BastionGuard::RootGuard::Client Class Reference

#include <RootGuardClient.hpp>

Classes
struct	Request

Public Member Functions
	Client ()
	~Client ()
	Client (const Client &)=delete
Client &	operator= (const Client &)=delete
sigc::signal< void(const Snapshot &)> &	signal_updated () noexcept
void	refresh ()
void	start_service ()
void	stop_service ()
void	reload_policy ()
void	restart_service ()
void	set_immediate_protection (bool enabled)
void	restore_event (const Event &event)
void	remove_event (const Event &event)
void	save_application_rules (ApplicationRules rules)

Private Types
enum class	Action {   Refresh , Start , Stop , Reload ,   Restart , SetProtection , Restore , Remove ,   SaveApplicationRules , Quit }

Private Member Functions
void	enqueue (Request request)
void	worker_loop ()
void	on_dispatch ()
Snapshot	collect_snapshot (const std::string &operation_message, bool operation_success) const
bool	run_request (const Request &request, std::string &message) const

Private Attributes
Glib::Dispatcher	dispatcher_
sigc::signal< void(const Snapshot &)>	signal_updated_
std::mutex	mutex_
std::condition_variable	condition_
std::deque< Request >	requests_
Snapshot	pending_snapshot_
bool	snapshot_ready_ {}
bool	stopping_ {}
std::thread	worker_

Detailed Description

Definition at line 51 of file RootGuardClient.hpp.

Member Enumeration Documentation

Action

enum class BastionGuard::RootGuard::Client::Action

strongprivate

Enumerator
Refresh
Start
Stop
Reload
Restart
SetProtection
Restore
Remove
SaveApplicationRules
Quit

Definition at line 72 of file RootGuardClient.hpp.

                      {
        Refresh,
        Start,
        Stop,
        Reload,
        Restart,
        SetProtection,
        Restore,
        Remove,
        SaveApplicationRules,
        Quit,
    };

Constructor & Destructor Documentation

Client() [1/2]

BastionGuard::RootGuard::Client::Client

(

)

Definition at line 298 of file RootGuardClient.cpp.

{
    dispatcher_.connect(sigc::mem_fun(*this, &Client::on_dispatch));
    worker_ = std::thread(&Client::worker_loop, this);
}

References dispatcher_, on_dispatch(), worker_, and worker_loop().

Referenced by Client(), and operator=().

~Client()

BastionGuard::RootGuard::Client::~Client

(

)

Definition at line 304 of file RootGuardClient.cpp.

{
    {
        std::lock_guard lock(mutex_);
        stopping_ = true;
        requests_.clear();
        requests_.push_front(Request{Action::Quit, false, std::nullopt, {}});
    }
    condition_.notify_one();
    if (worker_.joinable())
        worker_.join();
}

References condition_, mutex_, Quit, requests_, stopping_, and worker_.

Client() [2/2]

BastionGuard::RootGuard::Client::Client ( const Client & )

delete

References Client().

Member Function Documentation

collect_snapshot()

Snapshot BastionGuard::RootGuard::Client::collect_snapshot ( const std::string & operation_message, bool operation_success ) const

private

Definition at line 363 of file RootGuardClient.cpp.

{
    const CommandResult status_result = run_command({
        BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "status"
    });
 
    Snapshot snapshot;
    snapshot.service = parse_status(status_result.output);
    snapshot.events = read_recent_events(400);
    snapshot.application_rules = read_application_rules();
    snapshot.operation_message = operation_message;
    snapshot.operation_success = operation_success;
    if (snapshot.service.state == "unknown" && status_result.exit_code != 0)
        snapshot.service.state = "unavailable";
    return snapshot;
}

References BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, and BastionGuard::RootGuard::Snapshot::service.

Referenced by worker_loop().

enqueue()

void BastionGuard::RootGuard::Client::enqueue ( Request request )

private

Definition at line 345 of file RootGuardClient.cpp.

{
    {
        std::lock_guard lock(mutex_);
        if (stopping_)
            return;
        if (request.action == Action::Refresh) {
            const bool refreshAlreadyQueued = std::any_of(
                requests_.begin(), requests_.end(),
                [](const Request& queued) { return queued.action == Action::Refresh; });
            if (refreshAlreadyQueued)
                return;
        }
        requests_.push_back(std::move(request));
    }
    condition_.notify_one();
}

References BastionGuard::RootGuard::Client::Request::action, condition_, mutex_, Refresh, requests_, and stopping_.

Referenced by refresh(), reload_policy(), remove_event(), restart_service(), restore_event(), save_application_rules(), set_immediate_protection(), start_service(), and stop_service().

on_dispatch()

void BastionGuard::RootGuard::Client::on_dispatch ( )

private

Definition at line 537 of file RootGuardClient.cpp.

{
    Snapshot snapshot;
    {
        std::lock_guard lock(mutex_);
        if (!snapshot_ready_)
            return;
        snapshot = std::move(pending_snapshot_);
        snapshot_ready_ = false;
    }
    signal_updated_.emit(snapshot);
}

References mutex_, pending_snapshot_, signal_updated_, and snapshot_ready_.

Referenced by Client().

operator=()

Client & BastionGuard::RootGuard::Client::operator= ( const Client & )

delete

References Client(), refresh(), reload_policy(), remove_event(), restart_service(), restore_event(), save_application_rules(), set_immediate_protection(), signal_updated(), start_service(), and stop_service().

refresh()

void BastionGuard::RootGuard::Client::refresh

(

)

Definition at line 322 of file RootGuardClient.cpp.

{ enqueue(Request{Action::Refresh, false, std::nullopt, {}}); }

References enqueue(), and Refresh.

Referenced by RootGuardPage::dismiss_event(), RootGuardPage::on_auto_refresh(), operator=(), and RootGuardPage::RootGuardPage().

reload_policy()

void BastionGuard::RootGuard::Client::reload_policy

(

)

Definition at line 325 of file RootGuardClient.cpp.

{ enqueue(Request{Action::Reload, false, std::nullopt, {}}); }

References enqueue(), and Reload.

Referenced by operator=(), and RootGuardPage::RootGuardPage().

remove_event()

void BastionGuard::RootGuard::Client::remove_event

(

const Event &

event

)

Definition at line 335 of file RootGuardClient.cpp.

{
    enqueue(Request{Action::Remove, false, event, {}});
}

References enqueue(), and Remove.

Referenced by operator=(), and RootGuardPage::remove_event().

restart_service()

void BastionGuard::RootGuard::Client::restart_service

(

)

Definition at line 326 of file RootGuardClient.cpp.

{ enqueue(Request{Action::Restart, false, std::nullopt, {}}); }

References enqueue(), and Restart.

Referenced by operator=(), and RootGuardPage::RootGuardPage().

restore_event()

void BastionGuard::RootGuard::Client::restore_event

(

const Event &

event

)

Definition at line 331 of file RootGuardClient.cpp.

{
    enqueue(Request{Action::Restore, false, event, {}});
}

References enqueue(), and Restore.

Referenced by operator=(), and RootGuardPage::restore_event().

run_request()

bool BastionGuard::RootGuard::Client::run_request ( const Request & request, std::string & message ) const

private

Definition at line 381 of file RootGuardClient.cpp.

{
    if (request.action == Action::Refresh)
        return true;
 
    if (request.action == Action::Start || request.action == Action::Stop ||
        request.action == Action::Reload || request.action == Action::Restart) {
        const char* action = request.action == Action::Start ? "start" :
                             request.action == Action::Stop ? "stop" :
                             request.action == Action::Reload ? "reload" : "restart";
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, action
        }), std::string("RootGuard action completed: ") + action, message);
    }
 
    if (request.action == Action::SetProtection) {
        const auto result = run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "set-protection", "--state", request.enabled ? "on" : "off"
        });
        if (!command_success(result, "RootGuard protection mode updated.", message))
            return false;
        const auto reload = run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "reload"
        });
        std::string reloadMessage;
        const bool reloadSuccess = command_success(
            reload, "RootGuard policy reloaded.", reloadMessage);
        if (!reloadMessage.empty())
            message += " " + reloadMessage;
        if (!reloadSuccess && request.enabled) {
            const auto rollback = run_command({
                BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
                "set-protection", "--state", "off"
            });
            std::string rollbackMessage;
            const bool rollbackSuccess = command_success(
                rollback, "Unsafe future enablement was rolled back to audit mode.",
                rollbackMessage);
            message += rollbackSuccess
                ? " " + rollbackMessage
                : " WARNING: the policy rollback to audit mode failed: " + rollbackMessage;
        }
        return reloadSuccess;
    }
 
    if (request.action == Action::SaveApplicationRules) {
        std::vector<std::string> command {
            BASTIONGUARD_PKEXEC,
            BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "set-application-rules"
        };
        const auto appendRules = [&command](const char* option,
                                             const std::vector<std::string>& entries) {
            for (const auto& entry : entries) {
                command.emplace_back(option);
                command.push_back(entry);
            }
        };
        appendRules("--trusted-application",
                    request.application_rules.trustedApplications);
        appendRules("--trusted-executable",
                    request.application_rules.trustedExecutables);
        appendRules("--denied-executable",
                    request.application_rules.deniedExecutables);
 
        const auto saveResult = run_command(command);
        if (!command_success(saveResult,
                             "RootGuard application rules saved.", message))
            return false;
 
        const auto restartResult = run_command({
            BASTIONGUARD_PKEXEC,
            BASTIONGUARD_ROOTGUARD_SERVICE_HELPER,
            "restart"
        });
        std::string restartMessage;
        const bool restartSuccess = command_success(
            restartResult, "RootGuard restarted with the new rules.",
            restartMessage);
        if (!restartMessage.empty())
            message += " " + restartMessage;
        return restartSuccess;
    }
 
    if (!request.event)
        return false;
    const Event& event = *request.event;
    if (event.filename.empty()) {
        message = "The incident has no actionable path.";
        return false;
    }
 
    if (request.action == Action::Restore) {
        const bool metadataAvailable = event.old_mode != 0 || event.new_mode != 0 ||
                                       event.old_uid != 0 || event.new_uid != 0 ||
                                       event.old_gid != 0 || event.new_gid != 0;
        if (!metadataAvailable) {
            if (is_system_service_path(event.filename)) {
                return command_success(run_command({
                    BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
                    "unblock-service", "--path", event.filename
                }), "The blocked service was unmasked. It was not restarted.", message);
            }
            message = "The change was denied before it was committed; no metadata restoration was required.";
            return true;
        }
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "restore", "--path", event.filename,
            "--mode", octal_argument(event.old_mode),
            "--uid", std::to_string(event.old_uid),
            "--gid", std::to_string(event.old_gid),
            "--device", std::to_string(event.device),
            "--inode", std::to_string(event.inode)
        }), "Protected metadata restored.", message);
    }
 
    if (request.action == Action::Remove) {
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "remove", "--path", event.filename,
            "--device", std::to_string(event.device),
            "--inode", std::to_string(event.inode)
        }), "The file was removed and quarantined.", message);
    }
 
    return false;
}

References BastionGuard::RootGuard::Client::Request::action, BastionGuard::RootGuard::Client::Request::application_rules, BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, BastionGuard::RootGuard::ApplicationRules::deniedExecutables, BastionGuard::RootGuard::Client::Request::enabled, BastionGuard::RootGuard::Client::Request::event, BastionGuard::RootGuard::is_system_service_path(), Refresh, Reload, Remove, Restart, Restore, SaveApplicationRules, SetProtection, Start, Stop, BastionGuard::RootGuard::ApplicationRules::trustedApplications, and BastionGuard::RootGuard::ApplicationRules::trustedExecutables.

Referenced by worker_loop().

save_application_rules()

void BastionGuard::RootGuard::Client::save_application_rules

(

ApplicationRules

rules

)

Definition at line 339 of file RootGuardClient.cpp.

{
    enqueue(Request{Action::SaveApplicationRules, false, std::nullopt,
                    std::move(rules)});
}

References enqueue(), and SaveApplicationRules.

Referenced by operator=(), and RootGuardPage::save_application_rules().

set_immediate_protection()

void BastionGuard::RootGuard::Client::set_immediate_protection

(

bool

enabled

)

Definition at line 327 of file RootGuardClient.cpp.

{
    enqueue(Request{Action::SetProtection, enabled, std::nullopt, {}});
}

References enqueue(), and SetProtection.

Referenced by RootGuardPage::on_protection_toggled(), and operator=().

signal_updated()

sigc::signal< void(const Snapshot &)> & BastionGuard::RootGuard::Client::signal_updated ( )

noexcept

Definition at line 317 of file RootGuardClient.cpp.

{
    return signal_updated_;
}

References signal_updated_.

Referenced by operator=(), and RootGuardPage::RootGuardPage().

start_service()

void BastionGuard::RootGuard::Client::start_service

(

)

Definition at line 323 of file RootGuardClient.cpp.

{ enqueue(Request{Action::Start, false, std::nullopt, {}}); }

References enqueue(), and Start.

Referenced by operator=(), and RootGuardPage::RootGuardPage().

stop_service()

void BastionGuard::RootGuard::Client::stop_service

(

)

Definition at line 324 of file RootGuardClient.cpp.

{ enqueue(Request{Action::Stop, false, std::nullopt, {}}); }

References enqueue(), and Stop.

Referenced by operator=(), and RootGuardPage::RootGuardPage().

worker_loop()

void BastionGuard::RootGuard::Client::worker_loop ( )

private

Definition at line 511 of file RootGuardClient.cpp.

{
    for (;;) {
        Request request;
        {
            std::unique_lock lock(mutex_);
            condition_.wait(lock, [this] { return !requests_.empty(); });
            request = std::move(requests_.front());
            requests_.pop_front();
        }
 
        if (request.action == Action::Quit)
            break;
 
        std::string message;
        const bool success = run_request(request, message);
        Snapshot snapshot = collect_snapshot(message, success);
        {
            std::lock_guard lock(mutex_);
            pending_snapshot_ = std::move(snapshot);
            snapshot_ready_ = true;
        }
        dispatcher_.emit();
    }
}

References BastionGuard::RootGuard::Client::Request::action, collect_snapshot(), condition_, dispatcher_, mutex_, pending_snapshot_, Quit, requests_, run_request(), and snapshot_ready_.

Referenced by Client().

Member Data Documentation

condition_

std::condition_variable BastionGuard::RootGuard::Client::condition_

private

Definition at line 103 of file RootGuardClient.hpp.

Referenced by enqueue(), worker_loop(), and ~Client().

dispatcher_

Glib::Dispatcher BastionGuard::RootGuard::Client::dispatcher_

private

Definition at line 99 of file RootGuardClient.hpp.

Referenced by Client(), and worker_loop().

mutex_

std::mutex BastionGuard::RootGuard::Client::mutex_

mutableprivate

Definition at line 102 of file RootGuardClient.hpp.

Referenced by enqueue(), on_dispatch(), worker_loop(), and ~Client().

pending_snapshot_

Snapshot BastionGuard::RootGuard::Client::pending_snapshot_

private

Definition at line 105 of file RootGuardClient.hpp.

Referenced by on_dispatch(), and worker_loop().

requests_

std::deque<Request> BastionGuard::RootGuard::Client::requests_

private

Definition at line 104 of file RootGuardClient.hpp.

Referenced by enqueue(), worker_loop(), and ~Client().

signal_updated_

sigc::signal<void(const Snapshot&)> BastionGuard::RootGuard::Client::signal_updated_

private

Definition at line 100 of file RootGuardClient.hpp.

Referenced by on_dispatch(), and signal_updated().

snapshot_ready_

bool BastionGuard::RootGuard::Client::snapshot_ready_ {}

private

Definition at line 106 of file RootGuardClient.hpp.

Referenced by on_dispatch(), and worker_loop().

stopping_

bool BastionGuard::RootGuard::Client::stopping_ {}

private

Definition at line 107 of file RootGuardClient.hpp.

Referenced by enqueue(), and ~Client().

worker_

std::thread BastionGuard::RootGuard::Client::worker_

private

Definition at line 108 of file RootGuardClient.hpp.

Referenced by Client(), and ~Client().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/RootGuardClient.hpp
• BastionGuard/src/rootguard/RootGuardClient.cpp