bastionguard::rootguard::FileIdentityResolver Class Reference

#include <FileIdentity.hpp>

Static Public Member Functions
static __u64	kernelDeviceNumber (dev_t encodedDevice)
static FileIdentity	resolve (const std::filesystem::path &path, bool requireRegularFile, bool requireRootOwnedAndNotWritable)

Detailed Description

Definition at line 20 of file FileIdentity.hpp.

Member Function Documentation

kernelDeviceNumber()

__u64 bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber ( dev_t encodedDevice )

staticnodiscard

Definition at line 13 of file FileIdentity.cpp.

{
    constexpr std::uint64_t minorBits = 20U;
    constexpr std::uint64_t maxMajor = (1ULL << 12U) - 1ULL;
    constexpr std::uint64_t maxMinor = (1ULL << minorBits) - 1ULL;
 
    const auto deviceMajor = static_cast<std::uint64_t>(major(encodedDevice));
    const auto deviceMinor = static_cast<std::uint64_t>(minor(encodedDevice));
 
    if (deviceMajor > maxMajor || deviceMinor > maxMinor)
        throw std::runtime_error("numero di device non rappresentabile nel formato kernel dev_t");
 
    return static_cast<__u64>((deviceMajor << minorBits) | deviceMinor);
}

Referenced by bastionguard::rootguard::RootGuardEngine::enrichActorExecutable(), bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::identityMatches(), bastionguard::rootguard::RootGuardEngine::isTrustedApplicationEvent(), anonymous_namespace{ActionHelper.cpp}::logAction(), main(), anonymous_namespace{ActionHelper.cpp}::quarantineFile(), resolve(), anonymous_namespace{ActionHelper.cpp}::restoreFile(), and bastionguard::rootguard::RootGuardEngine::runIntegrityCheckIfDue().

resolve()

FileIdentity bastionguard::rootguard::FileIdentityResolver::resolve ( const std::filesystem::path & path, bool requireRegularFile, bool requireRootOwnedAndNotWritable )

staticnodiscard

Definition at line 28 of file FileIdentity.cpp.

{
    struct stat linkStatus {};
    if (::lstat(path.c_str(), &linkStatus) != 0)
        throw std::runtime_error(path.string() + ": " + std::strerror(errno));
 
    if (S_ISLNK(linkStatus.st_mode))
        throw std::runtime_error(path.string() + ": i link simbolici non sono ammessi nelle policy");
 
    struct stat status {};
    if (::stat(path.c_str(), &status) != 0)
        throw std::runtime_error(path.string() + ": " + std::strerror(errno));
 
    if (requireRegularFile && !S_ISREG(status.st_mode))
        throw std::runtime_error(path.string() + ": non è un file regolare");
 
    if (!S_ISREG(status.st_mode) && !S_ISDIR(status.st_mode))
        throw std::runtime_error(path.string() +
                                 ": sono supportati soltanto file regolari e directory");
 
    if (requireRootOwnedAndNotWritable) {
        if (status.st_uid != 0)
            throw std::runtime_error(path.string() + ": eseguibile trusted non appartenente a root");
        if ((status.st_mode & (S_IWGRP | S_IWOTH)) != 0)
            throw std::runtime_error(path.string() +
                                     ": eseguibile trusted scrivibile da gruppo o altri");
    }
 
    FileIdentity identity;
    /*
     * stat(2) exposes the userspace-encoded dev_t, while inode->i_sb->s_dev
     * in BPF uses the kernel-internal MKDEV(major, minor) layout.  Store the
     * latter so trusted/protected map lookups use exactly the same key.
     */
    identity.key.device = FileIdentityResolver::kernelDeviceNumber(status.st_dev);
    identity.key.inode = static_cast<__u64>(status.st_ino);
    identity.canonicalPath = std::filesystem::canonical(path);
    identity.mode = static_cast<std::uint32_t>(status.st_mode & 07777U);
    identity.uid = static_cast<std::uint32_t>(status.st_uid);
    identity.gid = static_cast<std::uint32_t>(status.st_gid);
    identity.regularFile = S_ISREG(status.st_mode);
    identity.directory = S_ISDIR(status.st_mode);
    return identity;
}

References bastionguard::rootguard::FileIdentity::canonicalPath, rg_file_key::device, bastionguard::rootguard::FileIdentity::directory, bastionguard::rootguard::FileIdentity::gid, rg_file_key::inode, kernelDeviceNumber(), bastionguard::rootguard::FileIdentity::key, bastionguard::rootguard::FileIdentity::mode, bastionguard::rootguard::FileIdentity::regularFile, S_IWGRP, S_IWOTH, and bastionguard::rootguard::FileIdentity::uid.

Referenced by bastionguard::rootguard::RootGuardEngine::applyPolicy().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/include/rootguard/FileIdentity.hpp
• BastionGuard/src/rootguard/src/FileIdentity.cpp