Classes
struct	Options

Functions
void	handleStopSignal (int) noexcept
void	handleReloadSignal (int) noexcept
void	printUsage (const char *executable)
Options	parseOptions (const int argc, char *argv[])
bastionguard::rootguard::Policy	loadPolicy (const Options &options)
void	writeRuntimeStatus (const bastionguard::rootguard::Policy &policy)
void	writeRuntimePolicyView (const bastionguard::rootguard::Policy &policy)
bastionguard::rootguard::Policy	auditRuntimePolicy (bastionguard::rootguard::Policy policy)
void	printPolicySummary (const bastionguard::rootguard::Policy &policy)
bool	is_flag (const std::string &arg, const std::string &long_name, const std::string &short_name={})
int	clamp_log_level (int lvl)

Variables
volatile std::sig_atomic_t	gStopRequested = 0
volatile std::sig_atomic_t	gReloadRequested = 0

Function Documentation

◆ auditRuntimePolicy()

bastionguard::rootguard::Policy anonymous_namespace{main.cpp}::auditRuntimePolicy ( bastionguard::rootguard::Policy policy )

Definition at line 149 of file main.cpp.

{
    using namespace bastionguard::rootguard;
    policy.mode = Mode::Audit;
    policy.metadataAction = Action::Audit;
    policy.globalMetadataAction = Action::Audit;
    policy.unknownAction = Action::Audit;
    policy.credentialAnomalyAction = Action::Audit;
    return policy;
}

References bastionguard::rootguard::Audit, auditRuntimePolicy(), bastionguard::rootguard::Policy::credentialAnomalyAction, bastionguard::rootguard::Policy::globalMetadataAction, bastionguard::rootguard::Policy::metadataAction, bastionguard::rootguard::Policy::mode, and bastionguard::rootguard::Policy::unknownAction.

Referenced by auditRuntimePolicy(), and main().

◆ clamp_log_level()

int anonymous_namespace{main.cpp}::clamp_log_level ( int lvl )

Definition at line 22 of file main.cpp.

                             {
    if (lvl <= 0) return 0;
    if (lvl >= 3) return 3;
    return lvl;
}

References clamp_log_level().

Referenced by clamp_log_level(), and main().

◆ handleReloadSignal()

void anonymous_namespace{main.cpp}::handleReloadSignal ( int )

noexcept

Definition at line 34 of file main.cpp.

{
    gReloadRequested = 1;
}

References gReloadRequested, and handleReloadSignal().

Referenced by handleReloadSignal(), and main().

◆ handleStopSignal()

void anonymous_namespace{main.cpp}::handleStopSignal ( int )

noexcept

Definition at line 29 of file main.cpp.

{
    gStopRequested = 1;
}

References gStopRequested, and handleStopSignal().

Referenced by handleStopSignal(), and main().

◆ is_flag()

bool anonymous_namespace{main.cpp}::is_flag	(	const std::string &	arg,
		const std::string &	long_name,
		const std::string &	short_name = {} )

Definition at line 18 of file main.cpp.

                                                                                           {}) {
    return arg == long_name || (!short_name.empty() && arg == short_name);
}

References is_flag().

Referenced by is_flag(), and main().

◆ loadPolicy()

bastionguard::rootguard::Policy anonymous_namespace{main.cpp}::loadPolicy ( const Options & options )

Definition at line 76 of file main.cpp.

{
    using namespace bastionguard::rootguard;
 
    const std::string content = PolicySecurity::read(
        options.policyPath, !options.allowUnsafePolicy);
    Policy policy = PolicyLoader::loadFromText(content, options.policyPath);
    if (options.modeOverride)
        policy.mode = *options.modeOverride;
    return policy;
}

References anonymous_namespace{main.cpp}::Options::allowUnsafePolicy, bastionguard::rootguard::PolicyLoader::loadFromText(), loadPolicy(), bastionguard::rootguard::Policy::mode, anonymous_namespace{main.cpp}::Options::modeOverride, anonymous_namespace{main.cpp}::Options::policyPath, and bastionguard::rootguard::PolicySecurity::read().

Referenced by loadPolicy(), and main().

◆ parseOptions()

Options anonymous_namespace{main.cpp}::parseOptions	(	const int	argc,
		char *	argv[] )

Definition at line 53 of file main.cpp.

{
    Options options;
    for (int index = 1; index < argc; ++index) {
        const std::string_view argument(argv[index]);
        if (argument == "--policy" && index + 1 < argc) {
            options.policyPath = argv[++index];
        } else if (argument == "--audit") {
            options.modeOverride = bastionguard::rootguard::Mode::Audit;
        } else if (argument == "--enforce") {
            options.modeOverride = bastionguard::rootguard::Mode::Enforce;
        } else if (argument == "--allow-unsafe-policy") {
            options.allowUnsafePolicy = true;
        } else if (argument == "--check-policy") {
            options.checkOnly = true;
        } else {
            printUsage(argv[0]);
            throw std::invalid_argument("argomento non riconosciuto");
        }
    }
    return options;
}

References anonymous_namespace{main.cpp}::Options::allowUnsafePolicy, bastionguard::rootguard::Audit, anonymous_namespace{main.cpp}::Options::checkOnly, bastionguard::rootguard::Enforce, anonymous_namespace{main.cpp}::Options::modeOverride, parseOptions(), anonymous_namespace{main.cpp}::Options::policyPath, and printUsage().

Referenced by main(), and parseOptions().

◆ printPolicySummary()

void anonymous_namespace{main.cpp}::printPolicySummary ( const bastionguard::rootguard::Policy & policy )

Definition at line 161 of file main.cpp.

{
    using namespace bastionguard::rootguard;
    std::cerr << "RootGuard policy: mode=" << toString(policy.mode)
              << " unknown_action=" << toString(policy.unknownAction)
              << " metadata_action=" << toString(policy.metadataAction)
              << " global_metadata_action=" << toString(policy.globalMetadataAction)
              << " credential_action=" << toString(policy.credentialAnomalyAction)
              << " auto_block_services=" << (policy.autoBlockSystemServices ? "true" : "false")
              << " block_user_home=" << (policy.blockUserHome ? "true" : "false")
              << " global_metadata=" << (policy.monitorGlobalPrivilegeMetadata ? "true" : "false")
              << " metadata_bursts=" << (policy.detectGlobalMetadataBursts ? "true" : "false")
              << " sample_limit=" << policy.globalMetadataSampleLimit
              << " burst_threshold=" << policy.metadataBurstThreshold
              << " trusted_apps=" << policy.trustedApplications.size()
              << " trusted=" << policy.trustedExecutables.size()
              << " denied=" << policy.deniedExecutables.size()
              << " protected=" << policy.protectedPaths.size()
              << " ignored=" << policy.ignoredPaths.size() << '\n';
}

Referenced by main(), and printPolicySummary().

◆ printUsage()

void anonymous_namespace{main.cpp}::printUsage ( const char * executable )

Definition at line 46 of file main.cpp.

{
    std::cerr << "uso: " << executable
              << " [--policy FILE] [--audit|--enforce]"
                 " [--allow-unsafe-policy] [--check-policy]\n";
}

References printUsage().

Referenced by parseOptions(), and printUsage().

◆ writeRuntimePolicyView()

void anonymous_namespace{main.cpp}::writeRuntimePolicyView ( const bastionguard::rootguard::Policy & policy )

Definition at line 114 of file main.cpp.

{
    const std::filesystem::path path{"/run/bastionguard-rootguard.policy-view"};
    const std::filesystem::path temporary = path.string() + ".tmp." +
                                            std::to_string(::getpid());
    std::ofstream output(temporary, std::ios::trunc);
    if (!output)
        return;
    output << "block_user_home=" << (policy.blockUserHome ? "true" : "false") << '\n'
           << "monitor_global_privilege_metadata=" << (policy.monitorGlobalPrivilegeMetadata ? "true" : "false") << '\n'
           << "detect_global_metadata_bursts=" << (policy.detectGlobalMetadataBursts ? "true" : "false") << '\n'
           << "global_metadata_sample_limit=" << policy.globalMetadataSampleLimit << '\n'
           << "metadata_burst_threshold=" << policy.metadataBurstThreshold << '\n'
           << "metadata_burst_window_ms=" << policy.metadataBurstWindowMs << '\n'
           << "metadata_burst_cooldown_ms=" << policy.metadataBurstCooldownMs << '\n';
    for (const auto& rule : policy.trustedApplications)
        output << "trusted_application=" << rule.path.string() << '\n';
    for (const auto& rule : policy.trustedExecutables)
        output << "trusted_executable=" << rule.path.string() << '\n';
    for (const auto& rule : policy.deniedExecutables)
        output << "denied_executable=" << rule.path.string() << '\n';
    for (const auto& rule : policy.protectedPaths)
        output << (rule.recursive ? "protected_recursive=" : "protected_path=")
               << rule.path.string() << '\n';
    for (const auto& rule : policy.ignoredPaths)
        output << (rule.recursive ? "ignored_recursive=" : "ignored_path=")
               << rule.path.string() << '\n';
    output.close();
    if (!output)
        return;
    ::chmod(temporary.c_str(), 0644);
    if (::rename(temporary.c_str(), path.c_str()) != 0)
        std::filesystem::remove(temporary);
}

Referenced by main(), and writeRuntimePolicyView().

◆ writeRuntimeStatus()

void anonymous_namespace{main.cpp}::writeRuntimeStatus ( const bastionguard::rootguard::Policy & policy )

Definition at line 88 of file main.cpp.

{
    using namespace bastionguard::rootguard;
    const std::filesystem::path path{"/run/bastionguard-rootguard.status"};
    const std::filesystem::path temporary = path.string() + ".tmp." +
                                            std::to_string(::getpid());
    std::ofstream output(temporary, std::ios::trunc);
    if (!output)
        return;
    const bool effectiveServiceBlocking = policy.autoBlockSystemServices &&
        policy.mode == Mode::Enforce &&
        policy.metadataAction == Action::Block;
    output << "mode=" << toString(policy.mode) << '\n'
           << "metadata_action=" << toString(policy.metadataAction) << '\n'
           << "global_metadata_action=" << toString(policy.globalMetadataAction) << '\n'
           << "auto_block_services="
           << (effectiveServiceBlocking ? "true" : "false") << '\n'
           << "block_user_home=" << (policy.blockUserHome ? "true" : "false") << '\n';
    output.close();
    if (!output)
        return;
    ::chmod(temporary.c_str(), 0644);
    if (::rename(temporary.c_str(), path.c_str()) != 0)
        std::filesystem::remove(temporary);
}

References bastionguard::rootguard::Policy::autoBlockSystemServices, bastionguard::rootguard::Block, bastionguard::rootguard::Policy::blockUserHome, bastionguard::rootguard::Enforce, bastionguard::rootguard::Policy::globalMetadataAction, bastionguard::rootguard::Policy::metadataAction, bastionguard::rootguard::Policy::mode, bastionguard::rootguard::toString(), and writeRuntimeStatus().

Referenced by main(), and writeRuntimeStatus().

Variable Documentation

◆ gReloadRequested

volatile std::sig_atomic_t anonymous_namespace{main.cpp}::gReloadRequested = 0

Definition at line 27 of file main.cpp.