RootGuardEvent.hpp

Go to the documentation of this file.

/*
 * BastionGuard™ RootGuard GTK integration
 * Copyright (C) 2025–2026 Calogero Scarnà
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
#pragma once
 
#include <cstdint>
#include <optional>
#include <string>
 
namespace BastionGuard::RootGuard {
 
enum class EventSeverity {
    Telemetry,
    Observation,
    Incident,
};
 
struct Event {
    std::string received_at;
    std::string event;
    std::string verdict;
    std::uint32_t pid{};
    std::uint32_t tgid{};
    std::uint32_t ppid{};
    std::uint32_t old_euid{};
    std::uint32_t new_euid{};
    std::uint32_t rule_id{};
    std::uint32_t reason_flags{};
    std::int32_t lsm_flags{};
    std::uint32_t auxiliary{};
    std::uint64_t device{};
    std::uint64_t inode{};
    std::uint64_t actor_device{};
    std::uint64_t actor_inode{};
    std::uint64_t parent_device{};
    std::uint64_t parent_inode{};
    std::uint64_t actor_start_boottime_ns{};
    std::uint32_t old_mode{};
    std::uint32_t new_mode{};
    std::uint32_t old_uid{};
    std::uint32_t new_uid{};
    std::uint32_t old_gid{};
    std::uint32_t new_gid{};
    std::string comm;
    std::string parent_comm;
    std::string actor_executable;
    std::string parent_executable;
    std::string filename;
    std::string path_resolution{"basename-only"};
    std::string raw_json;
};
 
std::optional<Event> parse_event_json(const std::string& line);
std::string format_event(const Event& event);
std::string event_fingerprint(const Event& event);
EventSeverity classify_event(const Event& event) noexcept;
bool is_security_observation(const Event& event) noexcept;
bool is_actionable_incident(const Event& event) noexcept;
bool is_system_service_path(const std::string& path) noexcept;
 
} // namespace BastionGuard::RootGuard