Functions
std::string	trim (std::string value)
std::string	lower (std::string value)
std::string	unquote (std::string value)
bool	parseBool (const std::string &value, const std::size_t line)
Mode	parseMode (const std::string &value, const std::size_t line)
Action	parseAction (const std::string &value, const std::size_t line, const char *keyName)
std::uint32_t	parseUint32 (const std::string &value, const std::size_t line, const char *keyName)
std::string	normalizedPolicyPath (const std::filesystem::path &path)
void	validatePathList (const std::vector< PolicyPath > &entries, const char *label, std::set< std::string > &output)
void	validate (const Policy &policy)

Function Documentation

◆ lower()

std::string bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::lower ( std::string value )

Definition at line 28 of file PolicyLoader.cpp.

{
    std::transform(value.begin(), value.end(), value.begin(),
                   [](const unsigned char character) {
                       return static_cast<char>(std::tolower(character));
                   });
    return value;
}

References lower().

Referenced by lower(), parseAction(), parseBool(), and parseMode().

◆ normalizedPolicyPath()

std::string bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::normalizedPolicyPath ( const std::filesystem::path & path )

Definition at line 97 of file PolicyLoader.cpp.

{
    return path.lexically_normal().string();
}

References normalizedPolicyPath().

Referenced by normalizedPolicyPath(), and validatePathList().

◆ parseAction()

Action bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::parseAction	(	const std::string &	value,
		const std::size_t	line,
		const char *	keyName )

Definition at line 70 of file PolicyLoader.cpp.

{
    const std::string normalized = lower(trim(value));
    if (normalized == "audit")
        return Action::Audit;
    if (normalized == "block")
        return Action::Block;
    throw std::runtime_error(std::string(keyName) +
                             " non valida alla riga " +
                             std::to_string(line));
}

References bastionguard::rootguard::Audit, bastionguard::rootguard::Block, lower(), parseAction(), and trim().

Referenced by parseAction().

◆ parseBool()

bool bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::parseBool	(	const std::string &	value,
		const std::size_t	line )

Definition at line 48 of file PolicyLoader.cpp.

{
    const std::string normalized = lower(trim(value));
    if (normalized == "true" || normalized == "yes" || normalized == "1")
        return true;
    if (normalized == "false" || normalized == "no" || normalized == "0")
        return false;
    throw std::runtime_error("valore booleano non valido alla riga " +
                             std::to_string(line));
}

References lower(), parseBool(), and trim().

Referenced by parseBool().

◆ parseMode()

Mode bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::parseMode	(	const std::string &	value,
		const std::size_t	line )

Definition at line 59 of file PolicyLoader.cpp.

{
    const std::string normalized = lower(trim(value));
    if (normalized == "audit")
        return Mode::Audit;
    if (normalized == "enforce")
        return Mode::Enforce;
    throw std::runtime_error("modalità non valida alla riga " +
                             std::to_string(line));
}

References bastionguard::rootguard::Audit, bastionguard::rootguard::Enforce, lower(), parseMode(), and trim().

Referenced by parseMode().

◆ parseUint32()

std::uint32_t bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::parseUint32	(	const std::string &	value,
		const std::size_t	line,
		const char *	keyName )

Definition at line 83 of file PolicyLoader.cpp.

{
    std::size_t consumed = 0;
    const unsigned long parsed = std::stoul(value, &consumed, 10);
    if (consumed != value.size() ||
        parsed > std::numeric_limits<std::uint32_t>::max()) {
        throw std::runtime_error(std::string(keyName) +
                                 " non valido alla riga " +
                                 std::to_string(line));
    }
    return static_cast<std::uint32_t>(parsed);
}

References parseUint32().

Referenced by parseUint32().

◆ trim()

std::string bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::trim ( std::string value )

Definition at line 17 of file PolicyLoader.cpp.

{
    const auto notSpace = [](const unsigned char character) {
        return !std::isspace(character);
    };
 
    value.erase(value.begin(), std::find_if(value.begin(), value.end(), notSpace));
    value.erase(std::find_if(value.rbegin(), value.rend(), notSpace).base(), value.end());
    return value;
}

References trim().

Referenced by parseAction(), parseBool(), parseMode(), trim(), and unquote().

◆ unquote()

std::string bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::unquote ( std::string value )

Definition at line 37 of file PolicyLoader.cpp.

{
    value = trim(std::move(value));
    if (value.size() >= 2 &&
        ((value.front() == '"' && value.back() == '"') ||
         (value.front() == '\'' && value.back() == '\''))) {
        value = value.substr(1, value.size() - 2);
    }
    return value;
}

References trim(), and unquote().

Referenced by unquote().

◆ validate()

void bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::validate ( const Policy & policy )

Definition at line 116 of file PolicyLoader.cpp.

{
    if (policy.version != 2)
        throw std::runtime_error("versione policy non supportata: attesa 2");
 
    if (policy.integrityPollSeconds > 3600)
        throw std::runtime_error("integrity_poll_seconds deve essere compreso tra 0 e 3600");
 
    if (policy.globalMetadataSampleLimit > 64)
        throw std::runtime_error("global_metadata_sample_limit deve essere compreso tra 0 e 64");
    if (policy.metadataBurstThreshold < 8 || policy.metadataBurstThreshold > 100000)
        throw std::runtime_error("metadata_burst_threshold deve essere compreso tra 8 e 100000");
    if (policy.metadataBurstWindowMs < 250 || policy.metadataBurstWindowMs > 60000)
        throw std::runtime_error("metadata_burst_window_ms deve essere compreso tra 250 e 60000");
    if (policy.metadataBurstCooldownMs < policy.metadataBurstWindowMs ||
        policy.metadataBurstCooldownMs > 3600000)
        throw std::runtime_error("metadata_burst_cooldown_ms deve essere >= metadata_burst_window_ms e <= 3600000");
 
    if (policy.globalMetadataAction == Action::Block) {
        throw std::runtime_error(
            "global_metadata_action=block non e supportato: la sorveglianza globale "
            "deve restare audit-only per non bloccare la home utente; aggiungere gli "
            "oggetti di sistema a [protected-paths]");
    }
 
    if (policy.mode == Mode::Enforce &&
        (policy.unknownAction == Action::Block ||
         policy.credentialAnomalyAction == Action::Block) &&
        policy.trustedExecutables.empty()) {
        throw std::runtime_error(
            "enforcement con blocco delle elevazioni richiede almeno un eseguibile trusted");
    }
 
    std::set<std::string> trustedApplications;
    std::set<std::string> trusted;
    std::set<std::string> denied;
    std::set<std::string> protectedPaths;
    std::set<std::string> ignoredPaths;
    validatePathList(policy.trustedApplications, "trusted application", trustedApplications);
    validatePathList(policy.trustedExecutables, "trusted", trusted);
    validatePathList(policy.deniedExecutables, "denied", denied);
    validatePathList(policy.protectedPaths, "protected", protectedPaths);
    validatePathList(policy.ignoredPaths, "ignored", ignoredPaths);
 
    for (const auto& key : trusted) {
        if (denied.count(key) != 0)
            throw std::runtime_error("percorso presente sia in trusted sia in denied: " + key);
    }
    for (const auto& key : trustedApplications) {
        if (denied.count(key) != 0)
            throw std::runtime_error("applicazione presente sia in trusted-applications sia in denied: " + key);
    }
}

Referenced by validate().

◆ validatePathList()

void bastionguard::rootguard::anonymous_namespace{PolicyLoader.cpp}::validatePathList	(	const std::vector< PolicyPath > &	entries,
		const char *	label,
		std::set< std::string > &	output )

Definition at line 102 of file PolicyLoader.cpp.

{
    for (const auto& entry : entries) {
        if (entry.path.empty())
            throw std::runtime_error(std::string("percorso ") + label + " vuoto");
        const auto key = normalizedPolicyPath(entry.path);
        if (!output.insert(key).second)
            throw std::runtime_error(std::string("percorso ") + label +
                                     " duplicato: " + key);
    }
}

References normalizedPolicyPath(), and validatePathList().

Referenced by validate(), and validatePathList().

Functions