1. Overview
The ConsoleEventSink.cpp implementation converts low-level rg_event fields into a dense administrator-readable line and writes it to standard output for service logs and live diagnostics.
The file integrates the following components, APIs, or runtime concepts:
- IEventSink
- rootguard_shared.h event/verdict/path constants
- std::cout
2. Event and Verdict Names
Numeric event types are mapped to names including setuid, privileged exec, credential anomaly, permission/owner/xattr/ACL changes, protected unlink/rename/hardlink, integrity drift/restored, service blocked, file restored/quarantined, and protection-mode changes. Verdicts map to AUDIT, AUTHORIZED, BLOCKED, TRUSTED, ALERT, or RESTORED.
3. Path Resolution Names
Path provenance is printed as protected-baseline, proc-fd, process-cwd, kernel-exact, lsm-exact, or basename-only.
4. Console Record Content
Each line includes verdict, event type, PID/TGID/PPID, comm and parent comm, actor/parent filesystem identities, actor start time, EUID transition, rule ID, hexadecimal reason flags, auxiliary value, target identity, optional mode/ownership transitions, optional xattr name, affected filename, path provenance, and actor/parent executable paths when known.
5. Callback Safety
The whole formatting and output path is wrapped in a catch-all handler so iostream failures cannot cross the libbpf callback boundary. Output is explicitly flushed after every event.
6. Runtime and Security Considerations
- Operational transparency: rich event context is directly visible in daemon logs.
- Callback containment: output exceptions cannot terminate event processing.