RootGuardEvent.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ RootGuard GTK integration
 * Copyright (C) 2025–2026 Calogero Scarnà
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
#include "RootGuardEvent.hpp"
#include "rootguard/rootguard_shared.h"
 
#include <functional>
#include <iomanip>
#include <limits>
#include <sstream>
 
namespace BastionGuard::RootGuard {
namespace {
 
std::optional<std::string> json_string(const std::string& json,
                                       const std::string& key)
{
    const std::string marker = "\"" + key + "\":\"";
    const auto begin = json.find(marker);
    if (begin == std::string::npos)
        return std::nullopt;
 
    std::string result;
    bool escaped = false;
    for (std::size_t index = begin + marker.size(); index < json.size(); ++index) {
        const char character = json[index];
        if (escaped) {
            switch (character) {
            case 'n': result.push_back('\n'); break;
            case 'r': result.push_back('\r'); break;
            case 't': result.push_back('\t'); break;
            case '\\': result.push_back('\\'); break;
            case '"': result.push_back('"'); break;
            default: result.push_back(character); break;
            }
            escaped = false;
        } else if (character == '\\') {
            escaped = true;
        } else if (character == '"') {
            return result;
        } else {
            result.push_back(character);
        }
    }
    return std::nullopt;
}
 
std::optional<std::uint64_t> json_u64(const std::string& json,
                                      const std::string& key)
{
    const std::string marker = "\"" + key + "\":";
    const auto begin = json.find(marker);
    if (begin == std::string::npos)
        return std::nullopt;
 
    std::size_t consumed = 0;
    try {
        const unsigned long long value =
            std::stoull(json.substr(begin + marker.size()), &consumed, 10);
        if (consumed == 0)
            return std::nullopt;
        return static_cast<std::uint64_t>(value);
    } catch (...) {
        return std::nullopt;
    }
}
 
std::optional<std::int64_t> json_i64(const std::string& json,
                                     const std::string& key)
{
    const std::string marker = "\"" + key + "\":";
    const auto begin = json.find(marker);
    if (begin == std::string::npos)
        return std::nullopt;
 
    std::size_t consumed = 0;
    try {
        const long long value =
            std::stoll(json.substr(begin + marker.size()), &consumed, 10);
        if (consumed == 0)
            return std::nullopt;
        return static_cast<std::int64_t>(value);
    } catch (...) {
        return std::nullopt;
    }
}
 
std::uint32_t as_u32(const std::optional<std::uint64_t>& value)
{
    return value && *value <= 0xffffffffULL
        ? static_cast<std::uint32_t>(*value) : 0U;
}
 
std::int32_t as_i32(const std::optional<std::int64_t>& value)
{
    if (!value ||
        *value < std::numeric_limits<std::int32_t>::min() ||
        *value > std::numeric_limits<std::int32_t>::max())
        return 0;
    return static_cast<std::int32_t>(*value);
}
 
std::string octal_mode(const std::uint32_t mode)
{
    std::ostringstream output;
    output << std::oct << (mode & 07777U);
    return output.str();
}
 
bool has_prefix(const std::string& path, const std::string& prefix)
{
    return path == prefix ||
           (path.size() > prefix.size() && path.compare(0, prefix.size(), prefix) == 0 &&
            path[prefix.size()] == '/');
}
 
 
} // namespace
 
std::optional<Event> parse_event_json(const std::string& line)
{
    Event event;
    event.raw_json = line;
 
    const auto event_name = json_string(line, "event");
    const auto verdict = json_string(line, "verdict");
    if (!event_name || !verdict)
        return std::nullopt;
 
    event.received_at = json_string(line, "received_at").value_or("");
    event.event = *event_name;
    event.verdict = *verdict;
    event.pid = as_u32(json_u64(line, "pid"));
    event.tgid = as_u32(json_u64(line, "tgid"));
    event.ppid = as_u32(json_u64(line, "ppid"));
    event.old_euid = as_u32(json_u64(line, "old_euid"));
    event.new_euid = as_u32(json_u64(line, "new_euid"));
    event.rule_id = as_u32(json_u64(line, "rule_id"));
    event.reason_flags = as_u32(json_u64(line, "reason_flags"));
    event.lsm_flags = as_i32(json_i64(line, "lsm_flags"));
    event.auxiliary = as_u32(json_u64(line, "auxiliary"));
    event.device = json_u64(line, "device").value_or(0);
    event.inode = json_u64(line, "inode").value_or(0);
    event.actor_device = json_u64(line, "actor_device").value_or(0);
    event.actor_inode = json_u64(line, "actor_inode").value_or(0);
    event.parent_device = json_u64(line, "parent_device").value_or(0);
    event.parent_inode = json_u64(line, "parent_inode").value_or(0);
    event.actor_start_boottime_ns =
        json_u64(line, "actor_start_boottime_ns").value_or(0);
    event.old_mode = as_u32(json_u64(line, "old_mode"));
    event.new_mode = as_u32(json_u64(line, "new_mode"));
    event.old_uid = as_u32(json_u64(line, "old_uid"));
    event.new_uid = as_u32(json_u64(line, "new_uid"));
    event.old_gid = as_u32(json_u64(line, "old_gid"));
    event.new_gid = as_u32(json_u64(line, "new_gid"));
    event.comm = json_string(line, "comm").value_or("unknown");
    event.parent_comm = json_string(line, "parent_comm").value_or("");
    event.actor_executable = json_string(line, "actor_executable").value_or("");
    event.parent_executable = json_string(line, "parent_executable").value_or("");
    event.filename = json_string(line, "filename").value_or("");
    event.path_resolution = json_string(line, "path_resolution").value_or("basename-only");
    return event;
}
 
std::string format_event(const Event& event)
{
    std::ostringstream output;
    output << '[' << (event.received_at.empty() ? "unknown time" : event.received_at)
           << "] [" << event.verdict << "] " << event.event
           << " process=" << event.comm
           << " pid=" << event.pid
           << " tgid=" << event.tgid
           << " ppid=" << event.ppid;
 
    if (event.old_euid != event.new_euid)
        output << " euid=" << event.old_euid << "->" << event.new_euid;
    if (event.old_mode != event.new_mode)
        output << " mode=" << octal_mode(event.old_mode)
               << "->" << octal_mode(event.new_mode);
    if (event.old_uid != event.new_uid || event.old_gid != event.new_gid)
        output << " owner=" << event.old_uid << ':' << event.old_gid
               << "->" << event.new_uid << ':' << event.new_gid;
    if (event.rule_id != 0)
        output << " rule=" << event.rule_id;
    if (!event.parent_comm.empty())
        output << " parent=" << event.parent_comm;
    if (!event.parent_executable.empty())
        output << " parent-exe=" << event.parent_executable;
    if (event.parent_device != 0 || event.parent_inode != 0)
        output << " parent-identity=" << event.parent_device
               << ':' << event.parent_inode;
    if (!event.actor_executable.empty())
        output << " actor=" << event.actor_executable;
    if (event.actor_device != 0 || event.actor_inode != 0)
        output << " actor-identity=" << event.actor_device
               << ':' << event.actor_inode;
    if (!event.filename.empty())
        output << " file=" << event.filename
               << " path-resolution=" << event.path_resolution;
    if (event.device != 0 || event.inode != 0)
        output << " identity=" << event.device << ':' << event.inode;
 
    output << " reason=0x" << std::hex << event.reason_flags << std::dec;
    return output.str();
}
 
std::string event_fingerprint(const Event& event)
{
    const auto hash = std::hash<std::string>{}(event.raw_json);
    std::ostringstream output;
    output << std::hex << hash;
    return output.str();
}
 
EventSeverity classify_event(const Event& event) noexcept
{
    if (event.filename.empty() || event.filename == "--")
        return EventSeverity::Telemetry;
    if (event.verdict != "blocked" && event.verdict != "alert" &&
        event.verdict != "audit")
        return EventSeverity::Telemetry;
 
    if (event.event == "service-blocked")
        return EventSeverity::Incident;
 
    const bool metadataEvent =
        event.event == "permission-change" ||
        event.event == "owner-change" ||
        event.event == "xattr-change" ||
        event.event == "acl-change";
    if (metadataEvent) {
        /*
         * Explicitly protected identities retain their existing incident
         * semantics because they have a baseline and may have been blocked.
         */
        if (event.rule_id != 0)
            return EventSeverity::Incident;
 
        /*
         * Desktop policy: unprotected global privilege metadata is diagnostic
         * telemetry only. Keep it visible as an observation when explicitly
         * enabled, but never let backup/package metadata replay interrupt the
         * user with a popup. Historical broad-surveillance records remain
         * telemetry-only.
         */
        if ((event.reason_flags & RG_REASON_GLOBAL_METADATA) != 0)
            return (event.reason_flags & RG_REASON_METADATA_BURST) != 0
                ? EventSeverity::Incident
                : EventSeverity::Observation;
 
        return EventSeverity::Telemetry;
    }
 
    if (event.event == "protected-unlink" ||
        event.event == "protected-rename" ||
        event.event == "protected-hardlink" ||
        event.event == "integrity-drift")
        return event.rule_id != 0
            ? EventSeverity::Incident
            : EventSeverity::Telemetry;
 
    return EventSeverity::Telemetry;
}
 
bool is_security_observation(const Event& event) noexcept
{
    return classify_event(event) != EventSeverity::Telemetry;
}
 
bool is_actionable_incident(const Event& event) noexcept
{
    return classify_event(event) == EventSeverity::Incident;
}
 
bool is_system_service_path(const std::string& path) noexcept
{
    if (path.empty())
        return false;
    const bool systemd = has_prefix(path, "/etc/systemd/system") ||
                         has_prefix(path, "/usr/lib/systemd/system") ||
                         has_prefix(path, "/lib/systemd/system");
    const bool initScript = has_prefix(path, "/etc/init.d") ||
                            has_prefix(path, "/etc/conf.d");
    const bool dinit = has_prefix(path, "/etc/dinit.d") ||
                       has_prefix(path, "/usr/lib/dinit.d");
    return systemd || initScript || dinit;
}
 
} // namespace BastionGuard::RootGuard