IEventSink.hpp

1. Overview

The IEventSink.hpp header defines the minimal event-consumer interface used by the RootGuard engine to decouple kernel-event acquisition from console logging, JSON persistence, automatic response, and fan-out.

The file integrates the following components, APIs, or runtime concepts:

  • rootguard_shared.h – definition of the shared rg_event ABI structure

2. Interface Contract

IEventSink has a virtual destructor and one pure virtual method: void onEvent(const rg_event&) noexcept. Any sink can therefore receive a fully populated RootGuard event without the engine knowing how it is displayed, persisted, or acted upon.

3. Role in the Event Pipeline

RootGuardEngine owns only a reference to this abstraction. Implementations such as ConsoleEventSink, JsonEventSink, MultiEventSink, and AutomaticResponseSink compose around it.

4. Runtime and Security Considerations

  • Noexcept boundary: sink implementations are expected not to propagate failures into the libbpf event callback path.
  • Dependency inversion: kernel processing is independent of logging/response policy.
Published on:
Last updated on: