ActionHelper.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/FileIdentity.hpp"
#include "rootguard/JsonEventSink.hpp"
#include "rootguard/PolicyLoader.hpp"
#include "rootguard/PolicySecurity.hpp"
#include "rootguard/SystemServiceControl.hpp"
 
#include <algorithm>
#include <cerrno>
#include <chrono>
#include <cstring>
#include <filesystem>
#include <fstream>
#include <fcntl.h>
#include <iomanip>
#include <iostream>
#include <map>
#include <optional>
#include <sstream>
#include <set>
#include <vector>
#include <stdexcept>
#include <string>
#include <string_view>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
 
namespace fs = std::filesystem;
using namespace bastionguard::rootguard;
 
namespace {
 
constexpr const char* kDefaultPolicy = "/etc/bastionguard/rootguard.conf";
constexpr const char* kQuarantineDir = "/var/lib/bastionguard/rootguard/quarantine";
 
struct Options {
    std::string command;
    fs::path policy{kDefaultPolicy};
    fs::path path;
    std::optional<std::uint32_t> mode;
    std::optional<std::uint32_t> uid;
    std::optional<std::uint32_t> gid;
    std::optional<std::uint64_t> device;
    std::optional<std::uint64_t> inode;
    std::string protection;
    std::vector<fs::path> trustedApplications;
    std::vector<fs::path> trustedExecutables;
    std::vector<fs::path> deniedExecutables;
};
 
[[noreturn]] void fail(const std::string& message)
{
    throw std::runtime_error(message);
}
 
std::uint64_t parseUnsigned(const std::string& value, const char* label,
                            const int base = 10)
{
    std::size_t consumed = 0;
    unsigned long long parsed = 0;
    try {
        parsed = std::stoull(value, &consumed, base);
    } catch (...) {
        fail(std::string("Invalid ") + label + ": " + value);
    }
    if (consumed != value.size())
        fail(std::string("Invalid ") + label + ": " + value);
    return static_cast<std::uint64_t>(parsed);
}
 
Options parseOptions(const int argc, char* argv[])
{
    if (argc < 2)
        fail("Usage: bastionguard-rootguard-action <set-protection|set-application-rules|restore|remove|block-service|unblock-service> [options]");
 
    Options options;
    options.command = argv[1];
    for (int index = 2; index < argc; ++index) {
        const std::string key = argv[index];
        if (index + 1 >= argc)
            fail("Missing value for " + key);
        const std::string value = argv[++index];
        if (key == "--policy") options.policy = value;
        else if (key == "--path") options.path = value;
        else if (key == "--mode") options.mode = static_cast<std::uint32_t>(parseUnsigned(value, "mode", 8));
        else if (key == "--uid") options.uid = static_cast<std::uint32_t>(parseUnsigned(value, "uid"));
        else if (key == "--gid") options.gid = static_cast<std::uint32_t>(parseUnsigned(value, "gid"));
        else if (key == "--device") options.device = parseUnsigned(value, "device");
        else if (key == "--inode") options.inode = parseUnsigned(value, "inode");
        else if (key == "--state") options.protection = value;
        else if (key == "--trusted-application") options.trustedApplications.emplace_back(value);
        else if (key == "--trusted-executable") options.trustedExecutables.emplace_back(value);
        else if (key == "--denied-executable") options.deniedExecutables.emplace_back(value);
        else fail("Unknown option: " + key);
    }
    return options;
}
 
bool pathStartsWith(const fs::path& path, const fs::path& prefix)
{
    const auto normalizedPath = path.lexically_normal();
    const auto normalizedPrefix = prefix.lexically_normal();
    auto pathIt = normalizedPath.begin();
    for (auto prefixIt = normalizedPrefix.begin(); prefixIt != normalizedPrefix.end();
         ++prefixIt, ++pathIt) {
        if (pathIt == normalizedPath.end() || *pathIt != *prefixIt)
            return false;
    }
    return true;
}
 
fs::path normalizedAbsolute(const fs::path& path)
{
    if (path.empty() || !path.is_absolute())
        fail("An absolute path is required.");
    const auto normalized = path.lexically_normal();
    for (const auto& component : normalized) {
        if (component == "..")
            fail("Parent traversal is not allowed.");
    }
    return normalized;
}
 
bool isIgnoredPath(const Policy& policy, const fs::path& requested)
{
    const auto path = normalizedAbsolute(requested);
    for (const auto& rule : policy.ignoredPaths) {
        const auto ignoredPath = rule.path.lexically_normal();
        if (rule.recursive ? pathStartsWith(path, ignoredPath)
                           : path == ignoredPath)
            return true;
    }
    return false;
}
 
bool isProtectedPath(const Policy& policy, const fs::path& requested)
{
    const auto path = normalizedAbsolute(requested);
    if (isIgnoredPath(policy, path))
        return false;
 
    for (const auto& rule : policy.protectedPaths) {
        const auto protectedPath = rule.path.lexically_normal();
        if (rule.recursive ? pathStartsWith(path, protectedPath)
                           : path == protectedPath)
            return true;
    }
    return false;
}
 
void requireProtectedPath(const Policy& policy, const fs::path& path)
{
    if (!isProtectedPath(policy, path))
        fail("The requested path is not covered by the RootGuard protected-path policy.");
}
 
std::string timestamp()
{
    const auto now = std::chrono::system_clock::now();
    const auto time = std::chrono::system_clock::to_time_t(now);
    std::tm tm{};
    localtime_r(&time, &tm);
    std::ostringstream output;
    output << std::put_time(&tm, "%Y%m%d-%H%M%S");
    return output.str();
}
 
void copyString(char* destination, const std::size_t size,
                const std::string& source)
{
    if (size == 0)
        return;
    const auto count = std::min(size - 1, source.size());
    std::memcpy(destination, source.data(), count);
    destination[count] = '\0';
}
 
void logAction(const Policy& policy, const fs::path& path,
               const std::uint32_t eventType,
               const std::uint32_t verdict,
               const struct stat* before = nullptr,
               const struct stat* after = nullptr)
{
    if (policy.eventLog.empty())
        return;
    try {
        if (const auto parent = policy.eventLog.parent_path(); !parent.empty())
            fs::create_directories(parent);
        JsonEventSink sink(policy.eventLog);
        rg_event event{};
        event.pid = static_cast<__u32>(::getpid());
        event.tgid = event.pid;
        event.ppid = static_cast<__u32>(::getppid());
        event.event_type = eventType;
        event.verdict = verdict;
        if (before) {
            event.file.device = FileIdentityResolver::kernelDeviceNumber(before->st_dev);
            event.file.inode = static_cast<__u64>(before->st_ino);
            event.old_mode = static_cast<__u32>(before->st_mode & 07777U);
            event.old_uid = static_cast<__u32>(before->st_uid);
            event.old_gid = static_cast<__u32>(before->st_gid);
        }
        if (after) {
            event.new_mode = static_cast<__u32>(after->st_mode & 07777U);
            event.new_uid = static_cast<__u32>(after->st_uid);
            event.new_gid = static_cast<__u32>(after->st_gid);
        }
        event.path_resolution = RG_PATH_PROTECTED_BASELINE;
        copyString(event.comm, sizeof(event.comm), "rootguard-action");
        std::error_code actorError;
        const fs::path actor = fs::read_symlink("/proc/self/exe", actorError);
        if (!actorError)
            copyString(event.actor_executable,
                       sizeof(event.actor_executable), actor.string());
        copyString(event.filename, sizeof(event.filename), path.string());
        sink.onEvent(event);
    } catch (...) {
        // The privileged action must not fail only because logging failed.
    }
}
 
Policy loadPolicy(const fs::path& path)
{
    return PolicyLoader::loadFromText(PolicySecurity::read(path, true), path);
}
 
std::string trim(std::string value)
{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}
 
void rewriteProtectionPolicy(const fs::path& policyPath, const bool enabled)
{
    struct stat metadata{};
    if (::lstat(policyPath.c_str(), &metadata) != 0)
        fail(std::string("Cannot stat policy: ") + std::strerror(errno));
    if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
        fail("The RootGuard policy must be a regular non-symlink file.");
 
    std::ifstream input(policyPath);
    if (!input)
        fail("Cannot read the RootGuard policy.");
    std::vector<std::string> lines;
    std::string line;
    while (std::getline(input, line))
        lines.push_back(line);
 
    const std::map<std::string, std::string> replacements{
        {"mode", enabled ? "enforce" : "audit"},
        {"metadata_action", enabled ? "block" : "audit"},
        {"global_metadata_action", "audit"},
        {"block_user_home", "false"},
    };
    std::map<std::string, bool> found;
    bool inEngine = false;
    std::size_t insertion = lines.size();
    for (std::size_t index = 0; index < lines.size(); ++index) {
        const std::string stripped = trim(lines[index]);
        if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
            if (inEngine && stripped != "[engine]") {
                insertion = index;
                inEngine = false;
            } else {
                inEngine = stripped == "[engine]";
            }
            continue;
        }
        if (!inEngine || stripped.empty() || stripped.front() == '#' || stripped.front() == ';')
            continue;
        const auto separator = stripped.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(stripped.substr(0, separator));
        const auto replacement = replacements.find(key);
        if (replacement != replacements.end()) {
            lines[index] = key + " = " + replacement->second;
            found[key] = true;
        }
    }
    if (insertion == lines.size() && inEngine)
        insertion = lines.size();
    for (auto iterator = replacements.rbegin(); iterator != replacements.rend(); ++iterator) {
        if (!found[iterator->first])
            lines.insert(lines.begin() + static_cast<std::ptrdiff_t>(insertion),
                         iterator->first + " = " + iterator->second);
    }
 
    const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
                               std::to_string(::getpid());
    {
        std::ofstream output(temporary, std::ios::trunc);
        if (!output)
            fail("Cannot create the temporary policy file.");
        for (const auto& item : lines)
            output << item << '\n';
        output.flush();
        if (!output)
            fail("Cannot write the temporary policy file.");
    }
    if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
        ::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot preserve policy ownership/mode: ") + std::strerror(errno));
    }
    if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot atomically replace the policy: ") + std::strerror(errno));
    }
}
 
std::vector<fs::path> normalizeApplicationEntries(
    const std::vector<fs::path>& entries,
    const char* label)
{
    std::vector<fs::path> normalized;
    std::set<std::string> seen;
    for (const auto& entry : entries) {
        const fs::path path = normalizedAbsolute(entry);
        struct stat metadata {};
        const bool exists = ::stat(path.c_str(), &metadata) == 0;
        if (!exists && errno != ENOENT)
            fail(std::string("Cannot inspect ") + label + ": " + path.string() +
                 ": " + std::strerror(errno));
        if (exists && !S_ISREG(metadata.st_mode))
            fail(std::string(label) + " is not a regular file: " + path.string());
        if (exists && ::access(path.c_str(), X_OK) != 0)
            fail(std::string(label) + " is not executable: " + path.string());
 
        /*
         * Cross-distribution policy files legitimately contain executable
         * paths that are absent on the current desktop. Preserve those entries
         * so saving from the UI does not silently delete rules for another DE
         * or browser. Existing files are still validated strictly.
         */
        std::error_code error;
        const fs::path canonical = fs::weakly_canonical(path, error);
        const fs::path finalPath = error ? path : canonical;
        if (seen.insert(finalPath.string()).second)
            normalized.push_back(finalPath);
    }
    std::sort(normalized.begin(), normalized.end());
    return normalized;
}
 
void writePolicyAtomically(const fs::path& policyPath,
                           const std::vector<std::string>& lines,
                           const struct stat& metadata)
{
    const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
                               std::to_string(::getpid());
    {
        std::ofstream output(temporary, std::ios::trunc);
        if (!output)
            fail("Cannot create the temporary policy file.");
        for (const auto& item : lines)
            output << item << '\n';
        output.flush();
        if (!output)
            fail("Cannot write the temporary policy file.");
    }
 
    std::ifstream validationInput(temporary);
    std::ostringstream validationText;
    validationText << validationInput.rdbuf();
    try {
        (void)PolicyLoader::loadFromText(validationText.str(), temporary);
    } catch (const std::exception& error) {
        fs::remove(temporary);
        fail(std::string("Refusing to install an invalid RootGuard policy: ") +
             error.what());
    }
 
    if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
        ::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot preserve policy ownership/mode: ") +
             std::strerror(errno));
    }
    if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot atomically replace the policy: ") +
             std::strerror(errno));
    }
}
 
void rewriteApplicationRules(const Options& options)
{
    struct stat metadata {};
    if (::lstat(options.policy.c_str(), &metadata) != 0)
        fail(std::string("Cannot stat policy: ") + std::strerror(errno));
    if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
        fail("The RootGuard policy must be a regular non-symlink file.");
 
    const auto trustedApplications = normalizeApplicationEntries(
        options.trustedApplications, "Trusted application");
    const auto trustedExecutables = normalizeApplicationEntries(
        options.trustedExecutables, "Privilege-trusted executable");
    const auto deniedExecutables = normalizeApplicationEntries(
        options.deniedExecutables, "Denied executable");
 
    std::set<std::string> trustedKeys;
    for (const auto& path : trustedApplications)
        trustedKeys.insert(path.string());
    for (const auto& path : trustedExecutables)
        trustedKeys.insert(path.string());
    for (const auto& path : deniedExecutables) {
        if (trustedKeys.count(path.string()) != 0)
            fail("An executable cannot be both trusted and denied: " + path.string());
    }
 
    std::ifstream input(options.policy);
    if (!input)
        fail("Cannot read the RootGuard policy.");
    std::vector<std::string> sourceLines;
    std::string line;
    while (std::getline(input, line))
        sourceLines.push_back(line);
 
    const std::map<std::string, std::vector<fs::path>> replacements {
        {"trusted-applications", trustedApplications},
        {"trusted-executables", trustedExecutables},
        {"denied-executables", deniedExecutables},
    };
    std::set<std::string> emitted;
    std::vector<std::string> output;
    std::string skippedSection;
 
    const auto emitSection = [&](const std::string& section,
                                 std::vector<std::string>& destination) {
        destination.push_back("[" + section + "]");
        if (section == "trusted-applications") {
            destination.push_back(
                "# Routine user-space metadata activity only. This never grants privilege trust.");
        } else if (section == "trusted-executables") {
            destination.push_back(
                "# Executables trusted specifically for privilege transitions.");
        } else {
            destination.push_back(
                "# Executables denied during RootGuard privilege-transition checks.");
        }
        for (const auto& path : replacements.at(section))
            destination.push_back("path = " + path.string());
        destination.push_back("");
    };
 
    for (const auto& sourceLine : sourceLines) {
        const std::string stripped = trim(sourceLine);
        if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
            const std::string section = stripped.substr(1, stripped.size() - 2);
            skippedSection.clear();
            if (replacements.count(section) != 0) {
                skippedSection = section;
                if (emitted.insert(section).second)
                    emitSection(section, output);
                continue;
            }
        }
        if (!skippedSection.empty())
            continue;
        output.push_back(sourceLine);
    }
 
    for (const auto& [section, entries] : replacements) {
        (void)entries;
        if (emitted.insert(section).second) {
            if (!output.empty() && !output.back().empty())
                output.push_back("");
            emitSection(section, output);
        }
    }
 
    writePolicyAtomically(options.policy, output, metadata);
    std::cout << "RootGuard application rules saved. A service restart is required.\n";
}
 
void restoreFile(const Options& options, const Policy& policy)
{
    if (!options.mode || !options.uid || !options.gid)
        fail("restore requires --mode, --uid and --gid.");
    const auto path = normalizedAbsolute(options.path);
    requireProtectedPath(policy, path);
 
    struct stat before{};
    if (::lstat(path.c_str(), &before) != 0)
        fail(std::string("Cannot restore missing path: ") + std::strerror(errno));
    if (S_ISLNK(before.st_mode))
        fail("Refusing to restore metadata through a symbolic link.");
    if (options.device && *options.device != 0 &&
        FileIdentityResolver::kernelDeviceNumber(before.st_dev) != *options.device)
        fail("The file device no longer matches the protected baseline.");
    if (options.inode && *options.inode != 0 &&
        static_cast<std::uint64_t>(before.st_ino) != *options.inode)
        fail("The file inode no longer matches the protected baseline. Quarantine the replacement instead.");
 
    const int openFlags = O_RDONLY | O_CLOEXEC | O_NOFOLLOW |
                          (S_ISDIR(before.st_mode) ? O_DIRECTORY : O_NONBLOCK);
    const int descriptor = ::open(path.c_str(), openFlags);
    if (descriptor < 0)
        fail(std::string("Secure open failed: ") + std::strerror(errno));
    struct stat verified{};
    if (::fstat(descriptor, &verified) != 0 ||
        verified.st_dev != before.st_dev || verified.st_ino != before.st_ino) {
        ::close(descriptor);
        fail("The protected path changed during the restore operation.");
    }
    if (::fchown(descriptor, static_cast<uid_t>(*options.uid),
                 static_cast<gid_t>(*options.gid)) != 0) {
        const std::string error = std::strerror(errno);
        ::close(descriptor);
        fail("fchown failed: " + error);
    }
    if (::fchmod(descriptor, static_cast<mode_t>(*options.mode & 07777U)) != 0) {
        const std::string error = std::strerror(errno);
        ::close(descriptor);
        fail("fchmod failed: " + error);
    }
    ::close(descriptor);
 
    const auto serviceResult = unblockSystemService(path);
    (void)serviceResult;
    struct stat after{};
    ::lstat(path.c_str(), &after);
    logAction(policy, path, RG_EVENT_FILE_RESTORED, RG_VERDICT_RESTORED,
              &before, &after);
    std::cout << "Protected metadata restored. A system service, when applicable, was unmasked but not restarted.\n";
}
 
void quarantineFile(const Options& options, const Policy& policy)
{
    const auto path = normalizedAbsolute(options.path);
    requireProtectedPath(policy, path);
    struct stat before{};
    if (::lstat(path.c_str(), &before) != 0)
        fail(std::string("Cannot remove path: ") + std::strerror(errno));
    if (S_ISDIR(before.st_mode))
        fail("Directory removal is not supported by the RootGuard incident action.");
 
    std::string serviceWarning;
    if (const auto target = identifySystemService(path)) {
        const bool identityMatches = options.device && options.inode &&
            *options.device != 0 && *options.inode != 0 &&
            FileIdentityResolver::kernelDeviceNumber(before.st_dev) == *options.device &&
            static_cast<std::uint64_t>(before.st_ino) == *options.inode;
        const bool scriptBased = target->init == InitSystem::OpenRC ||
                                 target->init == InitSystem::SysVInit;
        if (scriptBased && !identityMatches) {
            serviceWarning =
                "The affected OpenRC/SysV definition may have been replaced; "
                "RootGuard did not execute it as root. The service process may require manual containment.";
        } else {
            const auto result = blockSystemService(path);
            if (!result.success)
                serviceWarning = "Service blocking was not confirmed: " + result.message;
        }
    }
 
    fs::create_directories(kQuarantineDir);
    ::chmod(kQuarantineDir, 0700);
    const fs::path destination = fs::path(kQuarantineDir) /
        (timestamp() + "-" + std::to_string(::getpid()) + "-" + path.filename().string());
    if (::rename(path.c_str(), destination.c_str()) != 0)
        fail(std::string("Quarantine rename failed: ") + std::strerror(errno));
 
    std::ofstream manifest(destination.string() + ".manifest", std::ios::trunc);
    manifest << "original_path=" << path.string() << '\n'
             << "mode=" << std::oct << (before.st_mode & 07777U) << std::dec << '\n'
             << "uid=" << before.st_uid << '\n'
             << "gid=" << before.st_gid << '\n'
             << "device=" << FileIdentityResolver::kernelDeviceNumber(before.st_dev) << '\n'
             << "inode=" << before.st_ino << '\n';
    manifest.close();
    ::chmod(destination.c_str(), 0000);
    logAction(policy, path, RG_EVENT_FILE_QUARANTINED, RG_VERDICT_BLOCKED,
              &before, nullptr);
    std::cout << "The file was removed from its original location and quarantined at "
              << destination << ".\n";
}
 
} // namespace
 
int main(const int argc, char* argv[])
{
    try {
        if (::geteuid() != 0)
            fail("Administrative privileges are required.");
        const Options options = parseOptions(argc, argv);
        const Policy policy = loadPolicy(options.policy);
 
        if (options.command == "set-protection") {
            if (options.protection != "on" && options.protection != "off")
                fail("set-protection requires --state on|off.");
            const bool enabled = options.protection == "on";
            rewriteProtectionPolicy(options.policy, enabled);
            const Policy updated = loadPolicy(options.policy);
            logAction(updated, options.policy, RG_EVENT_PROTECTION_MODE_CHANGED,
                      enabled ? RG_VERDICT_BLOCKED : RG_VERDICT_AUDIT);
            std::cout << (enabled
                ? "Immediate blocking enabled for protected system paths; user home remains audit-only."
                : "Immediate metadata blocking disabled.") << '\n';
        } else if (options.command == "set-application-rules") {
            rewriteApplicationRules(options);
        } else if (options.command == "restore") {
            restoreFile(options, policy);
        } else if (options.command == "remove") {
            quarantineFile(options, policy);
        } else if (options.command == "block-service") {
            const auto path = normalizedAbsolute(options.path);
            requireProtectedPath(policy, path);
            if (const auto target = identifySystemService(path)) {
                if (target->init == InitSystem::OpenRC || target->init == InitSystem::SysVInit) {
                    struct stat current{};
                    if (!options.device || !options.inode ||
                        ::lstat(path.c_str(), &current) != 0 ||
                        FileIdentityResolver::kernelDeviceNumber(current.st_dev) != *options.device ||
                        static_cast<std::uint64_t>(current.st_ino) != *options.inode) {
                        fail("Refusing to execute an OpenRC/SysV service definition without a matching protected identity.");
                    }
                }
            }
            const auto result = blockSystemService(path);
            if (!result.success) fail(result.message);
            logAction(policy, path, RG_EVENT_SERVICE_BLOCKED, RG_VERDICT_BLOCKED);
            std::cout << result.message << '\n';
        } else if (options.command == "unblock-service") {
            const auto path = normalizedAbsolute(options.path);
            requireProtectedPath(policy, path);
            const auto result = unblockSystemService(path);
            if (!result.success) fail(result.message);
            std::cout << result.message << '\n';
        } else {
            fail("Unknown action: " + options.command);
        }
        return 0;
    } catch (const std::exception& error) {
        std::cerr << "RootGuard action: " << error.what() << '\n';
        return 1;
    }
}