SaneSecurityUpdater.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "SaneSecurityUpdater.hpp"
#include <iostream>
#include <cstdlib>
#include <vector>
#include <filesystem>
#include <algorithm>
#include <system_error>
#include <glibmm/i18n.h>
#include "SafeProcess.hpp"
 
static bool reload_clamav_service() {
    const std::vector<std::string> services = {
        "clamav-daemon.service",
        "clamd@scan.service",
        "clamd.service"
    };
 
    for (const auto& svc : services) {
        if (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                             "--system", "is-active", svc}).ok() &&
            bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                             "--system", "try-reload-or-restart", svc}).ok())
            return true;
    }
 
    return false;
}
bool SaneSecurityUpdater::runHeadless() {
 
    const std::string tmpDir = "/var/lib/clamav/sanesecurity.tmp";
 
 
    // Fixed working directory and argument-vector execution: no root shell.
    // Keep deletion confined to this directory, never to /var/lib/clamav.
    namespace fs = std::filesystem;
    std::error_code ec;
    fs::remove_all(tmpDir, ec);
    if (ec || !fs::create_directories(tmpDir, ec) || ec) {
        std::cerr << _("Errore: impossibile creare la cartella temporanea") << std::endl;
        return false;
    }
 
    const auto sync = bg_process::run({"rsync", "-av", "--delete", "--",
                     "rsync://rsync.sanesecurity.net/sanesecurity", tmpDir + "/"}, true);
    if (!sync.ok()) {
        std::cerr << _("Errore durante rsync") << std::endl;
        fs::remove_all(tmpDir, ec);
        return false;
    }
 
    // Never evaluate downloaded filenames as shell metacharacters.
    // Copy only extensions that ClamAV/SaneSecurity expects.
    const std::vector<std::string> extensions = {
        ".ndb", ".hdb", ".ldb", ".yar", ".yara", ".ign2", ".txt"
    };
    bool copies_ok = true;
    for (const auto& entry : fs::directory_iterator(tmpDir, ec)) {
        if (ec) { copies_ok = false; break; }
        // Never follow symlinks provided by an external rsync mirror.
        if (entry.is_symlink(ec) || ec) {
            copies_ok = false;
            ec.clear();
            continue;
        }
        if (!entry.is_regular_file(ec) || ec) {
            ec.clear();
            continue;
        }
        const auto extension = entry.path().extension().string();
        if (std::find(extensions.begin(), extensions.end(), extension) == extensions.end()) continue;
        const fs::path destination = fs::path("/var/lib/clamav") / entry.path().filename();
        fs::copy_file(entry.path(), destination, fs::copy_options::overwrite_existing, ec);
        if (ec) {
            copies_ok = false;
            ec.clear();
        }
    }
    fs::remove_all(tmpDir, ec);
    if (!copies_ok) std::cerr << _("Errore copiando i file SaneSecurity") << std::endl;
 
    if (!reload_clamav_service()) {
    std::cerr << _("⚠ Impossibile ricaricare il servizio ClamAV: servizio non trovato") << "\n";
}
 
    return copies_ok;
}