bastionguard::rootguard::ConsoleEventSink Class Reference

#include <ConsoleEventSink.hpp>

Inheritance diagram for bastionguard::rootguard::ConsoleEventSink:

Public Member Functions
void	onEvent (const rg_event &event) noexcept override
Public Member Functions inherited from bastionguard::rootguard::IEventSink
virtual	~IEventSink ()=default

Static Private Member Functions
static const char *	eventName (__u32 type) noexcept
static const char *	verdictName (__u32 verdict) noexcept

Detailed Description

Definition at line 7 of file ConsoleEventSink.hpp.

Member Function Documentation

eventName()

const char * bastionguard::rootguard::ConsoleEventSink::eventName ( __u32 type )

staticprivatenoexcept

Definition at line 9 of file ConsoleEventSink.cpp.

{
    switch (type) {
    case RG_EVENT_SETUID: return "setuid";
    case RG_EVENT_EXEC_PRIV: return "exec-priv";
    case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
    case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
    case RG_EVENT_OWNER_CHANGE: return "owner-change";
    case RG_EVENT_XATTR_CHANGE: return "xattr-change";
    case RG_EVENT_ACL_CHANGE: return "acl-change";
    case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
    case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
    case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
    case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
    case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
    case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
    case RG_EVENT_FILE_RESTORED: return "file-restored";
    case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
    case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
    default: return "unknown";
    }
}

References RG_EVENT_ACL_CHANGE, RG_EVENT_CREDENTIAL_ANOMALY, RG_EVENT_EXEC_PRIV, RG_EVENT_FILE_QUARANTINED, RG_EVENT_FILE_RESTORED, RG_EVENT_INTEGRITY_DRIFT, RG_EVENT_INTEGRITY_RESTORED, RG_EVENT_OWNER_CHANGE, RG_EVENT_PERMISSION_CHANGE, RG_EVENT_PROTECTED_HARDLINK, RG_EVENT_PROTECTED_RENAME, RG_EVENT_PROTECTED_UNLINK, RG_EVENT_PROTECTION_MODE_CHANGED, RG_EVENT_SERVICE_BLOCKED, RG_EVENT_SETUID, and RG_EVENT_XATTR_CHANGE.

Referenced by onEvent().

onEvent()

void bastionguard::rootguard::ConsoleEventSink::onEvent ( const rg_event & event )

overridevirtualnoexcept

Implements bastionguard::rootguard::IEventSink.

Definition at line 62 of file ConsoleEventSink.cpp.

{
    try {
        std::cout << '[' << verdictName(event.verdict) << "] "
                  << "type=" << eventName(event.event_type)
                  << " pid=" << event.pid
                  << " tgid=" << event.tgid
                  << " ppid=" << event.ppid
                  << " comm=" << event.comm
                  << " parent-comm=" << event.parent_comm
                  << " actor-dev=" << event.actor_file.device
                  << " actor-ino=" << event.actor_file.inode
                  << " parent-dev=" << event.parent_file.device
                  << " parent-ino=" << event.parent_file.inode
                  << " actor-start=" << event.actor_start_boottime_ns
                  << " euid=" << event.old_euid << "->" << event.new_euid
                  << " rule=" << event.rule_id
                  << " reason=0x" << std::hex << event.reason_flags << std::dec
                  << " aux=" << event.auxiliary
                  << " dev=" << event.file.device
                  << " ino=" << event.file.inode;
 
        if (event.old_mode != 0 || event.new_mode != 0) {
            std::cout << " mode=" << std::oct << event.old_mode
                      << "->" << event.new_mode << std::dec;
        }
        if (event.old_uid != 0 || event.new_uid != 0 ||
            event.old_gid != 0 || event.new_gid != 0) {
            std::cout << " owner=" << event.old_uid << ':' << event.old_gid
                      << "->" << event.new_uid << ':' << event.new_gid;
        }
        if (event.xattr_name[0] != '\0')
            std::cout << " xattr=" << event.xattr_name;
        std::cout << " file="
                  << (event.filename[0] != '\0' ? event.filename : "-")
                  << " path-resolution=" << pathResolutionName(event.path_resolution);
        if (event.actor_executable[0] != '\0')
            std::cout << " actor=" << event.actor_executable;
        if (event.parent_executable[0] != '\0')
            std::cout << " parent-exe=" << event.parent_executable;
        std::cout << '\n';
        std::cout.flush();
    } catch (...) {
        // Never allow an exception to cross the libbpf callback boundary.
    }
}

References eventName(), and verdictName().

verdictName()

const char * bastionguard::rootguard::ConsoleEventSink::verdictName ( __u32 verdict )

staticprivatenoexcept

Definition at line 32 of file ConsoleEventSink.cpp.

{
    switch (verdict) {
    case RG_VERDICT_AUDIT: return "AUDIT";
    case RG_VERDICT_AUTHORIZED: return "AUTHORIZED";
    case RG_VERDICT_BLOCKED: return "BLOCKED";
    case RG_VERDICT_TRUSTED: return "TRUSTED";
    case RG_VERDICT_ALERT: return "ALERT";
    case RG_VERDICT_RESTORED: return "RESTORED";
    default: return "UNKNOWN";
    }
}

References RG_VERDICT_ALERT, RG_VERDICT_AUDIT, RG_VERDICT_AUTHORIZED, RG_VERDICT_BLOCKED, RG_VERDICT_RESTORED, and RG_VERDICT_TRUSTED.

Referenced by onEvent().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/include/rootguard/ConsoleEventSink.hpp
• BastionGuard/src/rootguard/src/ConsoleEventSink.cpp