bastionguard::rootguard Namespace Reference

Namespaces
namespace	anonymous_namespace{AutomaticResponseSink.cpp}
namespace	anonymous_namespace{ConsoleEventSink.cpp}
namespace	anonymous_namespace{JsonEventSink.cpp}
namespace	anonymous_namespace{PolicyLoader.cpp}
namespace	anonymous_namespace{PolicySecurity.cpp}
namespace	anonymous_namespace{RootGuardEngine.cpp}
namespace	anonymous_namespace{SystemServiceControl.cpp}

Classes
class	AutomaticResponseSink
class	ConsoleEventSink
struct	FileIdentity
class	FileIdentityResolver
class	IEventSink
class	JsonEventSink
class	MultiEventSink
struct	Policy
struct	PolicyApplyReport
class	PolicyLoader
struct	PolicyPath
class	PolicySecurity
class	RootGuardEngine
struct	ServiceActionResult
struct	ServiceTarget

Enumerations
enum class	Mode : std::uint32_t { Audit = 0 , Enforce = 1 }
enum class	Action : std::uint32_t { Audit = 0 , Block = 1 }
enum class	InitSystem {   None , Systemd , OpenRC , Dinit ,   SysVInit }

Functions
const char *	toString (Mode mode) noexcept
const char *	toString (Action action) noexcept
InitSystem	detectInitSystem () noexcept
const char *	toString (InitSystem init) noexcept
std::optional< ServiceTarget >	identifySystemService (const std::filesystem::path &path) noexcept
ServiceActionResult	blockSystemService (const std::filesystem::path &path) noexcept
ServiceActionResult	unblockSystemService (const std::filesystem::path &path) noexcept

Enumeration Type Documentation

Action

enum class bastionguard::rootguard::Action : std::uint32_t

strong

Enumerator
Audit
Block

Definition at line 15 of file Policy.hpp.

                  : std::uint32_t {
    Audit = 0,
    Block = 1,
};

InitSystem

enum class bastionguard::rootguard::InitSystem

strong

Enumerator
None
Systemd
OpenRC
Dinit
SysVInit

Definition at line 10 of file SystemServiceControl.hpp.

                      {
    None,
    Systemd,
    OpenRC,
    Dinit,
    SysVInit,
};

Mode

enum class bastionguard::rootguard::Mode : std::uint32_t

strong

Enumerator
Audit
Enforce

Definition at line 10 of file Policy.hpp.

                : std::uint32_t {
    Audit = 0,
    Enforce = 1,
};

Function Documentation

blockSystemService()

ServiceActionResult bastionguard::rootguard::blockSystemService ( const std::filesystem::path & path )

nodiscardnoexcept

Definition at line 215 of file SystemServiceControl.cpp.

{
    const auto target = identifySystemService(path);
    if (!target)
        return {false, "The path is not a recognized system service definition."};
    if (target->name == "bastionguard-rootguard.service" ||
        target->name == "bastionguard-rootguard")
        return {false, "RootGuard refuses to block its own service."};
 
    std::vector<CommandResult> results;
    switch (target->init) {
    case InitSystem::Systemd: {
        const auto systemctl = firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"});
        if (systemctl.empty())
            return {false, "systemctl is unavailable."};
        results.push_back(runCommand({systemctl, "stop", target->name}));
        results.push_back(runCommand({systemctl, "mask", "--runtime", target->name}));
        break;
    }
    case InitSystem::OpenRC: {
        const auto rcService = firstExecutable({"/sbin/rc-service", "/usr/bin/rc-service"});
        if (rcService.empty())
            return {false, "rc-service is unavailable."};
        results.push_back(runCommand({rcService, target->name, "stop"}));
        break;
    }
    case InitSystem::Dinit: {
        const auto dinitctl = firstExecutable({"/usr/bin/dinitctl", "/bin/dinitctl"});
        if (dinitctl.empty())
            return {false, "dinitctl is unavailable."};
        results.push_back(runCommand({dinitctl, "stop", target->name}));
        break;
    }
    case InitSystem::SysVInit:
        results.push_back(runCommand({target->definition.string(), "stop"}));
        break;
    case InitSystem::None:
        return {false, "No supported init system was detected."};
    }
    return resultFrom("Blocked", *target, results);
}

References blockSystemService(), Dinit, identifySystemService(), None, OpenRC, Systemd, and SysVInit.

Referenced by blockSystemService(), main(), anonymous_namespace{ActionHelper.cpp}::quarantineFile(), and bastionguard::rootguard::AutomaticResponseSink::workerLoop().

detectInitSystem()

InitSystem bastionguard::rootguard::detectInitSystem ( )

nodiscardnoexcept

Definition at line 148 of file SystemServiceControl.cpp.

{
    try {
        if (std::filesystem::exists("/run/systemd/system") &&
            !firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"}).empty())
            return InitSystem::Systemd;
        if (!firstExecutable({"/sbin/openrc-run", "/usr/bin/openrc-run"}).empty() &&
            !firstExecutable({"/sbin/rc-service", "/usr/bin/rc-service"}).empty())
            return InitSystem::OpenRC;
        if (!firstExecutable({"/usr/bin/dinitctl", "/bin/dinitctl"}).empty())
            return InitSystem::Dinit;
        if (std::filesystem::exists("/etc/init.d"))
            return InitSystem::SysVInit;
    } catch (...) {
    }
    return InitSystem::None;
}

References detectInitSystem(), Dinit, None, OpenRC, Systemd, and SysVInit.

Referenced by detectInitSystem(), and identifySystemService().

identifySystemService()

std::optional< ServiceTarget > bastionguard::rootguard::identifySystemService ( const std::filesystem::path & path )

nodiscardnoexcept

Definition at line 179 of file SystemServiceControl.cpp.

{
    try {
        if (input.empty() || !input.is_absolute())
            return std::nullopt;
        const auto path = input.lexically_normal();
        const auto init = detectInitSystem();
 
        const bool systemdPath =
            startsWithPath(path, "/etc/systemd/system") ||
            startsWithPath(path, "/usr/lib/systemd/system") ||
            startsWithPath(path, "/lib/systemd/system");
        if (systemdPath && init == InitSystem::Systemd) {
            if (const auto unit = systemdUnitName(path))
                return ServiceTarget{InitSystem::Systemd, *unit, path};
        }
 
        if (startsWithPath(path, "/etc/conf.d") &&
            init == InitSystem::OpenRC && path.has_filename())
            return ServiceTarget{InitSystem::OpenRC, path.filename().string(), path};
 
        if (startsWithPath(path, "/etc/init.d") && path.has_filename()) {
            const auto detected = init == InitSystem::OpenRC
                ? InitSystem::OpenRC : InitSystem::SysVInit;
            return ServiceTarget{detected, path.filename().string(), path};
        }
 
        if ((startsWithPath(path, "/etc/dinit.d") ||
             startsWithPath(path, "/usr/lib/dinit.d")) &&
            init == InitSystem::Dinit && path.has_filename())
            return ServiceTarget{InitSystem::Dinit, path.filename().string(), path};
    } catch (...) {
    }
    return std::nullopt;
}

References detectInitSystem(), Dinit, identifySystemService(), OpenRC, Systemd, and SysVInit.

Referenced by blockSystemService(), identifySystemService(), main(), bastionguard::rootguard::AutomaticResponseSink::onEvent(), anonymous_namespace{ActionHelper.cpp}::quarantineFile(), and unblockSystemService().

toString() [1/3]

const char * bastionguard::rootguard::toString ( Action action )

nodiscardnoexcept

Definition at line 11 of file Policy.cpp.

{
    return action == Action::Block ? "block" : "audit";
}

References Block, and toString().

toString() [2/3]

const char * bastionguard::rootguard::toString ( InitSystem init )

nodiscardnoexcept

Definition at line 166 of file SystemServiceControl.cpp.

{
    switch (init) {
    case InitSystem::Systemd: return "systemd";
    case InitSystem::OpenRC: return "openrc";
    case InitSystem::Dinit: return "dinit";
    case InitSystem::SysVInit: return "sysvinit";
    case InitSystem::None: return "none";
    }
    return "none";
}

References Dinit, None, OpenRC, Systemd, SysVInit, and toString().

toString() [3/3]

const char * bastionguard::rootguard::toString ( Mode mode )

nodiscardnoexcept

Definition at line 6 of file Policy.cpp.

{
    return mode == Mode::Enforce ? "enforce" : "audit";
}

References Enforce, and toString().

Referenced by anonymous_namespace{main.cpp}::printPolicySummary(), bastionguard::rootguard::anonymous_namespace{SystemServiceControl.cpp}::resultFrom(), toString(), toString(), toString(), unblockSystemService(), and anonymous_namespace{main.cpp}::writeRuntimeStatus().

unblockSystemService()

ServiceActionResult bastionguard::rootguard::unblockSystemService ( const std::filesystem::path & path )

nodiscardnoexcept

Definition at line 257 of file SystemServiceControl.cpp.

{
    const auto target = identifySystemService(path);
    if (!target)
        return {true, "The path is not a system service definition."};
 
    std::vector<CommandResult> results;
    switch (target->init) {
    case InitSystem::Systemd: {
        const auto systemctl = firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"});
        if (systemctl.empty())
            return {false, "systemctl is unavailable."};
        results.push_back(runCommand({systemctl, "unmask", "--runtime", target->name}));
        break;
    }
    case InitSystem::OpenRC:
    case InitSystem::Dinit:
    case InitSystem::SysVInit:
        return {true, std::string("The service remains stopped; no runtime mask is used by ") +
                      toString(target->init) + "."};
    case InitSystem::None:
        return {false, "No supported init system was detected."};
    }
    return resultFrom("Unblocked", *target, results);
}

References Dinit, identifySystemService(), None, OpenRC, Systemd, SysVInit, toString(), and unblockSystemService().

Referenced by main(), anonymous_namespace{ActionHelper.cpp}::restoreFile(), and unblockSystemService().