Classes
struct	anonymous_namespace{main.cpp}::Options

Namespaces
namespace	anonymous_namespace{main.cpp}

Functions
void	anonymous_namespace{main.cpp}::handleStopSignal (int) noexcept
void	anonymous_namespace{main.cpp}::handleReloadSignal (int) noexcept
void	anonymous_namespace{main.cpp}::printUsage (const char *executable)
Options	anonymous_namespace{main.cpp}::parseOptions (const int argc, char *argv[])
bastionguard::rootguard::Policy	anonymous_namespace{main.cpp}::loadPolicy (const Options &options)
void	anonymous_namespace{main.cpp}::writeRuntimeStatus (const bastionguard::rootguard::Policy &policy)
void	anonymous_namespace{main.cpp}::writeRuntimePolicyView (const bastionguard::rootguard::Policy &policy)
bastionguard::rootguard::Policy	anonymous_namespace{main.cpp}::auditRuntimePolicy (bastionguard::rootguard::Policy policy)
void	anonymous_namespace{main.cpp}::printPolicySummary (const bastionguard::rootguard::Policy &policy)
int	main (const int argc, char *argv[])

Variables
volatile std::sig_atomic_t	anonymous_namespace{main.cpp}::gStopRequested = 0
volatile std::sig_atomic_t	anonymous_namespace{main.cpp}::gReloadRequested = 0

Function Documentation

◆ main()

int main	(	const int	argc,
		char *	argv[] )

Definition at line 184 of file main.cpp.

{
    using namespace bastionguard::rootguard;
 
    try {
        const Options options = parseOptions(argc, argv);
        Policy policy = loadPolicy(options);
        printPolicySummary(policy);
 
        if (options.checkOnly)
            return EXIT_SUCCESS;
 
        std::signal(SIGINT, handleStopSignal);
        std::signal(SIGTERM, handleStopSignal);
        std::signal(SIGHUP, handleReloadSignal);
 
        ConsoleEventSink consoleSink;
        MultiEventSink eventSink;
        eventSink.add(consoleSink);
 
        std::unique_ptr<JsonEventSink> jsonSink;
        if (!policy.eventLog.empty()) {
            if (const auto parent = policy.eventLog.parent_path(); !parent.empty())
                std::filesystem::create_directories(parent);
            jsonSink = std::make_unique<JsonEventSink>(policy.eventLog);
            eventSink.add(*jsonSink);
        }
 
        const auto automaticServiceBlockingEnabled = [](const Policy& activePolicy) {
            return activePolicy.autoBlockSystemServices &&
                   activePolicy.mode == Mode::Enforce &&
                   activePolicy.metadataAction == Action::Block;
        };
        AutomaticResponseSink responseSink(
            eventSink, automaticServiceBlockingEnabled(policy));
        RootGuardEngine engine(responseSink);
        PolicyApplyReport report = engine.start(policy);
        writeRuntimeStatus(policy);
        writeRuntimePolicyView(policy);
 
        std::cerr << "BastionGuard RootGuard avviato: trusted-app caricati="
                  << report.trustedApplicationsLoaded << " trusted caricati="
                  << report.trustedLoaded << " denied caricati="
                  << report.deniedLoaded << " protected caricati="
                  << report.protectedLoaded << '\n';
        for (const auto& warning : report.warnings)
            std::cerr << "RootGuard policy warning: " << warning << '\n';
 
        while (gStopRequested == 0) {
            const int result = engine.pollOnce(250);
            if (result < 0)
                throw std::runtime_error("errore ring buffer: " + std::to_string(result));
 
            engine.runIntegrityCheckIfDue();
 
            if (gReloadRequested != 0) {
                gReloadRequested = 0;
                bool auditEntered = false;
                try {
                    /*
                     * Enter audit before opening/parsing the new file. Thus a
                     * security, syntax or path-resolution failure cannot leave
                     * the previous enforcement policy active unexpectedly.
                     */
                    engine.enterAuditMode();
                    auditEntered = true;
                    responseSink.setAutoBlockSystemServices(false);
                    writeRuntimeStatus(auditRuntimePolicy(policy));
                    Policy reloaded = loadPolicy(options);
                    const auto previousEventLog = policy.eventLog;
                    const auto reloadedReport = engine.reloadPolicy(reloaded);
                    policy = std::move(reloaded);
                    responseSink.setAutoBlockSystemServices(
                        automaticServiceBlockingEnabled(policy));
                    writeRuntimeStatus(policy);
                    writeRuntimePolicyView(policy);
                    std::cerr << "RootGuard policy ricaricata: trusted-app="
                              << reloadedReport.trustedApplicationsLoaded
                              << " trusted="
                              << reloadedReport.trustedLoaded << " denied="
                              << reloadedReport.deniedLoaded << " protected="
                              << reloadedReport.protectedLoaded << '\n';
                    if (policy.eventLog != previousEventLog) {
                        std::cerr << "nota: una modifica di event_log richiede riavvio\n";
                    }
                } catch (const std::exception& error) {
                    std::cerr << "ricaricamento policy fallito; "
                              << (auditEntered
                                      ? "motore lasciato in audit: "
                                      : "impossibile garantire il passaggio in audit: ")
                              << error.what() << '\n';
                }
            }
        }
        std::filesystem::remove("/run/bastionguard-rootguard.status");
    } catch (const std::exception& error) {
        std::filesystem::remove("/run/bastionguard-rootguard.status");
        std::cerr << "RootGuard: " << error.what() << '\n';
        return EXIT_FAILURE;
    }
 
    return EXIT_SUCCESS;
}

Classes

Namespaces

Functions

Variables

Function Documentation

◆ main()