1. Overview
The AutomaticResponseSink.hpp header declares an event-sink decorator that forwards all events downstream and, when enabled, asynchronously contains recognized system services after RootGuard has blocked a qualifying metadata attack.
The file integrates the following components, APIs, or runtime concepts:
- IEventSink – downstream event pipeline
- SystemServiceControl – service identification and stop/mask operations
- std::thread – out-of-band containment worker
2. Public API
Construction requires a downstream sink and an initial autoBlockSystemServices flag. setAutoBlockSystemServices() updates the setting atomically, while onEvent() remains the standard sink callback.
3. Containment Queue
PendingService stores the affected path plus a copy of the triggering rg_event. A deque holds pending work and a set of normalized paths suppresses duplicate concurrent containment for the same service definition.
4. Worker Methods
workerLoop() performs blocking service-control operations away from the BPF callback. emitServiceResult() converts the result back into a RootGuard event for downstream logging/UI consumption.
5. Runtime and Security Considerations
- Non-blocking callback path: init-system commands are not executed directly inside
onEvent(). - Atomic runtime control: automatic containment can be enabled/disabled during policy reload.