PolicyLoader.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/PolicyLoader.hpp"
#include "rootguard/PolicySecurity.hpp"
 
#include <algorithm>
#include <cctype>
#include <fstream>
#include <limits>
#include <set>
#include <sstream>
#include <stdexcept>
#include <string>
 
namespace bastionguard::rootguard {
namespace {
 
std::string trim(std::string value)
{
    const auto notSpace = [](const unsigned char character) {
        return !std::isspace(character);
    };
 
    value.erase(value.begin(), std::find_if(value.begin(), value.end(), notSpace));
    value.erase(std::find_if(value.rbegin(), value.rend(), notSpace).base(), value.end());
    return value;
}
 
std::string lower(std::string value)
{
    std::transform(value.begin(), value.end(), value.begin(),
                   [](const unsigned char character) {
                       return static_cast<char>(std::tolower(character));
                   });
    return value;
}
 
std::string unquote(std::string value)
{
    value = trim(std::move(value));
    if (value.size() >= 2 &&
        ((value.front() == '"' && value.back() == '"') ||
         (value.front() == '\'' && value.back() == '\''))) {
        value = value.substr(1, value.size() - 2);
    }
    return value;
}
 
bool parseBool(const std::string& value, const std::size_t line)
{
    const std::string normalized = lower(trim(value));
    if (normalized == "true" || normalized == "yes" || normalized == "1")
        return true;
    if (normalized == "false" || normalized == "no" || normalized == "0")
        return false;
    throw std::runtime_error("valore booleano non valido alla riga " +
                             std::to_string(line));
}
 
Mode parseMode(const std::string& value, const std::size_t line)
{
    const std::string normalized = lower(trim(value));
    if (normalized == "audit")
        return Mode::Audit;
    if (normalized == "enforce")
        return Mode::Enforce;
    throw std::runtime_error("modalità non valida alla riga " +
                             std::to_string(line));
}
 
Action parseAction(const std::string& value, const std::size_t line,
                   const char* keyName)
{
    const std::string normalized = lower(trim(value));
    if (normalized == "audit")
        return Action::Audit;
    if (normalized == "block")
        return Action::Block;
    throw std::runtime_error(std::string(keyName) +
                             " non valida alla riga " +
                             std::to_string(line));
}
 
std::uint32_t parseUint32(const std::string& value, const std::size_t line,
                          const char* keyName)
{
    std::size_t consumed = 0;
    const unsigned long parsed = std::stoul(value, &consumed, 10);
    if (consumed != value.size() ||
        parsed > std::numeric_limits<std::uint32_t>::max()) {
        throw std::runtime_error(std::string(keyName) +
                                 " non valido alla riga " +
                                 std::to_string(line));
    }
    return static_cast<std::uint32_t>(parsed);
}
 
std::string normalizedPolicyPath(const std::filesystem::path& path)
{
    return path.lexically_normal().string();
}
 
void validatePathList(const std::vector<PolicyPath>& entries,
                      const char* label,
                      std::set<std::string>& output)
{
    for (const auto& entry : entries) {
        if (entry.path.empty())
            throw std::runtime_error(std::string("percorso ") + label + " vuoto");
        const auto key = normalizedPolicyPath(entry.path);
        if (!output.insert(key).second)
            throw std::runtime_error(std::string("percorso ") + label +
                                     " duplicato: " + key);
    }
}
 
void validate(const Policy& policy)
{
    if (policy.version != 2)
        throw std::runtime_error("versione policy non supportata: attesa 2");
 
    if (policy.integrityPollSeconds > 3600)
        throw std::runtime_error("integrity_poll_seconds deve essere compreso tra 0 e 3600");
 
    if (policy.globalMetadataSampleLimit > 64)
        throw std::runtime_error("global_metadata_sample_limit deve essere compreso tra 0 e 64");
    if (policy.metadataBurstThreshold < 8 || policy.metadataBurstThreshold > 100000)
        throw std::runtime_error("metadata_burst_threshold deve essere compreso tra 8 e 100000");
    if (policy.metadataBurstWindowMs < 250 || policy.metadataBurstWindowMs > 60000)
        throw std::runtime_error("metadata_burst_window_ms deve essere compreso tra 250 e 60000");
    if (policy.metadataBurstCooldownMs < policy.metadataBurstWindowMs ||
        policy.metadataBurstCooldownMs > 3600000)
        throw std::runtime_error("metadata_burst_cooldown_ms deve essere >= metadata_burst_window_ms e <= 3600000");
 
    if (policy.globalMetadataAction == Action::Block) {
        throw std::runtime_error(
            "global_metadata_action=block non e supportato: la sorveglianza globale "
            "deve restare audit-only per non bloccare la home utente; aggiungere gli "
            "oggetti di sistema a [protected-paths]");
    }
 
    if (policy.mode == Mode::Enforce &&
        (policy.unknownAction == Action::Block ||
         policy.credentialAnomalyAction == Action::Block) &&
        policy.trustedExecutables.empty()) {
        throw std::runtime_error(
            "enforcement con blocco delle elevazioni richiede almeno un eseguibile trusted");
    }
 
    std::set<std::string> trustedApplications;
    std::set<std::string> trusted;
    std::set<std::string> denied;
    std::set<std::string> protectedPaths;
    std::set<std::string> ignoredPaths;
    validatePathList(policy.trustedApplications, "trusted application", trustedApplications);
    validatePathList(policy.trustedExecutables, "trusted", trusted);
    validatePathList(policy.deniedExecutables, "denied", denied);
    validatePathList(policy.protectedPaths, "protected", protectedPaths);
    validatePathList(policy.ignoredPaths, "ignored", ignoredPaths);
 
    for (const auto& key : trusted) {
        if (denied.count(key) != 0)
            throw std::runtime_error("percorso presente sia in trusted sia in denied: " + key);
    }
    for (const auto& key : trustedApplications) {
        if (denied.count(key) != 0)
            throw std::runtime_error("applicazione presente sia in trusted-applications sia in denied: " + key);
    }
}
 
} // namespace
 
Policy PolicyLoader::load(const std::filesystem::path& path)
{
    return loadFromText(PolicySecurity::read(path, false), path);
}
 
Policy PolicyLoader::loadFromText(const std::string& content,
                                  const std::filesystem::path& source)
{
    std::istringstream input(content);
    Policy policy;
    std::string section;
    std::string line;
    std::size_t lineNumber = 0;
    std::uint32_t nextRuleId = 1;
 
    while (std::getline(input, line)) {
        ++lineNumber;
        line = trim(std::move(line));
        if (line.empty() || line.front() == '#' || line.front() == ';')
            continue;
 
        if (line.front() == '[' && line.back() == ']') {
            section = lower(trim(line.substr(1, line.size() - 2)));
            continue;
        }
 
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            throw std::runtime_error("riga policy non valida: " +
                                     std::to_string(lineNumber));
 
        const std::string key = lower(trim(line.substr(0, separator)));
        const std::string value = unquote(line.substr(separator + 1));
 
        if (section == "engine") {
            if (key == "version") {
                policy.version = parseUint32(value, lineNumber, "version");
            } else if (key == "mode") {
                policy.mode = parseMode(value, lineNumber);
            } else if (key == "unknown_action") {
                policy.unknownAction = parseAction(value, lineNumber, "unknown_action");
            } else if (key == "metadata_action") {
                policy.metadataAction = parseAction(value, lineNumber, "metadata_action");
            } else if (key == "global_metadata_action") {
                policy.globalMetadataAction =
                    parseAction(value, lineNumber, "global_metadata_action");
            } else if (key == "credential_anomaly_action") {
                policy.credentialAnomalyAction =
                    parseAction(value, lineNumber, "credential_anomaly_action");
            } else if (key == "allow_missing_paths") {
                policy.allowMissingPaths = parseBool(value, lineNumber);
            } else if (key == "require_root_owned_trusted_executables") {
                policy.requireRootOwnedTrustedExecutables = parseBool(value, lineNumber);
            } else if (key == "protect_trusted_executables") {
                policy.protectTrustedExecutables = parseBool(value, lineNumber);
            } else if (key == "monitor_global_privilege_metadata") {
                policy.monitorGlobalPrivilegeMetadata = parseBool(value, lineNumber);
            } else if (key == "detect_global_metadata_bursts") {
                policy.detectGlobalMetadataBursts = parseBool(value, lineNumber);
            } else if (key == "global_metadata_sample_limit") {
                policy.globalMetadataSampleLimit = parseUint32(value, lineNumber, "global_metadata_sample_limit");
            } else if (key == "metadata_burst_threshold") {
                policy.metadataBurstThreshold = parseUint32(value, lineNumber, "metadata_burst_threshold");
            } else if (key == "metadata_burst_window_ms") {
                policy.metadataBurstWindowMs = parseUint32(value, lineNumber, "metadata_burst_window_ms");
            } else if (key == "metadata_burst_cooldown_ms") {
                policy.metadataBurstCooldownMs = parseUint32(value, lineNumber, "metadata_burst_cooldown_ms");
            } else if (key == "ignore_run_global_metadata") {
                policy.ignoreRunGlobalMetadata = parseBool(value, lineNumber);
            } else if (key == "log_trusted") {
                policy.logTrusted = parseBool(value, lineNumber);
            } else if (key == "auto_block_system_services") {
                policy.autoBlockSystemServices = parseBool(value, lineNumber);
            } else if (key == "block_user_home") {
                policy.blockUserHome = parseBool(value, lineNumber);
            } else if (key == "integrity_poll_seconds") {
                policy.integrityPollSeconds =
                    parseUint32(value, lineNumber, "integrity_poll_seconds");
            } else if (key == "event_log") {
                policy.eventLog = value;
            } else {
                throw std::runtime_error("chiave engine sconosciuta alla riga " +
                                         std::to_string(lineNumber) + ": " + key);
            }
        } else if (section == "trusted-applications" ||
                   section == "trusted-executables" ||
                   section == "denied-executables" ||
                   section == "protected-paths" ||
                   section == "ignored-paths") {
            const bool recursiveKey =
                key == "recursive_path" || key == "required_recursive_path";
            const bool regularKey = key == "path" || key == "required_path";
            if (!regularKey && !recursiveKey)
                throw std::runtime_error("chiave policy sconosciuta alla riga " +
                                         std::to_string(lineNumber) + ": " + key);
            if (recursiveKey &&
                section != "protected-paths" &&
                section != "ignored-paths") {
                throw std::runtime_error(
                    "le regole ricorsive sono ammesse soltanto in [protected-paths] "
                    "o [ignored-paths] alla riga " +
                    std::to_string(lineNumber));
            }
 
            const bool required =
                key == "required_path" || key == "required_recursive_path";
            PolicyPath entry{nextRuleId++, value, required, recursiveKey};
            if (section == "trusted-applications")
                policy.trustedApplications.push_back(std::move(entry));
            else if (section == "trusted-executables")
                policy.trustedExecutables.push_back(std::move(entry));
            else if (section == "denied-executables")
                policy.deniedExecutables.push_back(std::move(entry));
            else if (section == "protected-paths")
                policy.protectedPaths.push_back(std::move(entry));
            else
                policy.ignoredPaths.push_back(std::move(entry));
        } else {
            throw std::runtime_error("sezione policy mancante o sconosciuta alla riga " +
                                     std::to_string(lineNumber));
        }
    }
 
    try {
        validate(policy);
    } catch (const std::exception& error) {
        throw std::runtime_error(source.string() + ": " + error.what());
    }
    return policy;
}
 
} // namespace bastionguard::rootguard