JsonEventSink.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/JsonEventSink.hpp"
 
#include <chrono>
#include <iomanip>
#include <sstream>
#include <stdexcept>
 
namespace bastionguard::rootguard {
namespace {
 
const char* eventName(const __u32 type) noexcept
{
    switch (type) {
    case RG_EVENT_SETUID: return "setuid";
    case RG_EVENT_EXEC_PRIV: return "exec-priv";
    case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
    case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
    case RG_EVENT_OWNER_CHANGE: return "owner-change";
    case RG_EVENT_XATTR_CHANGE: return "xattr-change";
    case RG_EVENT_ACL_CHANGE: return "acl-change";
    case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
    case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
    case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
    case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
    case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
    case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
    case RG_EVENT_FILE_RESTORED: return "file-restored";
    case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
    case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
    default: return "unknown";
    }
}
 
const char* verdictName(const __u32 verdict) noexcept
{
    switch (verdict) {
    case RG_VERDICT_AUDIT: return "audit";
    case RG_VERDICT_AUTHORIZED: return "authorized";
    case RG_VERDICT_BLOCKED: return "blocked";
    case RG_VERDICT_TRUSTED: return "trusted";
    case RG_VERDICT_ALERT: return "alert";
    case RG_VERDICT_RESTORED: return "restored";
    default: return "unknown";
    }
}
 
const char* pathResolutionName(const __u32 value) noexcept
{
    switch (value) {
    case RG_PATH_PROTECTED_BASELINE: return "protected-baseline";
    case RG_PATH_PROC_FD: return "proc-fd";
    case RG_PATH_PROCESS_CWD: return "process-cwd";
    case RG_PATH_KERNEL_EXACT: return "kernel-exact";
    case RG_PATH_LSM_EXACT: return "lsm-exact";
    default: return "basename-only";
    }
}
 
std::string receivedAtUtc()
{
    const auto now = std::chrono::system_clock::now();
    const auto time = std::chrono::system_clock::to_time_t(now);
    std::tm tm {};
    gmtime_r(&time, &tm);
    std::ostringstream output;
    output << std::put_time(&tm, "%Y-%m-%dT%H:%M:%SZ");
    return output.str();
}
 
} // namespace
 
JsonEventSink::JsonEventSink(const std::filesystem::path& path)
    : stream_(path, std::ios::app)
{
    if (!stream_)
        throw std::runtime_error("impossibile aprire il log JSON: " + path.string());
}
 
std::string JsonEventSink::escape(const char* value)
{
    std::ostringstream output;
    for (const unsigned char character : std::string(value ? value : "")) {
        switch (character) {
        case '"': output << "\\\""; break;
        case '\\': output << "\\\\"; break;
        case '\b': output << "\\b"; break;
        case '\f': output << "\\f"; break;
        case '\n': output << "\\n"; break;
        case '\r': output << "\\r"; break;
        case '\t': output << "\\t"; break;
        default:
            if (character < 0x20)
                output << "\\u" << std::hex << std::setw(4) << std::setfill('0')
                       << static_cast<unsigned int>(character) << std::dec;
            else
                output << static_cast<char>(character);
        }
    }
    return output.str();
}
 
void JsonEventSink::onEvent(const rg_event& event) noexcept
{
    try {
        std::lock_guard lock(mutex_);
        stream_ << '{'
                << "\"received_at\":\"" << receivedAtUtc() << "\","
                << "\"kernel_monotonic_ns\":" << event.timestamp_ns << ','
                << "\"event\":\"" << eventName(event.event_type) << "\","
                << "\"verdict\":\"" << verdictName(event.verdict) << "\","
                << "\"pid\":" << event.pid << ','
                << "\"tgid\":" << event.tgid << ','
                << "\"ppid\":" << event.ppid << ','
                << "\"old_euid\":" << event.old_euid << ','
                << "\"new_euid\":" << event.new_euid << ','
                << "\"rule_id\":" << event.rule_id << ','
                << "\"reason_flags\":" << event.reason_flags << ','
                << "\"lsm_flags\":" << event.lsm_flags << ','
                << "\"auxiliary\":" << event.auxiliary << ','
                << "\"path_resolution\":\"" << pathResolutionName(event.path_resolution) << "\","
                << "\"device\":" << event.file.device << ','
                << "\"inode\":" << event.file.inode << ','
                << "\"actor_device\":" << event.actor_file.device << ','
                << "\"actor_inode\":" << event.actor_file.inode << ','
                << "\"parent_device\":" << event.parent_file.device << ','
                << "\"parent_inode\":" << event.parent_file.inode << ','
                << "\"actor_start_boottime_ns\":" << event.actor_start_boottime_ns << ','
                << "\"old_mode\":" << event.old_mode << ','
                << "\"new_mode\":" << event.new_mode << ','
                << "\"old_uid\":" << event.old_uid << ','
                << "\"new_uid\":" << event.new_uid << ','
                << "\"old_gid\":" << event.old_gid << ','
                << "\"new_gid\":" << event.new_gid << ','
                << "\"comm\":\"" << escape(event.comm) << "\","
                << "\"parent_comm\":\"" << escape(event.parent_comm) << "\","
                << "\"actor_executable\":\"" << escape(event.actor_executable) << "\","
                << "\"parent_executable\":\"" << escape(event.parent_executable) << "\","
                << "\"filename\":\"" << escape(event.filename) << "\","
                << "\"xattr_name\":\"" << escape(event.xattr_name) << "\""
                << "}\n";
        stream_.flush();
    } catch (...) {
        // Logging must never crash the security engine.
    }
}
 
} // namespace bastionguard::rootguard