bastionguard::rootguard::anonymous_namespace{AutomaticResponseSink.cpp} Namespace Reference

Functions
bool	isActionableMetadataEvent (const rg_event &event) noexcept
void	copyString (char *destination, const std::size_t size, const std::string &source) noexcept

Function Documentation

copyString()

void bastionguard::rootguard::anonymous_namespace{AutomaticResponseSink.cpp}::copyString ( char * destination, const std::size_t size, const std::string & source )

noexcept

Definition at line 36 of file AutomaticResponseSink.cpp.

{
    if (!destination || size == 0)
        return;
    const auto count = std::min(size - 1, source.size());
    std::memcpy(destination, source.data(), count);
    destination[count] = '\0';
}

References copyString().

Referenced by copyString().

isActionableMetadataEvent()

bool bastionguard::rootguard::anonymous_namespace{AutomaticResponseSink.cpp}::isActionableMetadataEvent ( const rg_event & event )

noexcept

Definition at line 12 of file AutomaticResponseSink.cpp.

{
    switch (event.event_type) {
    case RG_EVENT_PERMISSION_CHANGE:
    case RG_EVENT_OWNER_CHANGE:
    case RG_EVENT_XATTR_CHANGE:
    case RG_EVENT_ACL_CHANGE:
    case RG_EVENT_PROTECTED_UNLINK:
    case RG_EVENT_PROTECTED_RENAME:
    case RG_EVENT_PROTECTED_HARDLINK:
    case RG_EVENT_INTEGRITY_DRIFT:
        break;
    default:
        return false;
    }
 
    /*
     * Automatic containment is a state-changing operation and must never run
     * for audit/alert events. It is allowed only after the kernel has denied
     * the metadata change and reported RG_VERDICT_BLOCKED.
     */
    return event.verdict == RG_VERDICT_BLOCKED;
}

References isActionableMetadataEvent(), RG_EVENT_ACL_CHANGE, RG_EVENT_INTEGRITY_DRIFT, RG_EVENT_OWNER_CHANGE, RG_EVENT_PERMISSION_CHANGE, RG_EVENT_PROTECTED_HARDLINK, RG_EVENT_PROTECTED_RENAME, RG_EVENT_PROTECTED_UNLINK, RG_EVENT_XATTR_CHANGE, and RG_VERDICT_BLOCKED.

Referenced by isActionableMetadataEvent().