Policy.hpp

Go to the documentation of this file.

#pragma once
 
#include <cstdint>
#include <filesystem>
#include <string>
#include <vector>
 
namespace bastionguard::rootguard {
 
enum class Mode : std::uint32_t {
    Audit = 0,
    Enforce = 1,
};
 
enum class Action : std::uint32_t {
    Audit = 0,
    Block = 1,
};
 
struct PolicyPath {
    std::uint32_t id{};
    std::filesystem::path path;
    bool required{};
    bool recursive{};
};
 
struct Policy {
    std::uint32_t version{2};
    Mode mode{Mode::Audit};
    Action unknownAction{Action::Audit};
    Action metadataAction{Action::Audit};
    Action globalMetadataAction{Action::Audit};
    Action credentialAnomalyAction{Action::Audit};
    bool allowMissingPaths{true};
    bool requireRootOwnedTrustedExecutables{true};
    bool protectTrustedExecutables{true};
    // Direct privilege primitives stay visible, but the eBPF source samples them
    // per execution domain so backup/restore work cannot fill the ring buffer.
    bool monitorGlobalPrivilegeMetadata{true};
    // Count only destructive unprotected permission/ownership patterns inside the
    // kernel and emit one aggregate signal instead of one popup per file.
    bool detectGlobalMetadataBursts{true};
    std::uint32_t globalMetadataSampleLimit{3};
    std::uint32_t metadataBurstThreshold{32};
    std::uint32_t metadataBurstWindowMs{5000};
    std::uint32_t metadataBurstCooldownMs{300000};
    // Suppress unprotected global metadata noise below /run. Protected identities
    // and credential/privilege-transition checks always take precedence.
    bool ignoreRunGlobalMetadata{true};
    bool logTrusted{true};
    bool autoBlockSystemServices{true};
    bool blockUserHome{false};
    std::uint32_t integrityPollSeconds{5};
    std::filesystem::path eventLog{"/var/log/bastionguard/rootguard-events.jsonl"};
    std::vector<PolicyPath> trustedApplications;
    std::vector<PolicyPath> trustedExecutables;
    std::vector<PolicyPath> deniedExecutables;
    std::vector<PolicyPath> protectedPaths;
    std::vector<PolicyPath> ignoredPaths;
};
 
[[nodiscard]] const char* toString(Mode mode) noexcept;
[[nodiscard]] const char* toString(Action action) noexcept;
 
} // namespace bastionguard::rootguard