main.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/AutomaticResponseSink.hpp"
#include "rootguard/ConsoleEventSink.hpp"
#include "rootguard/JsonEventSink.hpp"
#include "rootguard/MultiEventSink.hpp"
#include "rootguard/PolicyLoader.hpp"
#include "rootguard/PolicySecurity.hpp"
#include "rootguard/RootGuardEngine.hpp"
 
#include <csignal>
#include <cstdlib>
#include <exception>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <memory>
#include <optional>
#include <stdexcept>
#include <string>
#include <string_view>
#include <sys/stat.h>
#include <unistd.h>
 
namespace {
 
volatile std::sig_atomic_t gStopRequested = 0;
volatile std::sig_atomic_t gReloadRequested = 0;
 
extern "C" void handleStopSignal(int) noexcept
{
    gStopRequested = 1;
}
 
extern "C" void handleReloadSignal(int) noexcept
{
    gReloadRequested = 1;
}
 
struct Options {
    std::filesystem::path policyPath{"/etc/bastionguard/rootguard.conf"};
    std::optional<bastionguard::rootguard::Mode> modeOverride;
    bool allowUnsafePolicy{};
    bool checkOnly{};
};
 
void printUsage(const char* executable)
{
    std::cerr << "uso: " << executable
              << " [--policy FILE] [--audit|--enforce]"
                 " [--allow-unsafe-policy] [--check-policy]\n";
}
 
Options parseOptions(const int argc, char* argv[])
{
    Options options;
    for (int index = 1; index < argc; ++index) {
        const std::string_view argument(argv[index]);
        if (argument == "--policy" && index + 1 < argc) {
            options.policyPath = argv[++index];
        } else if (argument == "--audit") {
            options.modeOverride = bastionguard::rootguard::Mode::Audit;
        } else if (argument == "--enforce") {
            options.modeOverride = bastionguard::rootguard::Mode::Enforce;
        } else if (argument == "--allow-unsafe-policy") {
            options.allowUnsafePolicy = true;
        } else if (argument == "--check-policy") {
            options.checkOnly = true;
        } else {
            printUsage(argv[0]);
            throw std::invalid_argument("argomento non riconosciuto");
        }
    }
    return options;
}
 
bastionguard::rootguard::Policy loadPolicy(const Options& options)
{
    using namespace bastionguard::rootguard;
 
    const std::string content = PolicySecurity::read(
        options.policyPath, !options.allowUnsafePolicy);
    Policy policy = PolicyLoader::loadFromText(content, options.policyPath);
    if (options.modeOverride)
        policy.mode = *options.modeOverride;
    return policy;
}
 
void writeRuntimeStatus(const bastionguard::rootguard::Policy& policy)
{
    using namespace bastionguard::rootguard;
    const std::filesystem::path path{"/run/bastionguard-rootguard.status"};
    const std::filesystem::path temporary = path.string() + ".tmp." +
                                            std::to_string(::getpid());
    std::ofstream output(temporary, std::ios::trunc);
    if (!output)
        return;
    const bool effectiveServiceBlocking = policy.autoBlockSystemServices &&
        policy.mode == Mode::Enforce &&
        policy.metadataAction == Action::Block;
    output << "mode=" << toString(policy.mode) << '\n'
           << "metadata_action=" << toString(policy.metadataAction) << '\n'
           << "global_metadata_action=" << toString(policy.globalMetadataAction) << '\n'
           << "auto_block_services="
           << (effectiveServiceBlocking ? "true" : "false") << '\n'
           << "block_user_home=" << (policy.blockUserHome ? "true" : "false") << '\n';
    output.close();
    if (!output)
        return;
    ::chmod(temporary.c_str(), 0644);
    if (::rename(temporary.c_str(), path.c_str()) != 0)
        std::filesystem::remove(temporary);
}
 
void writeRuntimePolicyView(const bastionguard::rootguard::Policy& policy)
{
    const std::filesystem::path path{"/run/bastionguard-rootguard.policy-view"};
    const std::filesystem::path temporary = path.string() + ".tmp." +
                                            std::to_string(::getpid());
    std::ofstream output(temporary, std::ios::trunc);
    if (!output)
        return;
    output << "block_user_home=" << (policy.blockUserHome ? "true" : "false") << '\n'
           << "monitor_global_privilege_metadata=" << (policy.monitorGlobalPrivilegeMetadata ? "true" : "false") << '\n'
           << "detect_global_metadata_bursts=" << (policy.detectGlobalMetadataBursts ? "true" : "false") << '\n'
           << "global_metadata_sample_limit=" << policy.globalMetadataSampleLimit << '\n'
           << "metadata_burst_threshold=" << policy.metadataBurstThreshold << '\n'
           << "metadata_burst_window_ms=" << policy.metadataBurstWindowMs << '\n'
           << "metadata_burst_cooldown_ms=" << policy.metadataBurstCooldownMs << '\n';
    for (const auto& rule : policy.trustedApplications)
        output << "trusted_application=" << rule.path.string() << '\n';
    for (const auto& rule : policy.trustedExecutables)
        output << "trusted_executable=" << rule.path.string() << '\n';
    for (const auto& rule : policy.deniedExecutables)
        output << "denied_executable=" << rule.path.string() << '\n';
    for (const auto& rule : policy.protectedPaths)
        output << (rule.recursive ? "protected_recursive=" : "protected_path=")
               << rule.path.string() << '\n';
    for (const auto& rule : policy.ignoredPaths)
        output << (rule.recursive ? "ignored_recursive=" : "ignored_path=")
               << rule.path.string() << '\n';
    output.close();
    if (!output)
        return;
    ::chmod(temporary.c_str(), 0644);
    if (::rename(temporary.c_str(), path.c_str()) != 0)
        std::filesystem::remove(temporary);
}
 
bastionguard::rootguard::Policy auditRuntimePolicy(
    bastionguard::rootguard::Policy policy)
{
    using namespace bastionguard::rootguard;
    policy.mode = Mode::Audit;
    policy.metadataAction = Action::Audit;
    policy.globalMetadataAction = Action::Audit;
    policy.unknownAction = Action::Audit;
    policy.credentialAnomalyAction = Action::Audit;
    return policy;
}
 
void printPolicySummary(const bastionguard::rootguard::Policy& policy)
{
    using namespace bastionguard::rootguard;
    std::cerr << "RootGuard policy: mode=" << toString(policy.mode)
              << " unknown_action=" << toString(policy.unknownAction)
              << " metadata_action=" << toString(policy.metadataAction)
              << " global_metadata_action=" << toString(policy.globalMetadataAction)
              << " credential_action=" << toString(policy.credentialAnomalyAction)
              << " auto_block_services=" << (policy.autoBlockSystemServices ? "true" : "false")
              << " block_user_home=" << (policy.blockUserHome ? "true" : "false")
              << " global_metadata=" << (policy.monitorGlobalPrivilegeMetadata ? "true" : "false")
              << " metadata_bursts=" << (policy.detectGlobalMetadataBursts ? "true" : "false")
              << " sample_limit=" << policy.globalMetadataSampleLimit
              << " burst_threshold=" << policy.metadataBurstThreshold
              << " trusted_apps=" << policy.trustedApplications.size()
              << " trusted=" << policy.trustedExecutables.size()
              << " denied=" << policy.deniedExecutables.size()
              << " protected=" << policy.protectedPaths.size()
              << " ignored=" << policy.ignoredPaths.size() << '\n';
}
 
} // namespace
 
int main(const int argc, char* argv[])
{
    using namespace bastionguard::rootguard;
 
    try {
        const Options options = parseOptions(argc, argv);
        Policy policy = loadPolicy(options);
        printPolicySummary(policy);
 
        if (options.checkOnly)
            return EXIT_SUCCESS;
 
        std::signal(SIGINT, handleStopSignal);
        std::signal(SIGTERM, handleStopSignal);
        std::signal(SIGHUP, handleReloadSignal);
 
        ConsoleEventSink consoleSink;
        MultiEventSink eventSink;
        eventSink.add(consoleSink);
 
        std::unique_ptr<JsonEventSink> jsonSink;
        if (!policy.eventLog.empty()) {
            if (const auto parent = policy.eventLog.parent_path(); !parent.empty())
                std::filesystem::create_directories(parent);
            jsonSink = std::make_unique<JsonEventSink>(policy.eventLog);
            eventSink.add(*jsonSink);
        }
 
        const auto automaticServiceBlockingEnabled = [](const Policy& activePolicy) {
            return activePolicy.autoBlockSystemServices &&
                   activePolicy.mode == Mode::Enforce &&
                   activePolicy.metadataAction == Action::Block;
        };
        AutomaticResponseSink responseSink(
            eventSink, automaticServiceBlockingEnabled(policy));
        RootGuardEngine engine(responseSink);
        PolicyApplyReport report = engine.start(policy);
        writeRuntimeStatus(policy);
        writeRuntimePolicyView(policy);
 
        std::cerr << "BastionGuard RootGuard avviato: trusted-app caricati="
                  << report.trustedApplicationsLoaded << " trusted caricati="
                  << report.trustedLoaded << " denied caricati="
                  << report.deniedLoaded << " protected caricati="
                  << report.protectedLoaded << '\n';
        for (const auto& warning : report.warnings)
            std::cerr << "RootGuard policy warning: " << warning << '\n';
 
        while (gStopRequested == 0) {
            const int result = engine.pollOnce(250);
            if (result < 0)
                throw std::runtime_error("errore ring buffer: " + std::to_string(result));
 
            engine.runIntegrityCheckIfDue();
 
            if (gReloadRequested != 0) {
                gReloadRequested = 0;
                bool auditEntered = false;
                try {
                    /*
                     * Enter audit before opening/parsing the new file. Thus a
                     * security, syntax or path-resolution failure cannot leave
                     * the previous enforcement policy active unexpectedly.
                     */
                    engine.enterAuditMode();
                    auditEntered = true;
                    responseSink.setAutoBlockSystemServices(false);
                    writeRuntimeStatus(auditRuntimePolicy(policy));
                    Policy reloaded = loadPolicy(options);
                    const auto previousEventLog = policy.eventLog;
                    const auto reloadedReport = engine.reloadPolicy(reloaded);
                    policy = std::move(reloaded);
                    responseSink.setAutoBlockSystemServices(
                        automaticServiceBlockingEnabled(policy));
                    writeRuntimeStatus(policy);
                    writeRuntimePolicyView(policy);
                    std::cerr << "RootGuard policy ricaricata: trusted-app="
                              << reloadedReport.trustedApplicationsLoaded
                              << " trusted="
                              << reloadedReport.trustedLoaded << " denied="
                              << reloadedReport.deniedLoaded << " protected="
                              << reloadedReport.protectedLoaded << '\n';
                    if (policy.eventLog != previousEventLog) {
                        std::cerr << "nota: una modifica di event_log richiede riavvio\n";
                    }
                } catch (const std::exception& error) {
                    std::cerr << "ricaricamento policy fallito; "
                              << (auditEntered
                                      ? "motore lasciato in audit: "
                                      : "impossibile garantire il passaggio in audit: ")
                              << error.what() << '\n';
                }
            }
        }
        std::filesystem::remove("/run/bastionguard-rootguard.status");
    } catch (const std::exception& error) {
        std::filesystem::remove("/run/bastionguard-rootguard.status");
        std::cerr << "RootGuard: " << error.what() << '\n';
        return EXIT_FAILURE;
    }
 
    return EXIT_SUCCESS;
}