Skip to content
API Documentation
BastionGuard™
bsc::service::anonymous_namespace{DaemonService.cpp} Namespace Reference

Functions

std::string lower_copy (std::string s)
bool looks_like_browser_thread_comm (const std::string &comm)
bool has_process_identity (const bsc::model::Connection &c)
void merge_process_info (bsc::model::Connection &conn, const bsc::model::ProcessInfo &p)
bool same_process_signature (const bsc::model::ProcessInfo &a, const bsc::model::ProcessInfo &b)

Variables

constexpr auto kRecentFlowTtl = std::chrono::seconds(10)

Function Documentation

◆ has_process_identity()

bool bsc::service::anonymous_namespace{DaemonService.cpp}::has_process_identity ( const bsc::model::Connection & c)

◆ looks_like_browser_thread_comm()

bool bsc::service::anonymous_namespace{DaemonService.cpp}::looks_like_browser_thread_comm ( const std::string & comm)

Definition at line 26 of file DaemonService.cpp.

26 {
27 const auto s = lower_copy(comm);
28 return s.find("thread") != std::string::npos ||
29 s.find("socket") != std::string::npos ||
30 s.find("web content") != std::string::npos ||
31 s.find("renderer") != std::string::npos ||
32 s.find("utility") != std::string::npos ||
33 s.find("chrome_") != std::string::npos ||
34 s.find("isolated web") != std::string::npos ||
35 s == "gpu process" ||
36 s == "rdd process" ||
37 s == "privileged cont";
38}

References looks_like_browser_thread_comm(), and lower_copy().

Referenced by has_process_identity(), and looks_like_browser_thread_comm().

◆ lower_copy()

std::string bsc::service::anonymous_namespace{DaemonService.cpp}::lower_copy ( std::string s)

Definition at line 21 of file DaemonService.cpp.

21 {
22 for (char& ch : s) ch = static_cast<char>(std::tolower(static_cast<unsigned char>(ch)));
23 return s;
24}

References lower_copy().

Referenced by looks_like_browser_thread_comm(), and lower_copy().

◆ merge_process_info()

void bsc::service::anonymous_namespace{DaemonService.cpp}::merge_process_info ( bsc::model::Connection & conn,
const bsc::model::ProcessInfo & p )

Definition at line 46 of file DaemonService.cpp.

46 {
47 if (conn.process_id == 0) conn.process_id = static_cast<std::uint32_t>(p.pid);
48 // /proc/<tgid>/comm è il nome del processo principale. Preferiscilo
49 // sempre al task comm catturato da eBPF, che nei browser spesso è il
50 // nome del thread (es. "Socket Thread", "Chrome_ChildIOT").
51 if (!p.comm.empty()) conn.process_comm = p.comm;
52 if (!p.path.empty()) conn.process_path = p.path;
53 if (conn.process_cwd.empty()) conn.process_cwd = p.cwd;
54 if (conn.process_args.empty()) conn.process_args = p.args;
55 if (conn.process_env.empty()) conn.process_env = p.env;
56 if (conn.process_checksums.empty()) conn.process_checksums = p.checksums;
57 if (conn.process_tree.empty()) conn.process_tree = p.process_tree;
58 if (conn.user_id == 0xffffffffu) conn.user_id = static_cast<std::uint32_t>(p.uid);
59}
std::vector< std::pair< std::string, std::uint32_t > > process_tree
std::vector< std::string > process_args
std::map< std::string, std::string > process_checksums
std::map< std::string, std::string > process_env
std::uint32_t user_id
std::map< std::string, std::string > env
std::map< std::string, std::string > checksums
std::vector< std::pair< std::string, std::uint32_t > > process_tree
std::vector< std::string > args

References bsc::model::ProcessInfo::args, bsc::model::ProcessInfo::checksums, bsc::model::ProcessInfo::comm, bsc::model::ProcessInfo::cwd, bsc::model::ProcessInfo::env, merge_process_info(), bsc::model::ProcessInfo::path, bsc::model::ProcessInfo::pid, bsc::model::Connection::process_args, bsc::model::Connection::process_checksums, bsc::model::Connection::process_comm, bsc::model::Connection::process_cwd, bsc::model::Connection::process_env, bsc::model::Connection::process_id, bsc::model::Connection::process_path, bsc::model::Connection::process_tree, bsc::model::ProcessInfo::process_tree, bsc::model::ProcessInfo::uid, and bsc::model::Connection::user_id.

Referenced by merge_process_info().

◆ same_process_signature()

bool bsc::service::anonymous_namespace{DaemonService.cpp}::same_process_signature ( const bsc::model::ProcessInfo & a,
const bsc::model::ProcessInfo & b )

Definition at line 61 of file DaemonService.cpp.

61 {
62 if (!a.path.empty() && !b.path.empty()) return a.path == b.path;
63 return !a.comm.empty() && !b.comm.empty() && a.comm == b.comm;
64}

References bsc::model::ProcessInfo::comm, bsc::model::ProcessInfo::path, and same_process_signature().

Referenced by same_process_signature().

Variable Documentation

◆ kRecentFlowTtl

auto bsc::service::anonymous_namespace{DaemonService.cpp}::kRecentFlowTtl = std::chrono::seconds(10)
constexpr

Definition at line 19 of file DaemonService.cpp.