RootGuardPage Class Reference

#include <RootGuardPage.hpp>

Inheritance diagram for RootGuardPage:

Public Member Functions
	RootGuardPage ()
	~RootGuardPage () override

Private Member Functions
void	on_snapshot (const BastionGuard::RootGuard::Snapshot &snapshot)
void	render_incidents (const BastionGuard::RootGuard::Snapshot &snapshot)
void	render_events (const BastionGuard::RootGuard::Snapshot &snapshot)
void	queue_new_alerts (const BastionGuard::RootGuard::Snapshot &snapshot)
void	show_next_alert ()
void	close_current_alert ()
void	dismiss_alert (const BastionGuard::RootGuard::Event &event)
void	dismiss_event (const BastionGuard::RootGuard::Event &event)
void	restore_event (const BastionGuard::RootGuard::Event &event)
void	remove_event (const BastionGuard::RootGuard::Event &event)
bool	on_auto_refresh ()
void	on_protection_toggled ()
Gtk::Box *	make_rule_editor (const Glib::ustring &title, const Glib::ustring &description, Gtk::ListBox &list, Gtk::Entry &entry)
void	add_rule_from_entry (Gtk::Entry &entry, Gtk::ListBox &list)
void	add_installed_application_defaults ()
void	remove_selected_rule (Gtk::ListBox &list)
void	mark_rules_dirty ()
void	populate_application_rules (const BastionGuard::RootGuard::ApplicationRules &rules)
std::vector< std::string >	collect_rules (const Gtk::ListBox &list) const
void	save_application_rules ()

Private Attributes
BastionGuard::RootGuard::Client	client_
Gtk::Label	title_
Gtk::Label	service_value_
Gtk::Label	mode_value_
Gtk::Label	init_value_
Gtk::Label	pid_value_
Gtk::Stack	page_stack_
Gtk::StackSwitcher	page_switcher_
Gtk::Switch	protection_switch_
Gtk::Label	protection_label_
Gtk::Popover	protection_info_popover_
Gtk::MenuButton	protection_info_button_
Gtk::Label	system_scope_value_
Gtk::Label	home_scope_value_
Gtk::Button	start_button_
Gtk::Button	stop_button_
Gtk::Button	reload_button_
Gtk::Button	restart_button_
Gtk::Button	refresh_button_
Gtk::Label	incidents_title_
Gtk::ScrolledWindow	incidents_scroller_
Gtk::ListBox	incidents_list_
Gtk::CheckButton	show_trusted_
Gtk::ScrolledWindow	events_scroller_
Gtk::TextView	events_view_
Gtk::Stack	rules_stack_
Gtk::StackSwitcher	rules_switcher_
Gtk::ListBox	trusted_applications_list_
Gtk::Entry	trusted_applications_entry_
Gtk::ListBox	trusted_executables_list_
Gtk::Entry	trusted_executables_entry_
Gtk::ListBox	denied_executables_list_
Gtk::Entry	denied_executables_entry_
Gtk::Button	save_rules_button_
Gtk::Label	rules_status_
Gtk::Label	status_
sigc::connection	client_update_connection_
sigc::connection	auto_refresh_connection_
bool	updating_switch_ {}
bool	initial_snapshot_ {true}
bool	rules_dirty_ {}
bool	rules_saving_ {}
std::string	rules_signature_
std::optional< BastionGuard::RootGuard::Snapshot >	last_snapshot_
std::set< std::string >	seen_events_
std::set< std::string >	dismissed_events_
std::set< std::string >	dismissed_paths_
std::set< std::string >	notified_paths_
std::queue< BastionGuard::RootGuard::Event >	alert_queue_
std::chrono::steady_clock::time_point	last_global_burst_alert_shown_ {}
std::unique_ptr< Gtk::Window >	current_alert_
std::shared_ptr< std::atomic_bool >	alive_ {std::make_shared<std::atomic_bool>(true)}

Detailed Description

Definition at line 21 of file RootGuardPage.hpp.

Constructor & Destructor Documentation

RootGuardPage()

RootGuardPage::RootGuardPage

(

)

Definition at line 275 of file RootGuardPage.cpp.

    : Gtk::Box(Gtk::Orientation::VERTICAL, 8)
{
    set_margin(12);
    set_hexpand(true);
    set_vexpand(true);
 
    auto* title_box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL);
    title_box->add_css_class("secure-headerbar");
    title_box->set_margin_bottom(4);
 
    title_.set_text(_("🛡️ RootGuard — Permission and Privilege Protection"));
    title_.set_margin(8);
    title_.set_halign(Gtk::Align::CENTER);
    title_.set_hexpand(true);
    title_.add_css_class("secure-header-title");
    title_box->append(title_);
    append(*title_box);
 
    auto* summary = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    summary->set_homogeneous(true);
    summary->append(*make_status_item(_("Service"), service_value_));
    summary->append(*make_status_item(_("Mode"), mode_value_));
    summary->append(*make_status_item(_("Init system"), init_value_));
    summary->append(*make_status_item(_("PID"), pid_value_));
    append(*summary);
 
    page_stack_.set_hexpand(true);
    page_stack_.set_vexpand(true);
    page_stack_.set_hhomogeneous(false);
    page_stack_.set_vhomogeneous(false);
 
    page_switcher_.set_stack(page_stack_);
    page_switcher_.set_halign(Gtk::Align::CENTER);
    page_switcher_.set_margin_top(2);
    page_switcher_.set_margin_bottom(2);
    append(page_switcher_);
 
    // Overview tab.
    auto* overview = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    overview->set_margin_top(8);
    overview->set_hexpand(true);
    overview->set_vexpand(true);
 
    auto* protection_box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    protection_box->set_halign(Gtk::Align::CENTER);
    protection_label_.set_text(_("Immediate permission blocking"));
    protection_label_.set_tooltip_text(
        _("Blocks protected system metadata changes before they are committed."));
    protection_box->append(protection_label_);
    protection_box->append(protection_switch_);
 
    protection_info_button_.set_label("ⓘ");
    protection_info_button_.set_has_frame(false);
    protection_info_button_.set_tooltip_text(_("Show protection scope"));
    auto* protection_info = Gtk::make_managed<Gtk::Label>(
        _("Immediate blocking applies to protected system paths and service definitions. "
          "User home directories remain audit-only because BastionGuard Anti-Ransomware "
          "is responsible for enforcement on user data. Routine desktop and browser "
          "metadata activity can be classified under Application rules without granting "
          "privilege-transition trust."));
    protection_info->set_wrap(true);
    protection_info->set_max_width_chars(58);
    protection_info->set_margin(14);
    protection_info->set_halign(Gtk::Align::START);
    protection_info_popover_.set_autohide(true);
    protection_info_popover_.set_child(*protection_info);
    protection_info_button_.set_popover(protection_info_popover_);
    protection_box->append(protection_info_button_);
    overview->append(*protection_box);
 
    auto* scope = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    scope->set_homogeneous(true);
    scope->set_margin_start(40);
    scope->set_margin_end(40);
    scope->append(*make_status_item(_("Protected system paths"), system_scope_value_));
    scope->append(*make_status_item(_("User home"), home_scope_value_));
    overview->append(*scope);
 
    auto* scope_note = Gtk::make_managed<Gtk::Label>(
        _("RootGuard records privilege-relevant global metadata. Lower-risk changes remain "
          "visible as observations; only high-signal incidents generate popups."));
    scope_note->set_wrap(true);
    scope_note->set_halign(Gtk::Align::CENTER);
    scope_note->add_css_class("dim-label");
    overview->append(*scope_note);
 
    auto* controls = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    controls->set_halign(Gtk::Align::CENTER);
 
    start_button_.set_label(_("▶ Start"));
    stop_button_.set_label(_("■ Stop"));
    reload_button_.set_label(_("↻ Reload policy"));
    restart_button_.set_label(_("⟳ Restart"));
    refresh_button_.set_label(_("Refresh"));
    start_button_.add_css_class("btn-primary");
    stop_button_.add_css_class("btn-danger");
    reload_button_.add_css_class("btn-warning");
 
    controls->append(start_button_);
    controls->append(stop_button_);
    controls->append(reload_button_);
    controls->append(restart_button_);
    controls->append(refresh_button_);
    overview->append(*controls);
 
    auto* overview_spacer = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL);
    overview_spacer->set_vexpand(true);
    overview->append(*overview_spacer);
    page_stack_.add(*overview, "overview", _("Overview"));
 
    // Incidents tab.
    auto* incidents_panel = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    incidents_panel->set_hexpand(true);
    incidents_panel->set_vexpand(true);
    incidents_panel->set_margin_top(8);
 
    incidents_title_.set_text(_("Security observations and active incidents"));
    incidents_title_.set_halign(Gtk::Align::START);
    incidents_title_.add_css_class("BastionGuard-title");
    incidents_panel->append(incidents_title_);
 
    incidents_list_.set_selection_mode(Gtk::SelectionMode::NONE);
    incidents_list_.add_css_class("rootguard-incident-list");
    incidents_scroller_.set_hexpand(true);
    incidents_scroller_.set_vexpand(true);
    incidents_scroller_.set_min_content_height(280);
    incidents_scroller_.set_policy(Gtk::PolicyType::AUTOMATIC,
                                   Gtk::PolicyType::AUTOMATIC);
    incidents_scroller_.set_child(incidents_list_);
    incidents_panel->append(incidents_scroller_);
    page_stack_.add(*incidents_panel, "incidents", _("Incidents"));
 
    // Events tab.
    auto* events_panel = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    events_panel->set_hexpand(true);
    events_panel->set_vexpand(true);
    events_panel->set_margin_top(8);
 
    auto* events_header = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto* events_label = Gtk::make_managed<Gtk::Label>(_("Recent RootGuard events"));
    events_label->set_halign(Gtk::Align::START);
    events_label->set_hexpand(true);
    events_label->add_css_class("BastionGuard-title");
    show_trusted_.set_label(_("Show trusted events"));
    show_trusted_.set_active(true);
    show_trusted_.set_tooltip_text(
        _("Trusted application activity is shown by default for maximum transparency. "
          "Disable this option only to focus on audit and blocked events."));
    events_header->append(*events_label);
    events_header->append(show_trusted_);
    events_panel->append(*events_header);
 
    events_view_.set_editable(false);
    events_view_.set_cursor_visible(false);
    events_view_.set_monospace(true);
    events_view_.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    events_view_.set_left_margin(8);
    events_view_.set_right_margin(8);
    events_view_.set_top_margin(8);
    events_view_.set_bottom_margin(8);
    events_view_.add_css_class("rootguard-terminal");
 
    events_scroller_.set_hexpand(true);
    events_scroller_.set_vexpand(true);
    events_scroller_.set_min_content_height(280);
    events_scroller_.set_policy(Gtk::PolicyType::AUTOMATIC,
                                Gtk::PolicyType::AUTOMATIC);
    events_scroller_.set_child(events_view_);
    events_panel->append(events_scroller_);
    page_stack_.add(*events_panel, "events", _("Events"));
 
    // Application rules tab, with nested tabs to keep the page compact.
    auto* rules_page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    rules_page->set_hexpand(true);
    rules_page->set_vexpand(true);
    rules_page->set_margin_top(8);
 
    auto* rules_intro = Gtk::make_managed<Gtk::Label>(
        _("Manage executable identities used by RootGuard. Saving validates the policy, "
          "requests administrator authentication, and restarts RootGuard so the new inode "
          "identities take effect immediately."));
    rules_intro->set_wrap(true);
    rules_intro->set_halign(Gtk::Align::START);
    rules_page->append(*rules_intro);
 
    auto* defaults_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    defaults_row->set_halign(Gtk::Align::END);
    auto* add_defaults = Gtk::make_managed<Gtk::Button>(
        _("Add installed desktop/browser defaults"));
    add_defaults->set_tooltip_text(
        _("Adds only known executables that exist on this computer. Review the list before saving."));
    defaults_row->append(*add_defaults);
    rules_page->append(*defaults_row);
 
    rules_stack_.set_hexpand(true);
    rules_stack_.set_vexpand(true);
    rules_stack_.set_hhomogeneous(false);
    rules_stack_.set_vhomogeneous(false);
    rules_switcher_.set_stack(rules_stack_);
    rules_switcher_.set_halign(Gtk::Align::CENTER);
    rules_page->append(rules_switcher_);
 
    rules_stack_.add(
        *make_rule_editor(
            _("Trusted applications"),
            _("Routine desktop, file-manager and browser compatibility activity. Matching "
              "legacy global events can become trusted, but direct privilege-metadata signals "
              "are never suppressed by this list. This list never grants privilege trust."),
            trusted_applications_list_, trusted_applications_entry_),
        "trusted-applications", _("Trusted apps"));
 
    rules_stack_.add(
        *make_rule_editor(
            _("Privilege-trusted executables"),
            _("Executables allowed as legitimate actors in RootGuard privilege-transition "
              "checks. Existing files are still subject to ownership and identity validation."),
            trusted_executables_list_, trusted_executables_entry_),
        "trusted-executables", _("Privilege trusted"));
 
    rules_stack_.add(
        *make_rule_editor(
            _("Blocked executables"),
            _("Executables blocked during RootGuard privilege-transition checks. This is not "
              "a general application-launch blacklist."),
            denied_executables_list_, denied_executables_entry_),
        "denied-executables", _("Blocked"));
 
    // The switcher only controls the stack; the stack itself must also be
    // inserted into the widget hierarchy or its rule editors remain invisible.
    rules_page->append(rules_stack_);
 
    auto* save_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    save_row->set_halign(Gtk::Align::END);
    save_rules_button_.set_label(_("Save rules and restart RootGuard"));
    save_rules_button_.add_css_class("btn-primary");
    save_rules_button_.set_sensitive(false);
    save_row->append(save_rules_button_);
    rules_page->append(*save_row);
 
    rules_status_.set_halign(Gtk::Align::START);
    rules_status_.set_wrap(true);
    rules_status_.add_css_class("dim-label");
    rules_status_.set_text(
        _("Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."));
    rules_page->append(rules_status_);
    page_stack_.add(*rules_page, "application-rules", _("Application rules"));
 
    append(page_stack_);
 
    status_.set_halign(Gtk::Align::CENTER);
    status_.set_wrap(true);
    status_.set_margin_top(2);
    append(status_);
 
    client_update_connection_ = client_.signal_updated().connect(
        sigc::mem_fun(*this, &RootGuardPage::on_snapshot));
 
    start_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Requesting service start…")); client_.start_service(); });
    stop_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Requesting service stop…")); client_.stop_service(); });
    reload_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Reloading RootGuard policy…")); client_.reload_policy(); });
    restart_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Restarting RootGuard…")); client_.restart_service(); });
    refresh_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Refreshing RootGuard status…")); client_.refresh(); });
    show_trusted_.signal_toggled().connect([this] {
        // Filtering is a local presentation choice. Re-render the most recent
        // snapshot immediately instead of waiting for the asynchronous client
        // refresh/next timer tick.
        if (last_snapshot_) {
            render_events(*last_snapshot_);
            return;
        }
        client_.refresh();
    });
    protection_switch_.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &RootGuardPage::on_protection_toggled));
    save_rules_button_.signal_clicked().connect(
        sigc::mem_fun(*this, &RootGuardPage::save_application_rules));
    add_defaults->signal_clicked().connect(
        sigc::mem_fun(*this, &RootGuardPage::add_installed_application_defaults));
 
    auto_refresh_connection_ = Glib::signal_timeout().connect_seconds(
        sigc::mem_fun(*this, &RootGuardPage::on_auto_refresh), 1);
 
    service_value_.set_text(_("Checking…"));
    mode_value_.set_text(Glib::ustring("—"));
    init_value_.set_text(Glib::ustring("—"));
    pid_value_.set_text(Glib::ustring("—"));
    system_scope_value_.set_text(_("Checking…"));
    home_scope_value_.set_text(_("Audit-only"));
    status_.set_text(_("Loading RootGuard status and recent security events…"));
    client_.refresh();
}

References _, add_installed_application_defaults(), auto_refresh_connection_, client_, client_update_connection_, denied_executables_entry_, denied_executables_list_, events_scroller_, events_view_, home_scope_value_, incidents_list_, incidents_scroller_, incidents_title_, init_value_, last_snapshot_, make_rule_editor(), mode_value_, on_auto_refresh(), on_protection_toggled(), on_snapshot(), page_stack_, page_switcher_, pid_value_, protection_info_button_, protection_info_popover_, protection_label_, protection_switch_, BastionGuard::RootGuard::Client::refresh(), refresh_button_, reload_button_, BastionGuard::RootGuard::Client::reload_policy(), render_events(), restart_button_, BastionGuard::RootGuard::Client::restart_service(), rules_stack_, rules_status_, rules_switcher_, save_application_rules(), save_rules_button_, service_value_, show_trusted_, BastionGuard::RootGuard::Client::signal_updated(), start_button_, BastionGuard::RootGuard::Client::start_service(), status_, stop_button_, BastionGuard::RootGuard::Client::stop_service(), system_scope_value_, title_, trusted_applications_entry_, trusted_applications_list_, trusted_executables_entry_, and trusted_executables_list_.

~RootGuardPage()

RootGuardPage::~RootGuardPage ( )

override

Definition at line 573 of file RootGuardPage.cpp.

{
    alive_->store(false, std::memory_order_release);
    if (client_update_connection_.connected())
        client_update_connection_.disconnect();
    if (auto_refresh_connection_.connected())
        auto_refresh_connection_.disconnect();
    while (!alert_queue_.empty())
        alert_queue_.pop();
    if (current_alert_)
        current_alert_->hide();
    current_alert_.reset();
}

References alert_queue_, alive_, auto_refresh_connection_, client_update_connection_, and current_alert_.

Member Function Documentation

add_installed_application_defaults()

void RootGuardPage::add_installed_application_defaults ( )

private

Definition at line 670 of file RootGuardPage.cpp.

{
    static const std::vector<std::string> candidates {
        "/usr/bin/gnome-shell",
        "/usr/bin/nautilus",
        "/usr/bin/plasmashell",
        "/usr/bin/kwin_wayland",
        "/usr/bin/dolphin",
        "/usr/bin/xfdesktop",
        "/usr/bin/xfwm4",
        "/usr/bin/thunar",
        "/usr/bin/cinnamon",
        "/usr/bin/nemo",
        "/usr/bin/mate-panel",
        "/usr/bin/caja",
        "/usr/bin/firefox",
        "/usr/lib/firefox/firefox",
        "/usr/bin/chromium",
        "/usr/bin/google-chrome-stable",
        "/usr/bin/brave",
        "/usr/bin/vivaldi-stable",
    };
 
    auto current = collect_rules(trusted_applications_list_);
    std::set<std::string> present(current.begin(), current.end());
    std::size_t added = 0;
    for (const auto& candidate : candidates) {
        std::error_code error;
        const auto status = std::filesystem::status(candidate, error);
        if (error || !std::filesystem::is_regular_file(status))
            continue;
        const auto permissions = status.permissions();
        const bool executable =
            (permissions & std::filesystem::perms::owner_exec) !=
                std::filesystem::perms::none ||
            (permissions & std::filesystem::perms::group_exec) !=
                std::filesystem::perms::none ||
            (permissions & std::filesystem::perms::others_exec) !=
                std::filesystem::perms::none;
        if (!executable)
            continue;
 
        const auto canonical = std::filesystem::weakly_canonical(candidate, error);
        const std::string normalized = error
            ? std::filesystem::path(candidate).lexically_normal().string()
            : canonical.string();
        if (!present.insert(normalized).second)
            continue;
        append_path_row(trusted_applications_list_, normalized);
        ++added;
    }
 
    if (added == 0) {
        rules_status_.set_text(
            _("No new installed desktop or browser defaults were found."));
        return;
    }
    mark_rules_dirty();
    rules_status_.set_text(Glib::ustring::compose(
        _("Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."),
        added));
}

References _, collect_rules(), mark_rules_dirty(), rules_status_, and trusted_applications_list_.

Referenced by RootGuardPage().

add_rule_from_entry()

void RootGuardPage::add_rule_from_entry ( Gtk::Entry & entry, Gtk::ListBox & list )

private

Definition at line 643 of file RootGuardPage.cpp.

{
    const std::string raw = trim_copy(entry.get_text().raw());
    if (raw.empty()) {
        rules_status_.set_text(_("Enter an absolute executable path first."));
        return;
    }
 
    std::filesystem::path candidate(raw);
    if (!candidate.is_absolute()) {
        rules_status_.set_text(_("Application rules require an absolute path beginning with /."));
        return;
    }
 
    candidate = candidate.lexically_normal();
    const std::string normalized = candidate.string();
    const auto current = collect_rules(list);
    if (std::find(current.begin(), current.end(), normalized) != current.end()) {
        rules_status_.set_text(_("That executable path is already present in this list."));
        return;
    }
 
    append_path_row(list, normalized);
    entry.set_text("");
    mark_rules_dirty();
}

References _, collect_rules(), mark_rules_dirty(), and rules_status_.

Referenced by make_rule_editor().

close_current_alert()

void RootGuardPage::close_current_alert ( )

private

Definition at line 1263 of file RootGuardPage.cpp.

{
    if (!current_alert_)
        return;
    auto* window = current_alert_.get();
    window->hide();
    const auto alive = alive_;
    Glib::signal_idle().connect_once([this, window, alive] {
        if (!alive->load(std::memory_order_acquire))
            return;
        if (current_alert_.get() == window)
            current_alert_.reset();
        show_next_alert();
    });
}

References alive_, current_alert_, and show_next_alert().

Referenced by show_next_alert().

collect_rules()

std::vector< std::string > RootGuardPage::collect_rules ( const Gtk::ListBox & list ) const

private

Definition at line 752 of file RootGuardPage.cpp.

{
    std::vector<std::string> values;
    for (auto* widget = list.get_first_child(); widget;
         widget = widget->get_next_sibling()) {
        const auto* row = dynamic_cast<const Gtk::ListBoxRow*>(widget);
        if (!row)
            continue;
        const auto* label = dynamic_cast<const Gtk::Label*>(row->get_child());
        if (!label)
            continue;
        const std::string value = trim_copy(label->get_text().raw());
        if (!value.empty())
            values.push_back(value);
    }
    std::sort(values.begin(), values.end());
    values.erase(std::unique(values.begin(), values.end()), values.end());
    return values;
}

Referenced by add_installed_application_defaults(), add_rule_from_entry(), and save_application_rules().

dismiss_alert()

void RootGuardPage::dismiss_alert ( const BastionGuard::RootGuard::Event & event )

private

Definition at line 1279 of file RootGuardPage.cpp.

{
    dismissed_events_.insert(BastionGuard::RootGuard::event_fingerprint(event));
}

References dismissed_events_, and BastionGuard::RootGuard::event_fingerprint().

Referenced by show_next_alert().

dismiss_event()

void RootGuardPage::dismiss_event ( const BastionGuard::RootGuard::Event & event )

private

Definition at line 1284 of file RootGuardPage.cpp.

{
    dismissed_events_.insert(BastionGuard::RootGuard::event_fingerprint(event));
    dismissed_paths_.insert(incident_key(event));
    client_.refresh();
}

References client_, dismissed_events_, dismissed_paths_, BastionGuard::RootGuard::event_fingerprint(), and BastionGuard::RootGuard::Client::refresh().

Referenced by render_incidents().

make_rule_editor()

Gtk::Box * RootGuardPage::make_rule_editor ( const Glib::ustring & title, const Glib::ustring & description, Gtk::ListBox & list, Gtk::Entry & entry )

private

Definition at line 587 of file RootGuardPage.cpp.

{
    auto* editor = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    editor->set_hexpand(true);
    editor->set_vexpand(true);
    editor->set_margin_top(6);
 
    auto* heading = Gtk::make_managed<Gtk::Label>(title);
    heading->set_halign(Gtk::Align::START);
    heading->add_css_class("BastionGuard-title");
    editor->append(*heading);
 
    auto* explanation = Gtk::make_managed<Gtk::Label>(description);
    explanation->set_halign(Gtk::Align::START);
    explanation->set_wrap(true);
    explanation->add_css_class("dim-label");
    editor->append(*explanation);
 
    list.set_selection_mode(Gtk::SelectionMode::SINGLE);
    list.add_css_class("rootguard-rule-list");
    auto* scroller = Gtk::make_managed<Gtk::ScrolledWindow>();
    scroller->set_hexpand(true);
    scroller->set_vexpand(true);
    scroller->set_min_content_height(210);
    scroller->set_policy(Gtk::PolicyType::AUTOMATIC,
                         Gtk::PolicyType::AUTOMATIC);
    scroller->set_child(list);
    editor->append(*scroller);
 
    auto* input_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    entry.set_hexpand(true);
    entry.set_placeholder_text(_("Absolute executable path, for example /usr/bin/firefox"));
    auto* add = Gtk::make_managed<Gtk::Button>(_("Add"));
    auto* remove = Gtk::make_managed<Gtk::Button>(_("Remove selected"));
    add->add_css_class("btn-primary");
    remove->add_css_class("btn-danger");
    input_row->append(entry);
    input_row->append(*add);
    input_row->append(*remove);
    editor->append(*input_row);
 
    add->signal_clicked().connect([this, &entry, &list] {
        add_rule_from_entry(entry, list);
    });
    entry.signal_activate().connect([this, &entry, &list] {
        add_rule_from_entry(entry, list);
    });
    remove->signal_clicked().connect([this, &list] {
        remove_selected_rule(list);
    });
    return editor;
}

References _, add_rule_from_entry(), and remove_selected_rule().

Referenced by RootGuardPage().

mark_rules_dirty()

void RootGuardPage::mark_rules_dirty ( )

private

Definition at line 744 of file RootGuardPage.cpp.

{
    rules_dirty_ = true;
    rules_status_.set_text(
        _("Rules have unsaved changes. Saving will validate the policy and restart RootGuard."));
    save_rules_button_.set_sensitive(!rules_saving_);
}

References _, rules_dirty_, rules_saving_, rules_status_, and save_rules_button_.

Referenced by add_installed_application_defaults(), add_rule_from_entry(), and remove_selected_rule().

on_auto_refresh()

bool RootGuardPage::on_auto_refresh ( )

private

Definition at line 820 of file RootGuardPage.cpp.

{
    client_.refresh();
    return true;
}

References client_, and BastionGuard::RootGuard::Client::refresh().

Referenced by RootGuardPage().

on_protection_toggled()

void RootGuardPage::on_protection_toggled ( )

private

Definition at line 826 of file RootGuardPage.cpp.

{
    if (updating_switch_)
        return;
    protection_switch_.set_sensitive(false);
    const bool enabled = protection_switch_.get_active();
    status_.set_text(enabled
        ? _("Enabling immediate blocking for protected system paths; user home remains audit-only…")
        : _("Switching RootGuard system-path protection to audit mode…"));
    client_.set_immediate_protection(enabled);
}

References _, client_, protection_switch_, BastionGuard::RootGuard::Client::set_immediate_protection(), status_, and updating_switch_.

Referenced by RootGuardPage().

on_snapshot()

void RootGuardPage::on_snapshot ( const BastionGuard::RootGuard::Snapshot & snapshot )

private

Definition at line 838 of file RootGuardPage.cpp.

{
    // Keep a local copy so event filtering reacts immediately when the user
    // toggles trusted-event visibility.
    last_snapshot_ = snapshot;
 
    service_value_.set_text(snapshot.service.active ? _("Active") : _("Inactive"));
    mode_value_.set_text(snapshot.service.immediateProtection
        ? _("Immediate block")
        : snapshot.service.mode.empty() ? "unknown" : snapshot.service.mode);
    init_value_.set_text(snapshot.service.init_system.empty()
                             ? "unknown"
                             : snapshot.service.init_system);
    pid_value_.set_text(snapshot.service.pid.empty() ? "—" : snapshot.service.pid);
 
    system_scope_value_.set_text(snapshot.service.immediateProtection
        ? _("Immediate blocking") : _("Audit-only"));
    home_scope_value_.set_text(snapshot.service.blockUserHome
        ? _("Blocking enabled by manual policy")
        : _("Audit-only · Anti-Ransomware enforcement"));
 
    start_button_.set_sensitive(!snapshot.service.active);
    stop_button_.set_sensitive(snapshot.service.active);
    reload_button_.set_sensitive(snapshot.service.active);
    restart_button_.set_sensitive(snapshot.service.active);
 
    updating_switch_ = true;
    protection_switch_.set_active(snapshot.service.immediateProtection);
    updating_switch_ = false;
    protection_switch_.set_sensitive(snapshot.service.active && !rules_saving_);
 
    if (rules_saving_ && !snapshot.operation_message.empty()) {
        rules_saving_ = false;
        if (snapshot.operation_success) {
            rules_dirty_ = false;
            rules_signature_.clear();
            rules_status_.set_text(
                _("Application rules saved and RootGuard restarted successfully."));
        } else {
            rules_status_.set_text(Glib::ustring::compose(
                _("Application rules were not applied: %1"),
                snapshot.operation_message));
        }
    }
    save_rules_button_.set_sensitive(rules_dirty_ && !rules_saving_);
    populate_application_rules(snapshot.application_rules);
 
    if (!snapshot.operation_message.empty()) {
        status_.set_text(snapshot.operation_success
                             ? Glib::ustring::compose(_("✅ %1"), snapshot.operation_message)
                             : Glib::ustring::compose(_("❌ %1"), snapshot.operation_message));
    } else if (snapshot.service.active && snapshot.service.immediateProtection) {
        status_.set_text(snapshot.service.autoBlockServices
            ? _("RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection.")
            : _("RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."));
    } else if (snapshot.service.active) {
        status_.set_text(
            _("RootGuard is monitoring filesystem metadata in audit mode. Global privilege events are sampled and destructive permission bursts are aggregated."));
    } else {
        status_.set_text(_("RootGuard is not running."));
    }
 
    render_incidents(snapshot);
    render_events(snapshot);
    queue_new_alerts(snapshot);
}

References _, BastionGuard::RootGuard::ServiceStatus::active, BastionGuard::RootGuard::Snapshot::application_rules, BastionGuard::RootGuard::ServiceStatus::autoBlockServices, BastionGuard::RootGuard::ServiceStatus::blockUserHome, home_scope_value_, BastionGuard::RootGuard::ServiceStatus::immediateProtection, BastionGuard::RootGuard::ServiceStatus::init_system, init_value_, last_snapshot_, BastionGuard::RootGuard::ServiceStatus::mode, mode_value_, BastionGuard::RootGuard::Snapshot::operation_message, BastionGuard::RootGuard::Snapshot::operation_success, BastionGuard::RootGuard::ServiceStatus::pid, pid_value_, populate_application_rules(), protection_switch_, queue_new_alerts(), reload_button_, render_events(), render_incidents(), restart_button_, rules_dirty_, rules_saving_, rules_signature_, rules_status_, save_rules_button_, BastionGuard::RootGuard::Snapshot::service, service_value_, start_button_, status_, stop_button_, system_scope_value_, and updating_switch_.

Referenced by RootGuardPage().

populate_application_rules()

void RootGuardPage::populate_application_rules ( const BastionGuard::RootGuard::ApplicationRules & rules )

private

Definition at line 772 of file RootGuardPage.cpp.

{
    const std::string signature = rules_signature(rules);
    if (rules_dirty_ || rules_saving_ || signature == rules_signature_)
        return;
 
    const auto populate = [](Gtk::ListBox& list,
                             std::vector<std::string> values) {
        clear_list(list);
        std::sort(values.begin(), values.end());
        values.erase(std::unique(values.begin(), values.end()), values.end());
        for (const auto& path : values)
            append_path_row(list, path);
    };
 
    populate(trusted_applications_list_, rules.trustedApplications);
    populate(trusted_executables_list_, rules.trustedExecutables);
    populate(denied_executables_list_, rules.deniedExecutables);
    rules_signature_ = signature;
}

References denied_executables_list_, BastionGuard::RootGuard::ApplicationRules::deniedExecutables, rules_dirty_, rules_saving_, rules_signature_, trusted_applications_list_, trusted_executables_list_, BastionGuard::RootGuard::ApplicationRules::trustedApplications, and BastionGuard::RootGuard::ApplicationRules::trustedExecutables.

Referenced by on_snapshot().

queue_new_alerts()

void RootGuardPage::queue_new_alerts ( const BastionGuard::RootGuard::Snapshot & snapshot )

private

Definition at line 1027 of file RootGuardPage.cpp.

{
    std::vector<BastionGuard::RootGuard::Event> new_events;
    for (const auto& event : snapshot.events) {
        if (event.verdict == "trusted")
            continue;
        if (closes_incident(event) && !event.filename.empty()) {
            notified_paths_.erase(incident_key(event));
            dismissed_paths_.erase(incident_key(event));
            continue;
        }
        if (!BastionGuard::RootGuard::is_actionable_incident(event))
            continue;
 
        const std::string fingerprint =
            BastionGuard::RootGuard::event_fingerprint(event);
        if (!seen_events_.insert(fingerprint).second)
            continue;
 
        const bool service_failure = event.event == "service-blocked" &&
                                     event.verdict != "blocked";
        const bool first_for_path = notified_paths_.insert(incident_key(event)).second;
        if (event.event != "service-blocked")
            dismissed_paths_.erase(incident_key(event));
 
        if (!initial_snapshot_ &&
            dismissed_events_.count(fingerprint) == 0 &&
            (first_for_path || service_failure)) {
            new_events.push_back(event);
        }
    }
    initial_snapshot_ = false;
 
    std::set<std::string> selected_paths;
    std::vector<BastionGuard::RootGuard::Event> selected;
    for (auto iterator = new_events.rbegin(); iterator != new_events.rend(); ++iterator) {
        const std::string key = incident_key(*iterator) + "\n" +
            (iterator->event == "service-blocked" && iterator->verdict != "blocked"
                ? "failure" : "incident");
        if (selected_paths.insert(key).second)
            selected.push_back(*iterator);
    }
    /*
     * Never build a popup backlog. Protected/service incidents take priority and
     * may interrupt immediately; a global metadata burst is deliberately much
     * quieter because backup/package activity can resemble a burst. The full
     * history always remains in Incidents/Events.
     */
    const auto critical = std::find_if(
        selected.begin(), selected.end(), [](const auto& event) {
            return event.rule_id != 0 || event.event == "service-blocked";
        });
    if (!current_alert_ && alert_queue_.empty() && critical != selected.end()) {
        alert_queue_.push(*critical);
    } else if (!current_alert_ && alert_queue_.empty() && !selected.empty()) {
        constexpr auto globalBurstPopupInterval = std::chrono::minutes(15);
        const auto now = std::chrono::steady_clock::now();
        const auto burst = std::find_if(
            selected.begin(), selected.end(), [](const auto& event) {
                return event.rule_id == 0 &&
                       (event.reason_flags & RG_REASON_METADATA_BURST) != 0;
            });
        const bool cooldownExpired =
            last_global_burst_alert_shown_.time_since_epoch().count() == 0 ||
            now - last_global_burst_alert_shown_ >= globalBurstPopupInterval;
        if (burst != selected.end() && cooldownExpired)
            alert_queue_.push(*burst);
    }
 
    if (!current_alert_)
        show_next_alert();
}

References alert_queue_, current_alert_, dismissed_events_, dismissed_paths_, BastionGuard::RootGuard::event_fingerprint(), BastionGuard::RootGuard::Snapshot::events, initial_snapshot_, BastionGuard::RootGuard::is_actionable_incident(), last_global_burst_alert_shown_, notified_paths_, seen_events_, and show_next_alert().

Referenced by on_snapshot().

remove_event()

void RootGuardPage::remove_event ( const BastionGuard::RootGuard::Event & event )

private

Definition at line 1297 of file RootGuardPage.cpp.

{
    status_.set_text(
        _("Moving the protected file from its original path into quarantine…"));
    client_.remove_event(event);
}

References _, client_, BastionGuard::RootGuard::Client::remove_event(), and status_.

Referenced by render_incidents(), and show_next_alert().

remove_selected_rule()

void RootGuardPage::remove_selected_rule ( Gtk::ListBox & list )

private

Definition at line 733 of file RootGuardPage.cpp.

{
    auto* row = list.get_selected_row();
    if (!row) {
        rules_status_.set_text(_("Select a rule to remove."));
        return;
    }
    list.remove(*row);
    mark_rules_dirty();
}

References _, mark_rules_dirty(), and rules_status_.

Referenced by make_rule_editor().

render_events()

void RootGuardPage::render_events ( const BastionGuard::RootGuard::Snapshot & snapshot )

private

Definition at line 1005 of file RootGuardPage.cpp.

{
    std::ostringstream output;
    std::size_t visible = 0;
    for (auto iterator = snapshot.events.rbegin(); iterator != snapshot.events.rend(); ++iterator) {
        if (!show_trusted_.get_active() && iterator->verdict == "trusted")
            continue;
        output << BastionGuard::RootGuard::format_event(*iterator) << '\n';
        if (++visible >= 150)
            break;
    }
    if (visible == 0) {
        if (snapshot.events.empty()) {
            output << _("No RootGuard events are available yet.") << '\n';
        } else {
            output << _("Only trusted events are available. Enable “Show trusted events” to display them.")
                   << '\n';
        }
    }
    events_view_.get_buffer()->set_text(output.str());
}

References _, BastionGuard::RootGuard::Snapshot::events, events_view_, BastionGuard::RootGuard::format_event(), and show_trusted_.

Referenced by on_snapshot(), and RootGuardPage().

render_incidents()

void RootGuardPage::render_incidents ( const BastionGuard::RootGuard::Snapshot & snapshot )

private

Definition at line 905 of file RootGuardPage.cpp.

{
    clear_list(incidents_list_);
 
    std::vector<BastionGuard::RootGuard::Event> incidents;
    std::set<std::string> closed_paths;
    std::set<std::string> displayed_paths;
    for (auto iterator = snapshot.events.rbegin(); iterator != snapshot.events.rend(); ++iterator) {
        if (closes_incident(*iterator) && !iterator->filename.empty()) {
            closed_paths.insert(incident_key(*iterator));
            continue;
        }
        if (!BastionGuard::RootGuard::is_security_observation(*iterator))
            continue;
        if (closed_paths.count(incident_key(*iterator)) != 0 ||
            displayed_paths.count(incident_key(*iterator)) != 0 ||
            dismissed_paths_.count(incident_key(*iterator)) != 0)
            continue;
        if (dismissed_events_.count(
                BastionGuard::RootGuard::event_fingerprint(*iterator)) != 0)
            continue;
        displayed_paths.insert(incident_key(*iterator));
        incidents.push_back(*iterator);
        if (incidents.size() >= 60)
            break;
    }
 
    if (incidents.empty()) {
        auto* empty = Gtk::make_managed<Gtk::Label>(
            _("No unresolved observations or blocked changes."));
        empty->set_margin(16);
        empty->set_halign(Gtk::Align::CENTER);
        incidents_list_.append(*empty);
        return;
    }
 
    for (const auto& event : incidents) {
        auto* row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 8);
        row->set_margin(8);
        row->add_css_class("rootguard-incident-row");
 
        auto* title = Gtk::make_managed<Gtk::Label>(incident_title(event));
        title->set_halign(Gtk::Align::START);
        const auto severity = BastionGuard::RootGuard::classify_event(event);
        if (event.verdict == "blocked")
            title->add_css_class("rootguard-blocked");
        else if (severity == BastionGuard::RootGuard::EventSeverity::Incident)
            title->add_css_class("rootguard-alert");
        else
            title->add_css_class("dim-label");
        row->append(*title);
 
        auto* detail = Gtk::make_managed<Gtk::Label>(incident_detail(event));
        detail->set_halign(Gtk::Align::START);
        detail->set_wrap(true);
        detail->set_selectable(true);
        row->append(*detail);
 
        const bool audit_event = event.verdict == "audit";
        const bool can_restore = !audit_event && restore_available(event);
        const bool can_remove = !audit_event && remove_available(event);
 
        if (!can_restore && !can_remove) {
            const auto note_text = audit_event
                ? Glib::ustring(
                    _("Audit observation: RootGuard did not block or alter the operation."))
                : recovery_note(event);
            if (!note_text.empty()) {
                auto* note = Gtk::make_managed<Gtk::Label>(note_text);
                note->set_halign(Gtk::Align::START);
                note->set_wrap(true);
                note->add_css_class("dim-label");
                row->append(*note);
            }
        }
 
        auto* actions = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
        actions->set_halign(Gtk::Align::END);
 
        if (can_restore) {
            auto* restore = Gtk::make_managed<Gtk::Button>(_("Restore"));
            restore->add_css_class("btn-primary");
            restore->signal_clicked().connect([this, event] { restore_event(event); });
            actions->append(*restore);
        }
        if (can_remove) {
            auto* remove = Gtk::make_managed<Gtk::Button>(_("Quarantine"));
            remove->add_css_class("btn-danger");
            remove->signal_clicked().connect([this, event] { remove_event(event); });
            actions->append(*remove);
        }
 
        auto* dismiss = Gtk::make_managed<Gtk::Button>(_("Dismiss"));
        dismiss->signal_clicked().connect([this, event] { dismiss_event(event); });
        actions->append(*dismiss);
        row->append(*actions);
        incidents_list_.append(*row);
    }
}

References _, BastionGuard::RootGuard::classify_event(), dismiss_event(), dismissed_events_, dismissed_paths_, BastionGuard::RootGuard::event_fingerprint(), BastionGuard::RootGuard::Snapshot::events, BastionGuard::RootGuard::Incident, incidents_list_, BastionGuard::RootGuard::is_security_observation(), remove_event(), and restore_event().

Referenced by on_snapshot().

restore_event()

void RootGuardPage::restore_event ( const BastionGuard::RootGuard::Event & event )

private

Definition at line 1291 of file RootGuardPage.cpp.

{
    status_.set_text(_("Restoring protected metadata and unblocking the service…"));
    client_.restore_event(event);
}

References _, client_, BastionGuard::RootGuard::Client::restore_event(), and status_.

Referenced by render_incidents(), and show_next_alert().

save_application_rules()

void RootGuardPage::save_application_rules ( )

private

Definition at line 794 of file RootGuardPage.cpp.

{
    BastionGuard::RootGuard::ApplicationRules rules;
    rules.trustedApplications = collect_rules(trusted_applications_list_);
    rules.trustedExecutables = collect_rules(trusted_executables_list_);
    rules.deniedExecutables = collect_rules(denied_executables_list_);
 
    std::set<std::string> trusted;
    trusted.insert(rules.trustedApplications.begin(), rules.trustedApplications.end());
    trusted.insert(rules.trustedExecutables.begin(), rules.trustedExecutables.end());
    for (const auto& denied : rules.deniedExecutables) {
        if (trusted.count(denied) != 0) {
            rules_status_.set_text(
                _("The same executable cannot be both trusted and blocked."));
            return;
        }
    }
 
    rules_saving_ = true;
    save_rules_button_.set_sensitive(false);
    rules_status_.set_text(
        _("Saving application rules and restarting RootGuard… Administrator authentication may be requested."));
    status_.set_text(_("Saving RootGuard application rules…"));
    client_.save_application_rules(std::move(rules));
}

References _, client_, collect_rules(), denied_executables_list_, BastionGuard::RootGuard::ApplicationRules::deniedExecutables, rules_saving_, rules_status_, BastionGuard::RootGuard::Client::save_application_rules(), save_rules_button_, status_, trusted_applications_list_, trusted_executables_list_, BastionGuard::RootGuard::ApplicationRules::trustedApplications, and BastionGuard::RootGuard::ApplicationRules::trustedExecutables.

Referenced by RootGuardPage().

show_next_alert()

void RootGuardPage::show_next_alert ( )

private

Definition at line 1100 of file RootGuardPage.cpp.

{
    if (current_alert_ || alert_queue_.empty())
        return;
 
    const auto event = alert_queue_.front();
    alert_queue_.pop();
    if (event.rule_id == 0 &&
        (event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        last_global_burst_alert_shown_ = std::chrono::steady_clock::now();
    current_alert_ = std::make_unique<Gtk::Window>();
    auto* win = current_alert_.get();
    win->set_title("");
    win->set_default_size(720, 520);
    win->set_resizable(true);
    win->set_modal(false);
    win->add_css_class("BastionGuard-popup");
    win->add_css_class("BastionGuard-dialog");
    if (auto* root = dynamic_cast<Gtk::Window*>(get_root()))
        win->set_transient_for(*root);
 
    auto* header = Gtk::make_managed<Gtk::HeaderBar>();
    header->set_show_title_buttons(false);
    header->set_decoration_layout("");
    header->add_css_class("custom-headerbar");
    auto* header_title = Gtk::make_managed<Gtk::Label>(
        event.event == "service-blocked"
            ? (event.verdict == "blocked"
                ? _("🛑 System service blocked")
                : _("⚠️ System service block failed"))
            : (event.reason_flags & RG_REASON_METADATA_BURST) != 0
                ? _("⚠️ Unusual permission-change burst")
            : event.rule_id == 0
                ? _("⚠️ Filesystem metadata change observed")
                : event.verdict == "blocked"
                    ? _("🛑 Protected change blocked")
                    : event.verdict == "audit"
                        ? _("⚠️ Protected change observed")
                        : _("⚠️ Protected change detected"));
    header_title->add_css_class("BastionGuard-title");
    header->pack_start(*header_title);
    win->set_titlebar(*header);
 
    auto* content = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    content->set_margin(18);
    win->set_child(*content);
 
    const Glib::ustring message_template =
        (event.reason_flags & RG_REASON_METADATA_BURST) != 0
            ? _("RootGuard detected many destructive permission/ownership changes in a short kernel window. Latest object:\n<b>%1</b>")
        : event.rule_id == 0
            ? _("RootGuard observed a filesystem metadata change to:\n<b>%1</b>")
            : event.verdict == "blocked"
                ? _("RootGuard blocked a change to:\n<b>%1</b>")
                : event.verdict == "audit"
                    ? _("RootGuard observed a change to:\n<b>%1</b>")
                    : _("RootGuard detected a change to:\n<b>%1</b>");
    auto* message = Gtk::make_managed<Gtk::Label>(
        Glib::ustring::compose(
            message_template,
            Glib::Markup::escape_text(event.filename.empty() ? "--" : event.filename)));
    message->set_use_markup(true);
    message->set_wrap(true);
    message->set_selectable(true);
    message->set_halign(Gtk::Align::CENTER);
    content->append(*message);
 
    auto* detail = Gtk::make_managed<Gtk::Label>(incident_detail(event));
    detail->set_wrap(true);
    detail->set_selectable(true);
    detail->set_halign(Gtk::Align::START);
    detail->set_valign(Gtk::Align::START);
    detail->set_xalign(0.0F);
 
    auto* detail_scroller = Gtk::make_managed<Gtk::ScrolledWindow>();
    detail_scroller->set_hexpand(true);
    detail_scroller->set_vexpand(true);
    detail_scroller->set_min_content_height(220);
    detail_scroller->set_policy(Gtk::PolicyType::AUTOMATIC,
                                Gtk::PolicyType::AUTOMATIC);
    detail_scroller->set_child(*detail);
    content->append(*detail_scroller);
 
    if (!has_exact_path(event)) {
        auto* path_notice = Gtk::make_managed<Gtk::Label>(
            _("Transparency notice: the kernel event contained only a basename. RootGuard "
              "shows the filesystem identity and disables path-based actions rather than "
              "guessing an unsafe path."));
        path_notice->set_wrap(true);
        path_notice->set_halign(Gtk::Align::CENTER);
        path_notice->add_css_class("dim-label");
        content->append(*path_notice);
    }
 
    if (BastionGuard::RootGuard::is_system_service_path(event.filename)) {
        auto* service_notice = Gtk::make_managed<Gtk::Label>(
            event.event == "service-blocked"
                ? (event.verdict == "blocked"
                    ? _("The affected system service has been stopped immediately. On systemd it is also runtime-masked.")
                    : _("RootGuard could not stop the affected service. Review the init-system logs immediately."))
                : event.verdict == "blocked"
                    ? _("RootGuard requested immediate service containment. A follow-up event will confirm the init-system action.")
                    : _("Audit mode never stops or masks services. This event is informational only."));
        service_notice->set_wrap(true);
        service_notice->add_css_class("rootguard-blocked");
        service_notice->set_halign(Gtk::Align::CENTER);
        content->append(*service_notice);
    }
 
    const bool audit_event = event.verdict == "audit";
    const bool can_restore = !audit_event && restore_available(event);
    const bool can_remove = !audit_event && remove_available(event);
    const auto note_text = audit_event
        ? Glib::ustring(
            _("Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."))
        : recovery_note(event);
    if (!note_text.empty() && !can_restore && !can_remove) {
        auto* note = Gtk::make_managed<Gtk::Label>(note_text);
        note->set_wrap(true);
        note->set_halign(Gtk::Align::CENTER);
        note->add_css_class("dim-label");
        content->append(*note);
    }
 
    auto* buttons = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 10);
    buttons->set_halign(Gtk::Align::CENTER);
 
    auto* acknowledge = Gtk::make_managed<Gtk::Button>(
        event.verdict == "blocked" ? _("Keep blocked") : _("Acknowledge"));
    buttons->append(*acknowledge);
 
    if (can_restore) {
        auto* restore = Gtk::make_managed<Gtk::Button>(_("Restore"));
        restore->add_css_class("btn-primary");
        restore->signal_clicked().connect([this, event] {
            restore_event(event);
            close_current_alert();
        });
        buttons->append(*restore);
    }
    if (can_remove) {
        auto* remove = Gtk::make_managed<Gtk::Button>(_("Quarantine"));
        remove->add_css_class("btn-danger");
        remove->signal_clicked().connect([this, event] {
            remove_event(event);
            close_current_alert();
        });
        buttons->append(*remove);
    }
    content->append(*buttons);
 
    acknowledge->signal_clicked().connect([this, event] {
        dismiss_alert(event);
        close_current_alert();
    });
    win->signal_close_request().connect([this, event]() -> bool {
        dismiss_alert(event);
        close_current_alert();
        return true;
    }, false);
    win->present();
}

References _, alert_queue_, close_current_alert(), current_alert_, dismiss_alert(), BastionGuard::RootGuard::is_system_service_path(), last_global_burst_alert_shown_, remove_event(), restore_event(), and RG_REASON_METADATA_BURST.

Referenced by close_current_alert(), and queue_new_alerts().

Member Data Documentation

alert_queue_

std::queue<BastionGuard::RootGuard::Event> RootGuardPage::alert_queue_

private

Definition at line 109 of file RootGuardPage.hpp.

Referenced by queue_new_alerts(), show_next_alert(), and ~RootGuardPage().

alive_

std::shared_ptr<std::atomic_bool> RootGuardPage::alive_ {std::make_shared<std::atomic_bool>(true)}

private

Definition at line 112 of file RootGuardPage.hpp.

Referenced by close_current_alert(), and ~RootGuardPage().

auto_refresh_connection_

sigc::connection RootGuardPage::auto_refresh_connection_

private

Definition at line 98 of file RootGuardPage.hpp.

Referenced by RootGuardPage(), and ~RootGuardPage().

client_

BastionGuard::RootGuard::Client RootGuardPage::client_

private

Definition at line 53 of file RootGuardPage.hpp.

Referenced by dismiss_event(), on_auto_refresh(), on_protection_toggled(), remove_event(), restore_event(), RootGuardPage(), and save_application_rules().

client_update_connection_

sigc::connection RootGuardPage::client_update_connection_

private

Definition at line 97 of file RootGuardPage.hpp.

Referenced by RootGuardPage(), and ~RootGuardPage().

current_alert_

std::unique_ptr<Gtk::Window> RootGuardPage::current_alert_

private

Definition at line 111 of file RootGuardPage.hpp.

Referenced by close_current_alert(), queue_new_alerts(), show_next_alert(), and ~RootGuardPage().

denied_executables_entry_

Gtk::Entry RootGuardPage::denied_executables_entry_

private

Definition at line 91 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

denied_executables_list_

Gtk::ListBox RootGuardPage::denied_executables_list_

private

Definition at line 90 of file RootGuardPage.hpp.

Referenced by populate_application_rules(), RootGuardPage(), and save_application_rules().

dismissed_events_

std::set<std::string> RootGuardPage::dismissed_events_

private

Definition at line 106 of file RootGuardPage.hpp.

Referenced by dismiss_alert(), dismiss_event(), queue_new_alerts(), and render_incidents().

dismissed_paths_

std::set<std::string> RootGuardPage::dismissed_paths_

private

Definition at line 107 of file RootGuardPage.hpp.

Referenced by dismiss_event(), queue_new_alerts(), and render_incidents().

events_scroller_

Gtk::ScrolledWindow RootGuardPage::events_scroller_

private

Definition at line 81 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

events_view_

Gtk::TextView RootGuardPage::events_view_

private

Definition at line 82 of file RootGuardPage.hpp.

Referenced by render_events(), and RootGuardPage().

home_scope_value_

Gtk::Label RootGuardPage::home_scope_value_

private

Definition at line 69 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

incidents_list_

Gtk::ListBox RootGuardPage::incidents_list_

private

Definition at line 78 of file RootGuardPage.hpp.

Referenced by render_incidents(), and RootGuardPage().

incidents_scroller_

Gtk::ScrolledWindow RootGuardPage::incidents_scroller_

private

Definition at line 77 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

incidents_title_

Gtk::Label RootGuardPage::incidents_title_

private

Definition at line 76 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

init_value_

Gtk::Label RootGuardPage::init_value_

private

Definition at line 58 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

initial_snapshot_

bool RootGuardPage::initial_snapshot_ {true}

private

Definition at line 100 of file RootGuardPage.hpp.

Referenced by queue_new_alerts().

last_global_burst_alert_shown_

std::chrono::steady_clock::time_point RootGuardPage::last_global_burst_alert_shown_ {}

private

Definition at line 110 of file RootGuardPage.hpp.

Referenced by queue_new_alerts(), and show_next_alert().

last_snapshot_

std::optional<BastionGuard::RootGuard::Snapshot> RootGuardPage::last_snapshot_

private

Definition at line 104 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

mode_value_

Gtk::Label RootGuardPage::mode_value_

private

Definition at line 57 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

notified_paths_

std::set<std::string> RootGuardPage::notified_paths_

private

Definition at line 108 of file RootGuardPage.hpp.

Referenced by queue_new_alerts().

page_stack_

Gtk::Stack RootGuardPage::page_stack_

private

Definition at line 61 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

page_switcher_

Gtk::StackSwitcher RootGuardPage::page_switcher_

private

Definition at line 62 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

pid_value_

Gtk::Label RootGuardPage::pid_value_

private

Definition at line 59 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

protection_info_button_

Gtk::MenuButton RootGuardPage::protection_info_button_

private

Definition at line 67 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

protection_info_popover_

Gtk::Popover RootGuardPage::protection_info_popover_

private

Definition at line 66 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

protection_label_

Gtk::Label RootGuardPage::protection_label_

private

Definition at line 65 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

protection_switch_

Gtk::Switch RootGuardPage::protection_switch_

private

Definition at line 64 of file RootGuardPage.hpp.

Referenced by on_protection_toggled(), on_snapshot(), and RootGuardPage().

refresh_button_

Gtk::Button RootGuardPage::refresh_button_

private

Definition at line 74 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

reload_button_

Gtk::Button RootGuardPage::reload_button_

private

Definition at line 72 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

restart_button_

Gtk::Button RootGuardPage::restart_button_

private

Definition at line 73 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

rules_dirty_

bool RootGuardPage::rules_dirty_ {}

private

Definition at line 101 of file RootGuardPage.hpp.

Referenced by mark_rules_dirty(), on_snapshot(), and populate_application_rules().

rules_saving_

bool RootGuardPage::rules_saving_ {}

private

Definition at line 102 of file RootGuardPage.hpp.

Referenced by mark_rules_dirty(), on_snapshot(), populate_application_rules(), and save_application_rules().

rules_signature_

std::string RootGuardPage::rules_signature_

private

Definition at line 103 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and populate_application_rules().

rules_stack_

Gtk::Stack RootGuardPage::rules_stack_

private

Definition at line 84 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

rules_status_

Gtk::Label RootGuardPage::rules_status_

private

Definition at line 93 of file RootGuardPage.hpp.

Referenced by add_installed_application_defaults(), add_rule_from_entry(), mark_rules_dirty(), on_snapshot(), remove_selected_rule(), RootGuardPage(), and save_application_rules().

rules_switcher_

Gtk::StackSwitcher RootGuardPage::rules_switcher_

private

Definition at line 85 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

save_rules_button_

Gtk::Button RootGuardPage::save_rules_button_

private

Definition at line 92 of file RootGuardPage.hpp.

Referenced by mark_rules_dirty(), on_snapshot(), RootGuardPage(), and save_application_rules().

seen_events_

std::set<std::string> RootGuardPage::seen_events_

private

Definition at line 105 of file RootGuardPage.hpp.

Referenced by queue_new_alerts().

service_value_

Gtk::Label RootGuardPage::service_value_

private

Definition at line 56 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

show_trusted_

Gtk::CheckButton RootGuardPage::show_trusted_

private

Definition at line 80 of file RootGuardPage.hpp.

Referenced by render_events(), and RootGuardPage().

start_button_

Gtk::Button RootGuardPage::start_button_

private

Definition at line 70 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

status_

Gtk::Label RootGuardPage::status_

private

Definition at line 95 of file RootGuardPage.hpp.

Referenced by on_protection_toggled(), on_snapshot(), remove_event(), restore_event(), RootGuardPage(), and save_application_rules().

stop_button_

Gtk::Button RootGuardPage::stop_button_

private

Definition at line 71 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

system_scope_value_

Gtk::Label RootGuardPage::system_scope_value_

private

Definition at line 68 of file RootGuardPage.hpp.

Referenced by on_snapshot(), and RootGuardPage().

title_

Gtk::Label RootGuardPage::title_

private

Definition at line 55 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

trusted_applications_entry_

Gtk::Entry RootGuardPage::trusted_applications_entry_

private

Definition at line 87 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

trusted_applications_list_

Gtk::ListBox RootGuardPage::trusted_applications_list_

private

Definition at line 86 of file RootGuardPage.hpp.

Referenced by add_installed_application_defaults(), populate_application_rules(), RootGuardPage(), and save_application_rules().

trusted_executables_entry_

Gtk::Entry RootGuardPage::trusted_executables_entry_

private

Definition at line 89 of file RootGuardPage.hpp.

Referenced by RootGuardPage().

trusted_executables_list_

Gtk::ListBox RootGuardPage::trusted_executables_list_

private

Definition at line 88 of file RootGuardPage.hpp.

Referenced by populate_application_rules(), RootGuardPage(), and save_application_rules().

updating_switch_

bool RootGuardPage::updating_switch_ {}

private

Definition at line 99 of file RootGuardPage.hpp.

Referenced by on_protection_toggled(), and on_snapshot().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/RootGuardPage.hpp
• BastionGuard/src/rootguard/RootGuardPage.cpp