Functions
Gtk::Box *	make_status_item (const Glib::ustring &label, Gtk::Label &value)
bool	has_exact_path (const BastionGuard::RootGuard::Event &event)
Glib::ustring	path_resolution_text (const BastionGuard::RootGuard::Event &event)
Glib::ustring	incident_title (const BastionGuard::RootGuard::Event &event)
Glib::ustring	incident_detail (const BastionGuard::RootGuard::Event &event)
bool	restore_available (const BastionGuard::RootGuard::Event &event)
bool	remove_available (const BastionGuard::RootGuard::Event &event)
Glib::ustring	recovery_note (const BastionGuard::RootGuard::Event &event)
std::string	incident_key (const BastionGuard::RootGuard::Event &event)
bool	closes_incident (const BastionGuard::RootGuard::Event &event)
void	clear_list (Gtk::ListBox &list)
void	append_path_row (Gtk::ListBox &list, const std::string &path)
std::string	trim_copy (std::string value)
std::string	rules_signature (const BastionGuard::RootGuard::ApplicationRules &rules)

Function Documentation

◆ append_path_row()

void anonymous_namespace{RootGuardPage.cpp}::append_path_row	(	Gtk::ListBox &	list,
		const std::string &	path )

Definition at line 238 of file RootGuardPage.cpp.

{
    auto* label = Gtk::make_managed<Gtk::Label>(path);
    label->set_halign(Gtk::Align::START);
    label->set_hexpand(true);
    label->set_selectable(true);
    label->set_margin(8);
    label->set_tooltip_text(path);
    list.append(*label);
}

References append_path_row().

Referenced by append_path_row().

◆ clear_list()

void anonymous_namespace{RootGuardPage.cpp}::clear_list ( Gtk::ListBox & list )

Definition at line 232 of file RootGuardPage.cpp.

{
    while (auto* child = list.get_first_child())
        list.remove(*child);
}

References clear_list().

Referenced by clear_list().

◆ closes_incident()

bool anonymous_namespace{RootGuardPage.cpp}::closes_incident ( const BastionGuard::RootGuard::Event & event )

Definition at line 225 of file RootGuardPage.cpp.

{
    return event.event == "file-restored" ||
           event.event == "file-quarantined" ||
           event.event == "integrity-restored";
}

References closes_incident().

Referenced by closes_incident().

◆ has_exact_path()

bool anonymous_namespace{RootGuardPage.cpp}::has_exact_path ( const BastionGuard::RootGuard::Event & event )

Definition at line 39 of file RootGuardPage.cpp.

{
    return !event.filename.empty() && event.filename.front() == '/';
}

References has_exact_path().

Referenced by has_exact_path(), incident_detail(), incident_key(), recovery_note(), remove_available(), and restore_available().

◆ incident_detail()

Glib::ustring anonymous_namespace{RootGuardPage.cpp}::incident_detail ( const BastionGuard::RootGuard::Event & event )

Definition at line 105 of file RootGuardPage.cpp.

{
    std::ostringstream output;
    output << "Affected object: "
           << (event.filename.empty() ? "--" : event.filename);
 
    if (has_exact_path(event)) {
        const std::filesystem::path affected(event.filename);
        const std::string directory = affected.parent_path().string();
        output << "\nAffected directory: "
               << (directory.empty() ? "/" : directory);
    } else {
        output << "\nAffected directory: unavailable";
    }
 
    output << "\nPath resolution: " << path_resolution_text(event).raw();
 
    if (event.device != 0 || event.inode != 0)
        output << "\nTarget identity: " << event.device << ':' << event.inode;
 
    output << "\nProcess name: "
           << (event.comm.empty() ? "unknown" : event.comm)
           << "\nProcess identifiers: PID " << event.pid
           << " · TGID " << event.tgid
           << " · PPID " << event.ppid;
 
    if (!event.parent_comm.empty())
        output << "\nParent process: " << event.parent_comm
               << " (PID " << event.ppid << ')';
    if (!event.parent_executable.empty())
        output << "\nParent executable: " << event.parent_executable;
 
    if (!event.actor_executable.empty()) {
        output << "\nActor executable: " << event.actor_executable;
    } else {
        output << "\nActor executable: unresolved";
    }
 
    if (event.actor_device != 0 || event.actor_inode != 0)
        output << "\nActor identity: " << event.actor_device
               << ':' << event.actor_inode;
    if (event.old_euid == event.new_euid)
        output << "\nActor EUID: " << event.old_euid;
    else
        output << "\nActor EUID transition: " << event.old_euid
               << " → " << event.new_euid;
 
    if (event.old_mode != event.new_mode) {
        output << "\nMode: " << std::oct << (event.old_mode & 07777U)
               << " → " << (event.new_mode & 07777U) << std::dec;
    }
    if (event.old_uid != event.new_uid || event.old_gid != event.new_gid) {
        output << "\nOwner: " << event.old_uid << ':' << event.old_gid
               << " → " << event.new_uid << ':' << event.new_gid;
    }
    if ((event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        output << "\nBurst size in kernel window: " << event.auxiliary;
    output << "\nVerdict: " << event.verdict
           << " · Reason: 0x" << std::hex << event.reason_flags << std::dec;
    if (BastionGuard::RootGuard::is_system_service_path(event.filename))
        output << "\nScope: system service definition";
    return output.str();
}

Referenced by incident_detail().

◆ incident_key()

std::string anonymous_namespace{RootGuardPage.cpp}::incident_key ( const BastionGuard::RootGuard::Event & event )

Definition at line 217 of file RootGuardPage.cpp.

{
    if (has_exact_path(event))
        return event.filename;
    return event.filename + "\n" + std::to_string(event.device) + ':' +
           std::to_string(event.inode);
}

References BastionGuard::RootGuard::Event::device, has_exact_path(), incident_key(), and BastionGuard::RootGuard::Event::inode.

Referenced by incident_key().

◆ incident_title()

Glib::ustring anonymous_namespace{RootGuardPage.cpp}::incident_title ( const BastionGuard::RootGuard::Event & event )

Definition at line 59 of file RootGuardPage.cpp.

{
    const bool blocked = event.verdict == "blocked";
    const bool audit = event.verdict == "audit";
 
    if (event.event == "service-blocked")
        return blocked
            ? _("System service stopped and runtime-blocked")
            : _("System service blocking failed");
    if ((event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        return _("Unusual permission-change burst detected");
    if (event.event == "integrity-drift")
        return _("Protected file integrity changed");
    if (event.event == "permission-change")
        return blocked ? _("Permission change blocked")
                       : audit ? _("Permission change observed")
                               : _("Permission change detected");
    if (event.event == "owner-change")
        return blocked ? _("Ownership change blocked")
                       : audit ? _("Ownership change observed")
                               : _("Ownership change detected");
    if (event.event == "protected-unlink")
        return blocked ? _("Protected file removal blocked")
                       : audit ? _("Protected file removal observed")
                               : _("Protected file removal detected");
    if (event.event == "protected-rename")
        return blocked ? _("Protected file rename blocked")
                       : audit ? _("Protected file rename observed")
                               : _("Protected file rename detected");
    if (event.event == "protected-hardlink")
        return blocked ? _("Protected hard-link creation blocked")
                       : audit ? _("Protected hard-link creation observed")
                               : _("Protected hard-link creation detected");
    if (event.event == "xattr-change")
        return blocked ? _("Extended-attribute change blocked")
                       : audit ? _("Extended-attribute change observed")
                               : _("Extended-attribute change detected");
    if (event.event == "acl-change")
        return blocked ? _("ACL change blocked")
                       : audit ? _("ACL change observed")
                               : _("ACL change detected");
    return blocked ? _("Protected metadata change blocked")
                   : audit ? _("Protected metadata change observed")
                           : _("Protected metadata change detected");
}

References _, BastionGuard::RootGuard::Event::event, incident_title(), BastionGuard::RootGuard::Event::reason_flags, and RG_REASON_METADATA_BURST.

Referenced by incident_title().

◆ make_status_item()

Gtk::Box * anonymous_namespace{RootGuardPage.cpp}::make_status_item	(	const Glib::ustring &	label,
		Gtk::Label &	value )

Definition at line 21 of file RootGuardPage.cpp.

{
    auto* box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 4);
    box->add_css_class("rootguard-status-item");
    box->set_hexpand(true);
 
    auto* name = Gtk::make_managed<Gtk::Label>(label);
    name->set_halign(Gtk::Align::CENTER);
    name->add_css_class("rootguard-status-label");
    box->append(*name);
 
    value.set_halign(Gtk::Align::CENTER);
    value.set_wrap(true);
    value.add_css_class("rootguard-status-value");
    box->append(value);
    return box;
}

References make_status_item().

Referenced by make_status_item().

◆ path_resolution_text()

Glib::ustring anonymous_namespace{RootGuardPage.cpp}::path_resolution_text ( const BastionGuard::RootGuard::Event & event )

Definition at line 44 of file RootGuardPage.cpp.

{
    if (event.path_resolution == "protected-baseline")
        return _("exact path from protected baseline");
    if (event.path_resolution == "proc-fd")
        return _("exact path resolved from the process file descriptor");
    if (event.path_resolution == "process-cwd")
        return _("exact path resolved from the process working directory");
    if (event.path_resolution == "kernel-exact")
        return _("exact path supplied by the kernel event");
    if (event.path_resolution == "lsm-exact")
        return _("exact path captured by the LSM before the metadata operation");
    return _("basename only; the exact path was unavailable in this event");
}

References _, BastionGuard::RootGuard::Event::path_resolution, and path_resolution_text().

Referenced by incident_detail(), and path_resolution_text().

◆ recovery_note()

Glib::ustring anonymous_namespace{RootGuardPage.cpp}::recovery_note ( const BastionGuard::RootGuard::Event & event )

Definition at line 200 of file RootGuardPage.cpp.

{
    if (event.rule_id == 0)
        return _("This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable.");
    if (!has_exact_path(event))
        return _("RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object.");
    if (event.event == "protected-unlink")
        return event.verdict == "blocked"
            ? _("The removal was denied; the file is still present and no restore is required.")
            : _("The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy.");
    if (event.event == "protected-rename")
        return _("Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup.");
    if (event.event == "protected-hardlink")
        return _("No automatic action is offered for hard-link events. Review the source and destination manually.");
    return {};
}

References _, BastionGuard::RootGuard::Event::event, has_exact_path(), recovery_note(), and BastionGuard::RootGuard::Event::rule_id.

Referenced by recovery_note().

◆ remove_available()

bool anonymous_namespace{RootGuardPage.cpp}::remove_available ( const BastionGuard::RootGuard::Event & event )

Definition at line 184 of file RootGuardPage.cpp.

{
    if (event.rule_id == 0 || !has_exact_path(event))
        return false;
 
    constexpr std::uint32_t kProtectedMissing = 1U << 21;
    if ((event.reason_flags & kProtectedMissing) != 0)
        return false;
 
    return event.event == "permission-change" ||
           event.event == "owner-change" ||
           event.event == "xattr-change" ||
           event.event == "acl-change" ||
           event.event == "integrity-drift";
}

References has_exact_path(), BastionGuard::RootGuard::Event::reason_flags, remove_available(), and BastionGuard::RootGuard::Event::rule_id.

Referenced by remove_available().

◆ restore_available()

bool anonymous_namespace{RootGuardPage.cpp}::restore_available ( const BastionGuard::RootGuard::Event & event )

Definition at line 169 of file RootGuardPage.cpp.

{
    if (event.rule_id == 0 || !has_exact_path(event))
        return false;
 
    constexpr std::uint32_t kBaselineFileReplaced = 1U << 20;
    constexpr std::uint32_t kProtectedMissing = 1U << 21;
    if ((event.reason_flags & (kBaselineFileReplaced | kProtectedMissing)) != 0)
        return false;
    return event.event == "permission-change" ||
           event.event == "owner-change" ||
           event.event == "integrity-drift" ||
           event.event == "service-blocked";
}

References has_exact_path(), BastionGuard::RootGuard::Event::reason_flags, restore_available(), and BastionGuard::RootGuard::Event::rule_id.

Referenced by restore_available().

◆ rules_signature()

std::string anonymous_namespace{RootGuardPage.cpp}::rules_signature ( const BastionGuard::RootGuard::ApplicationRules & rules )

Definition at line 258 of file RootGuardPage.cpp.

{
    std::ostringstream output;
    const auto append = [&output](const char marker,
                                  const std::vector<std::string>& values) {
        output << marker << ':' << values.size() << '\n';
        for (const auto& value : values)
            output << value << '\n';
    };
    append('A', rules.trustedApplications);
    append('T', rules.trustedExecutables);
    append('D', rules.deniedExecutables);
    return output.str();
}

References BastionGuard::RootGuard::ApplicationRules::deniedExecutables, rules_signature(), BastionGuard::RootGuard::ApplicationRules::trustedApplications, and BastionGuard::RootGuard::ApplicationRules::trustedExecutables.

Referenced by rules_signature().

◆ trim_copy()

std::string anonymous_namespace{RootGuardPage.cpp}::trim_copy ( std::string value )

Definition at line 249 of file RootGuardPage.cpp.

{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}

References trim_copy().

Referenced by trim_copy().

Functions