PolicyLoaderTests.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/PolicyLoader.hpp"
#include "rootguard/PolicySecurity.hpp"
 
#include <cassert>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <stdexcept>
#include <string>
 
namespace {
 
template <typename Function>
bool throwsRuntimeError(Function&& function)
{
    try {
        function();
    } catch (const std::runtime_error&) {
        return true;
    }
    return false;
}
 
} // namespace
 
int main()
{
    namespace rg = bastionguard::rootguard;
 
    const auto directory = std::filesystem::temp_directory_path() /
                           "bastionguard-rootguard-policy-tests";
    std::filesystem::remove_all(directory);
    std::filesystem::create_directories(directory);
 
    const auto path = directory / "valid.conf";
    {
        std::ofstream output(path);
        output << R"(
[engine]
version = 2
mode = enforce
unknown_action = block
metadata_action = block
global_metadata_action = audit
credential_anomaly_action = block
allow_missing_paths = true
require_root_owned_trusted_executables = false
protect_trusted_executables = true
monitor_global_privilege_metadata = true
detect_global_metadata_bursts = true
global_metadata_sample_limit = 5
metadata_burst_threshold = 32
metadata_burst_window_ms = 2500
metadata_burst_cooldown_ms = 60000
ignore_run_global_metadata = false
integrity_poll_seconds = 3
log_trusted = true
auto_block_system_services = false
block_user_home = false
event_log = /tmp/rootguard-test.jsonl
 
[trusted-applications]
path = /usr/bin/firefox
 
[trusted-executables]
path = /usr/bin/sudo
required_path = /usr/bin/su
 
[denied-executables]
path = /tmp/evil
 
[protected-paths]
required_path = /etc/sudoers
recursive_path = /etc/pam.d
 
[ignored-paths]
path = /etc/cron.d/bastionguard-backup-hourly
recursive_path = /var/lib/bastionguard/generated
)";
    }
 
    const auto policy = rg::PolicyLoader::load(path);
    assert(policy.version == 2);
    assert(policy.mode == rg::Mode::Enforce);
    assert(policy.unknownAction == rg::Action::Block);
    assert(policy.metadataAction == rg::Action::Block);
    assert(policy.globalMetadataAction == rg::Action::Audit);
    assert(policy.credentialAnomalyAction == rg::Action::Block);
    assert(policy.detectGlobalMetadataBursts);
    assert(policy.globalMetadataSampleLimit == 5);
    assert(policy.metadataBurstThreshold == 32);
    assert(policy.metadataBurstWindowMs == 2500);
    assert(policy.metadataBurstCooldownMs == 60000);
    assert(!policy.ignoreRunGlobalMetadata);
    assert(policy.integrityPollSeconds == 3);
    assert(!policy.autoBlockSystemServices);
    assert(!policy.blockUserHome);
    assert(policy.trustedApplications.size() == 1);
    assert(policy.trustedApplications.at(0).id == 1);
    assert(policy.trustedExecutables.size() == 2);
    assert(policy.trustedExecutables.at(1).required);
    assert(policy.deniedExecutables.size() == 1);
    assert(policy.deniedExecutables.at(0).id == 4);
    assert(policy.protectedPaths.size() == 2);
    assert(policy.protectedPaths.at(0).id == 5);
    assert(policy.protectedPaths.at(0).required);
    assert(!policy.protectedPaths.at(0).recursive);
    assert(policy.protectedPaths.at(1).id == 6);
    assert(policy.protectedPaths.at(1).recursive);
    assert(policy.ignoredPaths.size() == 2);
    assert(policy.ignoredPaths.at(0).id == 7);
    assert(!policy.ignoredPaths.at(0).recursive);
    assert(policy.ignoredPaths.at(1).id == 8);
    assert(policy.ignoredPaths.at(1).recursive);
 
    const std::string unsafeGlobalBlock = R"(
[engine]
version = 2
mode = enforce
global_metadata_action = block
monitor_global_privilege_metadata = true
)";
    assert(throwsRuntimeError([&] {
        (void)rg::PolicyLoader::loadFromText(
            unsafeGlobalBlock, "unsafe-global-block.conf");
    }));
 
    const std::string unsafeBurstWindow = R"(
[engine]
version = 2
metadata_burst_threshold = 4
metadata_burst_window_ms = 100
metadata_burst_cooldown_ms = 50
)";
    assert(throwsRuntimeError([&] {
        (void)rg::PolicyLoader::loadFromText(
            unsafeBurstWindow, "unsafe-burst-window.conf");
    }));
 
    const std::string trustedApplicationDeniedConflict = R"(
[engine]
version = 2
mode = audit
[trusted-applications]
path = /usr/bin/firefox
[denied-executables]
path = /usr/bin/firefox
)";
    assert(throwsRuntimeError([&] {
        (void)rg::PolicyLoader::loadFromText(
            trustedApplicationDeniedConflict, "trusted-app-conflict.conf");
    }));
 
    const std::string noTrusted = R"(
[engine]
version = 2
mode = enforce
unknown_action = block
metadata_action = audit
credential_anomaly_action = block
)";
    assert(throwsRuntimeError([&] {
        (void)rg::PolicyLoader::loadFromText(noTrusted, "no-trusted.conf");
    }));
 
    const auto symlink = directory / "policy-link.conf";
    std::filesystem::create_symlink(path, symlink);
    assert(throwsRuntimeError([&] {
        (void)rg::PolicySecurity::read(symlink, false);
    }));
 
    std::filesystem::permissions(
        path,
        std::filesystem::perms::owner_read |
            std::filesystem::perms::owner_write |
            std::filesystem::perms::group_write,
        std::filesystem::perm_options::replace);
    assert(throwsRuntimeError([&] {
        (void)rg::PolicySecurity::read(path, true);
    }));
 
    std::filesystem::remove_all(directory);
    std::cout << "PolicyLoaderTests: OK\n";
    return 0;
}