FileIdentity.hpp

1. Overview

The FileIdentity.hpp header defines the userspace representation of a filesystem object identity and the resolver used to produce device/inode keys compatible with RootGuard’s eBPF maps.

The file integrates the following components, APIs, or runtime concepts:

  • rootguard_shared.h – rg_file_key shared with BPF
  • stat(2) / dev_t – Unix metadata and device encoding

2. FileIdentity Structure

FileIdentity contains the BPF-compatible file key, canonical path, permission mode, UID, GID, and booleans indicating whether the object is a regular file or directory.

3. Kernel Device Conversion

kernelDeviceNumber(dev_t) converts the userspace-encoded device number into the major/minor layout used by kernel s_dev and therefore by eBPF identity keys.

4. Resolver API

resolve() can require a regular file and can additionally require a root-owned object that is not writable by group or others. These switches let policy application apply stricter trust requirements only where needed.

5. Runtime and Security Considerations

  • Identity over path: RootGuard keys protection/trust by device+inode, not only by mutable pathname.
  • Symlink safety: the implementation rejects symbolic links for policy identities.
Published on:
Last updated on: