguard/quarantine"

Function Documentation

main()

int main	(	const int	argc,
		char *	argv[] )

Definition at line 586 of file ActionHelper.cpp.

{
    try {
        if (::geteuid() != 0)
            fail("Administrative privileges are required.");
        const Options options = parseOptions(argc, argv);
        const Policy policy = loadPolicy(options.policy);
 
        if (options.command == "set-protection") {
            if (options.protection != "on" && options.protection != "off")
                fail("set-protection requires --state on|off.");
            const bool enabled = options.protection == "on";
            rewriteProtectionPolicy(options.policy, enabled);
            const Policy updated = loadPolicy(options.policy);
            logAction(updated, options.policy, RG_EVENT_PROTECTION_MODE_CHANGED,
                      enabled ? RG_VERDICT_BLOCKED : RG_VERDICT_AUDIT);
            std::cout << (enabled
                ? "Immediate blocking enabled for protected system paths; user home remains audit-only."
                : "Immediate metadata blocking disabled.") << '\n';
        } else if (options.command == "set-application-rules") {
            rewriteApplicationRules(options);
        } else if (options.command == "restore") {
            restoreFile(options, policy);
        } else if (options.command == "remove") {
            quarantineFile(options, policy);
        } else if (options.command == "block-service") {
            const auto path = normalizedAbsolute(options.path);
            requireProtectedPath(policy, path);
            if (const auto target = identifySystemService(path)) {
                if (target->init == InitSystem::OpenRC || target->init == InitSystem::SysVInit) {
                    struct stat current{};
                    if (!options.device || !options.inode ||
                        ::lstat(path.c_str(), &current) != 0 ||
                        FileIdentityResolver::kernelDeviceNumber(current.st_dev) != *options.device ||
                        static_cast<std::uint64_t>(current.st_ino) != *options.inode) {
                        fail("Refusing to execute an OpenRC/SysV service definition without a matching protected identity.");
                    }
                }
            }
            const auto result = blockSystemService(path);
            if (!result.success) fail(result.message);
            logAction(policy, path, RG_EVENT_SERVICE_BLOCKED, RG_VERDICT_BLOCKED);
            std::cout << result.message << '\n';
        } else if (options.command == "unblock-service") {
            const auto path = normalizedAbsolute(options.path);
            requireProtectedPath(policy, path);
            const auto result = unblockSystemService(path);
            if (!result.success) fail(result.message);
            std::cout << result.message << '\n';
        } else {
            fail("Unknown action: " + options.command);
        }
        return 0;
    } catch (const std::exception& error) {
        std::cerr << "RootGuard action: " << error.what() << '\n';
        return 1;
    }
}

References bastionguard::rootguard::blockSystemService(), anonymous_namespace{ActionHelper.cpp}::fail(), bastionguard::rootguard::identifySystemService(), bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber(), anonymous_namespace{ActionHelper.cpp}::loadPolicy(), anonymous_namespace{ActionHelper.cpp}::logAction(), main(), anonymous_namespace{ActionHelper.cpp}::normalizedAbsolute(), bastionguard::rootguard::OpenRC, anonymous_namespace{ActionHelper.cpp}::parseOptions(), anonymous_namespace{ActionHelper.cpp}::quarantineFile(), anonymous_namespace{ActionHelper.cpp}::requireProtectedPath(), anonymous_namespace{ActionHelper.cpp}::restoreFile(), anonymous_namespace{ActionHelper.cpp}::rewriteApplicationRules(), anonymous_namespace{ActionHelper.cpp}::rewriteProtectionPolicy(), RG_EVENT_PROTECTION_MODE_CHANGED, RG_EVENT_SERVICE_BLOCKED, RG_VERDICT_AUDIT, RG_VERDICT_BLOCKED, bastionguard::rootguard::SysVInit, and bastionguard::rootguard::unblockSystemService().