SystemServiceControl

1. Overview

The SystemServiceControl.cpp implementation detects the host init system, maps an attacked service-definition path to a logical service, and performs immediate stop/runtime-containment actions without invoking a shell.

The file integrates the following components, APIs, or runtime concepts:

  • systemctl
  • rc-service
  • dinitctl
  • /etc/init.d
  • fork/execv

2. Command Runner

runCommand() uses pipe/fork/dup2/execv to capture stdout and stderr. Exit status or terminating signal is translated into an integer result. Command arguments are never concatenated into shell syntax.

3. Init Detection

  1. systemd when /run/systemd/system exists and systemctl is executable
  2. OpenRC when openrc-run and rc-service are available
  3. dinit when dinitctl is available
  4. SysV init when /etc/init.d exists
  5. otherwise None

4. Service Definition Recognition

systemd units and drop-in paths are recognized under /etc/systemd/system, /usr/lib/systemd/system, and /lib/systemd/system. Supported unit suffixes include service, socket, timer, path, mount, automount, and target. OpenRC/SysV and dinit directories are also recognized according to the detected init system.

5. Blocking Semantics

RootGuard refuses to block its own bastionguard-rootguard service. For systemd, containment runs systemctl stop followed by a runtime-only mask. OpenRC calls rc-service <name> stop; dinit calls dinitctl stop; SysV invokes the identified init script with stop.

6. Unblocking Semantics

On systemd, unblockSystemService() removes only the runtime mask and does not restart the service. OpenRC, dinit, and SysV do not use a comparable runtime mask here, so the function reports that the service remains stopped.

7. Result Aggregation

All command results are merged into a ServiceActionResult containing a success flag and diagnostic message with init system and captured command output.

8. Runtime and Security Considerations

  • Self-protection: RootGuard refuses to contain its own service.
  • Runtime-only systemd mask: containment does not permanently rewrite service configuration.
  • No shell: service commands are executed with execv().
  • Path constrained: only recognized service-definition directories produce targets.
Published on:
Last updated on: