Classes
struct	rg_file_key
struct	rg_rule_value
struct	rg_protected_value
struct	rg_kernel_config
struct	rg_event
struct	rg_auth_token

Macros
#define	RG_COMM_LEN 16
#define	RG_FILENAME_LEN 256
#define	RG_XATTR_NAME_LEN 32
#define	RG_POLICY_ABI_VERSION 7U
#define	RG_PROTECT_DEFAULT

Enumerations
enum	rg_event_type { RG_EVENT_SETUID = 1 , RG_EVENT_EXEC_PRIV = 2 , RG_EVENT_CREDENTIAL_ANOMALY = 3 , RG_EVENT_PERMISSION_CHANGE = 4 , RG_EVENT_OWNER_CHANGE = 5 , RG_EVENT_XATTR_CHANGE = 6 , RG_EVENT_ACL_CHANGE = 7 , RG_EVENT_PROTECTED_UNLINK = 8 , RG_EVENT_PROTECTED_RENAME = 9 , RG_EVENT_PROTECTED_HARDLINK = 10 , RG_EVENT_INTEGRITY_DRIFT = 11 , RG_EVENT_INTEGRITY_RESTORED = 12 , RG_EVENT_SERVICE_BLOCKED = 13 , RG_EVENT_FILE_RESTORED = 14 , RG_EVENT_FILE_QUARANTINED = 15 , RG_EVENT_PROTECTION_MODE_CHANGED = 16 }
enum	rg_verdict { RG_VERDICT_AUDIT = 0 , RG_VERDICT_AUTHORIZED = 1 , RG_VERDICT_BLOCKED = 2 , RG_VERDICT_TRUSTED = 3 , RG_VERDICT_ALERT = 4 , RG_VERDICT_RESTORED = 5 }
enum	rg_kernel_mode { RG_MODE_AUDIT = 0 , RG_MODE_ENFORCE = 1 }
enum	rg_action { RG_ACTION_AUDIT = 0 , RG_ACTION_BLOCK = 1 }
enum	rg_reason_flags { RG_REASON_NONE = 0 , RG_REASON_AUTH_TOKEN = 1U << 0 , RG_REASON_TRUSTED_EXEC = 1U << 1 , RG_REASON_DENIED_EXEC = 1U << 2 , RG_REASON_UNKNOWN_EXEC = 1U << 3 , RG_REASON_FILE_ID_UNAVAILABLE = 1U << 4 , RG_REASON_DIRECT_CRED_ANOMALY = 1U << 5 , RG_REASON_PROTECTED_MODE = 1U << 6 , RG_REASON_PROTECTED_OWNER = 1U << 7 , RG_REASON_SECURITY_CAPABILITY = 1U << 8 , RG_REASON_INTEGRITY_XATTR = 1U << 9 , RG_REASON_SECURITY_LABEL = 1U << 10 , RG_REASON_PROTECTED_ACL = 1U << 11 , RG_REASON_PROTECTED_UNLINK = 1U << 12 , RG_REASON_PROTECTED_RENAME = 1U << 13 , RG_REASON_PROTECTED_HARDLINK = 1U << 14 , RG_REASON_SETID_ADDED = 1U << 15 , RG_REASON_OWNER_TO_ROOT = 1U << 16 , RG_REASON_GLOBAL_METADATA = 1U << 17 , RG_REASON_BASELINE_MODE_MISMATCH = 1U << 18 , RG_REASON_BASELINE_OWNER_MISMATCH = 1U << 19 , RG_REASON_BASELINE_FILE_REPLACED = 1U << 20 , RG_REASON_PROTECTED_MISSING = 1U << 21 , RG_REASON_GLOBAL_SURVEILLANCE = 1U << 22 , RG_REASON_ROOT_OWNED_WRITE_EXPOSURE = 1U << 23 , RG_REASON_METADATA_BURST = 1U << 24 }
enum	rg_path_resolution { RG_PATH_BASENAME = 0 , RG_PATH_PROTECTED_BASELINE = 1 , RG_PATH_PROC_FD = 2 , RG_PATH_PROCESS_CWD = 3 , RG_PATH_KERNEL_EXACT = 4 , RG_PATH_LSM_EXACT = 5 }
enum	rg_protection_flags { RG_PROTECT_MODE = 1U << 0 , RG_PROTECT_OWNER = 1U << 1 , RG_PROTECT_CAPABILITY_XATTR = 1U << 2 , RG_PROTECT_INTEGRITY_XATTR = 1U << 3 , RG_PROTECT_SECURITY_LABEL = 1U << 4 , RG_PROTECT_ACL = 1U << 5 , RG_PROTECT_UNLINK = 1U << 6 , RG_PROTECT_RENAME = 1U << 7 , RG_PROTECT_HARDLINK = 1U << 8 , RG_PROTECT_AUDIT_ONLY = 1U << 31 }

Macro Definition Documentation

◆ RG_COMM_LEN

#define RG_COMM_LEN 16

Definition at line 8 of file rootguard_shared.h.

Referenced by copy_map_string().

◆ RG_FILENAME_LEN

#define RG_FILENAME_LEN 256

Definition at line 9 of file rootguard_shared.h.

Referenced by consume_pending_path(), copy_map_string(), and enrich_event_actor().

◆ RG_POLICY_ABI_VERSION

#define RG_POLICY_ABI_VERSION 7U

Definition at line 11 of file rootguard_shared.h.

Referenced by bastionguard::rootguard::RootGuardEngine::setKernelConfig().

◆ RG_PROTECT_DEFAULT

#define RG_PROTECT_DEFAULT

Value:

(RG_PROTECT_MODE | RG_PROTECT_OWNER | RG_PROTECT_CAPABILITY_XATTR | \
 RG_PROTECT_INTEGRITY_XATTR | RG_PROTECT_SECURITY_LABEL | \
 RG_PROTECT_ACL | RG_PROTECT_UNLINK | RG_PROTECT_RENAME | \
 RG_PROTECT_HARDLINK)

Definition at line 106 of file rootguard_shared.h.

Referenced by bastionguard::rootguard::RootGuardEngine::applyPolicy().

◆ RG_XATTR_NAME_LEN

#define RG_XATTR_NAME_LEN 32

Definition at line 10 of file rootguard_shared.h.

Referenced by xattr_kind().

Enumeration Type Documentation

◆ rg_action

enum rg_action

Enumerator
RG_ACTION_AUDIT
RG_ACTION_BLOCK

Definition at line 46 of file rootguard_shared.h.

               {
    RG_ACTION_AUDIT = 0,
    RG_ACTION_BLOCK = 1,
};

◆ rg_event_type

enum rg_event_type

Enumerator
RG_EVENT_SETUID
RG_EVENT_EXEC_PRIV
RG_EVENT_CREDENTIAL_ANOMALY
RG_EVENT_PERMISSION_CHANGE
RG_EVENT_OWNER_CHANGE
RG_EVENT_XATTR_CHANGE
RG_EVENT_ACL_CHANGE
RG_EVENT_PROTECTED_UNLINK
RG_EVENT_PROTECTED_RENAME
RG_EVENT_PROTECTED_HARDLINK
RG_EVENT_INTEGRITY_DRIFT
RG_EVENT_INTEGRITY_RESTORED
RG_EVENT_SERVICE_BLOCKED
RG_EVENT_FILE_RESTORED
RG_EVENT_FILE_QUARANTINED
RG_EVENT_PROTECTION_MODE_CHANGED

Definition at line 13 of file rootguard_shared.h.

                   {
    RG_EVENT_SETUID = 1,
    RG_EVENT_EXEC_PRIV = 2,
    RG_EVENT_CREDENTIAL_ANOMALY = 3,
    RG_EVENT_PERMISSION_CHANGE = 4,
    RG_EVENT_OWNER_CHANGE = 5,
    RG_EVENT_XATTR_CHANGE = 6,
    RG_EVENT_ACL_CHANGE = 7,
    RG_EVENT_PROTECTED_UNLINK = 8,
    RG_EVENT_PROTECTED_RENAME = 9,
    RG_EVENT_PROTECTED_HARDLINK = 10,
    RG_EVENT_INTEGRITY_DRIFT = 11,
    RG_EVENT_INTEGRITY_RESTORED = 12,
    RG_EVENT_SERVICE_BLOCKED = 13,
    RG_EVENT_FILE_RESTORED = 14,
    RG_EVENT_FILE_QUARANTINED = 15,
    RG_EVENT_PROTECTION_MODE_CHANGED = 16,
};

◆ rg_kernel_mode

enum rg_kernel_mode

Enumerator
RG_MODE_AUDIT
RG_MODE_ENFORCE

Definition at line 41 of file rootguard_shared.h.

                    {
    RG_MODE_AUDIT = 0,
    RG_MODE_ENFORCE = 1,
};

◆ rg_path_resolution

enum rg_path_resolution

Enumerator
RG_PATH_BASENAME
RG_PATH_PROTECTED_BASELINE
RG_PATH_PROC_FD
RG_PATH_PROCESS_CWD
RG_PATH_KERNEL_EXACT
RG_PATH_LSM_EXACT

Definition at line 83 of file rootguard_shared.h.

                        {
    RG_PATH_BASENAME = 0,
    RG_PATH_PROTECTED_BASELINE = 1,
    RG_PATH_PROC_FD = 2,
    RG_PATH_PROCESS_CWD = 3,
    RG_PATH_KERNEL_EXACT = 4,
    RG_PATH_LSM_EXACT = 5,
};

◆ rg_protection_flags

enum rg_protection_flags

Enumerator
RG_PROTECT_MODE
RG_PROTECT_OWNER
RG_PROTECT_CAPABILITY_XATTR
RG_PROTECT_INTEGRITY_XATTR
RG_PROTECT_SECURITY_LABEL
RG_PROTECT_ACL
RG_PROTECT_UNLINK
RG_PROTECT_RENAME
RG_PROTECT_HARDLINK
RG_PROTECT_AUDIT_ONLY

Definition at line 92 of file rootguard_shared.h.

                         {
    RG_PROTECT_MODE = 1U << 0,
    RG_PROTECT_OWNER = 1U << 1,
    RG_PROTECT_CAPABILITY_XATTR = 1U << 2,
    RG_PROTECT_INTEGRITY_XATTR = 1U << 3,
    RG_PROTECT_SECURITY_LABEL = 1U << 4,
    RG_PROTECT_ACL = 1U << 5,
    RG_PROTECT_UNLINK = 1U << 6,
    RG_PROTECT_RENAME = 1U << 7,
    RG_PROTECT_HARDLINK = 1U << 8,
    /* Never enforce this identity; it remains audit-only (normally user home). */
    RG_PROTECT_AUDIT_ONLY = 1U << 31,
};

◆ rg_reason_flags

enum rg_reason_flags

Enumerator
RG_REASON_NONE
RG_REASON_AUTH_TOKEN
RG_REASON_TRUSTED_EXEC
RG_REASON_DENIED_EXEC
RG_REASON_UNKNOWN_EXEC
RG_REASON_FILE_ID_UNAVAILABLE
RG_REASON_DIRECT_CRED_ANOMALY
RG_REASON_PROTECTED_MODE
RG_REASON_PROTECTED_OWNER
RG_REASON_SECURITY_CAPABILITY
RG_REASON_INTEGRITY_XATTR
RG_REASON_SECURITY_LABEL
RG_REASON_PROTECTED_ACL
RG_REASON_PROTECTED_UNLINK
RG_REASON_PROTECTED_RENAME
RG_REASON_PROTECTED_HARDLINK
RG_REASON_SETID_ADDED
RG_REASON_OWNER_TO_ROOT
RG_REASON_GLOBAL_METADATA
RG_REASON_BASELINE_MODE_MISMATCH
RG_REASON_BASELINE_OWNER_MISMATCH
RG_REASON_BASELINE_FILE_REPLACED
RG_REASON_PROTECTED_MISSING
RG_REASON_GLOBAL_SURVEILLANCE
RG_REASON_ROOT_OWNED_WRITE_EXPOSURE
RG_REASON_METADATA_BURST

Definition at line 51 of file rootguard_shared.h.

                     {
    RG_REASON_NONE = 0,
    RG_REASON_AUTH_TOKEN = 1U << 0,
    RG_REASON_TRUSTED_EXEC = 1U << 1,
    RG_REASON_DENIED_EXEC = 1U << 2,
    RG_REASON_UNKNOWN_EXEC = 1U << 3,
    RG_REASON_FILE_ID_UNAVAILABLE = 1U << 4,
    RG_REASON_DIRECT_CRED_ANOMALY = 1U << 5,
    RG_REASON_PROTECTED_MODE = 1U << 6,
    RG_REASON_PROTECTED_OWNER = 1U << 7,
    RG_REASON_SECURITY_CAPABILITY = 1U << 8,
    RG_REASON_INTEGRITY_XATTR = 1U << 9,
    RG_REASON_SECURITY_LABEL = 1U << 10,
    RG_REASON_PROTECTED_ACL = 1U << 11,
    RG_REASON_PROTECTED_UNLINK = 1U << 12,
    RG_REASON_PROTECTED_RENAME = 1U << 13,
    RG_REASON_PROTECTED_HARDLINK = 1U << 14,
    RG_REASON_SETID_ADDED = 1U << 15,
    RG_REASON_OWNER_TO_ROOT = 1U << 16,
    RG_REASON_GLOBAL_METADATA = 1U << 17,
    RG_REASON_BASELINE_MODE_MISMATCH = 1U << 18,
    RG_REASON_BASELINE_OWNER_MISMATCH = 1U << 19,
    RG_REASON_BASELINE_FILE_REPLACED = 1U << 20,
    RG_REASON_PROTECTED_MISSING = 1U << 21,
    RG_REASON_GLOBAL_SURVEILLANCE = 1U << 22,
    /* High-confidence global signal: a root-owned object gained group/other write access. */
    RG_REASON_ROOT_OWNED_WRITE_EXPOSURE = 1U << 23,
    /* Aggregated signal: many chmod/chown operations from one cgroup in a short window. */
    RG_REASON_METADATA_BURST = 1U << 24,
};

◆ rg_verdict

enum rg_verdict

Enumerator
RG_VERDICT_AUDIT
RG_VERDICT_AUTHORIZED
RG_VERDICT_BLOCKED
RG_VERDICT_TRUSTED
RG_VERDICT_ALERT
RG_VERDICT_RESTORED

Definition at line 32 of file rootguard_shared.h.

                {
    RG_VERDICT_AUDIT = 0,
    RG_VERDICT_AUTHORIZED = 1,
    RG_VERDICT_BLOCKED = 2,
    RG_VERDICT_TRUSTED = 3,
    RG_VERDICT_ALERT = 4,
    RG_VERDICT_RESTORED = 5,
};

Classes

Macros

Enumerations