BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp} Namespace Reference

Classes
struct	CommandResult
struct	IgnoredPathRule

Functions
CommandResult	run_command (const std::vector< std::string > &arguments)
std::string	trim (std::string value)
bool	parse_bool (const std::string &value)
ServiceStatus	parse_status (const std::string &text)
bool	path_starts_with (const std::filesystem::path &path, const std::filesystem::path &prefix)
std::vector< IgnoredPathRule >	read_ignored_paths ()
bool	is_ignored_event_path (const std::string &filename, const std::vector< IgnoredPathRule > &rules)
ApplicationRules	read_application_rules ()
std::vector< Event >	read_recent_events (const std::size_t maximum)
std::string	octal_argument (const std::uint32_t value)
bool	command_success (const CommandResult &result, const std::string &successFallback, std::string &message)

Function Documentation

command_success()

bool BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::command_success	(	const CommandResult &	result,
		const std::string &	successFallback,
		std::string &	message )

Definition at line 280 of file RootGuardClient.cpp.

{
    message = trim(result.output);
    const bool success = result.exit_code == 0;
    if (message.empty()) {
        if (success) {
            message = successFallback;
        } else {
            message = "RootGuard command failed with exit code " +
                      std::to_string(result.exit_code) + ".";
        }
    }
    return success;
}

References command_success(), BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::CommandResult::exit_code, BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::CommandResult::output, and trim().

Referenced by command_success().

is_ignored_event_path()

bool BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::is_ignored_event_path	(	const std::string &	filename,
		const std::vector< IgnoredPathRule > &	rules )

Definition at line 197 of file RootGuardClient.cpp.

{
    if (filename.empty() || filename == "--" || filename.front() != '/')
        return false;
    const std::filesystem::path path(filename);
    for (const auto& rule : rules) {
        if (rule.recursive ? path_starts_with(path, rule.path)
                           : path.lexically_normal() == rule.path)
            return true;
    }
    return false;
}

References is_ignored_event_path(), and path_starts_with().

Referenced by is_ignored_event_path(), and read_recent_events().

octal_argument()

std::string BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::octal_argument

(

const std::uint32_t

value

)

Definition at line 273 of file RootGuardClient.cpp.

{
    std::ostringstream output;
    output << std::oct << (value & 07777U);
    return output.str();
}

References octal_argument().

Referenced by octal_argument().

parse_bool()

bool BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::parse_bool

(

const std::string &

value

)

Definition at line 117 of file RootGuardClient.cpp.

{
    return value == "true" || value == "1" || value == "yes" || value == "on";
}

References parse_bool().

Referenced by parse_bool(), and parse_status().

parse_status()

ServiceStatus BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::parse_status

(

const std::string &

text

)

Definition at line 122 of file RootGuardClient.cpp.

{
    ServiceStatus status;
    std::istringstream input(text);
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (key == "active") status.active = parse_bool(value);
        else if (key == "init") status.init_system = value;
        else if (key == "state") status.state = value;
        else if (key == "mode") status.mode = value;
        else if (key == "metadata_action") status.metadata_action = value;
        else if (key == "global_metadata_action") status.global_metadata_action = value;
        else if (key == "auto_block_services") status.autoBlockServices = parse_bool(value);
        else if (key == "block_user_home") status.blockUserHome = parse_bool(value);
        else if (key == "pid") status.pid = value;
    }
    status.immediateProtection = status.mode == "enforce" &&
                                 status.metadata_action == "block";
    return status;
}

References BastionGuard::RootGuard::ServiceStatus::active, BastionGuard::RootGuard::ServiceStatus::autoBlockServices, BastionGuard::RootGuard::ServiceStatus::blockUserHome, BastionGuard::RootGuard::ServiceStatus::global_metadata_action, BastionGuard::RootGuard::ServiceStatus::immediateProtection, BastionGuard::RootGuard::ServiceStatus::init_system, BastionGuard::RootGuard::ServiceStatus::metadata_action, BastionGuard::RootGuard::ServiceStatus::mode, parse_bool(), parse_status(), BastionGuard::RootGuard::ServiceStatus::pid, BastionGuard::RootGuard::ServiceStatus::state, and trim().

Referenced by parse_status().

path_starts_with()

bool BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::path_starts_with	(	const std::filesystem::path &	path,
		const std::filesystem::path &	prefix )

Definition at line 154 of file RootGuardClient.cpp.

{
    const auto normalized_path = path.lexically_normal();
    const auto normalized_prefix = prefix.lexically_normal();
    auto path_iterator = normalized_path.begin();
    for (auto prefix_iterator = normalized_prefix.begin();
         prefix_iterator != normalized_prefix.end();
         ++prefix_iterator, ++path_iterator) {
        if (path_iterator == normalized_path.end() ||
            *path_iterator != *prefix_iterator)
            return false;
    }
    return true;
}

References path_starts_with().

Referenced by is_ignored_event_path(), and path_starts_with().

read_application_rules()

ApplicationRules BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::read_application_rules

(

)

Definition at line 211 of file RootGuardClient.cpp.

{
    std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
    ApplicationRules rules;
    if (!input)
        return rules;
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (value.empty())
            continue;
        if (key == "trusted_application")
            rules.trustedApplications.push_back(value);
        else if (key == "trusted_executable")
            rules.trustedExecutables.push_back(value);
        else if (key == "denied_executable")
            rules.deniedExecutables.push_back(value);
    }
    return rules;
}

References BASTIONGUARD_ROOTGUARD_POLICY_VIEW, BastionGuard::RootGuard::ApplicationRules::deniedExecutables, read_application_rules(), trim(), BastionGuard::RootGuard::ApplicationRules::trustedApplications, and BastionGuard::RootGuard::ApplicationRules::trustedExecutables.

Referenced by read_application_rules().

read_ignored_paths()

std::vector< IgnoredPathRule > BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::read_ignored_paths

(

)

Definition at line 170 of file RootGuardClient.cpp.

{
    std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
    if (!input)
        return {};
 
    std::vector<IgnoredPathRule> rules;
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (value.empty() || value.front() != '/')
            continue;
        if (key == "ignored_path") {
            rules.push_back(IgnoredPathRule{
                std::filesystem::path(value).lexically_normal(), false});
        } else if (key == "ignored_recursive") {
            rules.push_back(IgnoredPathRule{
                std::filesystem::path(value).lexically_normal(), true});
        }
    }
    return rules;
}

References BASTIONGUARD_ROOTGUARD_POLICY_VIEW, read_ignored_paths(), and trim().

Referenced by read_ignored_paths(), and read_recent_events().

read_recent_events()

std::vector< Event > BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::read_recent_events

(

const std::size_t

maximum

)

Definition at line 236 of file RootGuardClient.cpp.

{
    const auto ignored_paths = read_ignored_paths();
    std::ifstream stream(BASTIONGUARD_ROOTGUARD_EVENT_LOG, std::ios::binary);
    if (!stream)
        return {};
 
    constexpr std::streamoff kMaximumTailBytes = 2 * 1024 * 1024;
    stream.seekg(0, std::ios::end);
    const std::streamoff end = stream.tellg();
    if (end < 0)
        return {};
    const std::streamoff start = end > kMaximumTailBytes
        ? end - kMaximumTailBytes : 0;
    stream.seekg(start, std::ios::beg);
    std::string line;
    if (start > 0)
        std::getline(stream, line); // discard a potentially partial JSON line
 
    std::deque<std::string> lines;
    while (std::getline(stream, line)) {
        lines.push_back(std::move(line));
        if (lines.size() > maximum)
            lines.pop_front();
    }
 
    std::vector<Event> events;
    events.reserve(lines.size());
    for (const auto& item : lines) {
        if (auto event = parse_event_json(item)) {
            if (!is_ignored_event_path(event->filename, ignored_paths))
                events.push_back(std::move(*event));
        }
    }
    return events;
}

References BASTIONGUARD_ROOTGUARD_EVENT_LOG, is_ignored_event_path(), BastionGuard::RootGuard::parse_event_json(), read_ignored_paths(), and read_recent_events().

Referenced by read_recent_events().

run_command()

CommandResult BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::run_command

(

const std::vector< std::string > &

arguments

)

Definition at line 51 of file RootGuardClient.cpp.

{
    CommandResult result;
    if (arguments.empty())
        return result;
 
    int descriptors[2]{};
    if (::pipe(descriptors) != 0)
        return result;
 
    const pid_t child = ::fork();
    if (child < 0) {
        ::close(descriptors[0]);
        ::close(descriptors[1]);
        return result;
    }
 
    if (child == 0) {
        ::close(descriptors[0]);
        ::dup2(descriptors[1], STDOUT_FILENO);
        ::dup2(descriptors[1], STDERR_FILENO);
        ::close(descriptors[1]);
 
        std::vector<char*> argv;
        argv.reserve(arguments.size() + 1);
        for (const auto& argument : arguments)
            argv.push_back(const_cast<char*>(argument.c_str()));
        argv.push_back(nullptr);
 
        ::execv(argv.front(), argv.data());
        _exit(127);
    }
 
    ::close(descriptors[1]);
    std::array<char, 4096> buffer{};
    for (;;) {
        const ssize_t count = ::read(descriptors[0], buffer.data(), buffer.size());
        if (count > 0) {
            result.output.append(buffer.data(), static_cast<std::size_t>(count));
            continue;
        }
        if (count < 0 && errno == EINTR)
            continue;
        break;
    }
    ::close(descriptors[0]);
 
    int status = 0;
    while (::waitpid(child, &status, 0) < 0 && errno == EINTR) {
    }
    if (WIFEXITED(status))
        result.exit_code = WEXITSTATUS(status);
    else if (WIFSIGNALED(status))
        result.exit_code = 128 + WTERMSIG(status);
    return result;
}

References BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::CommandResult::exit_code, BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::CommandResult::output, and run_command().

Referenced by run_command().

trim()

std::string BastionGuard::RootGuard::anonymous_namespace{RootGuardClient.cpp}::trim

(

std::string

value

)

Definition at line 108 of file RootGuardClient.cpp.

{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}

References trim().

Referenced by command_success(), parse_status(), read_application_rules(), read_ignored_paths(), and trim().