bastionguard::rootguard::anonymous_namespace{JsonEventSink.cpp} Namespace Reference

Functions
const char *	eventName (const __u32 type) noexcept
const char *	verdictName (const __u32 verdict) noexcept
const char *	pathResolutionName (const __u32 value) noexcept
std::string	receivedAtUtc ()

Function Documentation

eventName()

const char * bastionguard::rootguard::anonymous_namespace{JsonEventSink.cpp}::eventName ( const __u32 type )

noexcept

Definition at line 12 of file JsonEventSink.cpp.

{
    switch (type) {
    case RG_EVENT_SETUID: return "setuid";
    case RG_EVENT_EXEC_PRIV: return "exec-priv";
    case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
    case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
    case RG_EVENT_OWNER_CHANGE: return "owner-change";
    case RG_EVENT_XATTR_CHANGE: return "xattr-change";
    case RG_EVENT_ACL_CHANGE: return "acl-change";
    case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
    case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
    case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
    case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
    case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
    case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
    case RG_EVENT_FILE_RESTORED: return "file-restored";
    case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
    case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
    default: return "unknown";
    }
}

References eventName(), RG_EVENT_ACL_CHANGE, RG_EVENT_CREDENTIAL_ANOMALY, RG_EVENT_EXEC_PRIV, RG_EVENT_FILE_QUARANTINED, RG_EVENT_FILE_RESTORED, RG_EVENT_INTEGRITY_DRIFT, RG_EVENT_INTEGRITY_RESTORED, RG_EVENT_OWNER_CHANGE, RG_EVENT_PERMISSION_CHANGE, RG_EVENT_PROTECTED_HARDLINK, RG_EVENT_PROTECTED_RENAME, RG_EVENT_PROTECTED_UNLINK, RG_EVENT_PROTECTION_MODE_CHANGED, RG_EVENT_SERVICE_BLOCKED, RG_EVENT_SETUID, and RG_EVENT_XATTR_CHANGE.

Referenced by eventName().

pathResolutionName()

const char * bastionguard::rootguard::anonymous_namespace{JsonEventSink.cpp}::pathResolutionName ( const __u32 value )

noexcept

Definition at line 48 of file JsonEventSink.cpp.

{
    switch (value) {
    case RG_PATH_PROTECTED_BASELINE: return "protected-baseline";
    case RG_PATH_PROC_FD: return "proc-fd";
    case RG_PATH_PROCESS_CWD: return "process-cwd";
    case RG_PATH_KERNEL_EXACT: return "kernel-exact";
    case RG_PATH_LSM_EXACT: return "lsm-exact";
    default: return "basename-only";
    }
}

References pathResolutionName(), RG_PATH_KERNEL_EXACT, RG_PATH_LSM_EXACT, RG_PATH_PROC_FD, RG_PATH_PROCESS_CWD, and RG_PATH_PROTECTED_BASELINE.

Referenced by pathResolutionName().

receivedAtUtc()

std::string bastionguard::rootguard::anonymous_namespace{JsonEventSink.cpp}::receivedAtUtc

(

)

Definition at line 60 of file JsonEventSink.cpp.

{
    const auto now = std::chrono::system_clock::now();
    const auto time = std::chrono::system_clock::to_time_t(now);
    std::tm tm {};
    gmtime_r(&time, &tm);
    std::ostringstream output;
    output << std::put_time(&tm, "%Y-%m-%dT%H:%M:%SZ");
    return output.str();
}

References receivedAtUtc().

Referenced by receivedAtUtc().

verdictName()

const char * bastionguard::rootguard::anonymous_namespace{JsonEventSink.cpp}::verdictName ( const __u32 verdict )

noexcept

Definition at line 35 of file JsonEventSink.cpp.

{
    switch (verdict) {
    case RG_VERDICT_AUDIT: return "audit";
    case RG_VERDICT_AUTHORIZED: return "authorized";
    case RG_VERDICT_BLOCKED: return "blocked";
    case RG_VERDICT_TRUSTED: return "trusted";
    case RG_VERDICT_ALERT: return "alert";
    case RG_VERDICT_RESTORED: return "restored";
    default: return "unknown";
    }
}

References RG_VERDICT_ALERT, RG_VERDICT_AUDIT, RG_VERDICT_AUTHORIZED, RG_VERDICT_BLOCKED, RG_VERDICT_RESTORED, RG_VERDICT_TRUSTED, and verdictName().

Referenced by verdictName().