PolicyLoaderTests.cpp File Reference

Go to the source code of this file.

Namespaces
namespace	anonymous_namespace{PolicyLoaderTests.cpp}

Functions
template<typename Function>
bool	anonymous_namespace{PolicyLoaderTests.cpp}::throwsRuntimeError (Function &&function)
int	main ()

Function Documentation

main()

int main

(

void

)

Definition at line 27 of file PolicyLoaderTests.cpp.

{
    namespace rg = bastionguard::rootguard;
 
    const auto directory = std::filesystem::temp_directory_path() /
                           "bastionguard-rootguard-policy-tests";
    std::filesystem::remove_all(directory);
    std::filesystem::create_directories(directory);
 
    const auto path = directory / "valid.conf";
    {
        std::ofstream output(path);
        output << R"(
[engine]
version = 2
mode = enforce
unknown_action = block
metadata_action = block
global_metadata_action = audit
credential_anomaly_action = block
allow_missing_paths = true
require_root_owned_trusted_executables = false
protect_trusted_executables = true
monitor_global_privilege_metadata = true
detect_global_metadata_bursts = true
global_metadata_sample_limit = 5
metadata_burst_threshold = 32
metadata_burst_window_ms = 2500
metadata_burst_cooldown_ms = 60000
ignore_run_global_metadata = false
integrity_poll_seconds = 3
log_trusted = true
auto_block_system_services = false
block_user_home = false
event_log = /tmp/rootguard-test.jsonl
 
[trusted-applications]
path = /usr/bin/firefox
 
[trusted-executables]
path = /usr/bin/sudo
required_path = /usr/bin/su
 
[denied-executables]
path = /tmp/evil
 
[protected-paths]
required_path = /etc/sudoers
recursive_path = /etc/pam.d
 
[ignored-paths]
path = /etc/cron.d/bastionguard-backup-hourly
recursive_path = /var/lib/bastionguard/generated
)";
    }
 
    const auto policy = rg::PolicyLoader::load(path);
    assert(policy.version == 2);
    assert(policy.mode == rg::Mode::Enforce);
    assert(policy.unknownAction == rg::Action::Block);
    assert(policy.metadataAction == rg::Action::Block);
    assert(policy.globalMetadataAction == rg::Action::Audit);
    assert(policy.credentialAnomalyAction == rg::Action::Block);
    assert(policy.detectGlobalMetadataBursts);
    assert(policy.globalMetadataSampleLimit == 5);
    assert(policy.metadataBurstThreshold == 32);
    assert(policy.metadataBurstWindowMs == 2500);
    assert(policy.metadataBurstCooldownMs == 60000);
    assert(!policy.ignoreRunGlobalMetadata);
    assert(policy.integrityPollSeconds == 3);
    assert(!policy.autoBlockSystemServices);
    assert(!policy.blockUserHome);
    assert(policy.trustedApplications.size() == 1);
    assert(policy.trustedApplications.at(0).id == 1);
    assert(policy.trustedExecutables.size() == 2);
    assert(policy.trustedExecutables.at(1).required);
    assert(policy.deniedExecutables.size() == 1);
    assert(policy.deniedExecutables.at(0).id == 4);
    assert(policy.protectedPaths.size() == 2);
    assert(policy.protectedPaths.at(0).id == 5);
    assert(policy.protectedPaths.at(0).required);
    assert(!policy.protectedPaths.at(0).recursive);
    assert(policy.protectedPaths.at(1).id == 6);
    assert(policy.protectedPaths.at(1).recursive);
    assert(policy.ignoredPaths.size() == 2);
    assert(policy.ignoredPaths.at(0).id == 7);
    assert(!policy.ignoredPaths.at(0).recursive);
    assert(policy.ignoredPaths.at(1).id == 8);
    assert(policy.ignoredPaths.at(1).recursive);
 
    const std::string unsafeGlobalBlock = R"(
[engine]

References main(), and anonymous_namespace{PolicyLoaderTests.cpp}::throwsRuntimeError().