RootGuardEngine.hpp

Go to the documentation of this file.

#pragma once
 
#include <chrono>
#include <cstddef>
#include <cstdint>
#include <filesystem>
#include <memory>
#include <string>
#include <unordered_set>
#include <vector>
#include <sys/stat.h>
 
#include "rootguard/IEventSink.hpp"
#include "rootguard/Policy.hpp"
#include "rootguard/rootguard_shared.h"
 
struct ring_buffer;
struct rootguard_bpf;
 
namespace bastionguard::rootguard {
 
struct PolicyApplyReport {
    std::size_t trustedApplicationsLoaded{};
    std::size_t trustedLoaded{};
    std::size_t deniedLoaded{};
    std::size_t protectedLoaded{};
    std::vector<std::string> warnings;
};
 
class RootGuardEngine final {
public:
    explicit RootGuardEngine(IEventSink& sink) noexcept;
    ~RootGuardEngine();
 
    RootGuardEngine(const RootGuardEngine&) = delete;
    RootGuardEngine& operator=(const RootGuardEngine&) = delete;
    RootGuardEngine(RootGuardEngine&&) = delete;
    RootGuardEngine& operator=(RootGuardEngine&&) = delete;
 
    [[nodiscard]] PolicyApplyReport start(const Policy& policy);
    [[nodiscard]] PolicyApplyReport reloadPolicy(const Policy& policy);
    void enterAuditMode();
    int pollOnce(int timeoutMilliseconds) noexcept;
    void runIntegrityCheckIfDue() noexcept;
 
    void authorizeProcess(std::uint32_t tgid,
                          std::uint32_t targetEuid,
                          std::chrono::milliseconds ttl,
                          std::uint32_t issuerPid);
 
private:
    struct SkeletonDeleter {
        void operator()(rootguard_bpf* value) const noexcept;
    };
 
    struct RingBufferDeleter {
        void operator()(ring_buffer* value) const noexcept;
    };
 
    struct ProtectedSnapshot {
        std::filesystem::path path;
        rg_file_key key{};
        std::uint32_t ruleId{};
        std::uint32_t mode{};
        std::uint32_t uid{};
        std::uint32_t gid{};
        bool drifted{};
        std::uint32_t lastReasons{};
    };
 
    using SkeletonPtr = std::unique_ptr<rootguard_bpf, SkeletonDeleter>;
    using RingBufferPtr = std::unique_ptr<ring_buffer, RingBufferDeleter>;
 
    static int handleEvent(void* context, void* data, std::size_t size) noexcept;
    [[nodiscard]] bool shouldIgnoreEvent(const rg_event& event) const noexcept;
    [[nodiscard]] bool enrichEventPath(rg_event& event) const noexcept;
    [[nodiscard]] bool enrichActorExecutable(rg_event& event) const noexcept;
    [[nodiscard]] bool isTrustedApplicationEvent(const rg_event& event) const noexcept;
    [[nodiscard]] PolicyApplyReport applyPolicy(const Policy& policy);
    void setKernelConfig(Mode mode,
                         Action unknownAction,
                         bool logTrusted,
                         Action metadataAction,
                         Action globalMetadataAction,
                         Action credentialAction,
                         bool monitorGlobalPrivilegeMetadata,
                         bool ignoreRunGlobalMetadata,
                         bool detectGlobalMetadataBursts,
                         std::uint32_t globalMetadataSampleLimit,
                         std::uint32_t metadataBurstThreshold,
                         std::uint32_t metadataBurstWindowMs,
                         std::uint32_t metadataBurstCooldownMs);
    static void clearMap(int mapFd);
    void emitIntegrityEvent(ProtectedSnapshot& snapshot,
                            std::uint32_t eventType,
                            std::uint32_t verdict,
                            std::uint32_t reasons,
                            const struct stat* current) noexcept;
 
    IEventSink& sink_;
    SkeletonPtr skeleton_;
    RingBufferPtr ringBuffer_;
    std::vector<ProtectedSnapshot> protectedSnapshots_;
    std::vector<PolicyPath> ignoredPaths_;
    std::unordered_set<std::string> trustedApplicationKeys_;
    std::unordered_set<std::string> trustedApplicationPaths_;
    std::unordered_set<std::string> ignoredExactNames_;
    bool logTrusted_{true};
    bool blockUserHome_{false};
    bool ignoreRunGlobalMetadata_{true};
    std::chrono::seconds integrityInterval_{0};
    std::chrono::steady_clock::time_point nextIntegrityCheck_{};
};
 
} // namespace bastionguard::rootguard