PolicySecurity.hpp

Go to the documentation of this file.

#pragma once
 
#include <filesystem>
#include <string>
 
namespace bastionguard::rootguard {
 
class PolicySecurity final {
public:
    /*
     * Opens the policy with O_NOFOLLOW, validates the already-open descriptor
     * and reads from that same descriptor. This removes the validate/open
     * time-of-check/time-of-use window.
     */
    [[nodiscard]] static std::string read(
        const std::filesystem::path& path,
        bool requireSecureOwnership);
};
 
} // namespace bastionguard::rootguard