bastionguard::rootguard::AutomaticResponseSink Class Reference

#include <AutomaticResponseSink.hpp>

Inheritance diagram for bastionguard::rootguard::AutomaticResponseSink:

Classes
struct	PendingService

Public Member Functions
	AutomaticResponseSink (IEventSink &downstream, bool autoBlockSystemServices)
	~AutomaticResponseSink () override
	AutomaticResponseSink (const AutomaticResponseSink &)=delete
AutomaticResponseSink &	operator= (const AutomaticResponseSink &)=delete
void	onEvent (const rg_event &event) noexcept override
void	setAutoBlockSystemServices (bool enabled) noexcept
Public Member Functions inherited from bastionguard::rootguard::IEventSink
virtual	~IEventSink ()=default

Private Member Functions
void	workerLoop () noexcept
void	enqueueService (const std::filesystem::path &path, const rg_event &source) noexcept
void	emitServiceResult (const std::filesystem::path &path, const rg_event &source, bool success) noexcept

Private Attributes
IEventSink &	downstream_
std::atomic< bool >	autoBlockSystemServices_ {true}
std::mutex	mutex_
std::condition_variable	condition_
std::deque< PendingService >	queue_
std::set< std::string >	queuedPaths_
bool	stopping_ {}
std::thread	worker_

Detailed Description

Definition at line 16 of file AutomaticResponseSink.hpp.

Constructor & Destructor Documentation

AutomaticResponseSink() [1/2]

bastionguard::rootguard::AutomaticResponseSink::AutomaticResponseSink ( IEventSink & downstream, bool autoBlockSystemServices )

explicit

Definition at line 48 of file AutomaticResponseSink.cpp.

    : downstream_(downstream),
      autoBlockSystemServices_(autoBlockSystemServices),
      worker_(&AutomaticResponseSink::workerLoop, this)
{
}

References autoBlockSystemServices_, AutomaticResponseSink(), downstream_, worker_, and workerLoop().

Referenced by AutomaticResponseSink(), AutomaticResponseSink(), and operator=().

~AutomaticResponseSink()

bastionguard::rootguard::AutomaticResponseSink::~AutomaticResponseSink ( )

override

Definition at line 56 of file AutomaticResponseSink.cpp.

{
    {
        std::lock_guard lock(mutex_);
        stopping_ = true;
    }
    condition_.notify_one();
    if (worker_.joinable())
        worker_.join();
}

References condition_, mutex_, stopping_, and worker_.

AutomaticResponseSink() [2/2]

bastionguard::rootguard::AutomaticResponseSink::AutomaticResponseSink ( const AutomaticResponseSink & )

delete

References AutomaticResponseSink().

Member Function Documentation

emitServiceResult()

void bastionguard::rootguard::AutomaticResponseSink::emitServiceResult ( const std::filesystem::path & path, const rg_event & source, bool success )

privatenoexcept

Definition at line 132 of file AutomaticResponseSink.cpp.

{
    try {
        rg_event event = source;
        event.event_type = RG_EVENT_SERVICE_BLOCKED;
        event.verdict = success ? RG_VERDICT_BLOCKED : RG_VERDICT_ALERT;
        copyString(event.comm, sizeof(event.comm), "rootguard-react");
        copyString(event.filename, sizeof(event.filename), path.string());
        downstream_.onEvent(event);
    } catch (...) {
    }
}

References downstream_, rg_event::event_type, RG_EVENT_SERVICE_BLOCKED, RG_VERDICT_ALERT, and RG_VERDICT_BLOCKED.

Referenced by operator=(), and workerLoop().

enqueueService()

void bastionguard::rootguard::AutomaticResponseSink::enqueueService ( const std::filesystem::path & path, const rg_event & source )

privatenoexcept

Definition at line 97 of file AutomaticResponseSink.cpp.

{
    try {
        const std::string key = path.lexically_normal().string();
        std::lock_guard lock(mutex_);
        if (stopping_ || !queuedPaths_.insert(key).second)
            return;
        queue_.push_back(PendingService{path, source});
        condition_.notify_one();
    } catch (...) {
    }
}

References condition_, mutex_, queue_, queuedPaths_, and stopping_.

Referenced by onEvent(), and operator=().

onEvent()

void bastionguard::rootguard::AutomaticResponseSink::onEvent ( const rg_event & event )

overridevirtualnoexcept

Implements bastionguard::rootguard::IEventSink.

Definition at line 72 of file AutomaticResponseSink.cpp.

{
    try {
        downstream_.onEvent(event);
 
        if (!autoBlockSystemServices_.load(std::memory_order_acquire) ||
            !isActionableMetadataEvent(event))
            return;
 
        const std::filesystem::path path(event.filename);
        const auto target = identifySystemService(path);
        if (!target)
            return;
 
        /*
         * The LSM denied the operation, therefore the service definition
         * remains unchanged. Stopping it cannot execute attacker-controlled
         * replacement content.
         */
        enqueueService(path, event);
    } catch (...) {
        // Automatic reaction must never terminate RootGuard.
    }
}

References autoBlockSystemServices_, downstream_, enqueueService(), and bastionguard::rootguard::identifySystemService().

Referenced by operator=().

operator=()

AutomaticResponseSink & bastionguard::rootguard::AutomaticResponseSink::operator= ( const AutomaticResponseSink & )

delete

References AutomaticResponseSink(), emitServiceResult(), enqueueService(), onEvent(), setAutoBlockSystemServices(), and workerLoop().

setAutoBlockSystemServices()

void bastionguard::rootguard::AutomaticResponseSink::setAutoBlockSystemServices ( bool enabled )

noexcept

Definition at line 67 of file AutomaticResponseSink.cpp.

{
    autoBlockSystemServices_.store(enabled, std::memory_order_release);
}

References autoBlockSystemServices_.

Referenced by main(), and operator=().

workerLoop()

void bastionguard::rootguard::AutomaticResponseSink::workerLoop ( )

privatenoexcept

Definition at line 111 of file AutomaticResponseSink.cpp.

{
    for (;;) {
        PendingService pending;
        {
            std::unique_lock lock(mutex_);
            condition_.wait(lock, [this] { return stopping_ || !queue_.empty(); });
            if (stopping_ && queue_.empty())
                break;
            pending = std::move(queue_.front());
            queue_.pop_front();
        }
 
        const auto result = blockSystemService(pending.path);
        emitServiceResult(pending.path, pending.source, result.success);
 
        std::lock_guard lock(mutex_);
        queuedPaths_.erase(pending.path.lexically_normal().string());
    }
}

References bastionguard::rootguard::blockSystemService(), condition_, emitServiceResult(), mutex_, bastionguard::rootguard::AutomaticResponseSink::PendingService::path, queue_, queuedPaths_, bastionguard::rootguard::AutomaticResponseSink::PendingService::source, and stopping_.

Referenced by AutomaticResponseSink(), and operator=().

Member Data Documentation

autoBlockSystemServices_

std::atomic<bool> bastionguard::rootguard::AutomaticResponseSink::autoBlockSystemServices_ {true}

private

Definition at line 42 of file AutomaticResponseSink.hpp.

Referenced by AutomaticResponseSink(), onEvent(), and setAutoBlockSystemServices().

condition_

std::condition_variable bastionguard::rootguard::AutomaticResponseSink::condition_

private

Definition at line 44 of file AutomaticResponseSink.hpp.

Referenced by enqueueService(), workerLoop(), and ~AutomaticResponseSink().

downstream_

IEventSink& bastionguard::rootguard::AutomaticResponseSink::downstream_

private

Definition at line 41 of file AutomaticResponseSink.hpp.

Referenced by AutomaticResponseSink(), emitServiceResult(), and onEvent().

mutex_

std::mutex bastionguard::rootguard::AutomaticResponseSink::mutex_

private

Definition at line 43 of file AutomaticResponseSink.hpp.

Referenced by enqueueService(), workerLoop(), and ~AutomaticResponseSink().

queue_

std::deque<PendingService> bastionguard::rootguard::AutomaticResponseSink::queue_

private

Definition at line 45 of file AutomaticResponseSink.hpp.

Referenced by enqueueService(), and workerLoop().

queuedPaths_

std::set<std::string> bastionguard::rootguard::AutomaticResponseSink::queuedPaths_

private

Definition at line 46 of file AutomaticResponseSink.hpp.

Referenced by enqueueService(), and workerLoop().

stopping_

bool bastionguard::rootguard::AutomaticResponseSink::stopping_ {}

private

Definition at line 47 of file AutomaticResponseSink.hpp.

Referenced by enqueueService(), workerLoop(), and ~AutomaticResponseSink().

worker_

std::thread bastionguard::rootguard::AutomaticResponseSink::worker_

private

Definition at line 48 of file AutomaticResponseSink.hpp.

Referenced by AutomaticResponseSink(), and ~AutomaticResponseSink().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/rootguard/include/rootguard/AutomaticResponseSink.hpp
• BastionGuard/src/rootguard/src/AutomaticResponseSink.cpp