rootguard_shared.h

Go to the documentation of this file.

#ifndef BASTIONGUARD_ROOTGUARD_SHARED_H
#define BASTIONGUARD_ROOTGUARD_SHARED_H
 
#ifndef __VMLINUX_H__
#include <linux/types.h>
#endif
 
#define RG_COMM_LEN 16
#define RG_FILENAME_LEN 256
#define RG_XATTR_NAME_LEN 32
#define RG_POLICY_ABI_VERSION 7U
 
enum rg_event_type {
    RG_EVENT_SETUID = 1,
    RG_EVENT_EXEC_PRIV = 2,
    RG_EVENT_CREDENTIAL_ANOMALY = 3,
    RG_EVENT_PERMISSION_CHANGE = 4,
    RG_EVENT_OWNER_CHANGE = 5,
    RG_EVENT_XATTR_CHANGE = 6,
    RG_EVENT_ACL_CHANGE = 7,
    RG_EVENT_PROTECTED_UNLINK = 8,
    RG_EVENT_PROTECTED_RENAME = 9,
    RG_EVENT_PROTECTED_HARDLINK = 10,
    RG_EVENT_INTEGRITY_DRIFT = 11,
    RG_EVENT_INTEGRITY_RESTORED = 12,
    RG_EVENT_SERVICE_BLOCKED = 13,
    RG_EVENT_FILE_RESTORED = 14,
    RG_EVENT_FILE_QUARANTINED = 15,
    RG_EVENT_PROTECTION_MODE_CHANGED = 16,
};
 
enum rg_verdict {
    RG_VERDICT_AUDIT = 0,
    RG_VERDICT_AUTHORIZED = 1,
    RG_VERDICT_BLOCKED = 2,
    RG_VERDICT_TRUSTED = 3,
    RG_VERDICT_ALERT = 4,
    RG_VERDICT_RESTORED = 5,
};
 
enum rg_kernel_mode {
    RG_MODE_AUDIT = 0,
    RG_MODE_ENFORCE = 1,
};
 
enum rg_action {
    RG_ACTION_AUDIT = 0,
    RG_ACTION_BLOCK = 1,
};
 
enum rg_reason_flags {
    RG_REASON_NONE = 0,
    RG_REASON_AUTH_TOKEN = 1U << 0,
    RG_REASON_TRUSTED_EXEC = 1U << 1,
    RG_REASON_DENIED_EXEC = 1U << 2,
    RG_REASON_UNKNOWN_EXEC = 1U << 3,
    RG_REASON_FILE_ID_UNAVAILABLE = 1U << 4,
    RG_REASON_DIRECT_CRED_ANOMALY = 1U << 5,
    RG_REASON_PROTECTED_MODE = 1U << 6,
    RG_REASON_PROTECTED_OWNER = 1U << 7,
    RG_REASON_SECURITY_CAPABILITY = 1U << 8,
    RG_REASON_INTEGRITY_XATTR = 1U << 9,
    RG_REASON_SECURITY_LABEL = 1U << 10,
    RG_REASON_PROTECTED_ACL = 1U << 11,
    RG_REASON_PROTECTED_UNLINK = 1U << 12,
    RG_REASON_PROTECTED_RENAME = 1U << 13,
    RG_REASON_PROTECTED_HARDLINK = 1U << 14,
    RG_REASON_SETID_ADDED = 1U << 15,
    RG_REASON_OWNER_TO_ROOT = 1U << 16,
    RG_REASON_GLOBAL_METADATA = 1U << 17,
    RG_REASON_BASELINE_MODE_MISMATCH = 1U << 18,
    RG_REASON_BASELINE_OWNER_MISMATCH = 1U << 19,
    RG_REASON_BASELINE_FILE_REPLACED = 1U << 20,
    RG_REASON_PROTECTED_MISSING = 1U << 21,
    RG_REASON_GLOBAL_SURVEILLANCE = 1U << 22,
    /* High-confidence global signal: a root-owned object gained group/other write access. */
    RG_REASON_ROOT_OWNED_WRITE_EXPOSURE = 1U << 23,
    /* Aggregated signal: many chmod/chown operations from one cgroup in a short window. */
    RG_REASON_METADATA_BURST = 1U << 24,
};
 
 
enum rg_path_resolution {
    RG_PATH_BASENAME = 0,
    RG_PATH_PROTECTED_BASELINE = 1,
    RG_PATH_PROC_FD = 2,
    RG_PATH_PROCESS_CWD = 3,
    RG_PATH_KERNEL_EXACT = 4,
    RG_PATH_LSM_EXACT = 5,
};
 
enum rg_protection_flags {
    RG_PROTECT_MODE = 1U << 0,
    RG_PROTECT_OWNER = 1U << 1,
    RG_PROTECT_CAPABILITY_XATTR = 1U << 2,
    RG_PROTECT_INTEGRITY_XATTR = 1U << 3,
    RG_PROTECT_SECURITY_LABEL = 1U << 4,
    RG_PROTECT_ACL = 1U << 5,
    RG_PROTECT_UNLINK = 1U << 6,
    RG_PROTECT_RENAME = 1U << 7,
    RG_PROTECT_HARDLINK = 1U << 8,
    /* Never enforce this identity; it remains audit-only (normally user home). */
    RG_PROTECT_AUDIT_ONLY = 1U << 31,
};
 
#define RG_PROTECT_DEFAULT \
    (RG_PROTECT_MODE | RG_PROTECT_OWNER | RG_PROTECT_CAPABILITY_XATTR | \
     RG_PROTECT_INTEGRITY_XATTR | RG_PROTECT_SECURITY_LABEL | \
     RG_PROTECT_ACL | RG_PROTECT_UNLINK | RG_PROTECT_RENAME | \
     RG_PROTECT_HARDLINK)
 
struct rg_file_key {
    __u64 device;
    __u64 inode;
};
 
struct rg_rule_value {
    __u32 rule_id;
    __u32 flags;
};
 
struct rg_protected_value {
    __u32 rule_id;
    __u32 flags;
    __u32 baseline_mode;
    __u32 baseline_uid;
    __u32 baseline_gid;
    __u32 reserved;
};
 
struct rg_kernel_config {
    __u32 abi_version;
    __u32 mode;
    __u32 unknown_action;
    __u32 log_trusted;
    __u32 metadata_action;
    __u32 credential_action;
    __u32 monitor_global_privilege_metadata;
    __u32 global_metadata_action;
    __u32 ignore_run_global_metadata;
    __u32 detect_global_metadata_bursts;
    __u32 global_metadata_sample_limit;
    __u32 metadata_burst_threshold;
    __u32 metadata_burst_window_ms;
    __u32 metadata_burst_cooldown_ms;
};
 
struct rg_event {
    __u64 timestamp_ns;
    __u32 pid;
    __u32 tgid;
    __u32 ppid;
    __u32 old_euid;
    __u32 new_euid;
    __u32 event_type;
    __u32 verdict;
    __u32 reason_flags;
    __u32 rule_id;
    __s32 lsm_flags;
    __u32 auxiliary;
    __u32 path_resolution;
    __u32 reserved_event;
    struct rg_file_key file;
    struct rg_file_key actor_file;
    struct rg_file_key parent_file;
    __u64 actor_start_boottime_ns;
    __u32 old_mode;
    __u32 new_mode;
    __u32 old_uid;
    __u32 new_uid;
    __u32 old_gid;
    __u32 new_gid;
    char comm[RG_COMM_LEN];
    char parent_comm[RG_COMM_LEN];
    char filename[RG_FILENAME_LEN];
    char actor_executable[RG_FILENAME_LEN];
    char parent_executable[RG_FILENAME_LEN];
    char xattr_name[RG_XATTR_NAME_LEN];
};
 
/* One-shot authorization token for a future PAM/polkit/sudo bridge. */
struct rg_auth_token {
    __u64 expires_ns;
    __u32 target_euid;
    __u32 issuer_pid;
};
 
#endif