#!/sbin/openrc-run

name="BastionGuard RootGuard"
description="Privilege-escalation and metadata-integrity monitor"
supervisor="supervise-daemon"
command="/usr/libexec/bastionguard/bastionguard-rootguard"
command_args="--policy /etc/bastionguard/rootguard.conf"
pidfile="/run/${RC_SVCNAME}.pid"
respawn_delay=2
respawn_max=0

output_logger="logger -t ${RC_SVCNAME}"
error_logger="logger -t ${RC_SVCNAME}"

start_pre() {
    checkpath --directory --mode 0755 /var/log/bastionguard
    [ -r /sys/kernel/btf/vmlinux ] || {
        eerror "Kernel BTF is unavailable: /sys/kernel/btf/vmlinux"
        return 1
    }
}

reload() {
    ebegin "Reloading BastionGuard RootGuard policy"
    start-stop-daemon --signal HUP --pidfile "${pidfile}"
    eend $?
}

depend() {
    need localmount
    after bootmisc
}
