anonymous_namespace{ActionHelper.cpp} Namespace Reference

Classes
struct	Options

Functions
void	fail (const std::string &message)
std::uint64_t	parseUnsigned (const std::string &value, const char *label, const int base=10)
Options	parseOptions (const int argc, char *argv[])
bool	pathStartsWith (const fs::path &path, const fs::path &prefix)
fs::path	normalizedAbsolute (const fs::path &path)
bool	isIgnoredPath (const Policy &policy, const fs::path &requested)
bool	isProtectedPath (const Policy &policy, const fs::path &requested)
void	requireProtectedPath (const Policy &policy, const fs::path &path)
std::string	timestamp ()
void	copyString (char *destination, const std::size_t size, const std::string &source)
void	logAction (const Policy &policy, const fs::path &path, const std::uint32_t eventType, const std::uint32_t verdict, const struct stat *before=nullptr, const struct stat *after=nullptr)
Policy	loadPolicy (const fs::path &path)
std::string	trim (std::string value)
void	rewriteProtectionPolicy (const fs::path &policyPath, const bool enabled)
std::vector< fs::path >	normalizeApplicationEntries (const std::vector< fs::path > &entries, const char *label)
void	writePolicyAtomically (const fs::path &policyPath, const std::vector< std::string > &lines, const struct stat &metadata)
void	rewriteApplicationRules (const Options &options)
void	restoreFile (const Options &options, const Policy &policy)
void	quarantineFile (const Options &options, const Policy &policy)

Variables
constexpr const char *	kDefaultPolicy = "/etc/bastionguard/rootguard.conf"
constexpr const char *	kQuarantineDir = "/var/lib/bastionguard/rootguard/quarantine"

Function Documentation

copyString()

void anonymous_namespace{ActionHelper.cpp}::copyString	(	char *	destination,
		const std::size_t	size,
		const std::string &	source )

Definition at line 169 of file ActionHelper.cpp.

{
    if (size == 0)
        return;
    const auto count = std::min(size - 1, source.size());
    std::memcpy(destination, source.data(), count);
    destination[count] = '\0';
}

References copyString().

Referenced by copyString(), and logAction().

fail()

void anonymous_namespace{ActionHelper.cpp}::fail

(

const std::string &

message

)

Definition at line 52 of file ActionHelper.cpp.

{
    throw std::runtime_error(message);
}

References fail().

Referenced by fail(), main(), normalizeApplicationEntries(), normalizedAbsolute(), parseOptions(), parseUnsigned(), quarantineFile(), requireProtectedPath(), restoreFile(), rewriteApplicationRules(), rewriteProtectionPolicy(), and writePolicyAtomically().

isIgnoredPath()

bool anonymous_namespace{ActionHelper.cpp}::isIgnoredPath	(	const Policy &	policy,
		const fs::path &	requested )

Definition at line 125 of file ActionHelper.cpp.

{
    const auto path = normalizedAbsolute(requested);
    for (const auto& rule : policy.ignoredPaths) {
        const auto ignoredPath = rule.path.lexically_normal();
        if (rule.recursive ? pathStartsWith(path, ignoredPath)
                           : path == ignoredPath)
            return true;
    }
    return false;
}

References bastionguard::rootguard::Policy::ignoredPaths, isIgnoredPath(), normalizedAbsolute(), and pathStartsWith().

Referenced by isIgnoredPath(), and isProtectedPath().

isProtectedPath()

bool anonymous_namespace{ActionHelper.cpp}::isProtectedPath	(	const Policy &	policy,
		const fs::path &	requested )

Definition at line 137 of file ActionHelper.cpp.

{
    const auto path = normalizedAbsolute(requested);
    if (isIgnoredPath(policy, path))
        return false;
 
    for (const auto& rule : policy.protectedPaths) {
        const auto protectedPath = rule.path.lexically_normal();
        if (rule.recursive ? pathStartsWith(path, protectedPath)
                           : path == protectedPath)
            return true;
    }
    return false;
}

References isIgnoredPath(), isProtectedPath(), normalizedAbsolute(), pathStartsWith(), and bastionguard::rootguard::Policy::protectedPaths.

Referenced by isProtectedPath(), and requireProtectedPath().

loadPolicy()

Policy anonymous_namespace{ActionHelper.cpp}::loadPolicy

(

const fs::path &

path

)

Definition at line 223 of file ActionHelper.cpp.

{
    return PolicyLoader::loadFromText(PolicySecurity::read(path, true), path);
}

References bastionguard::rootguard::PolicyLoader::loadFromText(), loadPolicy(), and bastionguard::rootguard::PolicySecurity::read().

Referenced by loadPolicy(), and main().

logAction()

void anonymous_namespace{ActionHelper.cpp}::logAction	(	const Policy &	policy,
		const fs::path &	path,
		const std::uint32_t	eventType,
		const std::uint32_t	verdict,
		const struct stat *	before = nullptr,
		const struct stat *	after = nullptr )

Definition at line 179 of file ActionHelper.cpp.

{
    if (policy.eventLog.empty())
        return;
    try {
        if (const auto parent = policy.eventLog.parent_path(); !parent.empty())
            fs::create_directories(parent);
        JsonEventSink sink(policy.eventLog);
        rg_event event{};
        event.pid = static_cast<__u32>(::getpid());
        event.tgid = event.pid;
        event.ppid = static_cast<__u32>(::getppid());
        event.event_type = eventType;
        event.verdict = verdict;
        if (before) {
            event.file.device = FileIdentityResolver::kernelDeviceNumber(before->st_dev);
            event.file.inode = static_cast<__u64>(before->st_ino);
            event.old_mode = static_cast<__u32>(before->st_mode & 07777U);
            event.old_uid = static_cast<__u32>(before->st_uid);
            event.old_gid = static_cast<__u32>(before->st_gid);
        }
        if (after) {
            event.new_mode = static_cast<__u32>(after->st_mode & 07777U);
            event.new_uid = static_cast<__u32>(after->st_uid);
            event.new_gid = static_cast<__u32>(after->st_gid);
        }
        event.path_resolution = RG_PATH_PROTECTED_BASELINE;
        copyString(event.comm, sizeof(event.comm), "rootguard-action");
        std::error_code actorError;
        const fs::path actor = fs::read_symlink("/proc/self/exe", actorError);
        if (!actorError)
            copyString(event.actor_executable,
                       sizeof(event.actor_executable), actor.string());
        copyString(event.filename, sizeof(event.filename), path.string());
        sink.onEvent(event);
    } catch (...) {
        // The privileged action must not fail only because logging failed.
    }
}

References copyString(), bastionguard::rootguard::Policy::eventLog, bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber(), logAction(), bastionguard::rootguard::JsonEventSink::onEvent(), rg_event::pid, and RG_PATH_PROTECTED_BASELINE.

Referenced by logAction(), main(), quarantineFile(), and restoreFile().

normalizeApplicationEntries()

std::vector< fs::path > anonymous_namespace{ActionHelper.cpp}::normalizeApplicationEntries	(	const std::vector< fs::path > &	entries,
		const char *	label )

Definition at line 316 of file ActionHelper.cpp.

{
    std::vector<fs::path> normalized;
    std::set<std::string> seen;
    for (const auto& entry : entries) {
        const fs::path path = normalizedAbsolute(entry);
        struct stat metadata {};
        const bool exists = ::stat(path.c_str(), &metadata) == 0;
        if (!exists && errno != ENOENT)
            fail(std::string("Cannot inspect ") + label + ": " + path.string() +
                 ": " + std::strerror(errno));
        if (exists && !S_ISREG(metadata.st_mode))
            fail(std::string(label) + " is not a regular file: " + path.string());
        if (exists && ::access(path.c_str(), X_OK) != 0)
            fail(std::string(label) + " is not executable: " + path.string());
 
        /*
         * Cross-distribution policy files legitimately contain executable
         * paths that are absent on the current desktop. Preserve those entries
         * so saving from the UI does not silently delete rules for another DE
         * or browser. Existing files are still validated strictly.
         */
        std::error_code error;
        const fs::path canonical = fs::weakly_canonical(path, error);
        const fs::path finalPath = error ? path : canonical;
        if (seen.insert(finalPath.string()).second)
            normalized.push_back(finalPath);
    }
    std::sort(normalized.begin(), normalized.end());
    return normalized;
}

References fail(), normalizeApplicationEntries(), and normalizedAbsolute().

Referenced by normalizeApplicationEntries(), and rewriteApplicationRules().

normalizedAbsolute()

fs::path anonymous_namespace{ActionHelper.cpp}::normalizedAbsolute

(

const fs::path &

path

)

Definition at line 113 of file ActionHelper.cpp.

{
    if (path.empty() || !path.is_absolute())
        fail("An absolute path is required.");
    const auto normalized = path.lexically_normal();
    for (const auto& component : normalized) {
        if (component == "..")
            fail("Parent traversal is not allowed.");
    }
    return normalized;
}

References fail(), and normalizedAbsolute().

Referenced by isIgnoredPath(), isProtectedPath(), main(), normalizeApplicationEntries(), normalizedAbsolute(), quarantineFile(), and restoreFile().

parseOptions()

Options anonymous_namespace{ActionHelper.cpp}::parseOptions	(	const int	argc,
		char *	argv[] )

Definition at line 72 of file ActionHelper.cpp.

{
    if (argc < 2)
        fail("Usage: bastionguard-rootguard-action <set-protection|set-application-rules|restore|remove|block-service|unblock-service> [options]");
 
    Options options;
    options.command = argv[1];
    for (int index = 2; index < argc; ++index) {
        const std::string key = argv[index];
        if (index + 1 >= argc)
            fail("Missing value for " + key);
        const std::string value = argv[++index];
        if (key == "--policy") options.policy = value;
        else if (key == "--path") options.path = value;
        else if (key == "--mode") options.mode = static_cast<std::uint32_t>(parseUnsigned(value, "mode", 8));
        else if (key == "--uid") options.uid = static_cast<std::uint32_t>(parseUnsigned(value, "uid"));
        else if (key == "--gid") options.gid = static_cast<std::uint32_t>(parseUnsigned(value, "gid"));
        else if (key == "--device") options.device = parseUnsigned(value, "device");
        else if (key == "--inode") options.inode = parseUnsigned(value, "inode");
        else if (key == "--state") options.protection = value;
        else if (key == "--trusted-application") options.trustedApplications.emplace_back(value);
        else if (key == "--trusted-executable") options.trustedExecutables.emplace_back(value);
        else if (key == "--denied-executable") options.deniedExecutables.emplace_back(value);
        else fail("Unknown option: " + key);
    }
    return options;
}

References anonymous_namespace{ActionHelper.cpp}::Options::command, anonymous_namespace{ActionHelper.cpp}::Options::deniedExecutables, anonymous_namespace{ActionHelper.cpp}::Options::device, fail(), anonymous_namespace{ActionHelper.cpp}::Options::gid, anonymous_namespace{ActionHelper.cpp}::Options::inode, anonymous_namespace{ActionHelper.cpp}::Options::mode, parseOptions(), parseUnsigned(), anonymous_namespace{ActionHelper.cpp}::Options::path, anonymous_namespace{ActionHelper.cpp}::Options::policy, anonymous_namespace{ActionHelper.cpp}::Options::protection, anonymous_namespace{ActionHelper.cpp}::Options::trustedApplications, anonymous_namespace{ActionHelper.cpp}::Options::trustedExecutables, and anonymous_namespace{ActionHelper.cpp}::Options::uid.

Referenced by main(), and parseOptions().

parseUnsigned()

std::uint64_t anonymous_namespace{ActionHelper.cpp}::parseUnsigned	(	const std::string &	value,
		const char *	label,
		const int	base = 10 )

Definition at line 57 of file ActionHelper.cpp.

{
    std::size_t consumed = 0;
    unsigned long long parsed = 0;
    try {
        parsed = std::stoull(value, &consumed, base);
    } catch (...) {
        fail(std::string("Invalid ") + label + ": " + value);
    }
    if (consumed != value.size())
        fail(std::string("Invalid ") + label + ": " + value);
    return static_cast<std::uint64_t>(parsed);
}

References fail(), and parseUnsigned().

Referenced by parseOptions(), and parseUnsigned().

pathStartsWith()

bool anonymous_namespace{ActionHelper.cpp}::pathStartsWith	(	const fs::path &	path,
		const fs::path &	prefix )

Definition at line 100 of file ActionHelper.cpp.

{
    const auto normalizedPath = path.lexically_normal();
    const auto normalizedPrefix = prefix.lexically_normal();
    auto pathIt = normalizedPath.begin();
    for (auto prefixIt = normalizedPrefix.begin(); prefixIt != normalizedPrefix.end();
         ++prefixIt, ++pathIt) {
        if (pathIt == normalizedPath.end() || *pathIt != *prefixIt)
            return false;
    }
    return true;
}

References pathStartsWith().

Referenced by isIgnoredPath(), isProtectedPath(), and pathStartsWith().

quarantineFile()

void anonymous_namespace{ActionHelper.cpp}::quarantineFile	(	const Options &	options,
		const Policy &	policy )

Definition at line 533 of file ActionHelper.cpp.

{
    const auto path = normalizedAbsolute(options.path);
    requireProtectedPath(policy, path);
    struct stat before{};
    if (::lstat(path.c_str(), &before) != 0)
        fail(std::string("Cannot remove path: ") + std::strerror(errno));
    if (S_ISDIR(before.st_mode))
        fail("Directory removal is not supported by the RootGuard incident action.");
 
    std::string serviceWarning;
    if (const auto target = identifySystemService(path)) {
        const bool identityMatches = options.device && options.inode &&
            *options.device != 0 && *options.inode != 0 &&
            FileIdentityResolver::kernelDeviceNumber(before.st_dev) == *options.device &&
            static_cast<std::uint64_t>(before.st_ino) == *options.inode;
        const bool scriptBased = target->init == InitSystem::OpenRC ||
                                 target->init == InitSystem::SysVInit;
        if (scriptBased && !identityMatches) {
            serviceWarning =
                "The affected OpenRC/SysV definition may have been replaced; "
                "RootGuard did not execute it as root. The service process may require manual containment.";
        } else {
            const auto result = blockSystemService(path);
            if (!result.success)
                serviceWarning = "Service blocking was not confirmed: " + result.message;
        }
    }
 
    fs::create_directories(kQuarantineDir);
    ::chmod(kQuarantineDir, 0700);
    const fs::path destination = fs::path(kQuarantineDir) /
        (timestamp() + "-" + std::to_string(::getpid()) + "-" + path.filename().string());
    if (::rename(path.c_str(), destination.c_str()) != 0)
        fail(std::string("Quarantine rename failed: ") + std::strerror(errno));
 
    std::ofstream manifest(destination.string() + ".manifest", std::ios::trunc);
    manifest << "original_path=" << path.string() << '\n'
             << "mode=" << std::oct << (before.st_mode & 07777U) << std::dec << '\n'
             << "uid=" << before.st_uid << '\n'
             << "gid=" << before.st_gid << '\n'
             << "device=" << FileIdentityResolver::kernelDeviceNumber(before.st_dev) << '\n'
             << "inode=" << before.st_ino << '\n';
    manifest.close();
    ::chmod(destination.c_str(), 0000);
    logAction(policy, path, RG_EVENT_FILE_QUARANTINED, RG_VERDICT_BLOCKED,
              &before, nullptr);
    std::cout << "The file was removed from its original location and quarantined at "
              << destination << ".\n";
}

References bastionguard::rootguard::blockSystemService(), anonymous_namespace{ActionHelper.cpp}::Options::device, fail(), bastionguard::rootguard::identifySystemService(), anonymous_namespace{ActionHelper.cpp}::Options::inode, bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber(), kQuarantineDir, logAction(), normalizedAbsolute(), bastionguard::rootguard::OpenRC, anonymous_namespace{ActionHelper.cpp}::Options::path, quarantineFile(), requireProtectedPath(), RG_EVENT_FILE_QUARANTINED, RG_VERDICT_BLOCKED, bastionguard::rootguard::SysVInit, and timestamp().

Referenced by main(), and quarantineFile().

requireProtectedPath()

void anonymous_namespace{ActionHelper.cpp}::requireProtectedPath	(	const Policy &	policy,
		const fs::path &	path )

Definition at line 152 of file ActionHelper.cpp.

{
    if (!isProtectedPath(policy, path))
        fail("The requested path is not covered by the RootGuard protected-path policy.");
}

References fail(), isProtectedPath(), and requireProtectedPath().

Referenced by main(), quarantineFile(), requireProtectedPath(), and restoreFile().

restoreFile()

void anonymous_namespace{ActionHelper.cpp}::restoreFile	(	const Options &	options,
		const Policy &	policy )

Definition at line 481 of file ActionHelper.cpp.

{
    if (!options.mode || !options.uid || !options.gid)
        fail("restore requires --mode, --uid and --gid.");
    const auto path = normalizedAbsolute(options.path);
    requireProtectedPath(policy, path);
 
    struct stat before{};
    if (::lstat(path.c_str(), &before) != 0)
        fail(std::string("Cannot restore missing path: ") + std::strerror(errno));
    if (S_ISLNK(before.st_mode))
        fail("Refusing to restore metadata through a symbolic link.");
    if (options.device && *options.device != 0 &&
        FileIdentityResolver::kernelDeviceNumber(before.st_dev) != *options.device)
        fail("The file device no longer matches the protected baseline.");
    if (options.inode && *options.inode != 0 &&
        static_cast<std::uint64_t>(before.st_ino) != *options.inode)
        fail("The file inode no longer matches the protected baseline. Quarantine the replacement instead.");
 
    const int openFlags = O_RDONLY | O_CLOEXEC | O_NOFOLLOW |
                          (S_ISDIR(before.st_mode) ? O_DIRECTORY : O_NONBLOCK);
    const int descriptor = ::open(path.c_str(), openFlags);
    if (descriptor < 0)
        fail(std::string("Secure open failed: ") + std::strerror(errno));
    struct stat verified{};
    if (::fstat(descriptor, &verified) != 0 ||
        verified.st_dev != before.st_dev || verified.st_ino != before.st_ino) {
        ::close(descriptor);
        fail("The protected path changed during the restore operation.");
    }
    if (::fchown(descriptor, static_cast<uid_t>(*options.uid),
                 static_cast<gid_t>(*options.gid)) != 0) {
        const std::string error = std::strerror(errno);
        ::close(descriptor);
        fail("fchown failed: " + error);
    }
    if (::fchmod(descriptor, static_cast<mode_t>(*options.mode & 07777U)) != 0) {
        const std::string error = std::strerror(errno);
        ::close(descriptor);
        fail("fchmod failed: " + error);
    }
    ::close(descriptor);
 
    const auto serviceResult = unblockSystemService(path);
    (void)serviceResult;
    struct stat after{};
    ::lstat(path.c_str(), &after);
    logAction(policy, path, RG_EVENT_FILE_RESTORED, RG_VERDICT_RESTORED,
              &before, &after);
    std::cout << "Protected metadata restored. A system service, when applicable, was unmasked but not restarted.\n";
}

References anonymous_namespace{ActionHelper.cpp}::Options::device, fail(), anonymous_namespace{ActionHelper.cpp}::Options::gid, anonymous_namespace{ActionHelper.cpp}::Options::inode, bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber(), logAction(), anonymous_namespace{ActionHelper.cpp}::Options::mode, normalizedAbsolute(), anonymous_namespace{ActionHelper.cpp}::Options::path, requireProtectedPath(), restoreFile(), RG_EVENT_FILE_RESTORED, RG_VERDICT_RESTORED, anonymous_namespace{ActionHelper.cpp}::Options::uid, and bastionguard::rootguard::unblockSystemService().

Referenced by main(), and restoreFile().

rewriteApplicationRules()

void anonymous_namespace{ActionHelper.cpp}::rewriteApplicationRules

(

const Options &

options

)

Definition at line 391 of file ActionHelper.cpp.

{
    struct stat metadata {};
    if (::lstat(options.policy.c_str(), &metadata) != 0)
        fail(std::string("Cannot stat policy: ") + std::strerror(errno));
    if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
        fail("The RootGuard policy must be a regular non-symlink file.");
 
    const auto trustedApplications = normalizeApplicationEntries(
        options.trustedApplications, "Trusted application");
    const auto trustedExecutables = normalizeApplicationEntries(
        options.trustedExecutables, "Privilege-trusted executable");
    const auto deniedExecutables = normalizeApplicationEntries(
        options.deniedExecutables, "Denied executable");
 
    std::set<std::string> trustedKeys;
    for (const auto& path : trustedApplications)
        trustedKeys.insert(path.string());
    for (const auto& path : trustedExecutables)
        trustedKeys.insert(path.string());
    for (const auto& path : deniedExecutables) {
        if (trustedKeys.count(path.string()) != 0)
            fail("An executable cannot be both trusted and denied: " + path.string());
    }
 
    std::ifstream input(options.policy);
    if (!input)
        fail("Cannot read the RootGuard policy.");
    std::vector<std::string> sourceLines;
    std::string line;
    while (std::getline(input, line))
        sourceLines.push_back(line);
 
    const std::map<std::string, std::vector<fs::path>> replacements {
        {"trusted-applications", trustedApplications},
        {"trusted-executables", trustedExecutables},
        {"denied-executables", deniedExecutables},
    };
    std::set<std::string> emitted;
    std::vector<std::string> output;
    std::string skippedSection;
 
    const auto emitSection = [&](const std::string& section,
                                 std::vector<std::string>& destination) {
        destination.push_back("[" + section + "]");
        if (section == "trusted-applications") {
            destination.push_back(
                "# Routine user-space metadata activity only. This never grants privilege trust.");
        } else if (section == "trusted-executables") {
            destination.push_back(
                "# Executables trusted specifically for privilege transitions.");
        } else {
            destination.push_back(
                "# Executables denied during RootGuard privilege-transition checks.");
        }
        for (const auto& path : replacements.at(section))
            destination.push_back("path = " + path.string());
        destination.push_back("");
    };
 
    for (const auto& sourceLine : sourceLines) {
        const std::string stripped = trim(sourceLine);
        if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
            const std::string section = stripped.substr(1, stripped.size() - 2);
            skippedSection.clear();
            if (replacements.count(section) != 0) {
                skippedSection = section;
                if (emitted.insert(section).second)
                    emitSection(section, output);
                continue;
            }
        }
        if (!skippedSection.empty())
            continue;
        output.push_back(sourceLine);
    }
 
    for (const auto& [section, entries] : replacements) {
        (void)entries;
        if (emitted.insert(section).second) {
            if (!output.empty() && !output.back().empty())
                output.push_back("");
            emitSection(section, output);
        }
    }
 
    writePolicyAtomically(options.policy, output, metadata);
    std::cout << "RootGuard application rules saved. A service restart is required.\n";
}

References anonymous_namespace{ActionHelper.cpp}::Options::deniedExecutables, fail(), normalizeApplicationEntries(), anonymous_namespace{ActionHelper.cpp}::Options::policy, rewriteApplicationRules(), trim(), anonymous_namespace{ActionHelper.cpp}::Options::trustedApplications, anonymous_namespace{ActionHelper.cpp}::Options::trustedExecutables, and writePolicyAtomically().

Referenced by main(), and rewriteApplicationRules().

rewriteProtectionPolicy()

void anonymous_namespace{ActionHelper.cpp}::rewriteProtectionPolicy	(	const fs::path &	policyPath,
		const bool	enabled )

Definition at line 237 of file ActionHelper.cpp.

{
    struct stat metadata{};
    if (::lstat(policyPath.c_str(), &metadata) != 0)
        fail(std::string("Cannot stat policy: ") + std::strerror(errno));
    if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
        fail("The RootGuard policy must be a regular non-symlink file.");
 
    std::ifstream input(policyPath);
    if (!input)
        fail("Cannot read the RootGuard policy.");
    std::vector<std::string> lines;
    std::string line;
    while (std::getline(input, line))
        lines.push_back(line);
 
    const std::map<std::string, std::string> replacements{
        {"mode", enabled ? "enforce" : "audit"},
        {"metadata_action", enabled ? "block" : "audit"},
        {"global_metadata_action", "audit"},
        {"block_user_home", "false"},
    };
    std::map<std::string, bool> found;
    bool inEngine = false;
    std::size_t insertion = lines.size();
    for (std::size_t index = 0; index < lines.size(); ++index) {
        const std::string stripped = trim(lines[index]);
        if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
            if (inEngine && stripped != "[engine]") {
                insertion = index;
                inEngine = false;
            } else {
                inEngine = stripped == "[engine]";
            }
            continue;
        }
        if (!inEngine || stripped.empty() || stripped.front() == '#' || stripped.front() == ';')
            continue;
        const auto separator = stripped.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(stripped.substr(0, separator));
        const auto replacement = replacements.find(key);
        if (replacement != replacements.end()) {
            lines[index] = key + " = " + replacement->second;
            found[key] = true;
        }
    }
    if (insertion == lines.size() && inEngine)
        insertion = lines.size();
    for (auto iterator = replacements.rbegin(); iterator != replacements.rend(); ++iterator) {
        if (!found[iterator->first])
            lines.insert(lines.begin() + static_cast<std::ptrdiff_t>(insertion),
                         iterator->first + " = " + iterator->second);
    }
 
    const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
                               std::to_string(::getpid());
    {
        std::ofstream output(temporary, std::ios::trunc);
        if (!output)
            fail("Cannot create the temporary policy file.");
        for (const auto& item : lines)
            output << item << '\n';
        output.flush();
        if (!output)
            fail("Cannot write the temporary policy file.");
    }
    if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
        ::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot preserve policy ownership/mode: ") + std::strerror(errno));
    }
    if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot atomically replace the policy: ") + std::strerror(errno));
    }
}

References fail(), rewriteProtectionPolicy(), and trim().

Referenced by main(), and rewriteProtectionPolicy().

timestamp()

std::string anonymous_namespace{ActionHelper.cpp}::timestamp

(

)

Definition at line 158 of file ActionHelper.cpp.

{
    const auto now = std::chrono::system_clock::now();
    const auto time = std::chrono::system_clock::to_time_t(now);
    std::tm tm{};
    localtime_r(&time, &tm);
    std::ostringstream output;
    output << std::put_time(&tm, "%Y%m%d-%H%M%S");
    return output.str();
}

References timestamp().

Referenced by quarantineFile(), and timestamp().

trim()

std::string anonymous_namespace{ActionHelper.cpp}::trim

(

std::string

value

)

Definition at line 228 of file ActionHelper.cpp.

{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}

References trim().

Referenced by rewriteApplicationRules(), rewriteProtectionPolicy(), and trim().

writePolicyAtomically()

void anonymous_namespace{ActionHelper.cpp}::writePolicyAtomically	(	const fs::path &	policyPath,
		const std::vector< std::string > &	lines,
		const struct stat &	metadata )

Definition at line 350 of file ActionHelper.cpp.

{
    const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
                               std::to_string(::getpid());
    {
        std::ofstream output(temporary, std::ios::trunc);
        if (!output)
            fail("Cannot create the temporary policy file.");
        for (const auto& item : lines)
            output << item << '\n';
        output.flush();
        if (!output)
            fail("Cannot write the temporary policy file.");
    }
 
    std::ifstream validationInput(temporary);
    std::ostringstream validationText;
    validationText << validationInput.rdbuf();
    try {
        (void)PolicyLoader::loadFromText(validationText.str(), temporary);
    } catch (const std::exception& error) {
        fs::remove(temporary);
        fail(std::string("Refusing to install an invalid RootGuard policy: ") +
             error.what());
    }
 
    if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
        ::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot preserve policy ownership/mode: ") +
             std::strerror(errno));
    }
    if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
        fs::remove(temporary);
        fail(std::string("Cannot atomically replace the policy: ") +
             std::strerror(errno));
    }
}

References fail(), bastionguard::rootguard::PolicyLoader::loadFromText(), and writePolicyAtomically().

Referenced by rewriteApplicationRules(), and writePolicyAtomically().

Variable Documentation

kDefaultPolicy

const char* anonymous_namespace{ActionHelper.cpp}::kDefaultPolicy = "/etc/bastionguard/rootguard.conf"

constexpr

Definition at line 34 of file ActionHelper.cpp.

kQuarantineDir

const char* anonymous_namespace{ActionHelper.cpp}::kQuarantineDir = "/var/lib/bastionguard/rootguard/quarantine"

constexpr

Definition at line 35 of file ActionHelper.cpp.

Referenced by quarantineFile().