bastionguard::rootguard::PolicyLoader Class Reference

#include <PolicyLoader.hpp>

Static Public Member Functions
static Policy	load (const std::filesystem::path &path)
static Policy	loadFromText (const std::string &content, const std::filesystem::path &source="<memory>")

Detailed Description

Definition at line 9 of file PolicyLoader.hpp.

Member Function Documentation

load()

Policy bastionguard::rootguard::PolicyLoader::load ( const std::filesystem::path & path )

staticnodiscard

Definition at line 172 of file PolicyLoader.cpp.

{
    return loadFromText(PolicySecurity::read(path, false), path);
}

References loadFromText(), and bastionguard::rootguard::PolicySecurity::read().

loadFromText()

Policy bastionguard::rootguard::PolicyLoader::loadFromText ( const std::string & content, const std::filesystem::path & source = "<memory>" )

staticnodiscard

Definition at line 177 of file PolicyLoader.cpp.

{
    std::istringstream input(content);
    Policy policy;
    std::string section;
    std::string line;
    std::size_t lineNumber = 0;
    std::uint32_t nextRuleId = 1;
 
    while (std::getline(input, line)) {
        ++lineNumber;
        line = trim(std::move(line));
        if (line.empty() || line.front() == '#' || line.front() == ';')
            continue;
 
        if (line.front() == '[' && line.back() == ']') {
            section = lower(trim(line.substr(1, line.size() - 2)));
            continue;
        }
 
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            throw std::runtime_error("riga policy non valida: " +
                                     std::to_string(lineNumber));
 
        const std::string key = lower(trim(line.substr(0, separator)));
        const std::string value = unquote(line.substr(separator + 1));
 
        if (section == "engine") {
            if (key == "version") {
                policy.version = parseUint32(value, lineNumber, "version");
            } else if (key == "mode") {
                policy.mode = parseMode(value, lineNumber);
            } else if (key == "unknown_action") {
                policy.unknownAction = parseAction(value, lineNumber, "unknown_action");
            } else if (key == "metadata_action") {
                policy.metadataAction = parseAction(value, lineNumber, "metadata_action");
            } else if (key == "global_metadata_action") {
                policy.globalMetadataAction =
                    parseAction(value, lineNumber, "global_metadata_action");
            } else if (key == "credential_anomaly_action") {
                policy.credentialAnomalyAction =
                    parseAction(value, lineNumber, "credential_anomaly_action");
            } else if (key == "allow_missing_paths") {
                policy.allowMissingPaths = parseBool(value, lineNumber);
            } else if (key == "require_root_owned_trusted_executables") {
                policy.requireRootOwnedTrustedExecutables = parseBool(value, lineNumber);
            } else if (key == "protect_trusted_executables") {
                policy.protectTrustedExecutables = parseBool(value, lineNumber);
            } else if (key == "monitor_global_privilege_metadata") {
                policy.monitorGlobalPrivilegeMetadata = parseBool(value, lineNumber);
            } else if (key == "detect_global_metadata_bursts") {
                policy.detectGlobalMetadataBursts = parseBool(value, lineNumber);
            } else if (key == "global_metadata_sample_limit") {
                policy.globalMetadataSampleLimit = parseUint32(value, lineNumber, "global_metadata_sample_limit");
            } else if (key == "metadata_burst_threshold") {
                policy.metadataBurstThreshold = parseUint32(value, lineNumber, "metadata_burst_threshold");
            } else if (key == "metadata_burst_window_ms") {
                policy.metadataBurstWindowMs = parseUint32(value, lineNumber, "metadata_burst_window_ms");
            } else if (key == "metadata_burst_cooldown_ms") {
                policy.metadataBurstCooldownMs = parseUint32(value, lineNumber, "metadata_burst_cooldown_ms");
            } else if (key == "ignore_run_global_metadata") {
                policy.ignoreRunGlobalMetadata = parseBool(value, lineNumber);
            } else if (key == "log_trusted") {
                policy.logTrusted = parseBool(value, lineNumber);
            } else if (key == "auto_block_system_services") {
                policy.autoBlockSystemServices = parseBool(value, lineNumber);
            } else if (key == "block_user_home") {
                policy.blockUserHome = parseBool(value, lineNumber);
            } else if (key == "integrity_poll_seconds") {
                policy.integrityPollSeconds =
                    parseUint32(value, lineNumber, "integrity_poll_seconds");
            } else if (key == "event_log") {
                policy.eventLog = value;
            } else {
                throw std::runtime_error("chiave engine sconosciuta alla riga " +
                                         std::to_string(lineNumber) + ": " + key);
            }
        } else if (section == "trusted-applications" ||
                   section == "trusted-executables" ||
                   section == "denied-executables" ||
                   section == "protected-paths" ||
                   section == "ignored-paths") {
            const bool recursiveKey =
                key == "recursive_path" || key == "required_recursive_path";
            const bool regularKey = key == "path" || key == "required_path";
            if (!regularKey && !recursiveKey)
                throw std::runtime_error("chiave policy sconosciuta alla riga " +
                                         std::to_string(lineNumber) + ": " + key);
            if (recursiveKey &&
                section != "protected-paths" &&
                section != "ignored-paths") {
                throw std::runtime_error(
                    "le regole ricorsive sono ammesse soltanto in [protected-paths] "
                    "o [ignored-paths] alla riga " +
                    std::to_string(lineNumber));
            }
 
            const bool required =
                key == "required_path" || key == "required_recursive_path";
            PolicyPath entry{nextRuleId++, value, required, recursiveKey};
            if (section == "trusted-applications")
                policy.trustedApplications.push_back(std::move(entry));
            else if (section == "trusted-executables")
                policy.trustedExecutables.push_back(std::move(entry));
            else if (section == "denied-executables")
                policy.deniedExecutables.push_back(std::move(entry));
            else if (section == "protected-paths")
                policy.protectedPaths.push_back(std::move(entry));
            else
                policy.ignoredPaths.push_back(std::move(entry));
        } else {
            throw std::runtime_error("sezione policy mancante o sconosciuta alla riga " +
                                     std::to_string(lineNumber));
        }
    }
 
    try {
        validate(policy);
    } catch (const std::exception& error) {
        throw std::runtime_error(source.string() + ": " + error.what());
    }
    return policy;
}

References bastionguard::rootguard::Policy::allowMissingPaths, bastionguard::rootguard::Policy::autoBlockSystemServices, bastionguard::rootguard::Policy::blockUserHome, bastionguard::rootguard::Policy::credentialAnomalyAction, bastionguard::rootguard::Policy::deniedExecutables, bastionguard::rootguard::Policy::detectGlobalMetadataBursts, bastionguard::rootguard::Policy::eventLog, bastionguard::rootguard::Policy::globalMetadataAction, bastionguard::rootguard::Policy::globalMetadataSampleLimit, bastionguard::rootguard::Policy::ignoredPaths, bastionguard::rootguard::Policy::ignoreRunGlobalMetadata, bastionguard::rootguard::Policy::integrityPollSeconds, bastionguard::rootguard::Policy::logTrusted, bastionguard::rootguard::Policy::metadataAction, bastionguard::rootguard::Policy::metadataBurstCooldownMs, bastionguard::rootguard::Policy::metadataBurstThreshold, bastionguard::rootguard::Policy::metadataBurstWindowMs, bastionguard::rootguard::Policy::mode, bastionguard::rootguard::Policy::monitorGlobalPrivilegeMetadata, bastionguard::rootguard::Policy::protectedPaths, bastionguard::rootguard::Policy::protectTrustedExecutables, bastionguard::rootguard::Policy::requireRootOwnedTrustedExecutables, bastionguard::rootguard::Policy::trustedApplications, bastionguard::rootguard::Policy::trustedExecutables, bastionguard::rootguard::Policy::unknownAction, and bastionguard::rootguard::Policy::version.

Referenced by load(), anonymous_namespace{ActionHelper.cpp}::loadPolicy(), anonymous_namespace{main.cpp}::loadPolicy(), and anonymous_namespace{ActionHelper.cpp}::writePolicyAtomically().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/include/rootguard/PolicyLoader.hpp
• BastionGuard/src/rootguard/src/PolicyLoader.cpp