BastionGuard-privacyd.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include <filesystem>
#include <fstream>
#include <iostream>
#include <thread>
#include <set>
#include <atomic>
#include <mutex>
#include <csignal>
#include <algorithm>
#include <chrono>
#include <vector>
#include <clocale>
#include <glibmm/miscutils.h>
#include <glibmm/i18n.h>
 
namespace fs = std::filesystem;
static std::atomic<bool> running{true};
static std::mutex log_mutex;
 
void write_log(const std::string& msg) {
    std::thread([msg]() {
        try {
            std::lock_guard<std::mutex> lock(log_mutex);
            std::string base_dir = Glib::get_home_dir() + "/.local/share/BastionGuard/logs";
            if (!fs::exists(base_dir))
                fs::create_directories(base_dir);
 
 
            auto t = std::time(nullptr);
            std::tm tm{};
            localtime_r(&t, &tm);  // thread-safe
            char datebuf[16];
            std::strftime(datebuf, sizeof(datebuf), "%Y-%m-%d", &tm);
            std::string log_path = base_dir + "/privacyd_" + std::string(datebuf) + ".log";
 
 
            std::ofstream f(log_path, std::ios::app);
            if (!f.is_open()) return;
 
            char timebuf[32];
            std::strftime(timebuf, sizeof(timebuf), "%H:%M:%S", &tm);
            f << "[" << timebuf << "] " << msg << std::endl;
 
 
            const auto now = std::chrono::system_clock::now();
            const auto seven_days = std::chrono::hours(24 * 7);
 
            for (const auto& entry : fs::directory_iterator(base_dir)) {
                if (entry.is_regular_file()) {
                    auto ftime = fs::last_write_time(entry);
                    auto sctp = std::chrono::time_point_cast<std::chrono::system_clock::duration>(
                        ftime - fs::file_time_type::clock::now()
                        + std::chrono::system_clock::now());
                    auto age = now - sctp;
 
                    if (age > seven_days) {
                        try {
                            fs::remove(entry.path());
                        } catch (...) {
 
                        }
                    }
                }
            }
        } catch (...) {
            std::cerr << _("[privacyd] Errore scrittura log.") << std::endl;
        }
    }).detach();
}
 
 
std::vector<std::string> detect_active_devices() {
    std::vector<std::string> result;
    const std::vector<std::string> prefixes = {"/dev/video", "/dev/snd/pcm"};
 
    // /proc è race-y: i PID possono sparire in qualsiasi momento tra open e iter.
    // Usiamo l'overload con std::error_code per non lanciare eccezioni
    // (altrimenti std::terminate nel thread monitor_loop -> SIGABRT).
    std::error_code ec;
    fs::directory_iterator proc_it("/proc", ec);
    if (ec) return result;
 
    for (; proc_it != fs::directory_iterator(); proc_it.increment(ec)) {
        if (ec) break; // PID scomparso mentre iteravamo
 
        const auto& pid_entry = *proc_it;
        std::error_code ec_dir;
        if (!pid_entry.is_directory(ec_dir) || ec_dir) continue;
 
        const std::string pid_str = pid_entry.path().filename();
        if (!std::all_of(pid_str.begin(), pid_str.end(), ::isdigit)) continue;
 
        const std::string fd_path = "/proc/" + pid_str + "/fd";
        std::error_code ec_exists;
        if (!fs::exists(fd_path, ec_exists) || ec_exists) continue;
 
        std::error_code ec_fd;
        fs::directory_iterator fd_it(
            fd_path,
            fs::directory_options::skip_permission_denied,
            ec_fd);
        if (ec_fd) continue;
 
        for (; fd_it != fs::directory_iterator(); fd_it.increment(ec_fd)) {
            if (ec_fd) break; // processo terminato mentre iteravamo gli fd
 
            const auto& fd_entry = *fd_it;
            std::error_code ec_link;
            auto link = fs::read_symlink(fd_entry.path(), ec_link);
            if (ec_link) continue;
            const std::string target = link.string();
 
            for (const auto& prefix : prefixes) {
                if (target.find(prefix) == 0) {
                    std::ifstream comm("/proc/" + pid_str + "/comm");
                    std::string name;
                    std::getline(comm, name);
                    if (name.empty()) name = "(sconosciuto)";
                    result.push_back(name + " (PID=" + pid_str + ")");
                    break;
                }
            }
        }
    }
 
    std::sort(result.begin(), result.end());
    result.erase(std::unique(result.begin(), result.end()), result.end());
    return result;
}
 
 
void monitor_loop() {
    std::set<std::string> known;
    write_log(_("[privacyd] Avviato monitoraggio webcam/microfono."));
 
    while (running) {
        try {
            auto active = detect_active_devices();
 
            for (const auto& proc : active) {
                if (!known.count(proc)) {
                    known.insert(proc);
                    write_log(_("Nuovo accesso: ") + proc);
                }
            }
 
            for (auto it = known.begin(); it != known.end();) {
                if (std::find(active.begin(), active.end(), *it) == active.end()) {
                    write_log(
                        Glib::ustring::compose(
                            _("Accesso terminato: %1"),
                            *it
                        )
                    );
                    it = known.erase(it);
                } else ++it;
            }
        } catch (const std::exception& e) {
            // Difesa in profondità: qualsiasi eccezione non catturata qui
            // ucciderebbe il daemon.
            try { write_log(std::string("[privacyd] Errore monitor_loop: ") + e.what()); }
            catch (...) {}
        } catch (...) {
            try { write_log("[privacyd] Errore sconosciuto in monitor_loop"); }
            catch (...) {}
        }
 
        std::this_thread::sleep_for(std::chrono::seconds(3));
    }
 
    write_log(_("[privacyd] Monitoraggio terminato."));
}
 
 
void handle_signal(int) { running = false; }
 
int main(int argc, char** argv) {
    setlocale(LC_ALL, "");
    bindtextdomain("BastionGuard", LOCALEDIR);
    bind_textdomain_codeset("BastionGuard", "UTF-8");
    textdomain("BastionGuard");
 
    std::signal(SIGINT, handle_signal);
    std::signal(SIGTERM, handle_signal);
 
    write_log(_("=== Avvio BastionGuard-privacyd (headless) ==="));
 
    std::thread monitor(monitor_loop);
    while (running)
        std::this_thread::sleep_for(std::chrono::seconds(1));
 
    if (monitor.joinable()) monitor.join();
 
    write_log(_("=== Arresto BastionGuard-privacyd ==="));
    return 0;
}