RootGuardClient.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ RootGuard GTK integration
 * Copyright (C) 2025–2026 Calogero Scarnà
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
#include "RootGuardClient.hpp"
 
#include <algorithm>
#include <array>
#include <cerrno>
#include <deque>
#include <filesystem>
#include <fstream>
#include <sstream>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
 
#ifndef BASTIONGUARD_ROOTGUARD_SERVICE_HELPER
#define BASTIONGUARD_ROOTGUARD_SERVICE_HELPER "/usr/libexec/bastionguard/bastionguard-rootguard-service"
#endif
 
#ifndef BASTIONGUARD_ROOTGUARD_ACTION_HELPER
#define BASTIONGUARD_ROOTGUARD_ACTION_HELPER "/usr/libexec/bastionguard/bastionguard-rootguard-action"
#endif
 
#ifndef BASTIONGUARD_ROOTGUARD_EVENT_LOG
#define BASTIONGUARD_ROOTGUARD_EVENT_LOG "/var/log/bastionguard/rootguard-events.jsonl"
#endif
 
#ifndef BASTIONGUARD_ROOTGUARD_POLICY
#define BASTIONGUARD_ROOTGUARD_POLICY "/etc/bastionguard/rootguard.conf"
#endif
 
#ifndef BASTIONGUARD_ROOTGUARD_POLICY_VIEW
#define BASTIONGUARD_ROOTGUARD_POLICY_VIEW "/run/bastionguard-rootguard.policy-view"
#endif
 
#ifndef BASTIONGUARD_PKEXEC
#define BASTIONGUARD_PKEXEC "/usr/bin/pkexec"
#endif
 
namespace BastionGuard::RootGuard {
namespace {
 
struct CommandResult {
    int exit_code{127};
    std::string output;
};
 
CommandResult run_command(const std::vector<std::string>& arguments)
{
    CommandResult result;
    if (arguments.empty())
        return result;
 
    int descriptors[2]{};
    if (::pipe(descriptors) != 0)
        return result;
 
    const pid_t child = ::fork();
    if (child < 0) {
        ::close(descriptors[0]);
        ::close(descriptors[1]);
        return result;
    }
 
    if (child == 0) {
        ::close(descriptors[0]);
        ::dup2(descriptors[1], STDOUT_FILENO);
        ::dup2(descriptors[1], STDERR_FILENO);
        ::close(descriptors[1]);
 
        std::vector<char*> argv;
        argv.reserve(arguments.size() + 1);
        for (const auto& argument : arguments)
            argv.push_back(const_cast<char*>(argument.c_str()));
        argv.push_back(nullptr);
 
        ::execv(argv.front(), argv.data());
        _exit(127);
    }
 
    ::close(descriptors[1]);
    std::array<char, 4096> buffer{};
    for (;;) {
        const ssize_t count = ::read(descriptors[0], buffer.data(), buffer.size());
        if (count > 0) {
            result.output.append(buffer.data(), static_cast<std::size_t>(count));
            continue;
        }
        if (count < 0 && errno == EINTR)
            continue;
        break;
    }
    ::close(descriptors[0]);
 
    int status = 0;
    while (::waitpid(child, &status, 0) < 0 && errno == EINTR) {
    }
    if (WIFEXITED(status))
        result.exit_code = WEXITSTATUS(status);
    else if (WIFSIGNALED(status))
        result.exit_code = 128 + WTERMSIG(status);
    return result;
}
 
std::string trim(std::string value)
{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}
 
bool parse_bool(const std::string& value)
{
    return value == "true" || value == "1" || value == "yes" || value == "on";
}
 
ServiceStatus parse_status(const std::string& text)
{
    ServiceStatus status;
    std::istringstream input(text);
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (key == "active") status.active = parse_bool(value);
        else if (key == "init") status.init_system = value;
        else if (key == "state") status.state = value;
        else if (key == "mode") status.mode = value;
        else if (key == "metadata_action") status.metadata_action = value;
        else if (key == "global_metadata_action") status.global_metadata_action = value;
        else if (key == "auto_block_services") status.autoBlockServices = parse_bool(value);
        else if (key == "block_user_home") status.blockUserHome = parse_bool(value);
        else if (key == "pid") status.pid = value;
    }
    status.immediateProtection = status.mode == "enforce" &&
                                 status.metadata_action == "block";
    return status;
}
 
 
struct IgnoredPathRule {
    std::filesystem::path path;
    bool recursive{};
};
 
bool path_starts_with(const std::filesystem::path& path,
                      const std::filesystem::path& prefix)
{
    const auto normalized_path = path.lexically_normal();
    const auto normalized_prefix = prefix.lexically_normal();
    auto path_iterator = normalized_path.begin();
    for (auto prefix_iterator = normalized_prefix.begin();
         prefix_iterator != normalized_prefix.end();
         ++prefix_iterator, ++path_iterator) {
        if (path_iterator == normalized_path.end() ||
            *path_iterator != *prefix_iterator)
            return false;
    }
    return true;
}
 
std::vector<IgnoredPathRule> read_ignored_paths()
{
    std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
    if (!input)
        return {};
 
    std::vector<IgnoredPathRule> rules;
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (value.empty() || value.front() != '/')
            continue;
        if (key == "ignored_path") {
            rules.push_back(IgnoredPathRule{
                std::filesystem::path(value).lexically_normal(), false});
        } else if (key == "ignored_recursive") {
            rules.push_back(IgnoredPathRule{
                std::filesystem::path(value).lexically_normal(), true});
        }
    }
    return rules;
}
 
bool is_ignored_event_path(const std::string& filename,
                           const std::vector<IgnoredPathRule>& rules)
{
    if (filename.empty() || filename == "--" || filename.front() != '/')
        return false;
    const std::filesystem::path path(filename);
    for (const auto& rule : rules) {
        if (rule.recursive ? path_starts_with(path, rule.path)
                           : path.lexically_normal() == rule.path)
            return true;
    }
    return false;
}
 
ApplicationRules read_application_rules()
{
    std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
    ApplicationRules rules;
    if (!input)
        return rules;
    std::string line;
    while (std::getline(input, line)) {
        const auto separator = line.find('=');
        if (separator == std::string::npos)
            continue;
        const std::string key = trim(line.substr(0, separator));
        const std::string value = trim(line.substr(separator + 1));
        if (value.empty())
            continue;
        if (key == "trusted_application")
            rules.trustedApplications.push_back(value);
        else if (key == "trusted_executable")
            rules.trustedExecutables.push_back(value);
        else if (key == "denied_executable")
            rules.deniedExecutables.push_back(value);
    }
    return rules;
}
 
std::vector<Event> read_recent_events(const std::size_t maximum)
{
    const auto ignored_paths = read_ignored_paths();
    std::ifstream stream(BASTIONGUARD_ROOTGUARD_EVENT_LOG, std::ios::binary);
    if (!stream)
        return {};
 
    constexpr std::streamoff kMaximumTailBytes = 2 * 1024 * 1024;
    stream.seekg(0, std::ios::end);
    const std::streamoff end = stream.tellg();
    if (end < 0)
        return {};
    const std::streamoff start = end > kMaximumTailBytes
        ? end - kMaximumTailBytes : 0;
    stream.seekg(start, std::ios::beg);
    std::string line;
    if (start > 0)
        std::getline(stream, line); // discard a potentially partial JSON line
 
    std::deque<std::string> lines;
    while (std::getline(stream, line)) {
        lines.push_back(std::move(line));
        if (lines.size() > maximum)
            lines.pop_front();
    }
 
    std::vector<Event> events;
    events.reserve(lines.size());
    for (const auto& item : lines) {
        if (auto event = parse_event_json(item)) {
            if (!is_ignored_event_path(event->filename, ignored_paths))
                events.push_back(std::move(*event));
        }
    }
    return events;
}
 
std::string octal_argument(const std::uint32_t value)
{
    std::ostringstream output;
    output << std::oct << (value & 07777U);
    return output.str();
}
 
bool command_success(const CommandResult& result, const std::string& successFallback,
                     std::string& message)
{
    message = trim(result.output);
    const bool success = result.exit_code == 0;
    if (message.empty()) {
        if (success) {
            message = successFallback;
        } else {
            message = "RootGuard command failed with exit code " +
                      std::to_string(result.exit_code) + ".";
        }
    }
    return success;
}
 
} // namespace
 
Client::Client()
{
    dispatcher_.connect(sigc::mem_fun(*this, &Client::on_dispatch));
    worker_ = std::thread(&Client::worker_loop, this);
}
 
Client::~Client()
{
    {
        std::lock_guard lock(mutex_);
        stopping_ = true;
        requests_.clear();
        requests_.push_front(Request{Action::Quit, false, std::nullopt, {}});
    }
    condition_.notify_one();
    if (worker_.joinable())
        worker_.join();
}
 
sigc::signal<void(const Snapshot&)>& Client::signal_updated() noexcept
{
    return signal_updated_;
}
 
void Client::refresh() { enqueue(Request{Action::Refresh, false, std::nullopt, {}}); }
void Client::start_service() { enqueue(Request{Action::Start, false, std::nullopt, {}}); }
void Client::stop_service() { enqueue(Request{Action::Stop, false, std::nullopt, {}}); }
void Client::reload_policy() { enqueue(Request{Action::Reload, false, std::nullopt, {}}); }
void Client::restart_service() { enqueue(Request{Action::Restart, false, std::nullopt, {}}); }
void Client::set_immediate_protection(const bool enabled)
{
    enqueue(Request{Action::SetProtection, enabled, std::nullopt, {}});
}
void Client::restore_event(const Event& event)
{
    enqueue(Request{Action::Restore, false, event, {}});
}
void Client::remove_event(const Event& event)
{
    enqueue(Request{Action::Remove, false, event, {}});
}
void Client::save_application_rules(ApplicationRules rules)
{
    enqueue(Request{Action::SaveApplicationRules, false, std::nullopt,
                    std::move(rules)});
}
 
void Client::enqueue(Request request)
{
    {
        std::lock_guard lock(mutex_);
        if (stopping_)
            return;
        if (request.action == Action::Refresh) {
            const bool refreshAlreadyQueued = std::any_of(
                requests_.begin(), requests_.end(),
                [](const Request& queued) { return queued.action == Action::Refresh; });
            if (refreshAlreadyQueued)
                return;
        }
        requests_.push_back(std::move(request));
    }
    condition_.notify_one();
}
 
Snapshot Client::collect_snapshot(const std::string& operation_message,
                                  const bool operation_success) const
{
    const CommandResult status_result = run_command({
        BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "status"
    });
 
    Snapshot snapshot;
    snapshot.service = parse_status(status_result.output);
    snapshot.events = read_recent_events(400);
    snapshot.application_rules = read_application_rules();
    snapshot.operation_message = operation_message;
    snapshot.operation_success = operation_success;
    if (snapshot.service.state == "unknown" && status_result.exit_code != 0)
        snapshot.service.state = "unavailable";
    return snapshot;
}
 
bool Client::run_request(const Request& request, std::string& message) const
{
    if (request.action == Action::Refresh)
        return true;
 
    if (request.action == Action::Start || request.action == Action::Stop ||
        request.action == Action::Reload || request.action == Action::Restart) {
        const char* action = request.action == Action::Start ? "start" :
                             request.action == Action::Stop ? "stop" :
                             request.action == Action::Reload ? "reload" : "restart";
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, action
        }), std::string("RootGuard action completed: ") + action, message);
    }
 
    if (request.action == Action::SetProtection) {
        const auto result = run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "set-protection", "--state", request.enabled ? "on" : "off"
        });
        if (!command_success(result, "RootGuard protection mode updated.", message))
            return false;
        const auto reload = run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "reload"
        });
        std::string reloadMessage;
        const bool reloadSuccess = command_success(
            reload, "RootGuard policy reloaded.", reloadMessage);
        if (!reloadMessage.empty())
            message += " " + reloadMessage;
        if (!reloadSuccess && request.enabled) {
            const auto rollback = run_command({
                BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
                "set-protection", "--state", "off"
            });
            std::string rollbackMessage;
            const bool rollbackSuccess = command_success(
                rollback, "Unsafe future enablement was rolled back to audit mode.",
                rollbackMessage);
            message += rollbackSuccess
                ? " " + rollbackMessage
                : " WARNING: the policy rollback to audit mode failed: " + rollbackMessage;
        }
        return reloadSuccess;
    }
 
    if (request.action == Action::SaveApplicationRules) {
        std::vector<std::string> command {
            BASTIONGUARD_PKEXEC,
            BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "set-application-rules"
        };
        const auto appendRules = [&command](const char* option,
                                             const std::vector<std::string>& entries) {
            for (const auto& entry : entries) {
                command.emplace_back(option);
                command.push_back(entry);
            }
        };
        appendRules("--trusted-application",
                    request.application_rules.trustedApplications);
        appendRules("--trusted-executable",
                    request.application_rules.trustedExecutables);
        appendRules("--denied-executable",
                    request.application_rules.deniedExecutables);
 
        const auto saveResult = run_command(command);
        if (!command_success(saveResult,
                             "RootGuard application rules saved.", message))
            return false;
 
        const auto restartResult = run_command({
            BASTIONGUARD_PKEXEC,
            BASTIONGUARD_ROOTGUARD_SERVICE_HELPER,
            "restart"
        });
        std::string restartMessage;
        const bool restartSuccess = command_success(
            restartResult, "RootGuard restarted with the new rules.",
            restartMessage);
        if (!restartMessage.empty())
            message += " " + restartMessage;
        return restartSuccess;
    }
 
    if (!request.event)
        return false;
    const Event& event = *request.event;
    if (event.filename.empty()) {
        message = "The incident has no actionable path.";
        return false;
    }
 
    if (request.action == Action::Restore) {
        const bool metadataAvailable = event.old_mode != 0 || event.new_mode != 0 ||
                                       event.old_uid != 0 || event.new_uid != 0 ||
                                       event.old_gid != 0 || event.new_gid != 0;
        if (!metadataAvailable) {
            if (is_system_service_path(event.filename)) {
                return command_success(run_command({
                    BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
                    "unblock-service", "--path", event.filename
                }), "The blocked service was unmasked. It was not restarted.", message);
            }
            message = "The change was denied before it was committed; no metadata restoration was required.";
            return true;
        }
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "restore", "--path", event.filename,
            "--mode", octal_argument(event.old_mode),
            "--uid", std::to_string(event.old_uid),
            "--gid", std::to_string(event.old_gid),
            "--device", std::to_string(event.device),
            "--inode", std::to_string(event.inode)
        }), "Protected metadata restored.", message);
    }
 
    if (request.action == Action::Remove) {
        return command_success(run_command({
            BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
            "remove", "--path", event.filename,
            "--device", std::to_string(event.device),
            "--inode", std::to_string(event.inode)
        }), "The file was removed and quarantined.", message);
    }
 
    return false;
}
 
void Client::worker_loop()
{
    for (;;) {
        Request request;
        {
            std::unique_lock lock(mutex_);
            condition_.wait(lock, [this] { return !requests_.empty(); });
            request = std::move(requests_.front());
            requests_.pop_front();
        }
 
        if (request.action == Action::Quit)
            break;
 
        std::string message;
        const bool success = run_request(request, message);
        Snapshot snapshot = collect_snapshot(message, success);
        {
            std::lock_guard lock(mutex_);
            pending_snapshot_ = std::move(snapshot);
            snapshot_ready_ = true;
        }
        dispatcher_.emit();
    }
}
 
void Client::on_dispatch()
{
    Snapshot snapshot;
    {
        std::lock_guard lock(mutex_);
        if (!snapshot_ready_)
            return;
        snapshot = std::move(pending_snapshot_);
        snapshot_ready_ = false;
    }
    signal_updated_.emit(snapshot);
}
 
} // namespace BastionGuard::RootGuard