bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp} Namespace Reference

Classes
struct	ResolvedRule
struct	PreparedProtected

Functions
std::runtime_error	systemError (const char *operation)
std::uint64_t	monotonicNanoseconds ()
std::string	fileKeyString (const rg_file_key &key)
bool	pathStartsWith (const std::filesystem::path &path, const std::filesystem::path &prefix) noexcept
bool	isIgnoredPath (const Policy &policy, const std::filesystem::path &candidate) noexcept
bool	isUserHomePath (const std::filesystem::path &candidate) noexcept
bool	identityMatches (const std::filesystem::path &candidate, const rg_file_key &expected) noexcept
std::string	readLink (const std::filesystem::path &path) noexcept
void	copyString (char *destination, const std::size_t destinationSize, const std::string &source) noexcept

Variables
constexpr std::size_t	kMaximumProtectedInodes = 8'000

Function Documentation

copyString()

void bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::copyString ( char * destination, const std::size_t destinationSize, const std::string & source )

noexcept

Definition at line 128 of file RootGuardEngine.cpp.

{
    if (!destination || destinationSize == 0)
        return;
    const auto count = std::min(destinationSize - 1, source.size());
    std::memcpy(destination, source.data(), count);
    destination[count] = '\0';
}

References copyString().

Referenced by copyString().

fileKeyString()

std::string bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::fileKeyString ( const rg_file_key & key )

nodiscard

Definition at line 57 of file RootGuardEngine.cpp.

{
    return std::to_string(key.device) + ":" + std::to_string(key.inode);
}

References rg_file_key::device, fileKeyString(), and rg_file_key::inode.

Referenced by fileKeyString().

identityMatches()

bool bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::identityMatches ( const std::filesystem::path & candidate, const rg_file_key & expected )

noexcept

Definition at line 108 of file RootGuardEngine.cpp.

{
    struct stat metadata {};
    if (::stat(candidate.c_str(), &metadata) != 0)
        return false;
    return FileIdentityResolver::kernelDeviceNumber(metadata.st_dev) == expected.device &&
           static_cast<std::uint64_t>(metadata.st_ino) == expected.inode;
}

References identityMatches(), and bastionguard::rootguard::FileIdentityResolver::kernelDeviceNumber().

Referenced by identityMatches().

isIgnoredPath()

bool bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::isIgnoredPath ( const Policy & policy, const std::filesystem::path & candidate )

noexcept

Definition at line 79 of file RootGuardEngine.cpp.

{
    try {
        const auto normalized = candidate.lexically_normal();
        for (const auto& rule : policy.ignoredPaths) {
            const auto ignored = rule.path.lexically_normal();
            if (rule.recursive ? pathStartsWith(normalized, ignored)
                               : normalized == ignored)
                return true;
        }
    } catch (...) {
    }
    return false;
}

References isIgnoredPath(), and pathStartsWith().

Referenced by isIgnoredPath().

isUserHomePath()

bool bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::isUserHomePath ( const std::filesystem::path & candidate )

noexcept

Definition at line 96 of file RootGuardEngine.cpp.

{
    try {
        const auto normalized = candidate.lexically_normal();
        return pathStartsWith(normalized, "/home") ||
               pathStartsWith(normalized, "/root") ||
               pathStartsWith(normalized, "/var/home");
    } catch (...) {
        return false;
    }
}

References isUserHomePath(), and pathStartsWith().

Referenced by isUserHomePath().

monotonicNanoseconds()

std::uint64_t bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::monotonicNanoseconds ( )

nodiscard

Definition at line 48 of file RootGuardEngine.cpp.

{
    timespec time {};
    if (::clock_gettime(CLOCK_MONOTONIC, &time) != 0)
        throw systemError("clock_gettime");
    return static_cast<std::uint64_t>(time.tv_sec) * 1'000'000'000ULL +
           static_cast<std::uint64_t>(time.tv_nsec);
}

References monotonicNanoseconds(), and systemError().

Referenced by monotonicNanoseconds().

pathStartsWith()

bool bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::pathStartsWith ( const std::filesystem::path & path, const std::filesystem::path & prefix )

noexcept

Definition at line 62 of file RootGuardEngine.cpp.

{
    const auto normalizedPath = path.lexically_normal();
    const auto normalizedPrefix = prefix.lexically_normal();
 
    auto pathIterator = normalizedPath.begin();
    for (auto prefixIterator = normalizedPrefix.begin();
         prefixIterator != normalizedPrefix.end();
         ++prefixIterator, ++pathIterator) {
        if (pathIterator == normalizedPath.end() ||
            *pathIterator != *prefixIterator)
            return false;
    }
    return true;
}

References pathStartsWith().

Referenced by isIgnoredPath(), isUserHomePath(), and pathStartsWith().

readLink()

std::string bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::readLink ( const std::filesystem::path & path )

noexcept

Definition at line 118 of file RootGuardEngine.cpp.

{
    char buffer[PATH_MAX + 1] {};
    const ssize_t count = ::readlink(path.c_str(), buffer, PATH_MAX);
    if (count <= 0)
        return {};
    buffer[count] = '\0';
    return std::string(buffer, static_cast<std::size_t>(count));
}

References readLink().

Referenced by readLink().

systemError()

std::runtime_error bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::systemError ( const char * operation )

nodiscard

Definition at line 43 of file RootGuardEngine.cpp.

{
    return std::runtime_error(std::string(operation) + ": " + std::strerror(errno));
}

References systemError().

Referenced by monotonicNanoseconds(), and systemError().

Variable Documentation

kMaximumProtectedInodes

std::size_t bastionguard::rootguard::anonymous_namespace{RootGuardEngine.cpp}::kMaximumProtectedInodes = 8'000

constexpr

Definition at line 41 of file RootGuardEngine.cpp.