AurScan.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "AurScan.hpp"
#include <fstream>
#include <filesystem>
#include <giomm.h>
#include <iostream>
#include <unordered_set>
#include <glibmm/i18n.h>
 
namespace AurScan {
 
namespace fs = std::filesystem;
 
static std::function<void(const std::string&)> logFunc;
static std::function<void(const std::string&)> pkgbuildDetectedFunc;
 
static std::vector<Glib::RefPtr<Gio::FileMonitor>> aurMonitors;
 
 
 
bool isArchBased() {
    std::ifstream f("/etc/os-release");
    if (!f.is_open()) return false;
 
    std::string line;
    while (std::getline(f, line)) {
        if (line.find("ID=") == 0 || line.find("ID_LIKE=") == 0) {
            if (line.find("arch") != std::string::npos ||
                line.find("manjaro") != std::string::npos ||
                line.find("endeavouros") != std::string::npos ||
                line.find("arco") != std::string::npos)
                return true;
        }
    }
    return false;
}
 
 
void initialize(
    std::function<void(const std::string&)> logCallback,
    std::function<void(const std::string&)> pkgbuildDetectedCallback)
{
    logFunc = logCallback;
    pkgbuildDetectedFunc = pkgbuildDetectedCallback;
 
    if (logFunc)
        logFunc(_("📦 AurScan inizializzato"));
}
 
 
static bool ends_with(const std::string& s, const std::string& suf) {
    return s.size() >= suf.size() &&
           s.compare(s.size() - suf.size(), suf.size(), suf) == 0;
}
 
 
static std::unordered_set<std::string> recentDetections;
 
static bool isRecentlyDetected(const std::string& path) {
    if (recentDetections.count(path))
        return true;
 
    recentDetections.insert(path);
 
    // Rimuove dopo 1 secondo
    Glib::signal_timeout().connect_once([path]() {
        recentDetections.erase(path);
    }, 1000);
 
    return false;
}
 
 
static void addMonitorRecursively(const std::string& base)
{
    if (!fs::exists(base)) return;
 
 
    const std::vector<std::string> skipDirs = {
        ".git", ".svn", ".hg", "pkg", "src"
    };
 
    auto basename = fs::path(base).filename().string();
    for (const auto& skip : skipDirs) {
        if (basename == skip)
            return;
    }
 
 
    auto gfile = Gio::File::create_for_path(base);
    auto monitor = gfile->monitor_directory(
        Gio::FileMonitorFlags::WATCH_MOVES |
        Gio::FileMonitorFlags::SEND_MOVED
    );
 
    monitor->signal_changed().connect(
        [base](const Glib::RefPtr<Gio::File>& file,
               const Glib::RefPtr<Gio::File>&,
               Gio::FileMonitor::Event e)
    {
        std::string path = file->get_path();
        if (path.empty()) return;
 
        // Eventi rilevanti
        if (e != Gio::FileMonitor::Event::CREATED &&
            e != Gio::FileMonitor::Event::MOVED_IN &&
            e != Gio::FileMonitor::Event::CHANGES_DONE_HINT)
            return;
 
 
        if (ends_with(path, "PKGBUILD")) {
 
            //
            if (isRecentlyDetected(path))
                return;
 
            if (logFunc)
                logFunc(_("📦 PKGBUILD rilevato: ") + path);
 
            if (pkgbuildDetectedFunc)
                pkgbuildDetectedFunc(path);
        }
    });
 
    aurMonitors.push_back(monitor);
 
    if (logFunc)
        logFunc(_("📁 Monitor AUR attivo su: ") + base);
 
 
    try {
        for (auto it = fs::directory_iterator(
                 base,
                 fs::directory_options::skip_permission_denied);
             it != fs::directory_iterator();
             ++it)
        {
            try {
                if (it->is_directory())
                    addMonitorRecursively(it->path().string());
            }
            catch (...) {
 
                continue;
            }
        }
    }
    catch (...) {
    }
}
 
 
 
static void addDynamicRootMonitor(const std::string& root)
{
    if (!fs::exists(root)) return;
 
    auto gfile = Gio::File::create_for_path(root);
    auto monitor = gfile->monitor_directory(Gio::FileMonitorFlags::WATCH_MOVES);
 
    monitor->signal_changed().connect(
        [root](const Glib::RefPtr<Gio::File>& file,
               const Glib::RefPtr<Gio::File>&,
               Gio::FileMonitor::Event e)
    {
        std::string path = file->get_path();
        if (path.empty()) return;
 
 
        if (e == Gio::FileMonitor::Event::CREATED ||
            e == Gio::FileMonitor::Event::MOVED_IN)
        {
            try {
                if (fs::is_directory(path)) {
 
                    if (logFunc)
                        logFunc(_("🆕 Nuova directory AUR trovata: ") + path);
 
 
                    addMonitorRecursively(path);
                }
            }
            catch (...) {
            }
        }
    });
 
    aurMonitors.push_back(monitor);
 
    if (logFunc)
        logFunc(_("🌱 Monitor root AUR attivo su: ") + root);
}
 
void startMonitoring() {
    if (!isArchBased()) {
        if (logFunc)
            logFunc(_("🐧 Sistema non Arch-based — AUR disattivato"));
        return;
    }
 
    if (logFunc)
        logFunc(_("📡 Avvio monitor AUR…"));
 
    std::vector<std::string> targets = {
        Glib::get_home_dir() + "/.cache/yay",
        Glib::get_home_dir() + "/.cache/paru/clone",
        Glib::get_home_dir() + "/.cache/trizen",
        Glib::get_home_dir() + "/.cache/pikaur/build"
    };
 
    for (auto& d : targets) {
        if (!fs::exists(d)) continue;
 
 
        addDynamicRootMonitor(d);
 
 
        addMonitorRecursively(d);
    }
 
    if (logFunc)
        logFunc(_("✅ AurScan avviato"));
}
 
 
 
void stopMonitoring() {
    for (auto& m : aurMonitors) {
        try { m->cancel(); }
        catch (...) {}
    }
    aurMonitors.clear();
 
    if (logFunc)
        logFunc(_("🛑 AurScan disattivato"));
}
 
 
void scanPKGBUILD(const std::string& path) {
    if (!fs::exists(path)) {
        if (logFunc) logFunc(_("❌ PKGBUILD non trovato: ") + path);
        return;
    }
 
    std::ifstream file(path);
    if (!file.is_open()) {
        if (logFunc) logFunc(_("❌ Impossibile leggere PKGBUILD: ") + path);
        return;
    }
 
    if (logFunc)
        logFunc(_("🔎 Analisi sicurezza PKGBUILD: ") + path);
 
    std::string line;
    int lineNum = 0;
    bool suspicious = false;
 
 
    auto isDependencyLine = [](const std::string& l) {
        return l.find("depends=(") != std::string::npos ||
               l.find("makedepends=(") != std::string::npos ||
               l.find("optdepends=(") != std::string::npos ||
               l.find("checkdepends=(") != std::string::npos ||
               l.find("provides=(") != std::string::npos ||
               l.find("conflicts=(") != std::string::npos;
    };
 
 
    const std::vector<std::pair<std::string, std::string>> patterns = {
        {"curl ",           _("Uso di curl come comando")},
        {"curl|",           _("Curl pipato verso shell — RCE")},
        {"curl |",          _("Curl pipato verso shell — RCE")},
        {"wget ",           _("Uso di wget come comando")},
        {"wget|",           _("Wget pipato verso shell — RCE")},
        {"wget |",          _("Wget pipato verso shell — RCE")},
        {"bash -c",         _("Esecuzione dinamica tramite bash -c")},
        {"chmod 777",       _("Permessi 777 pericolosi")},
        {"rm -rf",          _("Comando distruttivo rm -rf")},
        {"sudo ",           _("Uso improprio di sudo nel PKGBUILD")},
        {"| sh",            _("Pipe verso sh — RCE")},
        {"| bash",          _("Pipe verso bash — RCE")},
        {"base64 -d",       _("Possibile payload codificato e decodificato")},
        {"install -m 777",  _("Install con permessi insicuri")},
        {"/etc/",           _("Scrittura sospetta in /etc")},
        {"/usr/bin",        _("Scrittura diretta in /usr/bin")},
        {"python3 -c",      _("Exec dinamico con python")},
        {"System.exec",     _("Exec arbitrario")}
    };
 
 
    while (std::getline(file, line)) {
        lineNum++;
 
        if (isDependencyLine(line))
            continue;
 
        for (const auto& [needle, desc] : patterns) {
            if (line.find(needle) != std::string::npos) {
                suspicious = true;
                if (logFunc) {
                    logFunc("⚠️  [" + std::to_string(lineNum) + "] " + desc);
                    logFunc("     → " + line);
                }
            }
        }
    }
 
    if (suspicious) {
        if (logFunc)
            logFunc(_("🚨 Minacce individuate nel PKGBUILD!"));
 
        if (pkgbuildDetectedFunc)
            pkgbuildDetectedFunc("INFECTED://" + path);
 
    } else {
        if (logFunc)
            logFunc(_("✅ PKGBUILD pulito."));
    }
}
 
 
 
} // namespace AurScan