specialworld83/BastionGuard
1
0
Fork 0
Code Issues Activity

v2.0.3: add RootGuard and fix core UI/browser components

Browse source
This commit is contained in:
specialworld83 2026-08-28 13:45:22 +02:00
commit 4bf9f22022
113 changed files with 19628 additions and 208 deletions
Download patch file Download diff file Expand all files Collapse all files

140
CMakeLists.txt
View file

@ -542,8 +542,8 @@ target_include_directories(BastionGuard
)
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -568,6 +568,142 @@ target_link_libraries(BastionGuard
bg_set_rpath(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

3
alpine/APKBUILD
View file

@ -2,7 +2,7 @@
# Maintainer: BastionGuard <info@bastionguard.eu>
pkgname=bastionguard
pkgver=2.0.2
pkgver=2.0.3
pkgrel=0
pkgdesc="Transparent security control plane for Linux desktops"
url="https://bastionguard.eu/"
@ -97,6 +97,7 @@ build() {
-DENABLE_USER_AGENT_AUTO=OFF \
-DINSTALL_NGINX_DEFAULTS=OFF \
-DBASTIONGUARD_INIT_SYSTEM=OPENRC \
-DROOTGUARD_INIT_SYSTEM=openrc \
-DENABLE_CEF=OFF \
-DENABLE_EMBEDDED_CEF=OFF \
-DENABLE_CEF_DAEMON=OFF \

4
data/version.bs
View file

@ -1,2 +1,2 @@
version=2.0.2
build=20260727
version=2.0.3
build=20260803

140
debian/change_cmake/CMakeLists.txt vendored
View file

@ -672,8 +672,8 @@ target_include_directories(BastionGuard
)
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -697,6 +697,142 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
# ============================================================
# Blink / CEF Integration (SecureBrowser)
# ============================================================

2
debian/changelog vendored
View file

@ -1,4 +1,4 @@
bastionguard (2.0.2-2) stable; urgency=low
bastionguard (2.0.3-3) stable; urgency=low
* Debian package.

2
debian/changelog_ubuntu24 vendored
View file

@ -1,4 +1,4 @@
bastionguard (2.0.2-1ubuntu24.04.1) noble; urgency=low
bastionguard (2.0.3-1ubuntu24.04.1) noble; urgency=low
* Ubuntu 24.04 (Noble) package.

2
debian/changelog_ubuntu25 vendored
View file

@ -1,4 +1,4 @@
bastionguard (2.0.2-1ubuntu25.10) questing; urgency=low
bastionguard (2.0.3-1ubuntu25.10) questing; urgency=low
* Ubuntu 25.10 (Questing Quokka) package.

2
debian/changelog_ubuntu26 vendored
View file

@ -1,4 +1,4 @@
bastionguard (2.0.2-1ubuntu26.04) questing; urgency=low
bastionguard (2.0.3-1ubuntu26.04) questing; urgency=low
* Ubuntu 26.04 (Resolute Raccoon) package.

24
desktop/BastionGuard.desktop
View file

@ -1,16 +1,16 @@
[Desktop Entry]
Name=BastionGuard
Name[ar]=BastionGuard
Name[de]=BastionGuard
Name[en_US]=BastionGuard
Name[es]=BastionGuard
Name[fr]=BastionGuard
Name[it]=BastionGuard
Name[ja]=BastionGuard
Name[nl]=BastionGuard
Name[pl]=BastionGuard
Name[pt]=BastionGuard
Name[ru]=BastionGuard
Name=BastionGuard Endpoint
Name[ar]=BastionGuard Endpoint
Name[de]=BastionGuard Endpoint
Name[en_US]=BastionGuard Endpoint
Name[es]=BastionGuard Endpoint
Name[fr]=BastionGuard Endpoint
Name[it]=BastionGuard Endpoint
Name[ja]=BastionGuard Endpoint
Name[nl]=BastionGuard Endpoint
Name[pl]=BastionGuard Endpoint
Name[pt]=BastionGuard Endpoint
Name[ru]=BastionGuard Endpoint
Comment=Advanced protection against ransomware, phishing, and real-time threats
Comment[ar]=حماية متقدمة ضد برامج الفدية والتصيد والتهديدات في الوقت الفعلي

141
fedora_rpm/cmake_change_build/CMakeLists.txt
View file

@ -736,8 +736,8 @@ target_include_directories(BastionGuard
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -761,6 +761,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

1
gentoo/app-antivirus/bastionguard/bastionguard-2.0.2.ebuild → gentoo/app-antivirus/bastionguard/bastionguard-2.0.3.ebuild
View file

@ -131,6 +131,7 @@ src_configure() {
-DENABLE_USER_AGENT_AUTO=OFF
-DINSTALL_NGINX_DEFAULTS=OFF
-DBASTIONGUARD_INIT_SYSTEM="${init_system}"
-DROOTGUARD_INIT_SYSTEM="${init_system}"
-DENABLE_CEF="$(usex cef ON OFF)"
-DENABLE_EMBEDDED_CEF="$(usex cef ON OFF)"
-DENABLE_CEF_DAEMON=OFF

583
locale/BastionGuard.pot
View file

@ -8509,3 +8509,586 @@ msgstr ""
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr ""
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr ""
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr ""
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr ""
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr ""
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr ""
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr ""
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr ""
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr ""
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr ""
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr ""
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr ""

582
locale/ar_SA.po
View file

@ -8501,3 +8501,585 @@ msgstr "✔ تم تعطيل مفتاح الإيقاف."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ فشلت عملية مفتاح الإيقاف: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "تم تعطيل تثبيت شهادة CA الخاصة بالنظام وخدمة CEF الخلفية على Fedora وRHEL وAlmaLinux وRocky Linux وUbuntu وLinux Mint وMageia وOpenMandriva وopenSUSE. يظل Secure Browser وBank GUI متاحين."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "تم تعطيل تثبيت شهادة CA الخاصة بالنظام وخدمة CEF الخلفية على هذه التوزيعة؛ يظل Secure Browser وBank GUI متاحين."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "المسار الدقيق من خط الأساس المحمي"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "تم تحديد المسار الدقيق من واصف ملف العملية"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "تم تحديد المسار الدقيق من دليل عمل العملية"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "المسار الدقيق المقدم من حدث النواة"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "المسار الدقيق الذي التقطه LSM قبل عملية البيانات الوصفية"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "اسم الملف فقط؛ لم يكن المسار الدقيق متاحًا في هذا الحدث"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "تم إيقاف خدمة النظام وحظرها أثناء التشغيل"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "فشل حظر خدمة النظام"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "تغيّرت سلامة الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "تم حظر تغيير الأذونات"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "تمت ملاحظة تغيير الأذونات"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "تم اكتشاف تغيير الأذونات"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "تم حظر تغيير الملكية"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "تمت ملاحظة تغيير الملكية"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "تم اكتشاف تغيير الملكية"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "تم حظر إزالة الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "تمت ملاحظة إزالة الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "تم اكتشاف إزالة الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "تم حظر إعادة تسمية الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "تمت ملاحظة إعادة تسمية الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "تم اكتشاف إعادة تسمية الملف المحمي"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "تم حظر إنشاء رابط ثابت لملف محمي"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "تمت ملاحظة إنشاء رابط ثابت لملف محمي"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "تم اكتشاف إنشاء رابط ثابت لملف محمي"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "تم حظر تغيير السمات الموسعة"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "تمت ملاحظة تغيير السمات الموسعة"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "تم اكتشاف تغيير السمات الموسعة"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "تم حظر تغيير قائمة التحكم بالوصول"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "تمت ملاحظة تغيير قائمة التحكم بالوصول"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "تم اكتشاف تغيير قائمة التحكم بالوصول"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "تم حظر تغيير البيانات الوصفية المحمية"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "تمت ملاحظة تغيير البيانات الوصفية المحمية"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "تم اكتشاف تغيير البيانات الوصفية المحمية"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "ينتمي هذا الحدث إلى المراقبة الشاملة لنظام الملفات. لا يوجد خط أساس محمي مرتبط به، لذلك لا تتوفر الاستعادة أو العزل."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "يمتلك RootGuard هوية نظام الملفات، لكنه لا يمتلك مسارًا دقيقًا. تم تعطيل الإجراءات التدميرية لتجنب تنفيذ إجراء على العنصر الخطأ."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "تم رفض الإزالة؛ لا يزال الملف موجودًا ولا حاجة إلى الاستعادة."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "تمت إزالة الملف في وضع التدقيق. الاستعادة التلقائية غير ممكنة دون نسخة احتياطية موثوقة أو نسخة من الحزمة."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "الاسترداد التلقائي غير متاح لأحداث إعادة التسمية. استعد الملف من حزمة موثوقة أو نسخة احتياطية."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "لا يتوفر إجراء تلقائي لأحداث الروابط الثابتة. راجع المصدر والوجهة يدويًا."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — حماية الأذونات والامتيازات"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "الخدمة"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "الوضع"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "نظام التهيئة"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "معرّف العملية"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "الحظر الفوري لتغييرات الأذونات"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "يحظر تغييرات البيانات الوصفية المحمية للنظام قبل تطبيقها."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "عرض نطاق الحماية"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "ينطبق الحظر الفوري على مسارات النظام المحمية وتعريفات الخدمات. تظل مجلدات المستخدم الرئيسية في وضع التدقيق فقط لأن BastionGuard Anti-Ransomware مسؤول عن الإنفاذ على بيانات المستخدم. يمكن تصنيف نشاط البيانات الوصفية الروتيني لسطح المكتب والمتصفح ضمن قواعد التطبيقات دون منح ثقة لانتقال الامتيازات."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "مسارات النظام المحمية"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "مجلد المستخدم الرئيسي"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "يسجل RootGuard نشاط البيانات الوصفية على مستوى النظام. تظل أحداث التطبيقات الموثوقة متاحة في علامة تبويب الأحداث، لكنها مخفية افتراضيًا ولا تُنشئ نوافذ منبثقة."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ تشغيل"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ إيقاف"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ إعادة تحميل السياسة"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ إعادة التشغيل"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "تحديث"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "نظرة عامة"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "الملاحظات الأمنية والحوادث النشطة"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "الحوادث"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "أحداث RootGuard الأخيرة"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "إظهار الأحداث الموثوقة"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "يُعرض نشاط التطبيقات الموثوقة افتراضيًا لتحقيق أقصى درجات الشفافية. عطّل هذا الخيار فقط للتركيز على أحداث التدقيق والحظر."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "الأحداث"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "إدارة هويات الملفات التنفيذية التي يستخدمها RootGuard. يؤدي الحفظ إلى التحقق من صحة السياسة، وطلب مصادقة المسؤول، وإعادة تشغيل RootGuard لكي تصبح هويات inode الجديدة سارية فورًا."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "إضافة الإعدادات الافتراضية المثبتة لسطح المكتب والمتصفح"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "يضيف فقط الملفات التنفيذية المعروفة الموجودة على هذا الحاسوب. راجع القائمة قبل الحفظ."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "التطبيقات الموثوقة"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "نشاط البيانات الوصفية الروتيني لسطح المكتب ومدير الملفات والمتصفح. تصبح الأحداث العامة المطابقة موثوقة، ولا تُنشئ نافذة منبثقة، وتظل مرئية فقط عند تمكين «إظهار الأحداث الموثوقة». لا تمنح هذه القائمة ثقة للامتيازات مطلقًا."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "التطبيقات الموثوقة"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "الملفات التنفيذية الموثوقة للامتيازات"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "الملفات التنفيذية المسموح بها بوصفها جهات شرعية في فحوصات انتقال الامتيازات الخاصة بـ RootGuard. تظل الملفات الحالية خاضعة للتحقق من الملكية والهوية."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "موثوق للامتيازات"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "الملفات التنفيذية المحظورة"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "الملفات التنفيذية المحظورة أثناء فحوصات انتقال الامتيازات في RootGuard. هذه ليست قائمة حظر عامة لتشغيل التطبيقات."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "محظور"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "حفظ القواعد وإعادة تشغيل RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "لا تُطبّق التغييرات غير المحفوظة بصمت مطلقًا. يُعاد تشغيل RootGuard فقط بعد حفظ السياسة بنجاح."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "قواعد التطبيقات"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "جارٍ طلب تشغيل الخدمة…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "جارٍ طلب إيقاف الخدمة…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "جارٍ إعادة تحميل سياسة RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "جارٍ إعادة تشغيل RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "جارٍ تحديث حالة RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "جارٍ التحقق…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "تدقيق فقط"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "جارٍ تحميل حالة RootGuard وأحدث الأحداث الأمنية…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "المسار المطلق للملف التنفيذي، مثل /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "إضافة"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "إزالة المحدد"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "أدخل أولًا مسارًا مطلقًا لملف تنفيذي."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "تتطلب قواعد التطبيقات مسارًا مطلقًا يبدأ بـ /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "مسار الملف التنفيذي هذا موجود بالفعل في القائمة."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "لم يتم العثور على إعدادات افتراضية مثبتة جديدة لسطح المكتب أو المتصفح."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "تمت إضافة %1 من الملفات التنفيذية المثبتة لسطح المكتب والمتصفح. راجع القائمة واحفظها لإعادة تشغيل RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "حدد قاعدة لإزالتها."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "توجد تغييرات غير محفوظة في القواعد. سيؤدي الحفظ إلى التحقق من صحة السياسة وإعادة تشغيل RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "لا يمكن أن يكون الملف التنفيذي نفسه موثوقًا ومحظورًا في الوقت نفسه."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "جارٍ حفظ قواعد التطبيقات وإعادة تشغيل RootGuard… قد يُطلب منك مصادقة المسؤول."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "جارٍ حفظ قواعد تطبيقات RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "جارٍ تمكين الحظر الفوري لمسارات النظام المحمية؛ يظل مجلد المستخدم الرئيسي في وضع التدقيق فقط…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "جارٍ تحويل حماية مسارات النظام في RootGuard إلى وضع التدقيق…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "نشط"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "غير نشط"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "حظر فوري"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "الحظر الفوري"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "الحظر مفعّل بواسطة سياسة يدوية"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "تدقيق فقط · الإنفاذ بواسطة مكافحة برامج الفدية"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "تم حفظ قواعد التطبيقات وإعادة تشغيل RootGuard بنجاح."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "لم تُطبّق قواعد التطبيقات: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "يحظر RootGuard تغييرات النظام المحمية ويعزل الخدمات المتأثرة. يظل مجلد المستخدم الرئيسي في وضع التدقيق فقط تحت حماية مكافحة برامج الفدية."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "يحظر RootGuard تغييرات البيانات الوصفية المحمية للنظام. يظل مجلد المستخدم الرئيسي في وضع التدقيق فقط تحت حماية مكافحة برامج الفدية."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "يراقب RootGuard البيانات الوصفية لنظام الملفات في وضع التدقيق. تُسجّل أحداث التطبيقات الموثوقة دون نوافذ منبثقة."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard غير قيد التشغيل."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "لا توجد ملاحظات غير محلولة أو تغييرات محظورة."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "ملاحظة تدقيق: لم يحظر RootGuard العملية ولم يغيّرها."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "استعادة"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "عزل"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "تجاهل"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "لا توجد أحداث RootGuard متاحة حتى الآن."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "تتوفر أحداث موثوقة فقط. فعّل «إظهار الأحداث الموثوقة» لعرضها."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 تم حظر خدمة النظام"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ فشل حظر خدمة النظام"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ تمت ملاحظة تغيير في البيانات الوصفية لنظام الملفات"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 تم حظر تغيير محمي"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ تمت ملاحظة تغيير محمي"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ تم اكتشاف تغيير محمي"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "لاحظ RootGuard تغييرًا في البيانات الوصفية لنظام الملفات في:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "حظر RootGuard تغييرًا في:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "لاحظ RootGuard تغييرًا في:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "اكتشف RootGuard تغييرًا في:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "إشعار الشفافية: احتوى حدث النواة على اسم الملف فقط. يعرض RootGuard هوية نظام الملفات ويعطل الإجراءات المعتمدة على المسار بدلًا من تخمين مسار غير آمن."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "تم إيقاف خدمة النظام المتأثرة فورًا. وفي systemd تم حجبها مؤقتًا أثناء التشغيل أيضًا."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "تعذر على RootGuard إيقاف الخدمة المتأثرة. راجع سجلات نظام التهيئة فورًا."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "طلب RootGuard الاحتواء الفوري للخدمة. سيؤكد حدث لاحق إجراء نظام التهيئة."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "لا يوقف وضع التدقيق الخدمات ولا يحجبها مطلقًا. هذا الحدث للمعلومات فقط."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "سجّل وضع التدقيق هذا الحدث دون حظر العملية أو تغييرها. هذا الإشعار للإقرار فقط."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "إبقاء الحظر"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "إقرار"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "جارٍ استعادة البيانات الوصفية المحمية وإلغاء حظر الخدمة…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "جارٍ نقل الملف المحمي من مساره الأصلي إلى العزل…"

582
locale/de_DE.po
View file

@ -8536,3 +8536,585 @@ msgstr "✔ Kill-Switch deaktiviert."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Kill-Switch-Vorgang fehlgeschlagen: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Die Installation der System-CA und des CEF-Daemons ist unter Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva und openSUSE deaktiviert. Secure Browser und Bank GUI bleiben verfügbar."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "Die Installation der System-CA und des CEF-Daemons ist auf dieser Distribution deaktiviert; Secure Browser und Bank GUI bleiben verfügbar."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "Exakter Pfad aus der geschützten Baseline"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "Exakter Pfad über den Dateideskriptor des Prozesses ermittelt"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "Exakter Pfad über das Arbeitsverzeichnis des Prozesses ermittelt"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "Exakter Pfad vom Kernel-Ereignis bereitgestellt"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "Exakter Pfad vom LSM vor der Metadatenoperation erfasst"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "Nur Basisname; der exakte Pfad war für dieses Ereignis nicht verfügbar"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Systemdienst gestoppt und zur Laufzeit blockiert"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Blockierung des Systemdienstes fehlgeschlagen"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Integrität der geschützten Datei wurde verändert"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Änderung der Berechtigungen blockiert"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Änderung der Berechtigungen beobachtet"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Änderung der Berechtigungen erkannt"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Änderung des Eigentümers blockiert"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Änderung des Eigentümers beobachtet"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Änderung des Eigentümers erkannt"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Entfernung der geschützten Datei blockiert"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Entfernung der geschützten Datei beobachtet"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Entfernung der geschützten Datei erkannt"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Umbenennung der geschützten Datei blockiert"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Umbenennung der geschützten Datei beobachtet"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Umbenennung der geschützten Datei erkannt"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Erstellung eines Hardlinks auf eine geschützte Datei blockiert"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Erstellung eines Hardlinks auf eine geschützte Datei beobachtet"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Erstellung eines Hardlinks auf eine geschützte Datei erkannt"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Änderung erweiterter Attribute blockiert"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Änderung erweiterter Attribute beobachtet"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Änderung erweiterter Attribute erkannt"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "ACL-Änderung blockiert"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "ACL-Änderung beobachtet"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "ACL-Änderung erkannt"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Änderung geschützter Metadaten blockiert"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Änderung geschützter Metadaten beobachtet"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Änderung geschützter Metadaten erkannt"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Dieses Ereignis gehört zur globalen Dateisystemüberwachung. Es ist keine geschützte Baseline zugeordnet, daher sind Wiederherstellung und Quarantäne nicht verfügbar."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard kennt die Dateisystemidentität, jedoch nicht den exakten Pfad. Destruktive Aktionen sind deaktiviert, damit nicht das falsche Objekt bearbeitet wird."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "Das Entfernen wurde verweigert; die Datei ist weiterhin vorhanden und muss nicht wiederhergestellt werden."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Die Datei wurde im Audit-Modus entfernt. Eine automatische Wiederherstellung ist ohne vertrauenswürdige Sicherung oder Paketkopie nicht möglich."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Für Umbenennungsereignisse ist keine automatische Wiederherstellung verfügbar. Stellen Sie die Datei aus einem vertrauenswürdigen Paket oder einer Sicherung wieder her."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Für Hardlink-Ereignisse wird keine automatische Aktion angeboten. Prüfen Sie Quelle und Ziel manuell."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Schutz von Berechtigungen und Privilegien"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Dienst"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Modus"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Init-System"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Sofortige Blockierung von Berechtigungsänderungen"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Blockiert Änderungen geschützter Systemmetadaten, bevor sie angewendet werden."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Schutzbereich anzeigen"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Die sofortige Blockierung gilt für geschützte Systempfade und Dienstdefinitionen. Benutzerverzeichnisse bleiben auf den Audit-Modus beschränkt, da BastionGuard Anti-Ransomware den Schutz der Benutzerdaten übernimmt. Routinemäßige Metadatenaktivitäten von Desktop-Anwendungen und Browsern können unter den Anwendungsregeln klassifiziert werden, ohne Vertrauen für Privilegienübergänge zu gewähren."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Geschützte Systempfade"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Benutzerverzeichnis"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard zeichnet globale Metadatenaktivitäten auf. Ereignisse vertrauenswürdiger Anwendungen bleiben im Reiter „Ereignisse“ verfügbar, sind jedoch standardmäßig ausgeblendet und erzeugen keine Pop-up-Fenster."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Starten"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Stoppen"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Richtlinie neu laden"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Neu starten"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Aktualisieren"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Übersicht"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Sicherheitsbeobachtungen und aktive Vorfälle"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Vorfälle"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Letzte RootGuard-Ereignisse"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Vertrauenswürdige Ereignisse anzeigen"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "Aktivitäten vertrauenswürdiger Anwendungen werden für maximale Transparenz standardmäßig angezeigt. Deaktivieren Sie diese Option nur, um sich auf Audit- und blockierte Ereignisse zu konzentrieren."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Ereignisse"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Verwalten Sie die von RootGuard verwendeten Identitäten ausführbarer Dateien. Beim Speichern wird die Richtlinie validiert, eine Administratorauthentifizierung angefordert und RootGuard neu gestartet, damit die neuen Inode-Identitäten sofort wirksam werden."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Installierte Desktop- und Browser-Standardanwendungen hinzufügen"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Fügt nur bekannte ausführbare Dateien hinzu, die auf diesem Computer vorhanden sind. Prüfen Sie die Liste vor dem Speichern."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Vertrauenswürdige Anwendungen"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Routinemäßige Metadatenaktivitäten von Desktop-Umgebungen, Dateimanagern und Browsern. Übereinstimmende globale Ereignisse werden als vertrauenswürdig eingestuft, erzeugen keine Pop-up-Fenster und bleiben nur sichtbar, wenn „Vertrauenswürdige Ereignisse anzeigen“ aktiviert ist. Diese Liste gewährt niemals Vertrauen für Privilegienübergänge."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Vertrauenswürdige Anwendungen"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Für Privilegienübergänge vertrauenswürdige Programme"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Ausführbare Dateien, die bei RootGuard-Prüfungen von Privilegienübergängen als legitime Akteure zugelassen sind. Vorhandene Dateien werden weiterhin auf Eigentümer und Identität geprüft."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Für Privilegien vertrauenswürdig"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Blockierte ausführbare Dateien"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Ausführbare Dateien, die bei RootGuard-Prüfungen von Privilegienübergängen blockiert werden. Dies ist keine allgemeine Sperrliste zum Verhindern des Anwendungsstarts."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Blockiert"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Regeln speichern und RootGuard neu starten"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Nicht gespeicherte Änderungen werden niemals unbemerkt angewendet. RootGuard wird erst nach dem erfolgreichen Speichern der Richtlinie neu gestartet."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Anwendungsregeln"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Start des Dienstes wird angefordert…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Beenden des Dienstes wird angefordert…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "RootGuard-Richtlinie wird neu geladen…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "RootGuard wird neu gestartet…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "RootGuard-Status wird aktualisiert…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Wird geprüft…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Nur Audit"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "RootGuard-Status und aktuelle Sicherheitsereignisse werden geladen…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Absoluter Pfad der ausführbaren Datei, zum Beispiel /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Hinzufügen"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Ausgewählten Eintrag entfernen"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Geben Sie zuerst einen absoluten Pfad zu einer ausführbaren Datei ein."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Anwendungsregeln erfordern einen absoluten Pfad, der mit / beginnt."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Dieser Pfad zur ausführbaren Datei ist bereits in der Liste enthalten."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Es wurden keine neuen installierten Desktop- oder Browser-Standardanwendungen gefunden."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "%1 installierte ausführbare Datei(en) für Desktop oder Browser wurden hinzugefügt. Prüfen und speichern Sie die Liste, um RootGuard neu zu starten."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Wählen Sie eine zu entfernende Regel aus."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Die Regeln enthalten nicht gespeicherte Änderungen. Beim Speichern wird die Richtlinie validiert und RootGuard neu gestartet."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Dieselbe ausführbare Datei kann nicht gleichzeitig vertrauenswürdig und blockiert sein."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Anwendungsregeln werden gespeichert und RootGuard wird neu gestartet… Möglicherweise ist eine Administratorauthentifizierung erforderlich."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "RootGuard-Anwendungsregeln werden gespeichert…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Sofortige Blockierung für geschützte Systempfade wird aktiviert; das Benutzerverzeichnis bleibt im reinen Audit-Modus…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "RootGuard-Schutz für Systempfade wird in den Audit-Modus versetzt…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Aktiv"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inaktiv"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Sofortige Blockierung"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Sofortige Blockierung"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blockierung durch manuelle Richtlinie aktiviert"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Nur Audit · Durchsetzung durch Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Anwendungsregeln wurden gespeichert und RootGuard wurde erfolgreich neu gestartet."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Anwendungsregeln wurden nicht angewendet: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blockiert geschützte Systemänderungen und isoliert betroffene Dienste. Das Benutzerverzeichnis bleibt unter dem Schutz von Anti-Ransomware im reinen Audit-Modus."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blockiert Änderungen geschützter Systemmetadaten. Das Benutzerverzeichnis bleibt unter dem Schutz von Anti-Ransomware im reinen Audit-Modus."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard überwacht Dateisystemmetadaten im Audit-Modus. Ereignisse vertrauenswürdiger Anwendungen werden ohne Pop-up-Fenster protokolliert."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard wird nicht ausgeführt."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Keine ungelösten Beobachtungen oder blockierten Änderungen."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Audit-Beobachtung: RootGuard hat den Vorgang weder blockiert noch verändert."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Wiederherstellen"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarantäne"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Verwerfen"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Es sind noch keine RootGuard-Ereignisse verfügbar."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Es sind nur vertrauenswürdige Ereignisse verfügbar. Aktivieren Sie „Vertrauenswürdige Ereignisse anzeigen“, um sie einzublenden."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Systemdienst blockiert"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Blockierung des Systemdienstes fehlgeschlagen"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Änderung von Dateisystemmetadaten beobachtet"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Geschützte Änderung blockiert"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Geschützte Änderung beobachtet"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Geschützte Änderung erkannt"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard hat eine Änderung der Dateisystemmetadaten festgestellt bei:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard hat eine Änderung blockiert an:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard hat eine Änderung beobachtet an:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard hat eine Änderung erkannt an:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Transparenzhinweis: Das Kernel-Ereignis enthielt nur einen Basisnamen. RootGuard zeigt die Dateisystemidentität an und deaktiviert pfadbasierte Aktionen, anstatt einen möglicherweise unsicheren Pfad zu erraten."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "Der betroffene Systemdienst wurde sofort gestoppt. Unter systemd wurde er zusätzlich zur Laufzeit maskiert."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard konnte den betroffenen Dienst nicht stoppen. Prüfen Sie sofort die Protokolle des Init-Systems."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard hat die sofortige Eindämmung des Dienstes angefordert. Ein Folgeereignis bestätigt die Aktion des Init-Systems."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "Im Audit-Modus werden Dienste niemals gestoppt oder maskiert. Dieses Ereignis dient nur zur Information."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "Der Audit-Modus hat dieses Ereignis aufgezeichnet, ohne den Vorgang zu blockieren oder zu verändern. Diese Benachrichtigung muss lediglich bestätigt werden."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Blockierung beibehalten"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Bestätigen"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Geschützte Metadaten werden wiederhergestellt und der Dienst wird entsperrt…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Die geschützte Datei wird von ihrem ursprünglichen Pfad in die Quarantäne verschoben…"

582
locale/en_US.po
View file

@ -8624,3 +8624,585 @@ msgstr "✔ Kill switch deactivated."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Kill switch operation failed: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Installation of the system CA and CEF daemon is disabled on Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva, and openSUSE. Secure Browser and Bank GUI remain available."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "Installation of the system CA and CEF daemon is disabled on this distribution; Secure Browser and Bank GUI remain available."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "exact path from protected baseline"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "exact path resolved from the process file descriptor"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "exact path resolved from the process working directory"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "exact path supplied by the kernel event"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "exact path captured by the LSM before the metadata operation"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "basename only; the exact path was unavailable in this event"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "System service stopped and runtime-blocked"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "System service blocking failed"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Protected file integrity changed"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Permission change blocked"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Permission change observed"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Permission change detected"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Ownership change blocked"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Ownership change observed"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Ownership change detected"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Protected file removal blocked"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Protected file removal observed"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Protected file removal detected"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Protected file rename blocked"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Protected file rename observed"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Protected file rename detected"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Protected hard-link creation blocked"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Protected hard-link creation observed"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Protected hard-link creation detected"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Extended-attribute change blocked"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Extended-attribute change observed"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Extended-attribute change detected"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "ACL change blocked"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "ACL change observed"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "ACL change detected"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Protected metadata change blocked"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Protected metadata change observed"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Protected metadata change detected"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "The removal was denied; the file is still present and no restore is required."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "No automatic action is offered for hard-link events. Review the source and destination manually."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Permission and Privilege Protection"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Service"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Mode"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Init system"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Immediate permission blocking"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Blocks protected system metadata changes before they are committed."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Show protection scope"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Protected system paths"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "User home"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Start"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Stop"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Reload policy"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Restart"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Refresh"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Overview"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Security observations and active incidents"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidents"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Recent RootGuard events"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Show trusted events"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Events"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Add installed desktop/browser defaults"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Adds only known executables that exist on this computer. Review the list before saving."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Trusted applications"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Trusted apps"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Privilege-trusted executables"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Privilege trusted"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Blocked executables"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Blocked"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Save rules and restart RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Application rules"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Requesting service start…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Requesting service stop…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Reloading RootGuard policy…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "Restarting RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Refreshing RootGuard status…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Checking…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Audit-only"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Loading RootGuard status and recent security events…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Absolute executable path, for example /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Add"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Remove selected"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Enter an absolute executable path first."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Application rules require an absolute path beginning with /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "That executable path is already present in this list."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "No new installed desktop or browser defaults were found."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Select a rule to remove."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "The same executable cannot be both trusted and blocked."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Saving RootGuard application rules…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Enabling immediate blocking for protected system paths; user home remains audit-only…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Switching RootGuard system-path protection to audit mode…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Active"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inactive"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Immediate block"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Immediate blocking"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blocking enabled by manual policy"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Audit-only · Anti-Ransomware enforcement"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Application rules saved and RootGuard restarted successfully."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Application rules were not applied: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard is not running."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "No unresolved observations or blocked changes."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Audit observation: RootGuard did not block or alter the operation."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Restore"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarantine"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Dismiss"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "No RootGuard events are available yet."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Only trusted events are available. Enable “Show trusted events” to display them."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 System service blocked"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ System service block failed"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Filesystem metadata change observed"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Protected change blocked"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Protected change observed"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Protected change detected"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard blocked a change to:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard observed a change to:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard detected a change to:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard could not stop the affected service. Review the init-system logs immediately."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "Audit mode never stops or masks services. This event is informational only."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Keep blocked"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Acknowledge"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Restoring protected metadata and unblocking the service…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Moving the protected file from its original path into quarantine…"

582
locale/es_ES.po
View file

@ -8582,3 +8582,585 @@ msgstr "✔ Kill switch desactivado."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Error en la operación del kill switch: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "La instalación de la CA del sistema y del daemon CEF está deshabilitada en Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva y openSUSE. Secure Browser y Bank GUI siguen disponibles."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "La instalación de la CA del sistema y del daemon CEF está deshabilitada en esta distribución; Secure Browser y Bank GUI siguen disponibles."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "ruta exacta de la línea base protegida"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "ruta exacta obtenida a partir del descriptor de archivo del proceso"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "ruta exacta obtenida a partir del directorio de trabajo del proceso"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "ruta exacta proporcionada por el evento del kernel"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "ruta exacta capturada por el LSM antes de la operación de metadatos"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "solo el nombre base; la ruta exacta no estaba disponible en este evento"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Servicio del sistema detenido y bloqueado en tiempo de ejecución"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Ha fallado el bloqueo del servicio del sistema"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Ha cambiado la integridad del archivo protegido"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Cambio de permisos bloqueado"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Cambio de permisos observado"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Cambio de permisos detectado"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Cambio de propietario bloqueado"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Cambio de propietario observado"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Cambio de propietario detectado"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Eliminación del archivo protegido bloqueada"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Eliminación del archivo protegido observada"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Eliminación del archivo protegido detectada"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Cambio de nombre del archivo protegido bloqueado"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Cambio de nombre del archivo protegido observado"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Cambio de nombre del archivo protegido detectado"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Creación de un enlace duro al archivo protegido bloqueada"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Creación de un enlace duro al archivo protegido observada"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Creación de un enlace duro al archivo protegido detectada"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Cambio de atributos extendidos bloqueado"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Cambio de atributos extendidos observado"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Cambio de atributos extendidos detectado"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Cambio de ACL bloqueado"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Cambio de ACL observado"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Cambio de ACL detectado"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Cambio de metadatos protegidos bloqueado"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Cambio de metadatos protegidos observado"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Cambio de metadatos protegidos detectado"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Este evento pertenece a la supervisión global del sistema de archivos. No tiene asociada ninguna línea base protegida, por lo que las opciones Restaurar y Cuarentena no están disponibles."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard dispone de la identidad del sistema de archivos, pero no de una ruta exacta. Las acciones destructivas están desactivadas para evitar actuar sobre el objeto equivocado."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "La eliminación fue denegada; el archivo sigue presente y no es necesario restaurarlo."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "El archivo fue eliminado en modo de auditoría. La restauración automática no es posible sin una copia de seguridad fiable o una copia del paquete."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "La recuperación automática no está disponible para los eventos de cambio de nombre. Restaure el archivo desde un paquete fiable o una copia de seguridad."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "No se ofrece ninguna acción automática para los eventos de enlaces duros. Revise manualmente el origen y el destino."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Protección de permisos y privilegios"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Servicio"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Modo"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Sistema de inicio"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Bloqueo inmediato de cambios de permisos"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Bloquea los cambios de metadatos protegidos del sistema antes de que se apliquen."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Mostrar el ámbito de protección"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "El bloqueo inmediato se aplica a las rutas protegidas del sistema y a las definiciones de servicios. Los directorios personales de los usuarios permanecen únicamente en modo de auditoría porque BastionGuard Anti-Ransomware se encarga de proteger los datos de usuario. La actividad rutinaria de metadatos del escritorio y de los navegadores puede clasificarse en las reglas de aplicaciones sin conceder confianza para transiciones de privilegios."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Rutas protegidas del sistema"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Directorio personal del usuario"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard registra la actividad global de metadatos. Los eventos de aplicaciones de confianza permanecen disponibles en la pestaña Eventos, pero están ocultos de forma predeterminada y nunca generan ventanas emergentes."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Iniciar"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Detener"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Recargar política"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Reiniciar"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Actualizar"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Resumen"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Observaciones de seguridad e incidentes activos"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidentes"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Eventos recientes de RootGuard"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Mostrar eventos de confianza"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "La actividad de las aplicaciones de confianza se muestra de forma predeterminada para ofrecer la máxima transparencia. Desactive esta opción únicamente para centrarse en los eventos de auditoría y bloqueados."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Eventos"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Gestione las identidades de los ejecutables utilizados por RootGuard. Al guardar se valida la política, se solicita la autenticación del administrador y se reinicia RootGuard para que las nuevas identidades de inodo se apliquen inmediatamente."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Añadir aplicaciones instaladas predeterminadas de escritorio y navegador"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Añade únicamente ejecutables conocidos que existen en este equipo. Revise la lista antes de guardar."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Aplicaciones de confianza"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Actividad rutinaria de metadatos del escritorio, el gestor de archivos y el navegador. Los eventos globales coincidentes pasan a considerarse de confianza, no generan ventanas emergentes y solo permanecen visibles cuando está activada la opción «Mostrar eventos de confianza». Esta lista nunca concede confianza para privilegios."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Aplicaciones de confianza"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Ejecutables de confianza para privilegios"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Ejecutables permitidos como actores legítimos en las comprobaciones de transición de privilegios de RootGuard. Los archivos existentes siguen estando sujetos a la validación de propiedad e identidad."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "De confianza para privilegios"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Ejecutables bloqueados"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Ejecutables bloqueados durante las comprobaciones de transición de privilegios de RootGuard. Esta no es una lista negra general para impedir el inicio de aplicaciones."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Bloqueados"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Guardar reglas y reiniciar RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Los cambios no guardados nunca se aplican de forma silenciosa. RootGuard solo se reinicia después de guardar correctamente la política."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Reglas de aplicaciones"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Solicitando el inicio del servicio…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Solicitando la detención del servicio…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Recargando la política de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "Reiniciando RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Actualizando el estado de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Comprobando…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Solo auditoría"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Cargando el estado de RootGuard y los eventos de seguridad recientes…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Ruta absoluta del ejecutable, por ejemplo /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Añadir"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Eliminar seleccionado"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Introduzca primero una ruta absoluta a un ejecutable."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Las reglas de aplicaciones requieren una ruta absoluta que comience por /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "La ruta de ese ejecutable ya está presente en esta lista."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "No se han encontrado nuevas aplicaciones instaladas predeterminadas de escritorio o navegador."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Se han añadido %1 ejecutable(s) instalado(s) de escritorio o navegador. Revise y guarde la lista para reiniciar RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Seleccione una regla para eliminarla."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Las reglas contienen cambios sin guardar. Al guardar se validará la política y se reiniciará RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Un mismo ejecutable no puede ser simultáneamente de confianza y estar bloqueado."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Guardando las reglas de aplicaciones y reiniciando RootGuard… Es posible que se solicite la autenticación del administrador."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Guardando las reglas de aplicaciones de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Activando el bloqueo inmediato para las rutas protegidas del sistema; el directorio personal del usuario permanece en modo de solo auditoría…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Cambiando la protección de rutas del sistema de RootGuard al modo de auditoría…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Activo"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inactivo"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Bloqueo inmediato"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Bloqueo inmediato"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Bloqueo activado mediante una política manual"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Solo auditoría · Protección de Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Las reglas de aplicaciones se han guardado y RootGuard se ha reiniciado correctamente."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Las reglas de aplicaciones no se han aplicado: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard bloquea los cambios protegidos del sistema y contiene los servicios afectados. El directorio personal del usuario permanece en modo de solo auditoría bajo la protección de Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard bloquea los cambios de metadatos protegidos del sistema. El directorio personal del usuario permanece en modo de solo auditoría bajo la protección de Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard está supervisando los metadatos del sistema de archivos en modo de auditoría. Los eventos de aplicaciones de confianza se registran sin mostrar ventanas emergentes."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard no está en ejecución."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "No hay observaciones sin resolver ni cambios bloqueados."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Observación de auditoría: RootGuard no bloqueó ni modificó la operación."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Restaurar"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Cuarentena"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Descartar"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Todavía no hay eventos de RootGuard disponibles."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Solo hay eventos de confianza disponibles. Active «Mostrar eventos de confianza» para visualizarlos."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Servicio del sistema bloqueado"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Ha fallado el bloqueo del servicio del sistema"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Se ha observado un cambio en los metadatos del sistema de archivos"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Cambio protegido bloqueado"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Cambio protegido observado"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Cambio protegido detectado"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard ha observado un cambio en los metadatos del sistema de archivos en:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard ha bloqueado un cambio en:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard ha observado un cambio en:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard ha detectado un cambio en:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Aviso de transparencia: el evento del kernel solo contenía un nombre base. RootGuard muestra la identidad del sistema de archivos y desactiva las acciones basadas en rutas en lugar de intentar adivinar una ruta que podría no ser segura."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "El servicio del sistema afectado se ha detenido inmediatamente. En systemd también se ha enmascarado temporalmente durante la ejecución."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard no ha podido detener el servicio afectado. Revise inmediatamente los registros del sistema de inicio."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard ha solicitado la contención inmediata del servicio. Un evento posterior confirmará la acción realizada por el sistema de inicio."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "El modo de auditoría nunca detiene ni enmascara servicios. Este evento es únicamente informativo."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "El modo de auditoría ha registrado este evento sin bloquear ni modificar la operación. Esta notificación solo requiere confirmación."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Mantener bloqueado"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Confirmar"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Restaurando los metadatos protegidos y desbloqueando el servicio…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Moviendo el archivo protegido desde su ruta original a la cuarentena…"

582
locale/fr_FR.po
View file

@ -8545,3 +8545,585 @@ msgstr "✔ Kill switch désactivé."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Échec de l’opération du kill switch : "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "L’installation de la CA système et du démon CEF est désactivée sur Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva et openSUSE. Secure Browser et Bank GUI restent disponibles."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "L’installation de la CA système et du démon CEF est désactivée sur cette distribution ; Secure Browser et Bank GUI restent disponibles."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "chemin exact provenant de la référence protégée"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "chemin exact résolu à partir du descripteur de fichier du processus"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "chemin exact résolu à partir du répertoire de travail du processus"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "chemin exact fourni par l’événement du noyau"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "chemin exact capturé par le LSM avant l’opération sur les métadonnées"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "nom de base uniquement ; le chemin exact n’était pas disponible dans cet événement"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Service système arrêté et bloqué pendant l’exécution"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Échec du blocage du service système"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "L’intégrité du fichier protégé a changé"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Modification des permissions bloquée"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Modification des permissions observée"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Modification des permissions détectée"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Modification du propriétaire bloquée"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Modification du propriétaire observée"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Modification du propriétaire détectée"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Suppression du fichier protégé bloquée"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Suppression du fichier protégé observée"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Suppression du fichier protégé détectée"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Renommage du fichier protégé bloqué"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Renommage du fichier protégé observé"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Renommage du fichier protégé détecté"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Création d’un lien physique vers un fichier protégé bloquée"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Création d’un lien physique vers un fichier protégé observée"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Création d’un lien physique vers un fichier protégé détectée"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Modification des attributs étendus bloquée"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Modification des attributs étendus observée"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Modification des attributs étendus détectée"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Modification de l’ACL bloquée"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Modification de l’ACL observée"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Modification de l’ACL détectée"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Modification des métadonnées protégées bloquée"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Modification des métadonnées protégées observée"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Modification des métadonnées protégées détectée"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Cet événement appartient à la surveillance globale du système de fichiers. Aucune référence protégée n’y est associée ; les actions Restaurer et Quarantaine ne sont donc pas disponibles."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard dispose de l’identité du système de fichiers, mais pas d’un chemin exact. Les actions destructives sont désactivées afin d’éviter d’agir sur le mauvais objet."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "La suppression a été refusée ; le fichier est toujours présent et aucune restauration n’est nécessaire."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Le fichier a été supprimé en mode audit. La restauration automatique est impossible sans sauvegarde fiable ou copie provenant du paquet."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "La récupération automatique n’est pas disponible pour les événements de renommage. Restaurez le fichier à partir d’un paquet fiable ou d’une sauvegarde."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Aucune action automatique n’est proposée pour les événements de lien physique. Vérifiez manuellement la source et la destination."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Protection des permissions et des privilèges"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Service"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Mode"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Système d’initialisation"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Blocage immédiat des modifications de permissions"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Bloque les modifications des métadonnées système protégées avant leur application."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Afficher le périmètre de protection"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Le blocage immédiat s’applique aux chemins système protégés et aux définitions de services. Les répertoires personnels des utilisateurs restent en mode audit uniquement, car BastionGuard Anti-Ransomware assure la protection des données utilisateur. L’activité courante des métadonnées du bureau et des navigateurs peut être classée dans les règles des applications sans accorder de confiance pour les transitions de privilèges."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Chemins système protégés"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Répertoire personnel de l’utilisateur"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard enregistre l’activité globale des métadonnées. Les événements des applications de confiance restent disponibles dans l’onglet Événements, mais sont masqués par défaut et ne génèrent jamais de fenêtres contextuelles."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Démarrer"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Arrêter"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Recharger la politique"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Redémarrer"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Actualiser"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Vue d’ensemble"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Observations de sécurité et incidents actifs"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidents"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Événements RootGuard récents"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Afficher les événements de confiance"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "L’activité des applications de confiance est affichée par défaut pour garantir une transparence maximale. Désactivez cette option uniquement pour vous concentrer sur les événements d’audit et les événements bloqués."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Événements"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Gérez les identités des exécutables utilisés par RootGuard. L’enregistrement valide la politique, demande une authentification administrateur et redémarre RootGuard afin que les nouvelles identités d’inode prennent effet immédiatement."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Ajouter les applications de bureau et navigateurs installés par défaut"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Ajoute uniquement les exécutables connus présents sur cet ordinateur. Vérifiez la liste avant de l’enregistrer."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Applications de confiance"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Activité courante des métadonnées du bureau, du gestionnaire de fichiers et du navigateur. Les événements globaux correspondants deviennent fiables, ne génèrent aucune fenêtre contextuelle et restent visibles uniquement lorsque l’option « Afficher les événements de confiance » est activée. Cette liste n’accorde jamais de confiance pour les privilèges."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Applications de confiance"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Exécutables de confiance pour les privilèges"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Exécutables autorisés comme acteurs légitimes lors des contrôles de transition de privilèges de RootGuard. Les fichiers existants restent soumis à la validation de leur propriétaire et de leur identité."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Fiables pour les privilèges"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Exécutables bloqués"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Exécutables bloqués lors des contrôles de transition de privilèges de RootGuard. Il ne s’agit pas d’une liste noire générale empêchant le lancement des applications."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Bloqués"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Enregistrer les règles et redémarrer RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Les modifications non enregistrées ne sont jamais appliquées silencieusement. RootGuard ne redémarre qu’après l’enregistrement réussi de la politique."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Règles des applications"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Demande de démarrage du service…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Demande d’arrêt du service…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Rechargement de la politique RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "Redémarrage de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Actualisation de l’état de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Vérification…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Audit uniquement"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Chargement de l’état de RootGuard et des événements de sécurité récents…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Chemin absolu de l’exécutable, par exemple /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Ajouter"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Supprimer la sélection"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Saisissez d’abord le chemin absolu d’un exécutable."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Les règles des applications exigent un chemin absolu commençant par /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Ce chemin d’exécutable figure déjà dans la liste."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Aucune nouvelle application de bureau ou aucun nouveau navigateur installé par défaut n’a été trouvé."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "%1 exécutable(s) de bureau ou de navigateur installé(s) ont été ajoutés. Vérifiez et enregistrez la liste pour redémarrer RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Sélectionnez une règle à supprimer."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Les règles comportent des modifications non enregistrées. L’enregistrement validera la politique et redémarrera RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Un même exécutable ne peut pas être à la fois fiable et bloqué."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Enregistrement des règles des applications et redémarrage de RootGuard… Une authentification administrateur peut être demandée."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Enregistrement des règles d’applications de RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Activation du blocage immédiat pour les chemins système protégés ; le répertoire personnel de l’utilisateur reste en mode audit uniquement…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Passage de la protection des chemins système de RootGuard en mode audit…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Actif"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inactif"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Blocage immédiat"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Blocage immédiat"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blocage activé par une politique manuelle"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Audit uniquement · Protection assurée par Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Les règles des applications ont été enregistrées et RootGuard a été redémarré avec succès."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Les règles des applications n’ont pas été appliquées : %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard bloque les modifications protégées du système et contient les services affectés. Le répertoire personnel de l’utilisateur reste en mode audit uniquement sous la protection d’Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard bloque les modifications des métadonnées système protégées. Le répertoire personnel de l’utilisateur reste en mode audit uniquement sous la protection d’Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard surveille les métadonnées du système de fichiers en mode audit. Les événements des applications de confiance sont journalisés sans fenêtre contextuelle."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard n’est pas en cours d’exécution."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Aucune observation non résolue ni modification bloquée."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Observation d’audit : RootGuard n’a ni bloqué ni modifié l’opération."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Restaurer"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarantaine"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Ignorer"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Aucun événement RootGuard n’est encore disponible."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Seuls des événements de confiance sont disponibles. Activez « Afficher les événements de confiance » pour les afficher."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Service système bloqué"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Échec du blocage du service système"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Modification des métadonnées du système de fichiers observée"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Modification protégée bloquée"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Modification protégée observée"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Modification protégée détectée"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard a observé une modification des métadonnées du système de fichiers dans :\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard a bloqué une modification dans :\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard a observé une modification dans :\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard a détecté une modification dans :\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Avis de transparence : l’événement du noyau ne contenait qu’un nom de base. RootGuard affiche l’identité du système de fichiers et désactive les actions fondées sur le chemin au lieu de deviner un chemin potentiellement dangereux."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "Le service système affecté a été arrêté immédiatement. Sous systemd, il a également été masqué pendant l’exécution."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard n’a pas pu arrêter le service affecté. Consultez immédiatement les journaux du système d’initialisation."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard a demandé le confinement immédiat du service. Un événement ultérieur confirmera l’action du système d’initialisation."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "Le mode audit n’arrête et ne masque jamais les services. Cet événement est fourni uniquement à titre informatif."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "Le mode audit a enregistré cet événement sans bloquer ni modifier l’opération. Cette notification nécessite uniquement une confirmation."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Maintenir le blocage"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Confirmer"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Restauration des métadonnées protégées et déblocage du service…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Déplacement du fichier protégé depuis son chemin d’origine vers la quarantaine…"

582
locale/it_IT.po
View file

@ -8240,3 +8240,585 @@ msgstr "✔ Kill-switch disattivato."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Operazione kill-switch fallita: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "Installazione della CA di sistema e del daemon CEF disabilitata su questa distribuzione; Secure Browser e Bank GUI restano disponibili."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "percorso esatto dalla baseline protetta"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "percorso esatto risolto dal descrittore di file del processo"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "percorso esatto risolto dalla directory di lavoro del processo"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "percorso esatto fornito dall'evento del kernel"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "percorso esatto acquisito dall'LSM prima dell'operazione sui metadati"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "solo nome di base; il percorso esatto non era disponibile in questo evento"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Servizio di sistema arrestato e bloccato a runtime"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Blocco del servizio di sistema non riuscito"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Integrità del file protetto modificata"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Modifica dei permessi bloccata"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Modifica dei permessi osservata"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Modifica dei permessi rilevata"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Modifica della proprietà bloccata"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Modifica della proprietà osservata"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Modifica della proprietà rilevata"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Rimozione del file protetto bloccata"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Rimozione del file protetto osservata"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Rimozione del file protetto rilevata"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Ridenominazione del file protetto bloccata"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Ridenominazione del file protetto osservata"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Ridenominazione del file protetto rilevata"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Creazione di un collegamento fisico al file protetto bloccata"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Creazione di un collegamento fisico al file protetto osservata"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Creazione di un collegamento fisico al file protetto rilevata"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Modifica degli attributi estesi bloccata"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Modifica degli attributi estesi osservata"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Modifica degli attributi estesi rilevata"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Modifica dell'ACL bloccata"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Modifica dell'ACL osservata"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Modifica dell'ACL rilevata"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Modifica dei metadati protetti bloccata"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Modifica dei metadati protetti osservata"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Modifica dei metadati protetti rilevata"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Questo evento appartiene alla sorveglianza globale del filesystem. Non è associata alcuna baseline protetta, pertanto Ripristina e Quarantena non sono disponibili."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard dispone dell'identità del filesystem, ma non di un percorso esatto. Le azioni distruttive sono disabilitate per evitare di agire sull'oggetto errato."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "La rimozione è stata negata; il file è ancora presente e non è necessario ripristinarlo."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Il file è stato rimosso in modalità audit. Il ripristino automatico è impossibile senza un backup attendibile o una copia proveniente dal pacchetto."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Il recupero automatico non è disponibile per gli eventi di ridenominazione. Ripristinare il file da un pacchetto attendibile o da un backup."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Non è disponibile alcuna azione automatica per gli eventi relativi ai collegamenti fisici. Controllare manualmente l'origine e la destinazione."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Protezione di permessi e privilegi"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Servizio"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Modalità"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Sistema di init"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Blocco immediato delle modifiche ai permessi"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Blocca le modifiche ai metadati protetti del sistema prima che vengano applicate."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Mostra ambito di protezione"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Il blocco immediato si applica ai percorsi di sistema protetti e alle definizioni dei servizi. Le directory home degli utenti rimangono in modalità solo audit perché BastionGuard Anti-Ransomware è responsabile della protezione dei dati utente. La normale attività sui metadati di desktop e browser può essere classificata nelle Regole applicazioni senza concedere attendibilità per le transizioni di privilegio."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Percorsi di sistema protetti"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Home utente"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard registra l'attività globale sui metadati. Gli eventi delle applicazioni attendibili rimangono disponibili nella scheda Eventi, ma sono nascosti per impostazione predefinita e non generano mai finestre popup."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Avvia"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Arresta"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Ricarica policy"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Riavvia"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Aggiorna"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Panoramica"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Osservazioni di sicurezza e incidenti attivi"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidenti"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Eventi recenti di RootGuard"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Mostra eventi attendibili"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "L'attività delle applicazioni attendibili viene mostrata per impostazione predefinita per garantire la massima trasparenza. Disabilitare questa opzione solo per concentrarsi sugli eventi di audit e su quelli bloccati."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Eventi"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Gestisce le identità degli eseguibili utilizzate da RootGuard. Il salvataggio convalida la policy, richiede l'autenticazione dell'amministratore e riavvia RootGuard affinché le nuove identità inode diventino immediatamente operative."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Aggiungi applicazioni desktop/browser installate predefinite"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Aggiunge solo gli eseguibili conosciuti presenti su questo computer. Controllare l'elenco prima di salvare."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Applicazioni attendibili"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Normale attività sui metadati di desktop, gestori di file e browser. Gli eventi globali corrispondenti diventano attendibili, non generano finestre popup e rimangono visibili solo quando «Mostra eventi attendibili» è abilitato. Questo elenco non concede mai attendibilità per i privilegi."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Applicazioni attendibili"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Eseguibili attendibili per i privilegi"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Eseguibili consentiti come attori legittimi nei controlli di transizione dei privilegi di RootGuard. I file esistenti rimangono soggetti alla convalida della proprietà e dell'identità."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Attendibili per i privilegi"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Eseguibili bloccati"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Eseguibili bloccati durante i controlli di transizione dei privilegi di RootGuard. Non si tratta di una blacklist generale per l'avvio delle applicazioni."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Bloccati"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Salva le regole e riavvia RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Le modifiche non salvate non vengono mai applicate senza avviso. RootGuard viene riavviato solo dopo il corretto salvataggio della policy."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Regole applicazioni"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Richiesta di avvio del servizio…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Richiesta di arresto del servizio…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Ricaricamento della policy di RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "Riavvio di RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Aggiornamento dello stato di RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Controllo in corso…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Solo audit"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Caricamento dello stato di RootGuard e degli eventi di sicurezza recenti…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Percorso assoluto dell'eseguibile, ad esempio /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Aggiungi"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Rimuovi selezionato"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Inserire prima un percorso assoluto per l'eseguibile."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Le regole delle applicazioni richiedono un percorso assoluto che inizi con /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Il percorso di questo eseguibile è già presente nell'elenco."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Non sono state trovate nuove applicazioni desktop o browser installate predefinite."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Aggiunti %1 eseguibili desktop/browser installati. Controllare e salvare per riavviare RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Selezionare una regola da rimuovere."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Le regole contengono modifiche non salvate. Il salvataggio convaliderà la policy e riavvierà RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Lo stesso eseguibile non può essere contemporaneamente attendibile e bloccato."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Salvataggio delle regole delle applicazioni e riavvio di RootGuard… Potrebbe essere richiesta l'autenticazione dell'amministratore."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Salvataggio delle regole delle applicazioni di RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Abilitazione del blocco immediato per i percorsi di sistema protetti; la home utente rimane in modalità solo audit…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Passaggio della protezione dei percorsi di sistema di RootGuard alla modalità audit…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Attivo"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inattivo"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Blocco immediato"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Blocco immediato"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blocco abilitato tramite policy manuale"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Solo audit · Protezione applicata da Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Regole delle applicazioni salvate e RootGuard riavviato correttamente."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Le regole delle applicazioni non sono state applicate: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blocca le modifiche protette del sistema e contiene i servizi interessati. La home utente rimane in modalità solo audit sotto la protezione di Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blocca le modifiche ai metadati protetti del sistema. La home utente rimane in modalità solo audit sotto la protezione di Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard sta monitorando i metadati del filesystem in modalità audit. Gli eventi delle applicazioni attendibili vengono registrati senza finestre popup."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard non è in esecuzione."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Nessuna osservazione irrisolta o modifica bloccata."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Osservazione di audit: RootGuard non ha bloccato né modificato l'operazione."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Ripristina"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarantena"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Ignora"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Non sono ancora disponibili eventi di RootGuard."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Sono disponibili solo eventi attendibili. Abilitare «Mostra eventi attendibili» per visualizzarli."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Servizio di sistema bloccato"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Blocco del servizio di sistema non riuscito"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Modifica dei metadati del filesystem osservata"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Modifica protetta bloccata"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Modifica protetta osservata"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Modifica protetta rilevata"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard ha osservato una modifica dei metadati del filesystem in:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard ha bloccato una modifica in:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard ha osservato una modifica in:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard ha rilevato una modifica in:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Avviso di trasparenza: l'evento del kernel conteneva solo un nome di base. RootGuard mostra l'identità del filesystem e disabilita le azioni basate sul percorso invece di ipotizzare un percorso non sicuro."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "Il servizio di sistema interessato è stato arrestato immediatamente. Su systemd è stato anche mascherato a runtime."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard non è riuscito ad arrestare il servizio interessato. Controllare immediatamente i log del sistema di init."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard ha richiesto il contenimento immediato del servizio. Un evento successivo confermerà l'azione del sistema di init."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "La modalità audit non arresta né maschera mai i servizi. Questo evento è esclusivamente informativo."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "La modalità audit ha registrato questo evento senza bloccare né modificare l'operazione. Questa notifica richiede soltanto una presa visione."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Mantieni bloccato"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Presa visione"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Ripristino dei metadati protetti e sblocco del servizio…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Spostamento del file protetto dal percorso originale alla quarantena…"

594
locale/ja_JP.po
View file

@ -8473,3 +8473,597 @@ msgstr "✔ キルスイッチを無効化しました。"
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ キルスイッチ操作に失敗しました: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Fedora、RHEL、AlmaLinux、Rocky Linux、Ubuntu、Linux Mint、Mageia、OpenMandriva、openSUSEでは、システムCAおよびCEFデーモンのインストールが無効になっています。Secure BrowserとBank GUIは引き続き利用できます。"
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "このディストリビューションでは、システムCAおよびCEFデーモンのインストールが無効になっています。Secure BrowserとBank GUIは引き続き利用できます。"
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "保護されたベースラインから取得した正確なパス"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "プロセスのファイルディスクリプターから解決した正確なパス"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "プロセスの作業ディレクトリから解決した正確なパス"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "カーネルイベントによって提供された正確なパス"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "プロセスのファイルディスクリプターから解決した正確なパス"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "プロセスの作業ディレクトリから解決した正確なパス"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "カーネルイベントによって提供された正確なパス"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "メタデータ操作の前にLSMが取得した正確なパス"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "ベース名のみ。このイベントでは正確なパスを取得できませんでした"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "システムサービスを停止し、実行時にブロックしました"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "システムサービスのブロックに失敗しました"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "保護されたファイルの整合性が変更されました"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "アクセス権の変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "アクセス権の変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "アクセス権の変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "所有権の変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "所有権の変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "所有権の変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "保護されたファイルの削除をブロックしました"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "保護されたファイルの削除を確認しました"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "保護されたファイルの削除を検出しました"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "保護されたファイルの名前変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "保護されたファイルの名前変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "保護されたファイルの名前変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "保護されたファイルへのハードリンク作成をブロックしました"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "保護されたファイルへのハードリンク作成を確認しました"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "保護されたファイルへのハードリンク作成を検出しました"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "拡張属性の変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "拡張属性の変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "拡張属性の変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "ACLの変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "ACLの変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "ACLの変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "保護されたメタデータの変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "保護されたメタデータの変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "保護されたメタデータの変更を検出しました"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "このイベントはファイルシステム全体の監視に属します。保護されたベースラインが関連付けられていないため、復元と隔離は利用できません。"
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuardはファイルシステム上の識別情報を取得していますが、正確なパスは取得できていません。誤ったオブジェクトを操作しないよう、破壊的な操作は無効になっています。"
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "削除は拒否されました。ファイルは引き続き存在するため、復元は不要です。"
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "ファイルは監査モードで削除されました。信頼できるバックアップまたはパッケージのコピーがなければ、自動復元はできません。"
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "名前変更イベントでは自動復旧を利用できません。信頼できるパッケージまたはバックアップからファイルを復元してください。"
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "ハードリンクイベントには自動操作が用意されていません。リンク元とリンク先を手動で確認してください。"
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — アクセス権と特権の保護"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "サービス"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "モード"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "initシステム"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "アクセス権変更の即時ブロック"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "保護されたシステムメタデータへの変更を、適用される前にブロックします。"
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "保護範囲を表示"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "即時ブロックは、保護されたシステムパスとサービス定義に適用されます。ユーザーのホームディレクトリは、BastionGuard Anti-Ransomwareがユーザーデータの保護を担当するため、監査のみとなります。デスクトップやブラウザーによる通常のメタデータ操作は、特権移行の信頼を付与せずにアプリケーションルールで分類できます。"
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "保護されたシステムパス"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "ユーザーのホーム"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuardはシステム全体のメタデータ操作を記録します。信頼済みアプリケーションのイベントは「イベント」タブで確認できますが、既定では非表示で、ポップアップを生成することはありません。"
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ 開始"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ 停止"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ ポリシーを再読み込み"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ 再起動"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "更新"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "概要"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "セキュリティ上の観測事項と進行中のインシデント"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "インシデント"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "最近のRootGuardイベント"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "信頼済みイベントを表示"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "最大限の透明性を確保するため、信頼済みアプリケーションの操作は既定で表示されます。監査イベントとブロックされたイベントだけに注目する場合に限り、このオプションを無効にしてください。"
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "イベント"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "RootGuardが使用する実行ファイルの識別情報を管理します。保存時にポリシーが検証され、管理者認証が要求され、RootGuardが再起動されるため、新しいinode識別情報が直ちに有効になります。"
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "インストール済みのデスクトップ／ブラウザー既定値を追加"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "このコンピューターに存在する既知の実行ファイルだけを追加します。保存する前に一覧を確認してください。"
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "信頼済みアプリケーション"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "デスクトップ、ファイルマネージャー、ブラウザーによる通常のメタデータ操作です。一致するグローバルイベントは信頼済みとして扱われ、ポップアップを生成せず、「信頼済みイベントを表示」が有効な場合にのみ表示されます。この一覧によって特権移行の信頼が付与されることはありません。"
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "信頼済みアプリ"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "特権移行で信頼される実行ファイル"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "RootGuardの特権移行チェックで正当な実行主体として許可される実行ファイルです。既存のファイルについても、所有権と識別情報の検証は引き続き行われます。"
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "特権信頼"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "ブロック対象の実行ファイル"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "RootGuardの特権移行チェック中にブロックされる実行ファイルです。これはアプリケーションの起動全般を禁止するブラックリストではありません。"
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "ブロック対象"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "ルールを保存してRootGuardを再起動"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "未保存の変更が通知なしで適用されることはありません。RootGuardはポリシーが正常に保存された後にのみ再起動します。"
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "アプリケーションルール"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "サービスの開始を要求しています…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "サービスの停止を要求しています…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "RootGuardポリシーを再読み込みしています…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "RootGuardを再起動しています…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "RootGuardの状態を更新しています…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "確認しています…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "監査のみ"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "RootGuardの状態と最近のセキュリティイベントを読み込んでいます…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "実行ファイルの絶対パス（例：/usr/bin/firefox）"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "追加"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "選択項目を削除"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "最初に実行ファイルの絶対パスを入力してください。"
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "アプリケーションルールには、/ で始まる絶対パスが必要です。"
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "その実行ファイルのパスは既に一覧に登録されています。"
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "新たに追加できるインストール済みのデスクトップまたはブラウザー既定値は見つかりませんでした。"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "インストール済みのデスクトップ／ブラウザー実行ファイルを%1件追加しました。内容を確認して保存し、RootGuardを再起動してください。"
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "削除するルールを選択してください。"
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "ルールに未保存の変更があります。保存するとポリシーが検証され、RootGuardが再起動されます。"
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "同じ実行ファイルを信頼済みとブロック対象の両方に設定することはできません。"
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "アプリケーションルールを保存してRootGuardを再起動しています… 管理者認証を求められる場合があります。"
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "RootGuardのアプリケーションルールを保存しています…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "保護されたシステムパスの即時ブロックを有効にしています。ユーザーのホームは引き続き監査のみです…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "RootGuardのシステムパス保護を監査モードに切り替えています…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "有効"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "無効"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "即時ブロック"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "即時ブロック"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "手動ポリシーによってブロックが有効です"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "監査のみ · Anti-Ransomwareによる保護"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "アプリケーションルールを保存し、RootGuardを正常に再起動しました。"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "アプリケーションルールは適用されませんでした：%1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuardは保護対象のシステム変更をブロックし、影響を受けたサービスを封じ込めます。ユーザーのホームはAnti-Ransomwareの保護下で、引き続き監査のみとなります。"
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuardは保護されたシステムメタデータへの変更をブロックします。ユーザーのホームはAnti-Ransomwareの保護下で、引き続き監査のみとなります。"
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuardは監査モードでファイルシステムのメタデータを監視しています。信頼済みアプリケーションのイベントは、ポップアップを表示せずに記録されます。"
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuardは実行されていません。"
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "未解決の観測事項またはブロックされた変更はありません。"
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "監査結果：RootGuardはこの操作をブロックまたは変更しませんでした。"
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "復元"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "隔離"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "無視"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "RootGuardのイベントはまだありません。"
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "信頼済みイベントのみが存在します。表示するには「信頼済みイベントを表示」を有効にしてください。"
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 システムサービスをブロックしました"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ システムサービスのブロックに失敗しました"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ ファイルシステムメタデータの変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 保護対象の変更をブロックしました"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ 保護対象の変更を確認しました"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ 保護対象の変更を検出しました"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuardは次のファイルシステムメタデータの変更を確認しました：\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuardは次の対象への変更をブロックしました：\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuardは次の対象への変更を確認しました：\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuardは次の対象への変更を検出しました：\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "透明性に関する通知：カーネルイベントにはベース名しか含まれていませんでした。RootGuardは安全でないパスを推測せず、ファイルシステム上の識別情報を表示し、パスに基づく操作を無効にします。"
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "影響を受けたシステムサービスは直ちに停止されました。systemdでは実行時マスクも適用されています。"
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuardは影響を受けたサービスを停止できませんでした。直ちにinitシステムのログを確認してください。"
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuardはサービスの即時封じ込めを要求しました。後続イベントによってinitシステムの処理結果が確認されます。"
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "監査モードではサービスを停止またはマスクしません。このイベントは情報提供のみを目的としています。"
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "監査モードは操作をブロックまたは変更せずに、このイベントを記録しました。この通知は確認のみを目的としています。"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "ブロックを維持"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "確認"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "保護されたメタデータを復元し、サービスのブロックを解除しています…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "保護されたファイルを元のパスから隔離領域へ移動しています…"

582
locale/nl_NL.po
View file

@ -8417,3 +8417,585 @@ msgstr "✔ Kill-switch gedeactiveerd."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Kill-switchbewerking mislukt: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "De installatie van de systeem-CA en de CEF-daemon is uitgeschakeld op Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva en openSUSE. Secure Browser en Bank GUI blijven beschikbaar."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "De installatie van de systeem-CA en de CEF-daemon is uitgeschakeld op deze distributie; Secure Browser en Bank GUI blijven beschikbaar."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "exact pad uit de beveiligde referentiebasis"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "exact pad bepaald via de bestandsdescriptor van het proces"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "exact pad bepaald via de werkmap van het proces"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "exact pad geleverd door de kernelgebeurtenis"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "exact pad vastgelegd door de LSM vóór de metadatabewerking"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "alleen de basisnaam; het exacte pad was niet beschikbaar in deze gebeurtenis"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Systeemservice gestopt en tijdens runtime geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Blokkeren van de systeemservice is mislukt"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Integriteit van het beveiligde bestand is gewijzigd"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Wijziging van toegangsrechten geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Wijziging van toegangsrechten waargenomen"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Wijziging van toegangsrechten gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Wijziging van eigendom geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Wijziging van eigendom waargenomen"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Wijziging van eigendom gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Verwijdering van het beveiligde bestand geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Verwijdering van het beveiligde bestand waargenomen"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Verwijdering van het beveiligde bestand gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Hernoemen van het beveiligde bestand geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Hernoemen van het beveiligde bestand waargenomen"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Hernoemen van het beveiligde bestand gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Aanmaken van een harde koppeling naar een beveiligd bestand geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Aanmaken van een harde koppeling naar een beveiligd bestand waargenomen"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Aanmaken van een harde koppeling naar een beveiligd bestand gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Wijziging van uitgebreide attributen geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Wijziging van uitgebreide attributen waargenomen"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Wijziging van uitgebreide attributen gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "ACL-wijziging geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "ACL-wijziging waargenomen"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "ACL-wijziging gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Wijziging van beveiligde metadata geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Wijziging van beveiligde metadata waargenomen"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Wijziging van beveiligde metadata gedetecteerd"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Deze gebeurtenis behoort tot de globale bewaking van het bestandssysteem. Er is geen beveiligde referentiebasis gekoppeld, waardoor Herstellen en Quarantaine niet beschikbaar zijn."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard beschikt over de identiteit van het bestandssysteem, maar niet over een exact pad. Destructieve acties zijn uitgeschakeld om te voorkomen dat het verkeerde object wordt gewijzigd."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "De verwijdering is geweigerd; het bestand is nog aanwezig en hoeft niet te worden hersteld."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Het bestand is in auditmodus verwijderd. Automatisch herstel is niet mogelijk zonder een betrouwbare back-up of kopie uit het pakket."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Automatisch herstel is niet beschikbaar voor hernoemingsgebeurtenissen. Herstel het bestand vanuit een betrouwbaar pakket of een betrouwbare back-up."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Voor gebeurtenissen met harde koppelingen wordt geen automatische actie aangeboden. Controleer de bron en bestemming handmatig."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Bescherming van toegangsrechten en privileges"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Service"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Modus"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Init-systeem"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Toegangsrechten onmiddellijk blokkeren"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Blokkeert wijzigingen aan beveiligde systeemmetadata voordat deze worden toegepast."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Beschermingsbereik tonen"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Onmiddellijke blokkering is van toepassing op beveiligde systeempaden en servicedefinities. Persoonlijke mappen van gebruikers blijven alleen in auditmodus, omdat BastionGuard Anti-Ransomware verantwoordelijk is voor de bescherming van gebruikersgegevens. Routinematige metadata-activiteit van de desktop en browser kan onder Toepassingsregels worden geclassificeerd zonder vertrouwen voor privilegeovergangen toe te kennen."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Beveiligde systeempaden"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Persoonlijke map van gebruiker"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard registreert globale metadata-activiteit. Gebeurtenissen van vertrouwde toepassingen blijven beschikbaar op het tabblad Gebeurtenissen, maar zijn standaard verborgen en genereren nooit pop-ups."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Starten"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Stoppen"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Beleid opnieuw laden"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Opnieuw starten"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Vernieuwen"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Overzicht"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Beveiligingswaarnemingen en actieve incidenten"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidenten"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Recente RootGuard-gebeurtenissen"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Vertrouwde gebeurtenissen tonen"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "Activiteit van vertrouwde toepassingen wordt standaard getoond voor maximale transparantie. Schakel deze optie alleen uit om u te richten op auditgebeurtenissen en geblokkeerde gebeurtenissen."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Gebeurtenissen"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Beheer de identiteiten van uitvoerbare bestanden die door RootGuard worden gebruikt. Bij het opslaan wordt het beleid gevalideerd, beheerdersauthenticatie aangevraagd en RootGuard opnieuw gestart, zodat de nieuwe inode-identiteiten onmiddellijk van kracht worden."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Geïnstalleerde standaardtoepassingen voor desktop en browser toevoegen"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Voegt alleen bekende uitvoerbare bestanden toe die op deze computer aanwezig zijn. Controleer de lijst voordat u opslaat."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Vertrouwde toepassingen"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Routinematige metadata-activiteit van de desktop, bestandsbeheerder en browser. Overeenkomende globale gebeurtenissen worden vertrouwd, genereren geen pop-up en blijven alleen zichtbaar wanneer ‘Vertrouwde gebeurtenissen tonen’ is ingeschakeld. Deze lijst kent nooit vertrouwen voor privileges toe."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Vertrouwde apps"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Voor privileges vertrouwde uitvoerbare bestanden"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Uitvoerbare bestanden die als legitieme actoren zijn toegestaan tijdens controles van privilegeovergangen door RootGuard. Bestaande bestanden blijven onderworpen aan validatie van eigendom en identiteit."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Vertrouwd voor privileges"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Geblokkeerde uitvoerbare bestanden"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Uitvoerbare bestanden die worden geblokkeerd tijdens controles van privilegeovergangen door RootGuard. Dit is geen algemene zwarte lijst voor het starten van toepassingen."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Regels opslaan en RootGuard opnieuw starten"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Niet-opgeslagen wijzigingen worden nooit stilzwijgend toegepast. RootGuard wordt alleen opnieuw gestart nadat het beleid met succes is opgeslagen."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Toepassingsregels"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Start van service wordt aangevraagd…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Stoppen van service wordt aangevraagd…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "RootGuard-beleid wordt opnieuw geladen…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "RootGuard wordt opnieuw gestart…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "RootGuard-status wordt vernieuwd…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Controleren…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Alleen audit"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "RootGuard-status en recente beveiligingsgebeurtenissen worden geladen…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Absoluut pad naar uitvoerbaar bestand, bijvoorbeeld /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Toevoegen"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Selectie verwijderen"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Voer eerst een absoluut pad naar een uitvoerbaar bestand in."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Toepassingsregels vereisen een absoluut pad dat begint met /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Dat pad naar het uitvoerbare bestand staat al in deze lijst."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Er zijn geen nieuwe geïnstalleerde standaardtoepassingen voor desktop of browser gevonden."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "%1 geïnstalleerde uitvoerbare bestand(en) voor desktop of browser toegevoegd. Controleer en sla op om RootGuard opnieuw te starten."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Selecteer een regel om te verwijderen."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "De regels bevatten niet-opgeslagen wijzigingen. Bij het opslaan wordt het beleid gevalideerd en RootGuard opnieuw gestart."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Hetzelfde uitvoerbare bestand kan niet zowel vertrouwd als geblokkeerd zijn."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Toepassingsregels worden opgeslagen en RootGuard wordt opnieuw gestart… Mogelijk wordt beheerdersauthenticatie gevraagd."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "RootGuard-toepassingsregels worden opgeslagen…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Onmiddellijke blokkering voor beveiligde systeempaden wordt ingeschakeld; de persoonlijke map van de gebruiker blijft alleen in auditmodus…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "RootGuard-beveiliging van systeempaden wordt naar auditmodus geschakeld…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Actief"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inactief"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Onmiddellijke blokkering"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Onmiddellijke blokkering"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blokkering ingeschakeld door handmatig beleid"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Alleen audit · Bescherming door Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Toepassingsregels zijn opgeslagen en RootGuard is succesvol opnieuw gestart."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Toepassingsregels zijn niet toegepast: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blokkeert beveiligde systeemwijzigingen en beperkt de getroffen services. De persoonlijke map van de gebruiker blijft alleen in auditmodus onder bescherming van Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blokkeert wijzigingen aan beveiligde systeemmetadata. De persoonlijke map van de gebruiker blijft alleen in auditmodus onder bescherming van Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard bewaakt metadata van het bestandssysteem in auditmodus. Gebeurtenissen van vertrouwde toepassingen worden zonder pop-ups geregistreerd."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard is niet actief."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Geen onopgeloste waarnemingen of geblokkeerde wijzigingen."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Auditwaarneming: RootGuard heeft de bewerking niet geblokkeerd of gewijzigd."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Herstellen"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarantaine"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Negeren"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Er zijn nog geen RootGuard-gebeurtenissen beschikbaar."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Er zijn alleen vertrouwde gebeurtenissen beschikbaar. Schakel ‘Vertrouwde gebeurtenissen tonen’ in om ze weer te geven."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Systeemservice geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Blokkeren van systeemservice is mislukt"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Wijziging van bestandssysteemmetadata waargenomen"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Beveiligde wijziging geblokkeerd"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Beveiligde wijziging waargenomen"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Beveiligde wijziging gedetecteerd"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard heeft een wijziging van bestandssysteemmetadata waargenomen bij:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard heeft een wijziging geblokkeerd aan:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard heeft een wijziging waargenomen aan:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard heeft een wijziging gedetecteerd aan:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Transparantiemelding: de kernelgebeurtenis bevatte alleen een basisnaam. RootGuard toont de identiteit van het bestandssysteem en schakelt padgebaseerde acties uit in plaats van een mogelijk onveilig pad te raden."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "De getroffen systeemservice is onmiddellijk gestopt. Onder systemd is deze ook tijdens runtime gemaskeerd."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard kon de getroffen service niet stoppen. Controleer onmiddellijk de logboeken van het init-systeem."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard heeft onmiddellijke beperking van de service aangevraagd. Een vervolggebeurtenis zal de actie van het init-systeem bevestigen."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "In auditmodus worden services nooit gestopt of gemaskeerd. Deze gebeurtenis is uitsluitend informatief."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "De auditmodus heeft deze gebeurtenis geregistreerd zonder de bewerking te blokkeren of te wijzigen. Deze melding hoeft alleen te worden bevestigd."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Geblokkeerd houden"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Bevestigen"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Beveiligde metadata wordt hersteld en de service wordt gedeblokkeerd…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Het beveiligde bestand wordt vanaf het oorspronkelijke pad naar quarantaine verplaatst…"

582
locale/pl_PL.po
View file

@ -8478,3 +8478,585 @@ msgstr "✔ Kill-switch dezaktywowany."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Operacja kill-switcha nie powiodła się: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Instalacja systemowego urzędu certyfikacji (CA) i demona CEF jest wyłączona w systemach Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva i openSUSE. Secure Browser i Bank GUI pozostają dostępne."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "Instalacja systemowego urzędu certyfikacji (CA) i demona CEF jest wyłączona w tej dystrybucji; Secure Browser i Bank GUI pozostają dostępne."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "dokładna ścieżka z chronionej linii bazowej"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "dokładna ścieżka ustalona na podstawie deskryptora pliku procesu"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "dokładna ścieżka ustalona na podstawie katalogu roboczego procesu"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "dokładna ścieżka dostarczona przez zdarzenie jądra"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "dokładna ścieżka przechwycona przez LSM przed operacją na metadanych"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "tylko nazwa bazowa; dokładna ścieżka nie była dostępna w tym zdarzeniu"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Usługa systemowa została zatrzymana i zablokowana na czas działania"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Nie udało się zablokować usługi systemowej"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Integralność chronionego pliku została zmieniona"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Zmiana uprawnień została zablokowana"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Zaobserwowano zmianę uprawnień"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Wykryto zmianę uprawnień"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Zmiana właściciela została zablokowana"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Zaobserwowano zmianę właściciela"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Wykryto zmianę właściciela"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Usunięcie chronionego pliku zostało zablokowane"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Zaobserwowano usunięcie chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Wykryto usunięcie chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Zmiana nazwy chronionego pliku została zablokowana"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Zaobserwowano zmianę nazwy chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Wykryto zmianę nazwy chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Utworzenie dowiązania twardego do chronionego pliku zostało zablokowane"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Zaobserwowano utworzenie dowiązania twardego do chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Wykryto utworzenie dowiązania twardego do chronionego pliku"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Zmiana atrybutów rozszerzonych została zablokowana"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Zaobserwowano zmianę atrybutów rozszerzonych"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Wykryto zmianę atrybutów rozszerzonych"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Zmiana ACL została zablokowana"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Zaobserwowano zmianę ACL"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Wykryto zmianę ACL"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Zmiana chronionych metadanych została zablokowana"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Zaobserwowano zmianę chronionych metadanych"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Wykryto zmianę chronionych metadanych"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "To zdarzenie należy do globalnego monitorowania systemu plików. Nie jest z nim powiązana chroniona linia bazowa, dlatego funkcje Przywróć i Kwarantanna są niedostępne."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard zna tożsamość obiektu w systemie plików, ale nie zna jego dokładnej ścieżki. Działania destrukcyjne zostały wyłączone, aby uniknąć operacji na niewłaściwym obiekcie."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "Usunięcie zostało odrzucone; plik nadal istnieje i nie wymaga przywracania."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Plik został usunięty w trybie audytu. Automatyczne przywrócenie nie jest możliwe bez zaufanej kopii zapasowej lub kopii z pakietu."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Automatyczne odzyskiwanie nie jest dostępne dla zdarzeń zmiany nazwy. Przywróć plik z zaufanego pakietu lub kopii zapasowej."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Dla zdarzeń dotyczących dowiązań twardych nie jest dostępne żadne działanie automatyczne. Sprawdź ręcznie źródło i miejsce docelowe."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Ochrona uprawnień i przywilejów"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Usługa"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Tryb"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "System init"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Natychmiastowe blokowanie zmian uprawnień"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Blokuje zmiany chronionych metadanych systemowych przed ich zastosowaniem."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Pokaż zakres ochrony"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Natychmiastowe blokowanie dotyczy chronionych ścieżek systemowych i definicji usług. Katalogi domowe użytkowników pozostają objęte wyłącznie audytem, ponieważ za ochronę danych użytkownika odpowiada BastionGuard Anti-Ransomware. Rutynowa aktywność metadanych środowiska graficznego i przeglądarek może zostać sklasyfikowana w Regułach aplikacji bez przyznawania zaufania dla przejść uprawnień."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Chronione ścieżki systemowe"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Katalog domowy użytkownika"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard rejestruje globalną aktywność dotyczącą metadanych. Zdarzenia zaufanych aplikacji pozostają dostępne na karcie Zdarzenia, ale są domyślnie ukryte i nigdy nie generują wyskakujących powiadomień."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Uruchom"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Zatrzymaj"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Wczytaj ponownie politykę"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Uruchom ponownie"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Odśwież"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Przegląd"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Obserwacje bezpieczeństwa i aktywne incydenty"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incydenty"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Ostatnie zdarzenia RootGuard"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Pokaż zaufane zdarzenia"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "Aktywność zaufanych aplikacji jest domyślnie wyświetlana w celu zapewnienia maksymalnej przejrzystości. Wyłącz tę opcję tylko wtedy, gdy chcesz skupić się na zdarzeniach audytowych i zablokowanych."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Zdarzenia"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Zarządzaj tożsamościami plików wykonywalnych używanymi przez RootGuard. Zapisanie powoduje sprawdzenie polityki, zażądanie uwierzytelnienia administratora oraz ponowne uruchomienie RootGuard, dzięki czemu nowe tożsamości inode zaczynają obowiązywać natychmiast."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Dodaj domyślne zainstalowane aplikacje pulpitu i przeglądarki"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Dodaje tylko znane pliki wykonywalne istniejące na tym komputerze. Sprawdź listę przed zapisaniem."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Zaufane aplikacje"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Rutynowa aktywność metadanych środowiska graficznego, menedżera plików i przeglądarki. Pasujące zdarzenia globalne stają się zaufane, nie generują wyskakujących powiadomień i pozostają widoczne tylko wtedy, gdy włączona jest opcja „Pokaż zaufane zdarzenia”. Ta lista nigdy nie przyznaje zaufania dla przejść uprawnień."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Zaufane aplikacje"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Pliki wykonywalne zaufane dla przejść uprawnień"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Pliki wykonywalne dopuszczone jako prawidłowi wykonawcy podczas kontroli przejść uprawnień RootGuard. Istniejące pliki nadal podlegają weryfikacji właściciela i tożsamości."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Zaufane dla uprawnień"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Zablokowane pliki wykonywalne"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Pliki wykonywalne blokowane podczas kontroli przejść uprawnień RootGuard. Nie jest to ogólna czarna lista uniemożliwiająca uruchamianie aplikacji."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Zablokowane"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Zapisz reguły i uruchom ponownie RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Niezapisane zmiany nigdy nie są stosowane bez powiadomienia. RootGuard jest uruchamiany ponownie dopiero po pomyślnym zapisaniu polityki."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Reguły aplikacji"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Żądanie uruchomienia usługi…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Żądanie zatrzymania usługi…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Ponowne wczytywanie polityki RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "Ponowne uruchamianie RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Odświeżanie stanu RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Sprawdzanie…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Tylko audyt"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Wczytywanie stanu RootGuard i ostatnich zdarzeń bezpieczeństwa…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Bezwzględna ścieżka do pliku wykonywalnego, na przykład /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Dodaj"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Usuń zaznaczone"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Najpierw wprowadź bezwzględną ścieżkę do pliku wykonywalnego."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Reguły aplikacji wymagają bezwzględnej ścieżki rozpoczynającej się od /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Ta ścieżka do pliku wykonywalnego znajduje się już na liście."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Nie znaleziono nowych zainstalowanych domyślnych aplikacji pulpitu ani przeglądarek."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Dodano %1 zainstalowanych plików wykonywalnych aplikacji pulpitu lub przeglądarki. Sprawdź listę i zapisz ją, aby ponownie uruchomić RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Wybierz regułę do usunięcia."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "Reguły zawierają niezapisane zmiany. Zapisanie spowoduje sprawdzenie polityki i ponowne uruchomienie RootGuard."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Ten sam plik wykonywalny nie może być jednocześnie zaufany i zablokowany."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Zapisywanie reguł aplikacji i ponowne uruchamianie RootGuard… Może zostać wymagane uwierzytelnienie administratora."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Zapisywanie reguł aplikacji RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Włączanie natychmiastowego blokowania dla chronionych ścieżek systemowych; katalog domowy użytkownika pozostaje objęty wyłącznie audytem…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Przełączanie ochrony ścieżek systemowych RootGuard do trybu audytu…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Aktywny"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Nieaktywny"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Natychmiastowe blokowanie"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Natychmiastowe blokowanie"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Blokowanie włączone przez ręczną politykę"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Tylko audyt · Ochrona egzekwowana przez Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Reguły aplikacji zostały zapisane, a RootGuard został pomyślnie uruchomiony ponownie."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Reguły aplikacji nie zostały zastosowane: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blokuje chronione zmiany systemowe i izoluje dotknięte nimi usługi. Katalog domowy użytkownika pozostaje objęty wyłącznie audytem pod ochroną Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard blokuje zmiany chronionych metadanych systemowych. Katalog domowy użytkownika pozostaje objęty wyłącznie audytem pod ochroną Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard monitoruje metadane systemu plików w trybie audytu. Zdarzenia zaufanych aplikacji są rejestrowane bez wyskakujących powiadomień."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard nie jest uruchomiony."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Brak nierozwiązanych obserwacji lub zablokowanych zmian."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Obserwacja audytowa: RootGuard nie zablokował ani nie zmienił operacji."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Przywróć"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Kwarantanna"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Odrzuć"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Nie ma jeszcze dostępnych zdarzeń RootGuard."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Dostępne są tylko zaufane zdarzenia. Włącz opcję „Pokaż zaufane zdarzenia”, aby je wyświetlić."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Usługa systemowa została zablokowana"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Nie udało się zablokować usługi systemowej"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Zaobserwowano zmianę metadanych systemu plików"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Chroniona zmiana została zablokowana"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Zaobserwowano chronioną zmianę"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Wykryto chronioną zmianę"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard zaobserwował zmianę metadanych systemu plików w:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard zablokował zmianę w:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard zaobserwował zmianę w:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard wykrył zmianę w:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Informacja o przejrzystości: zdarzenie jądra zawierało wyłącznie nazwę bazową. RootGuard wyświetla tożsamość obiektu w systemie plików i wyłącza działania oparte na ścieżce, zamiast zgadywać potencjalnie niebezpieczną ścieżkę."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "Dotknięta usługa systemowa została natychmiast zatrzymana. W systemd została również zamaskowana na czas działania."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard nie mógł zatrzymać dotkniętej usługi. Natychmiast sprawdź dzienniki systemu init."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard zażądał natychmiastowej izolacji usługi. Kolejne zdarzenie potwierdzi działanie systemu init."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "Tryb audytu nigdy nie zatrzymuje ani nie maskuje usług. To zdarzenie ma charakter wyłącznie informacyjny."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "Tryb audytu zarejestrował to zdarzenie bez blokowania lub modyfikowania operacji. To powiadomienie wymaga jedynie potwierdzenia."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Pozostaw zablokowane"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Potwierdź"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Przywracanie chronionych metadanych i odblokowywanie usługi…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Przenoszenie chronionego pliku z jego pierwotnej ścieżki do kwarantanny…"

582
locale/pt_PT.po
View file

@ -8490,3 +8490,585 @@ msgstr "✔ Kill-switch desativado."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Falha na operação do kill-switch: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "A instalação da CA do sistema e do daemon CEF está desativada no Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. O Secure Browser e a Bank GUI continuam disponíveis."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "A instalação da CA do sistema e do daemon CEF está desativada nesta distribuição; o Secure Browser e a Bank GUI continuam disponíveis."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "caminho exato obtido da linha de base protegida"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "caminho exato determinado a partir do descritor de ficheiro do processo"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "caminho exato determinado a partir do diretório de trabalho do processo"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "caminho exato fornecido pelo evento do kernel"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "caminho exato capturado pelo LSM antes da operação sobre os metadados"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "apenas o nome de base; o caminho exato não estava disponível neste evento"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Serviço do sistema parado e bloqueado durante a execução"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Falha ao bloquear o serviço do sistema"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "A integridade do ficheiro protegido foi alterada"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Alteração de permissões bloqueada"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Alteração de permissões observada"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Alteração de permissões detetada"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Alteração de propriedade bloqueada"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Alteração de propriedade observada"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Alteração de propriedade detetada"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Remoção do ficheiro protegido bloqueada"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Remoção do ficheiro protegido observada"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Remoção do ficheiro protegido detetada"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Mudança de nome do ficheiro protegido bloqueada"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Mudança de nome do ficheiro protegido observada"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Mudança de nome do ficheiro protegido detetada"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Criação de uma ligação física para o ficheiro protegido bloqueada"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Criação de uma ligação física para o ficheiro protegido observada"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Criação de uma ligação física para o ficheiro protegido detetada"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Alteração de atributos estendidos bloqueada"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Alteração de atributos estendidos observada"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Alteração de atributos estendidos detetada"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Alteração da ACL bloqueada"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Alteração da ACL observada"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Alteração da ACL detetada"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Alteração de metadados protegidos bloqueada"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Alteração de metadados protegidos observada"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Alteração de metadados protegidos detetada"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Este evento pertence à monitorização global do sistema de ficheiros. Não existe qualquer linha de base protegida associada, pelo que Restaurar e Quarentena não estão disponíveis."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "O RootGuard possui a identidade do objeto no sistema de ficheiros, mas não dispõe de um caminho exato. As ações destrutivas estão desativadas para evitar atuar sobre o objeto errado."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "A remoção foi recusada; o ficheiro continua presente e não é necessário restaurá-lo."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "O ficheiro foi removido no modo de auditoria. O restauro automático é impossível sem uma cópia de segurança fidedigna ou uma cópia proveniente do pacote."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "A recuperação automática não está disponível para eventos de mudança de nome. Restaure o ficheiro a partir de um pacote fidedigno ou de uma cópia de segurança."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Não é disponibilizada qualquer ação automática para eventos de ligações físicas. Verifique manualmente a origem e o destino."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Proteção de permissões e privilégios"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Serviço"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Modo"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Sistema de inicialização"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Bloqueio imediato de alterações de permissões"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Bloqueia alterações aos metadados protegidos do sistema antes de serem aplicadas."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Mostrar âmbito da proteção"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "O bloqueio imediato aplica-se aos caminhos protegidos do sistema e às definições de serviços. Os diretórios pessoais dos utilizadores permanecem apenas em modo de auditoria, porque o BastionGuard Anti-Ransomware é responsável pela proteção dos dados dos utilizadores. A atividade rotineira de metadados do ambiente de trabalho e dos navegadores pode ser classificada nas Regras de aplicações sem conceder confiança para transições de privilégios."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Caminhos protegidos do sistema"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Diretório pessoal do utilizador"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "O RootGuard regista a atividade global de metadados. Os eventos de aplicações fidedignas permanecem disponíveis no separador Eventos, mas estão ocultos por predefinição e nunca geram janelas emergentes."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Iniciar"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Parar"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Recarregar política"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Reiniciar"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Atualizar"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Visão geral"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Observações de segurança e incidentes ativos"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Incidentes"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Eventos recentes do RootGuard"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Mostrar eventos fidedignos"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "A atividade das aplicações fidedignas é apresentada por predefinição para garantir a máxima transparência. Desative esta opção apenas para se concentrar nos eventos de auditoria e nos eventos bloqueados."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "Eventos"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Gerir as identidades dos executáveis utilizados pelo RootGuard. Ao guardar, a política é validada, é solicitada a autenticação do administrador e o RootGuard é reiniciado para que as novas identidades de inode entrem imediatamente em vigor."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Adicionar aplicações predefinidas instaladas do ambiente de trabalho e dos navegadores"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Adiciona apenas executáveis conhecidos que existem neste computador. Verifique a lista antes de guardar."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Aplicações fidedignas"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Atividade rotineira de metadados do ambiente de trabalho, do gestor de ficheiros e dos navegadores. Os eventos globais correspondentes passam a ser considerados fidedignos, não geram janelas emergentes e permanecem visíveis apenas quando «Mostrar eventos fidedignos» está ativado. Esta lista nunca concede confiança para privilégios."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Aplicações fidedignas"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Executáveis fidedignos para privilégios"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Executáveis permitidos como intervenientes legítimos nas verificações de transição de privilégios do RootGuard. Os ficheiros existentes continuam sujeitos à validação da propriedade e da identidade."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Fidedignos para privilégios"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Executáveis bloqueados"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Executáveis bloqueados durante as verificações de transição de privilégios do RootGuard. Esta não é uma lista negra geral para impedir o arranque de aplicações."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Bloqueados"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Guardar regras e reiniciar o RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "As alterações não guardadas nunca são aplicadas silenciosamente. O RootGuard só é reiniciado depois de a política ser guardada com êxito."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Regras de aplicações"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "A solicitar o início do serviço…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "A solicitar a paragem do serviço…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "A recarregar a política do RootGuard…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "A reiniciar o RootGuard…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "A atualizar o estado do RootGuard…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "A verificar…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Apenas auditoria"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "A carregar o estado do RootGuard e os eventos de segurança recentes…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Caminho absoluto do executável, por exemplo /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Adicionar"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Remover selecionado"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Introduza primeiro um caminho absoluto para um executável."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "As regras de aplicações exigem um caminho absoluto que comece por /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Esse caminho de executável já está presente nesta lista."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Não foram encontradas novas aplicações predefinidas instaladas do ambiente de trabalho ou dos navegadores."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Foram adicionados %1 executável(eis) instalado(s) do ambiente de trabalho ou dos navegadores. Verifique e guarde para reiniciar o RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Selecione uma regra para remover."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "As regras contêm alterações não guardadas. Ao guardar, a política será validada e o RootGuard será reiniciado."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "O mesmo executável não pode ser simultaneamente fidedigno e bloqueado."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "A guardar as regras de aplicações e a reiniciar o RootGuard… Poderá ser solicitada a autenticação do administrador."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "A guardar as regras de aplicações do RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "A ativar o bloqueio imediato para os caminhos protegidos do sistema; o diretório pessoal do utilizador permanece apenas em modo de auditoria…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "A mudar a proteção dos caminhos do sistema do RootGuard para o modo de auditoria…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Ativo"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Inativo"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Bloqueio imediato"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Bloqueio imediato"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Bloqueio ativado por uma política manual"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Apenas auditoria · Proteção aplicada pelo Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "As regras de aplicações foram guardadas e o RootGuard foi reiniciado com êxito."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "As regras de aplicações não foram aplicadas: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "O RootGuard bloqueia alterações protegidas do sistema e contém os serviços afetados. O diretório pessoal do utilizador permanece apenas em modo de auditoria sob a proteção do Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "O RootGuard bloqueia alterações aos metadados protegidos do sistema. O diretório pessoal do utilizador permanece apenas em modo de auditoria sob a proteção do Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "O RootGuard está a monitorizar os metadados do sistema de ficheiros no modo de auditoria. Os eventos de aplicações fidedignas são registados sem janelas emergentes."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "O RootGuard não está em execução."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Não existem observações por resolver nem alterações bloqueadas."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Observação de auditoria: o RootGuard não bloqueou nem alterou a operação."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Restaurar"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Quarentena"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Ignorar"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "Ainda não existem eventos do RootGuard disponíveis."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Apenas estão disponíveis eventos fidedignos. Ative «Mostrar eventos fidedignos» para os apresentar."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Serviço do sistema bloqueado"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Falha ao bloquear o serviço do sistema"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Alteração dos metadados do sistema de ficheiros observada"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Alteração protegida bloqueada"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Alteração protegida observada"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Alteração protegida detetada"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "O RootGuard observou uma alteração dos metadados do sistema de ficheiros em:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "O RootGuard bloqueou uma alteração em:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "O RootGuard observou uma alteração em:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "O RootGuard detetou uma alteração em:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Aviso de transparência: o evento do kernel continha apenas um nome de base. O RootGuard apresenta a identidade do objeto no sistema de ficheiros e desativa as ações baseadas no caminho, em vez de tentar adivinhar um caminho potencialmente inseguro."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "O serviço do sistema afetado foi parado imediatamente. Em systemd, também foi mascarado durante a execução."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "O RootGuard não conseguiu parar o serviço afetado. Consulte imediatamente os registos do sistema de inicialização."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "O RootGuard solicitou a contenção imediata do serviço. Um evento posterior confirmará a ação do sistema de inicialização."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "O modo de auditoria nunca para nem mascara serviços. Este evento é apenas informativo."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "O modo de auditoria registou este evento sem bloquear nem alterar a operação. Esta notificação requer apenas confirmação."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Manter bloqueado"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Confirmar"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "A restaurar os metadados protegidos e a desbloquear o serviço…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "A mover o ficheiro protegido do caminho original para a quarentena…"

582
locale/ru_RU.po
View file

@ -8380,3 +8380,585 @@ msgstr "✔ Kill-switch деактивирован."
#: src/vpn/VpnPage.cpp:651
msgid "✗ Operazione kill-switch fallita: "
msgstr "✗ Ошибка операции kill-switch: "
msgid "Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva e openSUSE. Secure Browser e Bank GUI restano disponibili."
msgstr "Установка системного центра сертификации (CA) и демона CEF отключена в Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Linux Mint, Mageia, OpenMandriva и openSUSE. Secure Browser и Bank GUI остаются доступными."
msgid "Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili"
msgstr "Установка системного центра сертификации (CA) и демона CEF отключена в этом дистрибутиве; Secure Browser и Bank GUI остаются доступными."
#: src/rootguard/RootGuardPage.cpp:46
msgid "exact path from protected baseline"
msgstr "точный путь из защищённой базовой конфигурации"
#: src/rootguard/RootGuardPage.cpp:48
msgid "exact path resolved from the process file descriptor"
msgstr "точный путь, определённый по файловому дескриптору процесса"
#: src/rootguard/RootGuardPage.cpp:50
msgid "exact path resolved from the process working directory"
msgstr "точный путь, определённый по рабочему каталогу процесса"
#: src/rootguard/RootGuardPage.cpp:52
msgid "exact path supplied by the kernel event"
msgstr "точный путь, предоставленный событием ядра"
#: src/rootguard/RootGuardPage.cpp:54
msgid "exact path captured by the LSM before the metadata operation"
msgstr "точный путь, полученный LSM до операции с метаданными"
#: src/rootguard/RootGuardPage.cpp:55
msgid "basename only; the exact path was unavailable in this event"
msgstr "только базовое имя; точный путь был недоступен в этом событии"
#: src/rootguard/RootGuardPage.cpp:65
msgid "System service stopped and runtime-blocked"
msgstr "Системная служба остановлена и заблокирована на время выполнения"
#: src/rootguard/RootGuardPage.cpp:66
msgid "System service blocking failed"
msgstr "Не удалось заблокировать системную службу"
#: src/rootguard/RootGuardPage.cpp:68
msgid "Protected file integrity changed"
msgstr "Целостность защищённого файла изменена"
#: src/rootguard/RootGuardPage.cpp:70
msgid "Permission change blocked"
msgstr "Изменение прав доступа заблокировано"
#: src/rootguard/RootGuardPage.cpp:71
msgid "Permission change observed"
msgstr "Зафиксировано изменение прав доступа"
#: src/rootguard/RootGuardPage.cpp:72
msgid "Permission change detected"
msgstr "Обнаружено изменение прав доступа"
#: src/rootguard/RootGuardPage.cpp:74
msgid "Ownership change blocked"
msgstr "Изменение владельца заблокировано"
#: src/rootguard/RootGuardPage.cpp:75
msgid "Ownership change observed"
msgstr "Зафиксировано изменение владельца"
#: src/rootguard/RootGuardPage.cpp:76
msgid "Ownership change detected"
msgstr "Обнаружено изменение владельца"
#: src/rootguard/RootGuardPage.cpp:78
msgid "Protected file removal blocked"
msgstr "Удаление защищённого файла заблокировано"
#: src/rootguard/RootGuardPage.cpp:79
msgid "Protected file removal observed"
msgstr "Зафиксировано удаление защищённого файла"
#: src/rootguard/RootGuardPage.cpp:80
msgid "Protected file removal detected"
msgstr "Обнаружено удаление защищённого файла"
#: src/rootguard/RootGuardPage.cpp:82
msgid "Protected file rename blocked"
msgstr "Переименование защищённого файла заблокировано"
#: src/rootguard/RootGuardPage.cpp:83
msgid "Protected file rename observed"
msgstr "Зафиксировано переименование защищённого файла"
#: src/rootguard/RootGuardPage.cpp:84
msgid "Protected file rename detected"
msgstr "Обнаружено переименование защищённого файла"
#: src/rootguard/RootGuardPage.cpp:86
msgid "Protected hard-link creation blocked"
msgstr "Создание жёсткой ссылки на защищённый файл заблокировано"
#: src/rootguard/RootGuardPage.cpp:87
msgid "Protected hard-link creation observed"
msgstr "Зафиксировано создание жёсткой ссылки на защищённый файл"
#: src/rootguard/RootGuardPage.cpp:88
msgid "Protected hard-link creation detected"
msgstr "Обнаружено создание жёсткой ссылки на защищённый файл"
#: src/rootguard/RootGuardPage.cpp:90
msgid "Extended-attribute change blocked"
msgstr "Изменение расширенных атрибутов заблокировано"
#: src/rootguard/RootGuardPage.cpp:91
msgid "Extended-attribute change observed"
msgstr "Зафиксировано изменение расширенных атрибутов"
#: src/rootguard/RootGuardPage.cpp:92
msgid "Extended-attribute change detected"
msgstr "Обнаружено изменение расширенных атрибутов"
#: src/rootguard/RootGuardPage.cpp:94
msgid "ACL change blocked"
msgstr "Изменение ACL заблокировано"
#: src/rootguard/RootGuardPage.cpp:95
msgid "ACL change observed"
msgstr "Зафиксировано изменение ACL"
#: src/rootguard/RootGuardPage.cpp:96
msgid "ACL change detected"
msgstr "Обнаружено изменение ACL"
#: src/rootguard/RootGuardPage.cpp:97
msgid "Protected metadata change blocked"
msgstr "Изменение защищённых метаданных заблокировано"
#: src/rootguard/RootGuardPage.cpp:98
msgid "Protected metadata change observed"
msgstr "Зафиксировано изменение защищённых метаданных"
#: src/rootguard/RootGuardPage.cpp:99
msgid "Protected metadata change detected"
msgstr "Обнаружено изменение защищённых метаданных"
#: src/rootguard/RootGuardPage.cpp:198
msgid "This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable."
msgstr "Это событие относится к глобальному наблюдению за файловой системой. Защищённая базовая конфигурация не связана с ним, поэтому восстановление и карантин недоступны."
#: src/rootguard/RootGuardPage.cpp:200
msgid "RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object."
msgstr "RootGuard располагает идентификатором объекта файловой системы, но не его точным путём. Разрушительные действия отключены, чтобы избежать воздействия на неверный объект."
#: src/rootguard/RootGuardPage.cpp:203
msgid "The removal was denied; the file is still present and no restore is required."
msgstr "Удаление было запрещено; файл всё ещё существует, поэтому восстановление не требуется."
#: src/rootguard/RootGuardPage.cpp:204
msgid "The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy."
msgstr "Файл был удалён в режиме аудита. Автоматическое восстановление невозможно без доверенной резервной копии или копии из пакета."
#: src/rootguard/RootGuardPage.cpp:206
msgid "Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup."
msgstr "Автоматическое восстановление недоступно для событий переименования. Восстановите файл из доверенного пакета или резервной копии."
#: src/rootguard/RootGuardPage.cpp:208
msgid "No automatic action is offered for hard-link events. Review the source and destination manually."
msgstr "Для событий с жёсткими ссылками автоматические действия не предусмотрены. Проверьте источник и назначение вручную."
#: src/rootguard/RootGuardPage.cpp:281
msgid "🛡️ RootGuard — Permission and Privilege Protection"
msgstr "🛡️ RootGuard — Защита прав доступа и привилегий"
#: src/rootguard/RootGuardPage.cpp:291
msgid "Service"
msgstr "Служба"
#: src/rootguard/RootGuardPage.cpp:292
msgid "Mode"
msgstr "Режим"
#: src/rootguard/RootGuardPage.cpp:293
msgid "Init system"
msgstr "Система инициализации"
#: src/rootguard/RootGuardPage.cpp:294
msgid "PID"
msgstr "PID"
#: src/rootguard/RootGuardPage.cpp:316
msgid "Immediate permission blocking"
msgstr "Немедленная блокировка изменений прав доступа"
#: src/rootguard/RootGuardPage.cpp:318
msgid "Blocks protected system metadata changes before they are committed."
msgstr "Блокирует изменения защищённых системных метаданных до их применения."
#: src/rootguard/RootGuardPage.cpp:324
msgid "Show protection scope"
msgstr "Показать область защиты"
#: src/rootguard/RootGuardPage.cpp:326
msgid "Immediate blocking applies to protected system paths and service definitions. User home directories remain audit-only because BastionGuard Anti-Ransomware is responsible for enforcement on user data. Routine desktop and browser metadata activity can be classified under Application rules without granting privilege-transition trust."
msgstr "Немедленная блокировка применяется к защищённым системным путям и определениям служб. Домашние каталоги пользователей остаются только в режиме аудита, поскольку за защиту пользовательских данных отвечает BastionGuard Anti-Ransomware. Обычную активность настольных приложений и браузеров с метаданными можно классифицировать в правилах приложений без предоставления доверия для переходов привилегий."
#: src/rootguard/RootGuardPage.cpp:345
msgid "Protected system paths"
msgstr "Защищённые системные пути"
#: src/rootguard/RootGuardPage.cpp:346
msgid "User home"
msgstr "Домашний каталог пользователя"
#: src/rootguard/RootGuardPage.cpp:350
msgid "RootGuard records global metadata activity. Trusted application events remain available in the Events tab but are hidden by default and never generate popups."
msgstr "RootGuard регистрирует глобальную активность с метаданными. События доверенных приложений остаются доступными на вкладке «События», но по умолчанию скрыты и никогда не создают всплывающих уведомлений."
#: src/rootguard/RootGuardPage.cpp:360
msgid "▶ Start"
msgstr "▶ Запустить"
#: src/rootguard/RootGuardPage.cpp:361
msgid "■ Stop"
msgstr "■ Остановить"
#: src/rootguard/RootGuardPage.cpp:362
msgid "↻ Reload policy"
msgstr "↻ Перезагрузить политику"
#: src/rootguard/RootGuardPage.cpp:363
msgid "⟳ Restart"
msgstr "⟳ Перезапустить"
#: src/rootguard/RootGuardPage.cpp:364
msgid "Refresh"
msgstr "Обновить"
#: src/rootguard/RootGuardPage.cpp:379
msgid "Overview"
msgstr "Обзор"
#: src/rootguard/RootGuardPage.cpp:387
msgid "Security observations and active incidents"
msgstr "Наблюдения безопасности и активные инциденты"
#: src/rootguard/RootGuardPage.cpp:401
msgid "Incidents"
msgstr "Инциденты"
#: src/rootguard/RootGuardPage.cpp:410
msgid "Recent RootGuard events"
msgstr "Недавние события RootGuard"
#: src/rootguard/RootGuardPage.cpp:414
msgid "Show trusted events"
msgstr "Показывать доверенные события"
#: src/rootguard/RootGuardPage.cpp:417
msgid "Trusted application activity is shown by default for maximum transparency. Disable this option only to focus on audit and blocked events."
msgstr "Для максимальной прозрачности активность доверенных приложений отображается по умолчанию. Отключайте этот параметр только для просмотра событий аудита и заблокированных событий."
#: src/rootguard/RootGuardPage.cpp:440
msgid "Events"
msgstr "События"
#: src/rootguard/RootGuardPage.cpp:449
msgid "Manage executable identities used by RootGuard. Saving validates the policy, requests administrator authentication, and restarts RootGuard so the new inode identities take effect immediately."
msgstr "Управление идентификаторами исполняемых файлов, используемыми RootGuard. При сохранении политика проверяется, запрашивается аутентификация администратора и RootGuard перезапускается, чтобы новые идентификаторы inode немедленно вступили в силу."
#: src/rootguard/RootGuardPage.cpp:459
msgid "Add installed desktop/browser defaults"
msgstr "Добавить установленные стандартные приложения рабочего стола и браузеры"
#: src/rootguard/RootGuardPage.cpp:461
msgid "Adds only known executables that exist on this computer. Review the list before saving."
msgstr "Добавляет только известные исполняемые файлы, существующие на этом компьютере. Проверьте список перед сохранением."
#: src/rootguard/RootGuardPage.cpp:475
msgid "Trusted applications"
msgstr "Доверенные приложения"
#: src/rootguard/RootGuardPage.cpp:476
msgid "Routine desktop, file-manager and browser metadata activity. Matching global events become trusted, produce no popup and remain visible only when “Show trusted events” is enabled. This list never grants privilege trust."
msgstr "Обычная активность рабочего стола, файлового менеджера и браузера с метаданными. Соответствующие глобальные события становятся доверенными, не создают всплывающих уведомлений и отображаются только при включённом параметре «Показывать доверенные события». Этот список никогда не предоставляет доверие для переходов привилегий."
#: src/rootguard/RootGuardPage.cpp:480
msgid "Trusted apps"
msgstr "Доверенные приложения"
#: src/rootguard/RootGuardPage.cpp:484
msgid "Privilege-trusted executables"
msgstr "Исполняемые файлы, доверенные для переходов привилегий"
#: src/rootguard/RootGuardPage.cpp:485
msgid "Executables allowed as legitimate actors in RootGuard privilege-transition checks. Existing files are still subject to ownership and identity validation."
msgstr "Исполняемые файлы, разрешённые в качестве легитимных субъектов при проверках переходов привилегий RootGuard. Существующие файлы по-прежнему проходят проверку владельца и идентичности."
#: src/rootguard/RootGuardPage.cpp:488
msgid "Privilege trusted"
msgstr "Доверенные для привилегий"
#: src/rootguard/RootGuardPage.cpp:492
msgid "Blocked executables"
msgstr "Заблокированные исполняемые файлы"
#: src/rootguard/RootGuardPage.cpp:493
msgid "Executables blocked during RootGuard privilege-transition checks. This is not a general application-launch blacklist."
msgstr "Исполняемые файлы, блокируемые во время проверок переходов привилегий RootGuard. Это не общий чёрный список запуска приложений."
#: src/rootguard/RootGuardPage.cpp:496
msgid "Blocked"
msgstr "Заблокированные"
#: src/rootguard/RootGuardPage.cpp:504
msgid "Save rules and restart RootGuard"
msgstr "Сохранить правила и перезапустить RootGuard"
#: src/rootguard/RootGuardPage.cpp:514
msgid "Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."
msgstr "Несохранённые изменения никогда не применяются без уведомления. RootGuard перезапускается только после успешного сохранения политики."
#: src/rootguard/RootGuardPage.cpp:516
msgid "Application rules"
msgstr "Правила приложений"
#: src/rootguard/RootGuardPage.cpp:529
msgid "Requesting service start…"
msgstr "Запрашивается запуск службы…"
#: src/rootguard/RootGuardPage.cpp:531
msgid "Requesting service stop…"
msgstr "Запрашивается остановка службы…"
#: src/rootguard/RootGuardPage.cpp:533
msgid "Reloading RootGuard policy…"
msgstr "Политика RootGuard перезагружается…"
#: src/rootguard/RootGuardPage.cpp:535
msgid "Restarting RootGuard…"
msgstr "RootGuard перезапускается…"
#: src/rootguard/RootGuardPage.cpp:537
msgid "Refreshing RootGuard status…"
msgstr "Состояние RootGuard обновляется…"
#: src/rootguard/RootGuardPage.cpp:558 src/rootguard/RootGuardPage.cpp:562
msgid "Checking…"
msgstr "Проверка…"
#: src/rootguard/RootGuardPage.cpp:563 src/rootguard/RootGuardPage.cpp:849
msgid "Audit-only"
msgstr "Только аудит"
#: src/rootguard/RootGuardPage.cpp:564
msgid "Loading RootGuard status and recent security events…"
msgstr "Загружается состояние RootGuard и последние события безопасности…"
#: src/rootguard/RootGuardPage.cpp:616
msgid "Absolute executable path, for example /usr/bin/firefox"
msgstr "Абсолютный путь к исполняемому файлу, например /usr/bin/firefox"
#: src/rootguard/RootGuardPage.cpp:617
msgid "Add"
msgstr "Добавить"
#: src/rootguard/RootGuardPage.cpp:618
msgid "Remove selected"
msgstr "Удалить выбранное"
#: src/rootguard/RootGuardPage.cpp:642
msgid "Enter an absolute executable path first."
msgstr "Сначала введите абсолютный путь к исполняемому файлу."
#: src/rootguard/RootGuardPage.cpp:648
msgid "Application rules require an absolute path beginning with /."
msgstr "Для правил приложений требуется абсолютный путь, начинающийся с /."
#: src/rootguard/RootGuardPage.cpp:656
msgid "That executable path is already present in this list."
msgstr "Этот путь к исполняемому файлу уже присутствует в списке."
#: src/rootguard/RootGuardPage.cpp:719
msgid "No new installed desktop or browser defaults were found."
msgstr "Новые установленные стандартные приложения рабочего стола или браузеры не найдены."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:724
msgid "Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."
msgstr "Добавлено установленных исполняемых файлов рабочего стола или браузеров: %1. Проверьте список и сохраните его для перезапуска RootGuard."
#: src/rootguard/RootGuardPage.cpp:732
msgid "Select a rule to remove."
msgstr "Выберите правило для удаления."
#: src/rootguard/RootGuardPage.cpp:743
msgid "Rules have unsaved changes. Saving will validate the policy and restart RootGuard."
msgstr "В правилах имеются несохранённые изменения. При сохранении политика будет проверена, а RootGuard перезапущен."
#: src/rootguard/RootGuardPage.cpp:802
msgid "The same executable cannot be both trusted and blocked."
msgstr "Один и тот же исполняемый файл не может быть одновременно доверенным и заблокированным."
#: src/rootguard/RootGuardPage.cpp:810
msgid "Saving application rules and restarting RootGuard… Administrator authentication may be requested."
msgstr "Сохраняются правила приложений и перезапускается RootGuard… Может быть запрошена аутентификация администратора."
#: src/rootguard/RootGuardPage.cpp:811
msgid "Saving RootGuard application rules…"
msgstr "Сохраняются правила приложений RootGuard…"
#: src/rootguard/RootGuardPage.cpp:828
msgid "Enabling immediate blocking for protected system paths; user home remains audit-only…"
msgstr "Включается немедленная блокировка для защищённых системных путей; домашний каталог пользователя остаётся только в режиме аудита…"
#: src/rootguard/RootGuardPage.cpp:829
msgid "Switching RootGuard system-path protection to audit mode…"
msgstr "Защита системных путей RootGuard переключается в режим аудита…"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Active"
msgstr "Активен"
#: src/rootguard/RootGuardPage.cpp:839
msgid "Inactive"
msgstr "Неактивен"
#: src/rootguard/RootGuardPage.cpp:841
msgid "Immediate block"
msgstr "Немедленная блокировка"
#: src/rootguard/RootGuardPage.cpp:849
msgid "Immediate blocking"
msgstr "Немедленная блокировка"
#: src/rootguard/RootGuardPage.cpp:851
msgid "Blocking enabled by manual policy"
msgstr "Блокировка включена вручную заданной политикой"
#: src/rootguard/RootGuardPage.cpp:852
msgid "Audit-only · Anti-Ransomware enforcement"
msgstr "Только аудит · Защита обеспечивается Anti-Ransomware"
#: src/rootguard/RootGuardPage.cpp:870
msgid "Application rules saved and RootGuard restarted successfully."
msgstr "Правила приложений сохранены, RootGuard успешно перезапущен."
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:873
msgid "Application rules were not applied: %1"
msgstr "Правила приложений не были применены: %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:882
msgid "✅ %1"
msgstr "✅ %1"
#. TRANSLATORS: Preserve placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:883
msgid "❌ %1"
msgstr "❌ %1"
#: src/rootguard/RootGuardPage.cpp:886
msgid "RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard блокирует защищённые системные изменения и изолирует затронутые службы. Домашний каталог пользователя остаётся только в режиме аудита под защитой Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:887
msgid "RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."
msgstr "RootGuard блокирует изменения защищённых системных метаданных. Домашний каталог пользователя остаётся только в режиме аудита под защитой Anti-Ransomware."
#: src/rootguard/RootGuardPage.cpp:890
msgid "RootGuard is monitoring filesystem metadata in audit mode. Trusted application events are logged without popups."
msgstr "RootGuard отслеживает метаданные файловой системы в режиме аудита. События доверенных приложений записываются без всплывающих уведомлений."
#: src/rootguard/RootGuardPage.cpp:892
msgid "RootGuard is not running."
msgstr "RootGuard не запущен."
#: src/rootguard/RootGuardPage.cpp:929
msgid "No unresolved observations or blocked changes."
msgstr "Нет неразрешённых наблюдений или заблокированных изменений."
#: src/rootguard/RootGuardPage.cpp:960
msgid "Audit observation: RootGuard did not block or alter the operation."
msgstr "Результат аудита: RootGuard не блокировал и не изменял операцию."
#: src/rootguard/RootGuardPage.cpp:975 src/rootguard/RootGuardPage.cpp:1191
msgid "Restore"
msgstr "Восстановить"
#: src/rootguard/RootGuardPage.cpp:981 src/rootguard/RootGuardPage.cpp:1200
msgid "Quarantine"
msgstr "Карантин"
#: src/rootguard/RootGuardPage.cpp:987
msgid "Dismiss"
msgstr "Игнорировать"
#: src/rootguard/RootGuardPage.cpp:1008
msgid "No RootGuard events are available yet."
msgstr "События RootGuard пока отсутствуют."
#: src/rootguard/RootGuardPage.cpp:1010
msgid "Only trusted events are available. Enable “Show trusted events” to display them."
msgstr "Доступны только доверенные события. Включите параметр «Показывать доверенные события», чтобы отобразить их."
#: src/rootguard/RootGuardPage.cpp:1091
msgid "🛑 System service blocked"
msgstr "🛑 Системная служба заблокирована"
#: src/rootguard/RootGuardPage.cpp:1092
msgid "⚠️ System service block failed"
msgstr "⚠️ Не удалось заблокировать системную службу"
#: src/rootguard/RootGuardPage.cpp:1094
msgid "⚠️ Filesystem metadata change observed"
msgstr "⚠️ Зафиксировано изменение метаданных файловой системы"
#: src/rootguard/RootGuardPage.cpp:1096
msgid "🛑 Protected change blocked"
msgstr "🛑 Защищённое изменение заблокировано"
#: src/rootguard/RootGuardPage.cpp:1098
msgid "⚠️ Protected change observed"
msgstr "⚠️ Зафиксировано защищённое изменение"
#: src/rootguard/RootGuardPage.cpp:1099
msgid "⚠️ Protected change detected"
msgstr "⚠️ Обнаружено защищённое изменение"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1110
msgid "RootGuard observed a filesystem metadata change to:\n<b>%1</b>"
msgstr "RootGuard зафиксировал изменение метаданных файловой системы в:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1112
msgid "RootGuard blocked a change to:\n<b>%1</b>"
msgstr "RootGuard заблокировал изменение в:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1114
msgid "RootGuard observed a change to:\n<b>%1</b>"
msgstr "RootGuard зафиксировал изменение в:\n<b>%1</b>"
#. TRANSLATORS: Preserve the Pango markup and placeholders such as %1.
#: src/rootguard/RootGuardPage.cpp:1115
msgid "RootGuard detected a change to:\n<b>%1</b>"
msgstr "RootGuard обнаружил изменение в:\n<b>%1</b>"
#: src/rootguard/RootGuardPage.cpp:1144
msgid "Transparency notice: the kernel event contained only a basename. RootGuard shows the filesystem identity and disables path-based actions rather than guessing an unsafe path."
msgstr "Уведомление о прозрачности: событие ядра содержало только базовое имя. RootGuard отображает идентификатор объекта файловой системы и отключает действия на основе пути вместо небезопасного предположения о полном пути."
#: src/rootguard/RootGuardPage.cpp:1157
msgid "The affected system service has been stopped immediately. On systemd it is also runtime-masked."
msgstr "Затронутая системная служба была немедленно остановлена. В systemd она также замаскирована на время выполнения."
#: src/rootguard/RootGuardPage.cpp:1158
msgid "RootGuard could not stop the affected service. Review the init-system logs immediately."
msgstr "RootGuard не удалось остановить затронутую службу. Немедленно проверьте журналы системы инициализации."
#: src/rootguard/RootGuardPage.cpp:1160
msgid "RootGuard requested immediate service containment. A follow-up event will confirm the init-system action."
msgstr "RootGuard запросил немедленную изоляцию службы. Последующее событие подтвердит действие системы инициализации."
#: src/rootguard/RootGuardPage.cpp:1161
msgid "Audit mode never stops or masks services. This event is informational only."
msgstr "Режим аудита никогда не останавливает и не маскирует службы. Это событие носит исключительно информационный характер."
#: src/rootguard/RootGuardPage.cpp:1173
msgid "Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."
msgstr "Режим аудита зарегистрировал это событие без блокировки или изменения операции. Это уведомление требует только подтверждения ознакомления."
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Keep blocked"
msgstr "Оставить заблокированным"
#: src/rootguard/RootGuardPage.cpp:1187
msgid "Acknowledge"
msgstr "Подтвердить"
#: src/rootguard/RootGuardPage.cpp:1252
msgid "Restoring protected metadata and unblocking the service…"
msgstr "Восстанавливаются защищённые метаданные и снимается блокировка службы…"
#: src/rootguard/RootGuardPage.cpp:1259
msgid "Moving the protected file from its original path into quarantine…"
msgstr "Защищённый файл перемещается из исходного расположения в карантин…"

25
mageia/bastionguard-mageia10.spec
View file

@ -19,7 +19,7 @@
#
Name: bastionguard
Version: 2.0.2
Version: 2.0.3
Release: %mkrel 1
%global yara_version 4.5.5
%global yara_stage %{_builddir}/%{name}-%{version}/.yara-stage
@ -277,6 +277,7 @@ export LDFLAGS="${LDFLAGS:-} -L$YARA_LIBDIR"
-DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
-DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
-DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
-DCMAKE_INSTALL_SBINDIR=sbin \
-DENABLE_SYSTEMD_SERVICES=OFF \
-DENABLE_USER_AGENT_AUTO=OFF \
-DINSTALL_NGINX_DEFAULTS=OFF \
@ -286,7 +287,8 @@ export LDFLAGS="${LDFLAGS:-} -L$YARA_LIBDIR"
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
-DROOTGUARD_INIT_SYSTEM=systemd \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF
@ -405,6 +407,7 @@ fi
%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop
@ -425,10 +428,10 @@ fi
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
%{_unitdir}/*
%{_userunitdir}/*
%{_datadir}/locale/*
%{_datadir}/icons/*
%{_datadir}/plymouth/*
@ -462,9 +465,15 @@ fi
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a
%{_datadir}/doc/bastionguard-rootguard/
%changelog
* Thu Jul 16 2026 Calogero Scarnà <info@bastionguard.eu> 2.0-2
- Build and bundle YARA 4.5.5 because Mageia 10 does not provide yara-devel.
- Stage YARA for BastionGuard through the imported PkgConfig::YARA target.
- Ship the YARA and yarac tools together with the versioned libyara runtime.
- Remove external yara and yara-devel package requirements.
* Thu Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package

141
mageia/change_cmake_mageia/CMakeLists.txt
View file

@ -757,8 +757,8 @@ target_include_directories(BastionGuard
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -782,6 +782,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_EMBEDDED_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

34
openmandriva/bastionguard-openmandriva6-rock.spec
View file

@ -20,7 +20,7 @@
Name: bastionguard
Version: 2.0.2
Version: 2.0.3
Release: 1
%global yara_version 4.5.5
@ -377,7 +377,7 @@ cmake -S . -B build \
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
-DCMAKE_BUILD_RPATH="$YARA_LIBDIR" \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
@ -478,6 +478,7 @@ fi
%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop
@ -498,10 +499,10 @@ fi
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
%{_unitdir}/*
%{_userunitdir}/*
%{_datadir}/locale/*
%{_datadir}/icons/*
%{_datadir}/plymouth/*
@ -535,20 +536,15 @@ fi
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a
%{_datadir}/doc/bastionguard-rootguard/
%changelog
* Thu Jul 16 2026 Calogero Scarnà <info@bastionguard.eu> 2.0-3
- Link the private YARA build through the imported PkgConfig::YARA target.
- Preserve the staged YARA library directory in the linker flags.
- Verify the unversioned libyara.so linker name before configuring CMake.
- Use generator-independent out-of-source CMake build and install commands.
- Verify the OpenMandriva Clang kPageOrder source patch.
* Thu Jul 16 2026 Calogero Scarnà <info@bastionguard.eu> 2.0-2
- Resolve libsoup-3.0 through its pkg-config capability.
- Stop applying the private YARA sysroot to native system dependencies.
- Rewrite the staged yara.pc paths instead.
- Verify libsoup headers and compiler flags before CMake configuration.
* Wed Jul 15 2026 Calogero Scarnà <info@bastionguard.eu> 2.0-2
- Build and bundle YARA 4.5.5 before BastionGuard on OpenMandriva Rock 6.0
- Remove unavailable external yara/yara-devel dependencies
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package

141
openmandriva/change_cmake_openmandriva/CMakeLists.txt
View file

@ -763,8 +763,8 @@ target_include_directories(BastionGuard
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -788,6 +788,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_EMBEDDED_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

37
opensuse_leap16/bastionguard.spec
View file

@ -23,7 +23,7 @@
#
Name: bastionguard
Version: 2.0.2
Version: 2.0.3
Release: 1leap
Summary: BastionGuard Security Platform
License: GPLv3
@ -231,7 +231,7 @@ cmake -S . -B build -G Ninja \
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
@ -278,6 +278,7 @@ fi
%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
@ -299,6 +300,7 @@ fi
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
%{_unitdir}/*
%{_userunitdir}/*
@ -339,26 +341,15 @@ fi
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a
%{_datadir}/doc/bastionguard-rootguard/
%changelog
* Thu Jul 16 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0-4
- Remove literal RPM CMake macro references from comments.
- Prevent comment macro expansion from injecting commands into the build.
- Keep the explicit Ninja build and install directories.
* Thu Jul 16 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0-3
- Use an explicit CMake source and build directory on Leap 16.
- Force the Ninja generator and build from ./build.
- Avoid inconsistent Leap container definitions of the CMake build helper.
- Install from the same verified CMake build tree.
* Wed Jul 15 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0-2
- Adapt the package specification to openSUSE Leap 16.0.
- Use the distribution python3 and python3-devel packages.
- Make PHP-FPM and BPF command-line tools weak dependencies.
- Require a pre-generated vmlinux.h in the source archive.
- Use the native wwwrun:www web-service account.
- Remove duplicate and runtime-only BuildRequires entries.
- Normalize file macros and avoid duplicate file-list entries.
* Fri Jun 12 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0-1
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package

141
opensuse_leap16/cmake_opensuse/CMakeLists.txt
View file

@ -719,8 +719,8 @@ target_include_directories(BastionGuard
)
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -744,6 +744,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_EMBEDDED_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

18
opensuse_rpm/bastionguard_opensuse.spec
View file

@ -23,7 +23,7 @@
#
Name: bastionguard
Version: 2.0.2
Version: 2.0.3
Release: 1
Summary: BastionGuard Security Platform
License: GPLv3
@ -213,7 +213,7 @@ unset LDFLAGS
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
@ -244,6 +244,7 @@ fi
%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
%{_datadir}/applications/BastionGuard-secure.desktop
@ -264,6 +265,7 @@ fi
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
%{_unitdir}/*
%{_userunitdir}/*
@ -275,7 +277,6 @@ fi
/usr/share/metainfo/*
/usr/share/man/*
/usr/share/icons/hicolor/*/apps/*
%dir %{_libexecdir}/bastionguard
%{_libexecdir}/bastionguard/*
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
@ -302,6 +303,15 @@ fi
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a
%{_datadir}/doc/bastionguard-rootguard/
%changelog
* Fri Jun 12 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package

141
opensuse_rpm/cmake_change_build/CMakeLists.txt
View file

@ -719,8 +719,8 @@ target_include_directories(BastionGuard
)
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -744,6 +744,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
if(ENABLE_EMBEDDED_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)

2
pkgbuild/PKGBUILD
View file

@ -21,7 +21,7 @@
# Maintainer: BastionGuard info@bastionguard.eu
pkgname=bastionguard
pkgver=2.0.2
pkgver=2.0.3
pkgrel=1
pkgdesc="BastionGuard - transparent security control plane for Linux desktops"
arch=('x86_64')

141
pkgbuild/cmake_archlinux/CMakeLists.txt
View file

@ -636,8 +636,8 @@ target_include_directories(BastionGuard
)
target_compile_definitions(BastionGuard PRIVATE
BASTIONGUARD_VERSION="2.0.2"
BASTIONGUARD_BUILD=20260727
BASTIONGUARD_VERSION="2.0.3"
BASTIONGUARD_BUILD=20260803
)
target_link_libraries(BastionGuard
@ -661,6 +661,143 @@ target_link_libraries(BastionGuard
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
"Build BastionGuard RootGuard"
ON
)
option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
"Build RootGuard tests"
OFF
)
set(BASTIONGUARD_ROOTGUARD_TARGET
"BastionGuard"
CACHE STRING
"Existing BastionGuard executable target"
)
set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
"auto"
CACHE STRING
"RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)
set(BASTIONGUARD_ROOTGUARD_BTF
"/sys/kernel/btf/vmlinux"
CACHE FILEPATH
"Kernel BTF used to build RootGuard"
)
if(ENABLE_BASTIONGUARD_ROOTGUARD)
set(BG_ROOTGUARD_SOURCE_DIR
"${CMAKE_SOURCE_DIR}/src/rootguard"
)
set(BG_ROOTGUARD_BINARY_DIR
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"[RootGuard] Module not found: "
"${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
)
endif()
if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
message(FATAL_ERROR
"[RootGuard] Main target does not exist: "
"${BASTIONGUARD_ROOTGUARD_TARGET}. "
"Move this block after add_executable()."
)
endif()
set(ROOTGUARD_BUILD_DAEMON
ON CACHE BOOL
"Build RootGuard daemon"
FORCE
)
set(ROOTGUARD_BUILD_GTK_PAGE
ON CACHE BOOL
"Build RootGuardPage"
FORCE
)
set(ROOTGUARD_BUILD_GTK_DEMO
OFF CACHE BOOL
"Disable standalone GTK demo"
FORCE
)
set(ROOTGUARD_BUILD_TESTS
${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
CACHE BOOL
"Build RootGuard tests"
FORCE
)
set(ROOTGUARD_INIT_SYSTEM
"${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
CACHE STRING
"RootGuard init system"
FORCE
)
set(ROOTGUARD_VMLINUX_BTF
"${BASTIONGUARD_ROOTGUARD_BTF}"
CACHE FILEPATH
"RootGuard kernel BTF"
FORCE
)
message(STATUS "[RootGuard] =====================================")
message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
message(STATUS "[RootGuard] Build dir : ${BG_ROOTGUARD_BINARY_DIR}")
message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")
add_subdirectory(
"${BG_ROOTGUARD_SOURCE_DIR}"
"${BG_ROOTGUARD_BINARY_DIR}"
)
if(NOT TARGET BastionGuard::RootGuardUI)
message(FATAL_ERROR
"[RootGuard] RootGuard UI target was not created"
)
endif()
target_link_libraries(
${BASTIONGUARD_ROOTGUARD_TARGET}
PRIVATE
BastionGuard::RootGuardUI
)
if(TARGET bastionguard-rootguard)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard
)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(
${BASTIONGUARD_ROOTGUARD_TARGET}
bastionguard-rootguard-action
)
endif()
message(STATUS "[RootGuard] Native module enabled")
message(STATUS "[RootGuard] =====================================")
endif()
# ============================================================
# Blink / CEF Integration (SecureBrowser)
# ============================================================

2
src/AboutPage.cpp
View file

@ -96,7 +96,7 @@ AboutPage::AboutPage() : Gtk::Box(Gtk::Orientation::VERTICAL) {
label_name->set_markup(
Glib::ustring::compose(
"<b>BastionGuard™</b> "
"<b>BastionGuard™ Endpoint</b> "
"<span size='medium'><i>%1 · build %2</i></span>",
version,
build

2
src/DashboardPage.cpp
View file

@ -89,7 +89,7 @@ DashboardPage::~DashboardPage()
DashboardPage::DashboardPage()
: Gtk::Box(Gtk::Orientation::VERTICAL, 16),
lbl_title_("<b>Dashboard BastionGuard</b>", Gtk::Align::START),
lbl_title_("<b>Dashboard BastionGuard Endpoint</b>", Gtk::Align::START),
grid_cards_(),
lbl_status_(_("Inizializzazione...")),
lbl_db_version_(_("Versione firme: sconosciuta")),

2
src/DonatePage.cpp
View file

@ -29,7 +29,7 @@ DonatePage::DonatePage()
{
set_margin(20);
auto lbl_title = Gtk::make_managed<Gtk::Label>("<b>" + Glib::ustring(_("Sostieni BastionGuard")) + "</b>");
auto lbl_title = Gtk::make_managed<Gtk::Label>("<b>" + Glib::ustring(_("Sostieni BastionGuard")) + " Endpoint </b>");
lbl_title->set_use_markup(true);
lbl_title->set_halign(Gtk::Align::CENTER);
append(*lbl_title);

52
src/IdentityLeakPage/ui/IdentityLeakPage.cpp
View file

@ -304,30 +304,54 @@ void IdentityLeakPage::onCheckClicked()
if (email.empty())
return;
// A std::thread remains joinable even after its function has returned.
// Reassigning a joinable std::thread calls std::terminate().
// running == false means the previous check has finished, so reap it
// before creating the next worker.
if (workerThread.joinable())
workerThread.join();
stopMonitor();
running = true;
logBuffer->set_text("");
appendLog(_("Avvio controllo violazioni…"));
workerThread = std::thread(
[this, email]() {
try {
workerThread = std::thread(
[this, email]() {
try {
LeakCheckWorker worker(
email,
[this](const std::string& msg) {
appendLog(msg);
});
LeakCheckWorker worker(
email,
[this](const std::string& msg) {
appendLog(msg);
});
worker.run();
worker.run();
appendLog(_("Controllo completato."));
appendLog(_("Controllo completato."));
if (IdentityLeakConfig::monitorEnabled())
startMonitor(email);
}
catch (const std::exception& ex) {
appendLog(
std::string(_("❌ Errore controllo violazioni: ")) +
ex.what());
}
catch (...) {
appendLog(_("❌ Errore inatteso durante il controllo violazioni"));
}
if (IdentityLeakConfig::monitorEnabled())
startMonitor(email);
running = false;
});
running = false;
});
}
catch (const std::exception& ex) {
running = false;
appendLog(
std::string(_("❌ Impossibile avviare il controllo: ")) +
ex.what());
}
}
void IdentityLeakPage::onCheckPasswordClicked()

7
src/MainWindow.cpp
View file

@ -87,6 +87,8 @@ MainWindow::MainWindow() {
#endif
privacy_page_ = Gtk::make_managed<PrivacyPage>();
stack_.add(*privacy_page_, "privacy");
rootguard_page_ = Gtk::make_managed<RootGuardPage>();
stack_.add(*rootguard_page_, "rootguard");
stack_.add(quarantine_page_, "quarantine");
usb_page_ = Gtk::make_managed<USBScanPage>();
stack_.add(*usb_page_, "usbscan");
@ -202,7 +204,7 @@ void MainWindow::build_sidebar(ClamdConfig&) {
#if BASTIONGUARD_HAS_CEF
"bank",
#endif
"privacy","usbscan","samba",
"privacy","rootguard","usbscan","samba",
"log","quarantine","identityleak","passwordmanager","backup","update",
"phishing",
"about","donate"
@ -225,7 +227,7 @@ void MainWindow::build_sidebar(ClamdConfig&) {
auto logo = Gtk::make_managed<Gtk::Image>(pb);
hdr->append(*logo);
} catch (...) {}
auto lbl = Gtk::make_managed<Gtk::Label>("BastionGuard™");
auto lbl = Gtk::make_managed<Gtk::Label>("BastionGuard™ Endpoint");
lbl->set_halign(Gtk::Align::START);
lbl->get_style_context()->add_class("sidebar-title");
hdr->append(*lbl);
@ -369,6 +371,7 @@ void MainWindow::build_sidebar(ClamdConfig&) {
}
#endif
grp_prot->append(*make_leaf(resource("icons/privacy.svg"), _("Privacy Webcam"), "privacy", true));
grp_prot->append(*make_leaf(resource("icons/rootguard.svg"), _("RootGuard"), "rootguard", true));
grp_prot->append(*make_leaf(resource("icons/usb.svg"), _("Periferiche USB"), "usbscan", true));
grp_prot->append(*make_leaf(resource("icons/samba.svg"), _("Samba"), "samba", true));

2
src/MainWindow.hpp
View file

@ -36,6 +36,7 @@
#include "BankPage.hpp"
#endif
#include "PrivacyPage.hpp"
#include "rootguard/RootGuardPage.hpp"
#include "AntiRansomwarePage.hpp"
#include "SettingsWindow.hpp"
#include "usb/USBScanPage.hpp"
@ -79,6 +80,7 @@ private:
VpnPage* vpn_page_ = nullptr;
UpdatePage update_page_;
PrivacyPage* privacy_page_;
RootGuardPage* rootguard_page_ = nullptr;
AntiRansomwarePage* anti_ransomware_page_ = nullptr;
USBScanPage* usb_page_ = nullptr;
SambaPage* samba_page_ = nullptr;

88
src/SecureBrowser.cpp
View file

@ -30,6 +30,7 @@
#include <include/cef_request_handler.h>
#include <include/cef_ssl_info.h>
#include <include/views/cef_browser_view.h>
#include <include/views/cef_browser_view_delegate.h>
#include <include/views/cef_window.h>
#include <include/views/cef_window_delegate.h>
#include <include/wrapper/cef_helpers.h>
@ -469,6 +470,80 @@ private:
IMPLEMENT_REFCOUNTING(SimpleHandler);
};
// -----------------------------------------------------------------------------
// Popup CEF Views
//
// Il browser principale usa CefBrowserView. Senza un delegate Views esplicito i
// popup creati da window.open()/target=_blank possono finire nella finestra CEF
// predefinita invece che in una finestra BastionGuard. Questo e' particolarmente
// visibile nei flussi OTP/3-D Secure.
//
// Manteniamo lo stesso CefClient/SimpleHandler e creiamo SOLO il contenitore
// grafico del popup. Nessun cambio a routing, proxy, sandbox o policy domini.
// -----------------------------------------------------------------------------
class SecurePopupWindowDelegate : public CefWindowDelegate {
public:
explicit SecurePopupWindowDelegate(CefRefPtr<CefBrowserView> view)
: view_(view) {}
void OnWindowCreated(CefRefPtr<CefWindow> window) override {
CEF_REQUIRE_UI_THREAD();
if (!view_) return;
window->AddChildView(view_);
window->SetBounds(CefRect(160, 120, 1000, 720));
view_->SetBounds(CefRect(0, 0, 1000, 720));
window->SetTitle("BastionGuard Secure Browser");
window->Show();
view_->RequestFocus();
std::cout << _("[SecureBrowser] 🪟 Popup CEF mostrato nella sessione sicura.\n");
}
void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
CEF_REQUIRE_UI_THREAD();
// Non uscire dal message loop quando si chiude solo il popup.
// SimpleHandler::OnBeforeClose() mantiene il conteggio dei browser.
view_ = nullptr;
}
IMPLEMENT_REFCOUNTING(SecurePopupWindowDelegate);
private:
CefRefPtr<CefBrowserView> view_;
};
class SecureBrowserViewDelegate : public CefBrowserViewDelegate {
public:
CefRefPtr<CefBrowserViewDelegate> GetDelegateForPopupBrowserView(
CefRefPtr<CefBrowserView>,
const CefBrowserSettings&,
CefRefPtr<CefClient>,
bool) override {
// Riusa lo stesso delegate anche per eventuali popup annidati.
return this;
}
bool OnPopupBrowserViewCreated(
CefRefPtr<CefBrowserView>,
CefRefPtr<CefBrowserView> popup_browser_view,
bool is_devtools) override {
CEF_REQUIRE_UI_THREAD();
if (is_devtools || !popup_browser_view)
return false;
CefWindow::CreateTopLevelWindow(
new SecurePopupWindowDelegate(popup_browser_view));
// La finestra e' stata creata da BastionGuard: evita la finestra popup
// predefinita di CEF/Chromium.
return true;
}
IMPLEMENT_REFCOUNTING(SecureBrowserViewDelegate);
};
class ClamApp : public CefApp, public CefBrowserProcessHandler {
public:
CefRefPtr<CefBrowserProcessHandler> GetBrowserProcessHandler() override { return this; }
@ -480,6 +555,13 @@ public:
cmd->AppendSwitch("disable-component-update");
cmd->AppendSwitch("disable-print-preview");
// Alcuni flussi bancari/3-D Secure aprono la finestra di conferma dopo
// una callback asincrona e Chromium puo' classificarla come popup non
// direttamente associato al click. Nel processo SecureBrowser i popup
// devono restare consentiti e vengono comunque contenuti nel CEF Views
// gestito sopra.
cmd->AppendSwitch("disable-popup-blocking");
cmd->AppendSwitchWithValue("disable-features", "TranslateUI");
cmd->AppendSwitchWithValue("ssl-certificates-file", "/etc/ssl/certs/ca-certificates.crt");
@ -690,13 +772,16 @@ bool SecureBrowser::open(const std::string& url, int argc, char** argv) {
}
CefRefPtr<SimpleHandler> handler = new SimpleHandler();
CefRefPtr<SecureBrowserViewDelegate> view_delegate =
new SecureBrowserViewDelegate();
CefBrowserSettings bset;
bset.javascript = STATE_ENABLED;
bset.webgl = STATE_ENABLED;
CefRefPtr<CefBrowserView> mainView =
CefBrowserView::CreateBrowserView(handler, url, bset, nullptr, nullptr, nullptr);
CefBrowserView::CreateBrowserView(
handler, url, bset, nullptr, nullptr, view_delegate);
if (!mainView) {
CefShutdown();
@ -754,6 +839,7 @@ static bool is_payment_domain(const std::string& host) {
"sumup.com", "square.com", "squareup.com", "mollie.com",
"gocardless.com", "wise.com", "revolut.com", "skrill.com",
"neteller.com", "paysafecard.com", "amazonpay.com",
"wallet.google.com", "pay.google.com",
};
const std::string hb = clean_domain(host);
if (builtin.count(hb)) return true;

2
src/cef/bank_filter.hpp
View file

@ -386,6 +386,8 @@ private:
"neteller.com",
"paysafecard.com",
"amazonpay.com",
"wallet.google.com",
"pay.google.com",
};
return pp;
}

241
src/cef/bastionguard_cef.cpp
View file

@ -33,6 +33,7 @@
#include <array>
#include <atomic>
#include <chrono>
#include <cerrno>
#include <cstdlib>
#include <cstring>
#include <functional>
@ -97,6 +98,7 @@ static std::string root_domain(const std::string& host) {
struct SessionEntry {
Clock::time_point opened_at;
std::string type;
pid_t child_pid = -1;
};
static std::mutex g_session_mutex;
@ -107,6 +109,8 @@ static std::unordered_map<std::string, SessionEntry> g_sessions;
// liberare il gate, così una nuova visita al sito dopo i 30 minuti può
// riaprire legittimamente la sandbox.
static void sandbox_close(const std::string& root);
static void sandbox_bind_pid(const std::string& root, pid_t pid);
static void sandbox_close_if_pid(const std::string& root, pid_t pid);
static bool session_active(const std::string& root, std::string& out_type) {
bool expired = false;
@ -128,19 +132,54 @@ static bool session_active(const std::string& root, std::string& out_type) {
return false;
}
static void session_open(const std::string& root, const std::string& type) {
// Apertura atomica usata dopo che il MITM ha verificato che la richiesta e'
// davvero una navigazione top-level. Gli iframe/POST non creano sessioni.
static bool session_try_open(const std::string& root, const std::string& type) {
std::lock_guard<std::mutex> lock(g_session_mutex);
g_sessions[root] = { Clock::now(), type };
auto [it, inserted] = g_sessions.emplace(
root, SessionEntry{Clock::now(), type, -1});
return inserted;
}
static void session_bind_pid(const std::string& root, pid_t pid) {
std::lock_guard<std::mutex> lock(g_session_mutex);
auto it = g_sessions.find(root);
if (it != g_sessions.end())
it->second.child_pid = pid;
}
static void session_close(const std::string& root) {
std::lock_guard<std::mutex> lock(g_session_mutex);
g_sessions.erase(root);
char msg[256];
std::snprintf(msg, sizeof(msg),
_("[bastionguard] session closed for root: %s — browser proxy restored\n"),
root.c_str());
std::cerr << msg;
bool removed = false;
{
std::lock_guard<std::mutex> lock(g_session_mutex);
removed = g_sessions.erase(root) != 0;
}
if (removed) {
char msg[256];
std::snprintf(msg, sizeof(msg),
_("[bastionguard] session closed for root: %s — browser proxy restored\n"),
root.c_str());
std::cerr << msg;
}
}
static void session_close_if_pid(const std::string& root, pid_t pid) {
bool removed = false;
{
std::lock_guard<std::mutex> lock(g_session_mutex);
auto it = g_sessions.find(root);
if (it != g_sessions.end() && it->second.child_pid == pid) {
g_sessions.erase(it);
removed = true;
}
}
if (removed) {
char msg[320];
std::snprintf(msg, sizeof(msg),
_("[bastionguard] secure browser pid %ld closed for root: %s — browser proxy restored\n"),
static_cast<long>(pid), root.c_str());
std::cerr << msg;
}
}
struct TunnelSession : std::enable_shared_from_this<TunnelSession> {
@ -191,52 +230,70 @@ private:
std::atomic<bool> closed_{false};
};
static void launch_sandbox(const std::string& url, bool is_bank) {
static void launch_sandbox(const std::string& url,
bool is_bank,
const std::string& root) {
const std::string binary = is_bank ? "/usr/bin/BastionGuard-bankopener"
: "/usr/bin/BastionGuard-secure";
// SICUREZZA + ANTI-CRASH: non usiamo std::system().
// - std::system passa la stringa a /bin/sh, quindi un URL con virgolette,
// $(), backtick o ';' produce command injection.
// - std::system è bloccante: chiamato da un io-thread asio bloccherebbe
// quel thread per tutta la vita del browser figlio.
// Usiamo un doppio fork + execl, passando l'URL come singolo argv
// (nessuna shell, nessun parsing), così l'URL è inerte qualunque sia il
// suo contenuto e il proxy non si blocca.
// Mantieni il processo reale come figlio del proxy. In questo modo il
// proxy conosce il PID della sandbox e può liberare sessione/gate appena
// l'utente chiude il Secure Browser. waitpid viene eseguito in un thread
// dedicato, quindi nessun io-thread asio viene bloccato.
pid_t pid = fork();
if (pid < 0) {
std::cerr << _("[bastionguard] fork() fallita per launch_sandbox\n");
sandbox_close(root);
session_close(root);
return;
}
if (pid == 0) {
// Figlio: secondo fork per non lasciare zombie (il nipote viene
// reparentato a init e raccolto da lì).
pid_t pid2 = fork();
if (pid2 < 0) {
_exit(127);
}
if (pid2 == 0) {
// Nipote: imposta BG_SANDBOX=1 e fa exec del binario col solo URL.
setenv("BG_SANDBOX", "1", 1);
execl(binary.c_str(), binary.c_str(), url.c_str(), (char*)nullptr);
// Se exec fallisce:
_exit(127);
}
// Figlio intermedio: esce subito.
_exit(0);
setenv("BG_SANDBOX", "1", 1);
execl(binary.c_str(), binary.c_str(), url.c_str(), (char*)nullptr);
_exit(127);
}
// Genitore: raccoglie subito il figlio intermedio (non bloccante a lungo).
int status = 0;
waitpid(pid, &status, 0);
// Associa il PID alla generazione corrente della sessione/gate PRIMA di
// avviare il watcher. Le varianti *_if_pid evitano che un vecchio processo
// possa chiudere per errore una sessione nuova dello stesso dominio.
session_bind_pid(root, pid);
sandbox_bind_pid(root, pid);
if (!(WIFEXITED(status) && WEXITSTATUS(status) == 0)) {
char buf[512];
std::snprintf(buf, sizeof(buf), _("[bastionguard] failed to launch %s for %s\n"),
binary.c_str(), url.c_str());
std::cerr << buf;
{
char msg[384];
std::snprintf(msg, sizeof(msg),
_("[bastionguard] secure browser started: pid=%ld root=%s binary=%s\n"),
static_cast<long>(pid), root.c_str(), binary.c_str());
std::cerr << msg;
}
std::thread([pid, root]() {
int status = 0;
pid_t rc;
do {
rc = waitpid(pid, &status, 0);
} while (rc < 0 && errno == EINTR);
if (rc < 0) {
const int wait_err = errno;
char msg[320];
std::snprintf(msg, sizeof(msg),
_("[bastionguard] waitpid(%ld) failed for root %s: %s; uso TTL fallback\n"),
static_cast<long>(pid), root.c_str(), std::strerror(wait_err));
std::cerr << msg;
// Non liberare alla cieca: se non siamo riusciti a osservare la
// morte del figlio, il vecchio TTL resta il fallback sicuro.
return;
}
// Prima libera il gate e poi la sessione. Se Firefox ritenta proprio
// in questa piccola finestra, vede ancora la sessione attiva e non può
// creare un doppio browser. Subito dopo la sessione viene rimossa e il
// tentativo successivo riapre normalmente la sandbox.
sandbox_close_if_pid(root, pid);
session_close_if_pid(root, pid);
}).detach();
}
struct ParsedRequest {
@ -448,16 +505,36 @@ static void open_notify_window(const std::string& root,
}
static std::mutex g_sandbox_mutex;
static std::unordered_set<std::string> g_sandbox_open;
static std::mutex g_sandbox_mutex;
static std::unordered_set<std::string> g_sandbox_open;
static std::unordered_map<std::string, pid_t> g_sandbox_pid;
static bool sandbox_try_open(const std::string& root) {
std::lock_guard<std::mutex> lock(g_sandbox_mutex);
return g_sandbox_open.insert(root).second;
const bool inserted = g_sandbox_open.insert(root).second;
if (inserted)
g_sandbox_pid[root] = -1;
return inserted;
}
static void sandbox_bind_pid(const std::string& root, pid_t pid) {
std::lock_guard<std::mutex> lock(g_sandbox_mutex);
if (g_sandbox_open.count(root))
g_sandbox_pid[root] = pid;
}
static void sandbox_close_if_pid(const std::string& root, pid_t pid) {
std::lock_guard<std::mutex> lock(g_sandbox_mutex);
auto it = g_sandbox_pid.find(root);
if (it != g_sandbox_pid.end() && it->second == pid) {
g_sandbox_pid.erase(it);
g_sandbox_open.erase(root);
}
}
static void sandbox_close(const std::string& root) {
std::lock_guard<std::mutex> lock(g_sandbox_mutex);
g_sandbox_pid.erase(root);
g_sandbox_open.erase(root);
}
@ -499,7 +576,8 @@ static void block_active_session(std::shared_ptr<tcp::socket> sock,
static void block_secure_request(std::shared_ptr<tcp::socket> sock,
const ParsedRequest& req,
const std::string& type,
const std::string& root)
const std::string& root,
int argc, char** argv)
{
if (req.is_connect) {
static constexpr char ok200[] =
@ -511,41 +589,32 @@ static void block_secure_request(std::shared_ptr<tcp::socket> sock,
auto ok_buf = std::make_shared<std::string>(ok200);
asio::async_write(*sock, asio::buffer(*ok_buf),
[sock, ok_buf, intercept_host, intercept_type, is_bank_type, root](
[sock, ok_buf, intercept_host, intercept_type, is_bank_type, root, argc, argv](
boost::system::error_code ec, std::size_t) mutable {
if (ec) {
// Errore PRIMA che la sandbox sia stata lanciata: annulla
// sia il gate sia la sessione, così un retry del browser
// può ripartire da capo (incluso il lancio sandbox)
// invece di restare bloccato per tutto il TTL senza che si
// apra nulla.
sandbox_close(root);
session_close(root);
return;
}
if (ec) return;
std::thread([s = std::move(*sock),
host = intercept_host,
t = intercept_type,
bank = is_bank_type,
r = root]() mutable {
auto on_url_ready = [bank, r](const std::string& full_url) {
if (sandbox_try_open(r)) {
std::thread([full_url, bank, r]() {
// ANTI-LOOP: NON chiudere qui sessione/gate.
// launch_sandbox fa fork+exec e ritorna in
// pochi ms; se chiudessimo subito la sessione,
// il browser (che continua a ritentare la
// CONNECT verso la banca) troverebbe di nuovo
// "nessuna sessione attiva" e rilancerebbe una
// nuova sandbox ad ogni tentativo → migliaia di
// finestre. La sessione resta aperta (TTL) così
// i tentativi successivi cadono in
// block_active_session, che NON rilancia la
// sandbox. Il gate verrà liberato alla scadenza
// del TTL o quando l'utente chiude la sessione.
launch_sandbox(full_url, bank);
}).detach();
r = root,
argc, argv]() mutable {
auto on_url_ready = [bank, r, t, host, argc, argv](const std::string& full_url) {
// Questo callback viene invocato SOLO da do_intercept
// per top-level GET/HEAD. Iframe/fetch/POST vengono
// inoltrati in-place e non devono aprire una sandbox.
if (!session_try_open(r, t)) return;
open_notify_window(r, host, t, argc, argv);
if (!sandbox_try_open(r)) {
// Stato incoerente/stale: non lasciare una sessione
// attiva senza un browser reale.
session_close(r);
return;
}
launch_sandbox(full_url, bank, r);
};
TlsIntercept::do_intercept(std::move(s), host, t,
std::move(on_url_ready));
@ -553,13 +622,15 @@ static void block_secure_request(std::shared_ptr<tcp::socket> sock,
});
} else {
const std::string full_url = "https://" + req.host + req.path;
if (sandbox_try_open(root)) {
std::thread([full_url, type, root]() {
// ANTI-LOOP: vedi nota nel ramo CONNECT. Non chiudere
// sessione/gate subito dopo il lancio, altrimenti i retry
// del browser riaprono la sandbox all'infinito.
launch_sandbox(full_url, type == "bank");
}).detach();
if (session_try_open(root, type)) {
open_notify_window(root, req.host, type, argc, argv);
if (sandbox_try_open(root)) {
std::thread([full_url, type, root]() {
launch_sandbox(full_url, type == "bank", root);
}).detach();
} else {
session_close(root);
}
}
const std::string loc = warning_url_for(req.host, type);
@ -694,10 +765,10 @@ static void handle_client(tcp::socket client, int argc, char** argv) {
std::cerr << msg;
}
session_open(root, type);
open_notify_window(root, req.host, type, argc, argv);
block_secure_request(sock, req, type, root);
// Non aprire ancora sessione/gate: per HTTPS dobbiamo prima
// vedere i Fetch Metadata dentro TLS e distinguere top-level da
// iframe/POST. Solo la vera navigazione top-level apre CEF.
block_secure_request(sock, req, type, root, argc, argv);
});
}

370
src/cef/tls_intercept.hpp
View file

@ -32,6 +32,11 @@
#include <unordered_map>
#include <functional>
#include <cstdlib>
#include <algorithm>
#include <array>
#include <cctype>
#include <cerrno>
#include <limits>
#include <openssl/ssl.h>
#include <openssl/x509.h>
@ -438,7 +443,10 @@ make_stealth_upstream_ctx(const std::string& host)
"TLS_AES_256_GCM_SHA384:"
"TLS_CHACHA20_POLY1305_SHA256");
#endif
static const unsigned char alpn[] = "\x02h2\x08http/1.1";
// Il proxy trasparente sotto usa HTTP/1.1 byte-for-byte. Non negoziare
// h2 upstream: inviare una request HTTP/1.1 su una connessione ALPN h2
// corromperebbe il flusso.
static const unsigned char alpn[] = "\x08http/1.1";
SSL_CTX_set_alpn_protos(native, alpn, sizeof(alpn) - 1);
SSL_CTX_set_default_verify_paths(native);
SSL_CTX_set_verify(native, SSL_VERIFY_PEER, nullptr);
@ -447,6 +455,329 @@ make_stealth_upstream_ctx(const std::string& host)
return ctx;
}
// -----------------------------------------------------------------------------
// Fetch Metadata / transaction passthrough
//
// Una navigazione "sicura" non e' sempre una pagina top-level. 3-D Secure,
// SCA, OTP e diversi flow bancari usano iframe, fetch/XHR o form POST verso
// ACS/issuer. Trasformare queste richieste in una nuova navigazione CEF perde
// POST body, cookie e contesto della transazione.
//
// Regola generica:
// * top-level GET/HEAD document -> comportamento BastionGuard tradizionale
// (apri SecureBrowser e mostra block page)
// * iframe/subresource -> inoltro HTTPS trasparente e verificato
// * qualunque metodo stateful -> inoltro HTTPS trasparente e verificato
// (POST/PUT/PATCH/DELETE, anche popup)
//
// In questo modo non servono eccezioni per "3ds4.*", "acs.*", ecc.
// -----------------------------------------------------------------------------
static inline std::string lower_ascii(std::string v) {
std::transform(v.begin(), v.end(), v.begin(),
[](unsigned char c) { return static_cast<char>(std::tolower(c)); });
return v;
}
static inline std::string trim_ascii(std::string v) {
while (!v.empty() && std::isspace(static_cast<unsigned char>(v.front())))
v.erase(v.begin());
while (!v.empty() && std::isspace(static_cast<unsigned char>(v.back())))
v.pop_back();
return v;
}
static inline std::string request_method_from_raw(const std::string& raw) {
const auto eol = raw.find("\r\n");
const std::string line = raw.substr(0, eol);
const auto sp = line.find(' ');
if (sp == std::string::npos) return {};
return lower_ascii(line.substr(0, sp));
}
static inline std::string header_value_ci(const std::string& raw,
const std::string& wanted) {
const std::string wanted_l = lower_ascii(wanted);
const auto first_eol = raw.find("\r\n");
if (first_eol == std::string::npos) return {};
std::size_t pos = first_eol + 2;
while (pos < raw.size()) {
const auto eol = raw.find("\r\n", pos);
if (eol == std::string::npos || eol == pos) break;
const auto colon = raw.find(':', pos);
if (colon != std::string::npos && colon < eol) {
std::string name = lower_ascii(raw.substr(pos, colon - pos));
if (name == wanted_l)
return trim_ascii(raw.substr(colon + 1, eol - colon - 1));
}
pos = eol + 2;
}
return {};
}
static inline bool is_stateful_method(const std::string& method_l) {
return !(method_l == "get" || method_l == "head" || method_l == "options");
}
static inline bool should_passthrough_transaction(const std::string& raw) {
const std::string method = request_method_from_raw(raw);
if (method.empty()) return false; // fail verso il comportamento storico
// Mai trasformare una POST/PUT/PATCH/DELETE in una GET dentro un altro
// browser: perderemmo i dati della transazione.
if (is_stateful_method(method)) return true;
const std::string dest = lower_ascii(header_value_ci(raw, "sec-fetch-dest"));
if (dest == "iframe" || dest == "frame" || dest == "embed" ||
dest == "object" || dest == "empty" || dest == "script" ||
dest == "style" || dest == "image" || dest == "font" ||
dest == "audio" || dest == "video" || dest == "track" ||
dest == "worker" || dest == "sharedworker" ||
dest == "serviceworker" || dest == "manifest") {
return true;
}
const std::string mode = lower_ascii(header_value_ci(raw, "sec-fetch-mode"));
if (mode == "cors" || mode == "no-cors" || mode == "same-origin" ||
mode == "websocket") {
return true;
}
const std::string purpose = lower_ascii(header_value_ci(raw, "purpose"));
const std::string sec_purpose = lower_ascii(header_value_ci(raw, "sec-purpose"));
if (purpose.find("prefetch") != std::string::npos ||
sec_purpose.find("prefetch") != std::string::npos) {
return true;
}
// dest=document + mode=navigate, oppure header Fetch Metadata assenti:
// conserva il comportamento top-level esistente.
return false;
}
static inline bool parse_content_length(const std::string& raw,
std::size_t& out_len) {
const std::string v = trim_ascii(header_value_ci(raw, "content-length"));
if (v.empty()) return false;
errno = 0;
char* end = nullptr;
const unsigned long long n = std::strtoull(v.c_str(), &end, 10);
if (errno != 0 || end == v.c_str() || (end && *end != '\0') ||
n > std::numeric_limits<std::size_t>::max()) {
return false;
}
out_len = static_cast<std::size_t>(n);
return true;
}
static inline bool is_chunked_request(const std::string& raw) {
const std::string te = lower_ascii(header_value_ci(raw, "transfer-encoding"));
return te.find("chunked") != std::string::npos;
}
static inline bool read_more(asio::ssl::stream<tcp::socket>& tls,
std::string& raw,
std::size_t min_total,
std::size_t max_total) {
std::array<char, 16 * 1024> buf{};
while (raw.size() < min_total) {
if (raw.size() >= max_total) return false;
boost::system::error_code ec;
const std::size_t room = std::min<std::size_t>(buf.size(), max_total - raw.size());
const std::size_t n = tls.read_some(asio::buffer(buf.data(), room), ec);
if (n) raw.append(buf.data(), n);
if (ec) return false;
}
return true;
}
static inline bool read_complete_chunked(asio::ssl::stream<tcp::socket>& tls,
std::string& raw,
std::size_t body_start,
std::size_t max_total) {
std::size_t cur = body_start;
std::array<char, 16 * 1024> buf{};
auto ensure_line = [&](std::size_t from, std::size_t& eol) -> bool {
for (;;) {
eol = raw.find("\r\n", from);
if (eol != std::string::npos) return true;
if (raw.size() >= max_total) return false;
boost::system::error_code ec;
const std::size_t room = std::min<std::size_t>(buf.size(), max_total - raw.size());
const std::size_t n = tls.read_some(asio::buffer(buf.data(), room), ec);
if (n) raw.append(buf.data(), n);
if (ec) return false;
}
};
for (;;) {
std::size_t eol = 0;
if (!ensure_line(cur, eol)) return false;
std::string size_line = raw.substr(cur, eol - cur);
const auto semi = size_line.find(';');
if (semi != std::string::npos) size_line.erase(semi);
size_line = trim_ascii(size_line);
if (size_line.empty()) return false;
errno = 0;
char* end = nullptr;
const unsigned long long chunk = std::strtoull(size_line.c_str(), &end, 16);
if (errno != 0 || end == size_line.c_str() || (end && *end != '\0') ||
chunk > max_total) {
return false;
}
cur = eol + 2;
if (chunk == 0) {
// Trailer section: zero o piu' header, terminati da una riga vuota.
for (;;) {
if (!ensure_line(cur, eol)) return false;
if (eol == cur) return true;
cur = eol + 2;
}
}
const std::size_t need = cur + static_cast<std::size_t>(chunk) + 2;
if (need < cur || need > max_total) return false;
if (!read_more(tls, raw, need, max_total)) return false;
if (raw.compare(cur + static_cast<std::size_t>(chunk), 2, "\r\n") != 0)
return false;
cur = need;
}
}
static inline bool read_complete_http1_request(asio::ssl::stream<tcp::socket>& tls,
std::string& raw) {
static constexpr std::size_t MAX_REQUEST = 32u * 1024u * 1024u;
const auto hdr_end_pos = raw.find("\r\n\r\n");
if (hdr_end_pos == std::string::npos) return false;
const std::size_t body_start = hdr_end_pos + 4;
std::size_t content_len = 0;
if (parse_content_length(raw, content_len)) {
if (content_len > MAX_REQUEST || body_start > MAX_REQUEST - content_len)
return false;
return read_more(tls, raw, body_start + content_len, MAX_REQUEST);
}
if (is_chunked_request(raw))
return read_complete_chunked(tls, raw, body_start, MAX_REQUEST);
return true;
}
static inline std::string force_connection_close(const std::string& raw) {
const auto hdr_end = raw.find("\r\n\r\n");
if (hdr_end == std::string::npos) return raw;
const std::string headers = raw.substr(0, hdr_end);
const std::string body = raw.substr(hdr_end + 4);
std::istringstream in(headers);
std::ostringstream out;
std::string line;
bool first = true;
while (std::getline(in, line)) {
if (!line.empty() && line.back() == '\r') line.pop_back();
if (first) {
out << line << "\r\n";
first = false;
continue;
}
const auto colon = line.find(':');
const std::string name = colon == std::string::npos
? std::string{} : lower_ascii(trim_ascii(line.substr(0, colon)));
if (name == "connection" || name == "proxy-connection" || name == "keep-alive")
continue;
out << line << "\r\n";
}
out << "Connection: close\r\n\r\n";
out << body;
return out.str();
}
static inline bool forward_transaction_https(asio::ssl::stream<tcp::socket>& client_tls,
const std::string& host,
std::string raw_request) {
if (!read_complete_http1_request(client_tls, raw_request)) {
std::cerr << "[tls-intercept] transaction request incomplete/too large for "
<< host << "\n";
return false;
}
raw_request = force_connection_close(raw_request);
try {
asio::io_context io;
tcp::resolver resolver(io);
auto endpoints = resolver.resolve(host, "443");
tcp::socket upstream_socket(io);
asio::connect(upstream_socket, endpoints);
auto upstream_ctx = make_stealth_upstream_ctx(host);
asio::ssl::stream<tcp::socket> upstream(std::move(upstream_socket), *upstream_ctx);
SSL* ssl = upstream.native_handle();
if (SSL_set_tlsext_host_name(ssl, host.c_str()) != 1) {
std::cerr << "[tls-intercept] SNI setup failed for " << host << "\n";
return false;
}
X509_VERIFY_PARAM* param = SSL_get0_param(ssl);
X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
if (X509_VERIFY_PARAM_set1_host(param, host.c_str(), 0) != 1) {
std::cerr << "[tls-intercept] hostname verification setup failed for "
<< host << "\n";
return false;
}
upstream.set_verify_mode(asio::ssl::verify_peer);
upstream.handshake(asio::ssl::stream_base::client);
asio::write(upstream, asio::buffer(raw_request));
std::array<char, 64 * 1024> buf{};
for (;;) {
boost::system::error_code rec;
const std::size_t n = upstream.read_some(asio::buffer(buf), rec);
if (n) {
boost::system::error_code wec;
asio::write(client_tls, asio::buffer(buf.data(), n), wec);
if (wec) return false;
}
if (rec) {
if (rec != asio::error::eof &&
rec != asio::ssl::error::stream_truncated) {
std::cerr << "[tls-intercept] upstream read failed for " << host
<< ": " << rec.message() << "\n";
}
break;
}
}
boost::system::error_code sd_ec;
upstream.shutdown(sd_ec);
return true;
} catch (const std::exception& e) {
std::cerr << "[tls-intercept] transaction passthrough failed for " << host
<< ": " << e.what() << "\n";
return false;
}
}
static inline void send_passthrough_failure(asio::ssl::stream<tcp::socket>& tls) {
static constexpr char body[] = "BastionGuard: upstream secure transaction failed\n";
std::ostringstream oss;
oss << "HTTP/1.1 502 Bad Gateway\r\n"
<< "Content-Type: text/plain; charset=UTF-8\r\n"
<< "Content-Length: " << (sizeof(body) - 1) << "\r\n"
<< "Cache-Control: no-store\r\n"
<< "Connection: close\r\n\r\n"
<< body;
const std::string resp = oss.str();
boost::system::error_code ec;
asio::write(tls, asio::buffer(resp), ec);
}
static inline void do_intercept(tcp::socket sock,
const std::string& host,
const std::string& type,
@ -480,14 +811,41 @@ static inline void do_intercept(tcp::socket sock,
asio::streambuf rbuf;
boost::system::error_code read_ec;
asio::read_until(tls, rbuf, "\r\n\r\n", read_ec);
if (read_ec) {
std::cerr << "[tls-intercept] request header read failed for " << host
<< ": " << read_ec.message() << "\n";
boost::system::error_code ignore;
tls.lowest_layer().close(ignore);
return;
}
const std::string raw{
asio::buffers_begin(rbuf.data()),
asio::buffers_end(rbuf.data())
};
if (should_passthrough_transaction(raw)) {
const std::string method = request_method_from_raw(raw);
const std::string dest = lower_ascii(header_value_ci(raw, "sec-fetch-dest"));
std::cerr << "[tls-intercept] iframe/stateful passthrough: host=" << host
<< " method=" << method << " dest=" << dest << "\n";
if (!forward_transaction_https(tls, host, raw))
send_passthrough_failure(tls);
boost::system::error_code sd_ec;
tls.shutdown(sd_ec);
boost::system::error_code ignore;
tls.lowest_layer().close(ignore);
return;
}
// Solo una vera navigazione top-level GET/HEAD viene trasformata in
// apertura SecureBrowser. Il callback NON viene chiamato per iframe,
// fetch/XHR o POST, quindi nessuna sessione/gate fittizia viene creata.
if (on_url_ready) {
const std::string raw{
asio::buffers_begin(rbuf.data()),
asio::buffers_end(rbuf.data())
};
const std::string path = extract_path_from_request(raw);
const std::string full_url = "https://" + host + path;
std::cerr << "[tls-intercept] full URL: " << full_url << "\n";
std::cerr << "[tls-intercept] top-level secure URL: " << full_url << "\n";
on_url_ready(full_url);
}

BIN
src/rootguard/.bastionguard-rootguard.pot.kate-swp Normal file
View file

Binary file not shown.

415
src/rootguard/CMakeLists.txt Normal file
View file

@ -0,0 +1,415 @@
cmake_minimum_required(VERSION 3.24)
# RootGuard can be built standalone or included directly from the main
# BastionGuard project with add_subdirectory(src/rootguard).
if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
project(BastionGuardRootGuard VERSION 2.5.7 LANGUAGES C CXX)
endif()
include(GNUInstallDirs)
include(CTest)
find_package(Threads REQUIRED)
find_package(PkgConfig REQUIRED)
option(ROOTGUARD_BUILD_DAEMON "Build the privileged eBPF/LSM daemon" ON)
option(ROOTGUARD_BUILD_GTK_PAGE "Build the GTK4/gtkmm RootGuardPage library" ON)
option(ROOTGUARD_BUILD_GTK_DEMO "Build a standalone RootGuardPage demo" OFF)
option(ROOTGUARD_BUILD_TESTS "Build RootGuard tests" ON)
set(ROOTGUARD_INIT_SYSTEM "auto" CACHE STRING
"Init integration: auto, systemd, openrc, dinit, sysvinit or none")
set_property(CACHE ROOTGUARD_INIT_SYSTEM PROPERTY STRINGS
auto systemd openrc dinit sysvinit none)
# Compatibility aliases accepted on the command line. The canonical spelling
# remains dinit and sysvinit.
if(ROOTGUARD_INIT_SYSTEM STREQUAL "sysv")
set(ROOTGUARD_INIT_SYSTEM "sysvinit")
elseif(ROOTGUARD_INIT_SYSTEM STREQUAL "dninit")
set(ROOTGUARD_INIT_SYSTEM "dinit")
endif()
set(_ROOTGUARD_INIT_VALUES auto systemd openrc dinit sysvinit none)
if(NOT ROOTGUARD_INIT_SYSTEM IN_LIST _ROOTGUARD_INIT_VALUES)
message(FATAL_ERROR
"Unknown ROOTGUARD_INIT_SYSTEM: ${ROOTGUARD_INIT_SYSTEM}. "
"Accepted values: auto, systemd, openrc, dinit, sysvinit, none")
endif()
set(ROOTGUARD_VMLINUX_BTF "/sys/kernel/btf/vmlinux" CACHE FILEPATH
"Kernel BTF source used for CO-RE")
set(ROOTGUARD_SYSCONFDIR "/etc/bastionguard" CACHE PATH
"RootGuard configuration directory")
set(ROOTGUARD_SYSTEMD_UNIT_DIR "/usr/lib/systemd/system" CACHE PATH
"systemd unit directory")
set(ROOTGUARD_SYSVINIT_DIR "/etc/init.d" CACHE PATH
"SysV init script directory")
set(ROOTGUARD_OPENRC_INIT_DIR "/etc/init.d" CACHE PATH
"OpenRC init script directory")
set(ROOTGUARD_OPENRC_CONF_DIR "/etc/conf.d" CACHE PATH
"OpenRC configuration directory")
set(ROOTGUARD_DINIT_DIR "/etc/dinit.d" CACHE PATH
"dinit service directory")
set(ROOTGUARD_POLKIT_ACTION_DIR "/usr/share/polkit-1/actions" CACHE PATH
"polkit action directory")
set(ROOTGUARD_DOCDIR "${CMAKE_INSTALL_DATADIR}/doc/bastionguard-rootguard" CACHE PATH
"RootGuard documentation directory")
set(ROOTGUARD_EVENT_LOG "/var/log/bastionguard/rootguard-events.jsonl" CACHE FILEPATH
"RootGuard JSONL event log consumed by RootGuardPage")
set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)
function(rootguard_enable_warnings target)
target_compile_options(${target} PRIVATE
$<$<COMPILE_LANGUAGE:CXX>:-Wall;-Wextra;-Wpedantic;-Wshadow;-Wconversion>
$<$<COMPILE_LANGUAGE:C>:-Wall;-Wextra;-Wpedantic>
)
endfunction()
if(ROOTGUARD_BUILD_DAEMON)
pkg_check_modules(LIBBPF REQUIRED IMPORTED_TARGET libbpf)
pkg_check_modules(LIBELF REQUIRED IMPORTED_TARGET libelf)
find_package(ZLIB REQUIRED)
find_program(ROOTGUARD_CLANG NAMES clang REQUIRED)
find_program(ROOTGUARD_BPFTOOL NAMES bpftool
HINTS /usr/sbin /usr/bin /usr/local/sbin /usr/local/bin
REQUIRED)
if(NOT EXISTS "${ROOTGUARD_VMLINUX_BTF}")
message(FATAL_ERROR
"Kernel BTF is required for the RootGuard daemon build: ${ROOTGUARD_VMLINUX_BTF}")
endif()
string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" ROOTGUARD_PROCESSOR)
if(ROOTGUARD_PROCESSOR MATCHES "^(x86_64|amd64|i[3-6]86)$")
set(ROOTGUARD_BPF_ARCH x86)
elseif(ROOTGUARD_PROCESSOR MATCHES "^(aarch64|arm64)$")
set(ROOTGUARD_BPF_ARCH arm64)
elseif(ROOTGUARD_PROCESSOR MATCHES "^arm")
set(ROOTGUARD_BPF_ARCH arm)
elseif(ROOTGUARD_PROCESSOR STREQUAL "ppc64le")
set(ROOTGUARD_BPF_ARCH powerpc)
elseif(ROOTGUARD_PROCESSOR STREQUAL "s390x")
set(ROOTGUARD_BPF_ARCH s390)
elseif(ROOTGUARD_PROCESSOR STREQUAL "riscv64")
set(ROOTGUARD_BPF_ARCH riscv)
else()
message(FATAL_ERROR
"Unsupported BPF target architecture: ${CMAKE_SYSTEM_PROCESSOR}")
endif()
set(ROOTGUARD_GENERATED_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated")
file(MAKE_DIRECTORY "${ROOTGUARD_GENERATED_DIR}")
set(ROOTGUARD_VMLINUX_H "${ROOTGUARD_GENERATED_DIR}/vmlinux.h")
set(ROOTGUARD_BPF_OBJECT "${ROOTGUARD_GENERATED_DIR}/rootguard.bpf.o")
set(ROOTGUARD_SKELETON "${ROOTGUARD_GENERATED_DIR}/rootguard.skel.h")
add_custom_command(
OUTPUT "${ROOTGUARD_VMLINUX_H}"
COMMAND "${CMAKE_COMMAND}"
"-DBPFTOOL:FILEPATH=${ROOTGUARD_BPFTOOL}"
"-DINPUT_BTF:FILEPATH=${ROOTGUARD_VMLINUX_BTF}"
"-DOUTPUT_FILE:FILEPATH=${ROOTGUARD_VMLINUX_H}"
-P "${CMAKE_CURRENT_SOURCE_DIR}/cmake/GenerateVmlinux.cmake"
DEPENDS
"${ROOTGUARD_VMLINUX_BTF}"
"${CMAKE_CURRENT_SOURCE_DIR}/cmake/GenerateVmlinux.cmake"
"${CMAKE_CURRENT_SOURCE_DIR}/cmake/StripOuterQuotes.cmake"
COMMENT "Generating RootGuard vmlinux.h"
VERBATIM
)
add_custom_command(
OUTPUT "${ROOTGUARD_BPF_OBJECT}"
COMMAND "${ROOTGUARD_CLANG}" -O2 -g -target bpf
-D__TARGET_ARCH_${ROOTGUARD_BPF_ARCH}
"-I${ROOTGUARD_GENERATED_DIR}"
"-I${CMAKE_CURRENT_SOURCE_DIR}/include"
-c "${CMAKE_CURRENT_SOURCE_DIR}/bpf/rootguard.bpf.c"
-o "${ROOTGUARD_BPF_OBJECT}"
DEPENDS
"${CMAKE_CURRENT_SOURCE_DIR}/bpf/rootguard.bpf.c"
"${CMAKE_CURRENT_SOURCE_DIR}/include/rootguard/rootguard_shared.h"
"${ROOTGUARD_VMLINUX_H}"
COMMENT "Compiling RootGuard eBPF LSM program"
VERBATIM
)
add_custom_command(
OUTPUT "${ROOTGUARD_SKELETON}"
COMMAND "${CMAKE_COMMAND}"
"-DBPFTOOL:FILEPATH=${ROOTGUARD_BPFTOOL}"
"-DINPUT_OBJECT:FILEPATH=${ROOTGUARD_BPF_OBJECT}"
"-DOUTPUT_FILE:FILEPATH=${ROOTGUARD_SKELETON}"
-P "${CMAKE_CURRENT_SOURCE_DIR}/cmake/GenerateSkeleton.cmake"
DEPENDS
"${ROOTGUARD_BPF_OBJECT}"
"${CMAKE_CURRENT_SOURCE_DIR}/cmake/GenerateSkeleton.cmake"
"${CMAKE_CURRENT_SOURCE_DIR}/cmake/StripOuterQuotes.cmake"
COMMENT "Generating RootGuard libbpf skeleton"
VERBATIM
)
add_custom_target(rootguard_bpf_artifacts DEPENDS "${ROOTGUARD_SKELETON}")
add_executable(bastionguard-rootguard
src/main.cpp
src/Policy.cpp
src/PolicyLoader.cpp
src/PolicySecurity.cpp
src/FileIdentity.cpp
src/RootGuardEngine.cpp
src/AutomaticResponseSink.cpp
src/SystemServiceControl.cpp
src/ConsoleEventSink.cpp
src/JsonEventSink.cpp
src/MultiEventSink.cpp
"${ROOTGUARD_SKELETON}"
)
set_source_files_properties("${ROOTGUARD_SKELETON}"
PROPERTIES GENERATED TRUE HEADER_FILE_ONLY TRUE)
add_dependencies(bastionguard-rootguard rootguard_bpf_artifacts)
target_include_directories(bastionguard-rootguard PRIVATE
"${CMAKE_CURRENT_SOURCE_DIR}/include"
"${ROOTGUARD_GENERATED_DIR}"
)
target_link_libraries(bastionguard-rootguard PRIVATE
PkgConfig::LIBBPF
PkgConfig::LIBELF
ZLIB::ZLIB
Threads::Threads
)
rootguard_enable_warnings(bastionguard-rootguard)
add_executable(bastionguard-rootguard-action
src/ActionHelper.cpp
src/Policy.cpp
src/PolicyLoader.cpp
src/PolicySecurity.cpp
src/FileIdentity.cpp
src/SystemServiceControl.cpp
src/JsonEventSink.cpp
)
target_include_directories(bastionguard-rootguard-action PRIVATE
"${CMAKE_CURRENT_SOURCE_DIR}/include")
target_link_libraries(bastionguard-rootguard-action PRIVATE Threads::Threads)
rootguard_enable_warnings(bastionguard-rootguard-action)
install(TARGETS bastionguard-rootguard bastionguard-rootguard-action
RUNTIME DESTINATION "${CMAKE_INSTALL_LIBEXECDIR}/bastionguard")
endif()
if(ROOTGUARD_BUILD_GTK_PAGE)
pkg_check_modules(ROOTGUARD_GTKMM4 REQUIRED IMPORTED_TARGET gtkmm-4.0)
find_program(ROOTGUARD_PKEXEC NAMES pkexec HINTS /usr/bin /bin)
if(NOT ROOTGUARD_PKEXEC)
set(ROOTGUARD_PKEXEC "/usr/bin/pkexec")
message(WARNING
"[RootGuard] pkexec was not found at configure time; using ${ROOTGUARD_PKEXEC}")
endif()
add_library(bastionguard-rootguard-gtk STATIC
RootGuardEvent.cpp
RootGuardClient.cpp
RootGuardPage.cpp
)
add_library(BastionGuard::RootGuardUI ALIAS bastionguard-rootguard-gtk)
target_include_directories(bastionguard-rootguard-gtk
PRIVATE
"${CMAKE_CURRENT_SOURCE_DIR}"
"${CMAKE_CURRENT_SOURCE_DIR}/include"
PUBLIC
"$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/..>"
"$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
)
target_link_libraries(bastionguard-rootguard-gtk PUBLIC
PkgConfig::ROOTGUARD_GTKMM4
Threads::Threads
)
target_compile_definitions(bastionguard-rootguard-gtk PRIVATE
BASTIONGUARD_ROOTGUARD_SERVICE_HELPER="${CMAKE_INSTALL_FULL_LIBEXECDIR}/bastionguard/bastionguard-rootguard-service"
BASTIONGUARD_ROOTGUARD_ACTION_HELPER="${CMAKE_INSTALL_FULL_LIBEXECDIR}/bastionguard/bastionguard-rootguard-action"
BASTIONGUARD_ROOTGUARD_EVENT_LOG="${ROOTGUARD_EVENT_LOG}"
BASTIONGUARD_ROOTGUARD_POLICY="${CMAKE_INSTALL_FULL_SYSCONFDIR}/bastionguard/rootguard.conf"
BASTIONGUARD_ROOTGUARD_POLICY_VIEW="/run/bastionguard-rootguard.policy-view"
BASTIONGUARD_PKEXEC="${ROOTGUARD_PKEXEC}"
)
set_target_properties(bastionguard-rootguard-gtk PROPERTIES
POSITION_INDEPENDENT_CODE ON)
rootguard_enable_warnings(bastionguard-rootguard-gtk)
install(TARGETS bastionguard-rootguard-gtk
ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
install(FILES
RootGuardEvent.hpp
RootGuardClient.hpp
RootGuardPage.hpp
DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/rootguard")
endif()
if(ROOTGUARD_BUILD_GTK_DEMO)
if(NOT ROOTGUARD_BUILD_GTK_PAGE)
message(FATAL_ERROR
"ROOTGUARD_BUILD_GTK_DEMO requires ROOTGUARD_BUILD_GTK_PAGE")
endif()
add_executable(bastionguard-rootguard-gtk-demo
demo/RootGuardPageDemo.cpp)
target_include_directories(bastionguard-rootguard-gtk-demo PRIVATE
"${CMAKE_CURRENT_SOURCE_DIR}")
target_link_libraries(bastionguard-rootguard-gtk-demo PRIVATE
BastionGuard::RootGuardUI)
endif()
if(ROOTGUARD_BUILD_TESTS)
add_executable(rootguard-policy-tests
tests/PolicyLoaderTests.cpp
src/Policy.cpp
src/PolicyLoader.cpp
src/PolicySecurity.cpp
)
target_include_directories(rootguard-policy-tests PRIVATE include)
rootguard_enable_warnings(rootguard-policy-tests)
add_test(NAME rootguard-policy-tests COMMAND rootguard-policy-tests)
add_executable(rootguard-file-identity-tests
tests/FileIdentityTests.cpp
src/FileIdentity.cpp
)
target_include_directories(rootguard-file-identity-tests PRIVATE include)
rootguard_enable_warnings(rootguard-file-identity-tests)
add_test(NAME rootguard-file-identity-tests COMMAND rootguard-file-identity-tests)
add_executable(rootguard-event-tests
tests/RootGuardEventTests.cpp
RootGuardEvent.cpp
)
target_include_directories(rootguard-event-tests PRIVATE
"${CMAKE_CURRENT_SOURCE_DIR}"
"${CMAKE_CURRENT_SOURCE_DIR}/include")
rootguard_enable_warnings(rootguard-event-tests)
add_test(NAME rootguard-event-tests COMMAND rootguard-event-tests)
endif()
# Common runtime files. These install rules are included automatically when
# this directory is added to the main BastionGuard build with add_subdirectory.
install(PROGRAMS scripts/bastionguard-rootguard-service
DESTINATION "${CMAKE_INSTALL_LIBEXECDIR}/bastionguard")
install(PROGRAMS scripts/enable-service.sh
DESTINATION "${CMAKE_INSTALL_DATADIR}/bastionguard-rootguard")
# Keep the packaged policy as a reference and never overwrite a policy edited
# through RootGuardPage. On a fresh installation only, seed rootguard.conf from
# the packaged default. DESTDIR is honoured for distro package staging.
install(FILES config/rootguard.conf
DESTINATION "${ROOTGUARD_SYSCONFDIR}"
RENAME rootguard.conf.default
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ)
set(_rootguard_policy_install_code [=[
set(_rootguard_config_dir "$ENV{DESTDIR}@ROOTGUARD_SYSCONFDIR@")
set(_rootguard_default_policy "${_rootguard_config_dir}/rootguard.conf.default")
set(_rootguard_active_policy "${_rootguard_config_dir}/rootguard.conf")
if(NOT EXISTS "${_rootguard_active_policy}")
file(COPY_FILE
"${_rootguard_default_policy}"
"${_rootguard_active_policy}"
ONLY_IF_DIFFERENT)
file(CHMOD "${_rootguard_active_policy}"
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ)
message(STATUS
"[RootGuard] Installed initial policy: ${_rootguard_active_policy}")
else()
message(STATUS
"[RootGuard] Preserving existing policy: ${_rootguard_active_policy}")
endif()
]=])
string(CONFIGURE "${_rootguard_policy_install_code}"
_rootguard_policy_install_code @ONLY)
install(CODE "${_rootguard_policy_install_code}")
install(FILES packaging/polkit/org.bastionguard.rootguard.policy
DESTINATION "${ROOTGUARD_POLKIT_ACTION_DIR}")
install(FILES README.md DESTINATION "${ROOTGUARD_DOCDIR}")
install(DIRECTORY docs/ DESTINATION "${ROOTGUARD_DOCDIR}")
install(DIRECTORY packaging/
DESTINATION "${CMAKE_INSTALL_DATADIR}/bastionguard-rootguard/init-samples")
install(DIRECTORY resources/
DESTINATION "${CMAKE_INSTALL_DATADIR}/bastionguard-rootguard/resources")
# Select exactly one native service definition for the target machine.
# OpenRC and SysV cannot be installed together because both own the same
# /etc/init.d/bastionguard-rootguard path.
function(rootguard_detect_init_system output_variable)
set(_detected "none")
set(_pid1 "")
if(EXISTS "/proc/1/comm")
file(READ "/proc/1/comm" _pid1 LIMIT 64)
string(STRIP "${_pid1}" _pid1)
string(TOLOWER "${_pid1}" _pid1)
endif()
if(_pid1 STREQUAL "systemd")
set(_detected "systemd")
elseif(_pid1 STREQUAL "openrc-init" OR _pid1 STREQUAL "openrc")
set(_detected "openrc")
elseif(_pid1 STREQUAL "dinit")
set(_detected "dinit")
else()
# Runtime markers are stronger evidence than a merely installed
# compatibility command such as systemctl.
find_program(_rootguard_systemctl NAMES systemctl
HINTS /usr/bin /bin /usr/local/bin)
find_program(_rootguard_rc_service NAMES rc-service
HINTS /sbin /usr/sbin /bin /usr/bin)
find_program(_rootguard_openrc_run NAMES openrc-run
HINTS /sbin /usr/sbin /bin /usr/bin)
find_program(_rootguard_dinitctl NAMES dinitctl
HINTS /sbin /usr/sbin /bin /usr/bin)
if(EXISTS "/run/systemd/system" AND _rootguard_systemctl)
set(_detected "systemd")
elseif((EXISTS "/run/openrc" OR EXISTS "/run/openrc/softlevel")
AND _rootguard_rc_service AND _rootguard_openrc_run)
set(_detected "openrc")
elseif(_rootguard_dinitctl AND
(EXISTS "/run/dinitctl" OR EXISTS "/run/dinitctl.sock"))
set(_detected "dinit")
elseif(EXISTS "/etc/init.d")
set(_detected "sysvinit")
endif()
endif()
set(${output_variable} "${_detected}" PARENT_SCOPE)
endfunction()
if(ROOTGUARD_INIT_SYSTEM STREQUAL "auto")
rootguard_detect_init_system(ROOTGUARD_DETECTED_INIT)
else()
set(ROOTGUARD_DETECTED_INIT "${ROOTGUARD_INIT_SYSTEM}")
endif()
message(STATUS "[RootGuard] Init integration selected: ${ROOTGUARD_DETECTED_INIT}")
if(ROOTGUARD_DETECTED_INIT STREQUAL "systemd")
install(FILES packaging/systemd/bastionguard-rootguard.service
DESTINATION "${ROOTGUARD_SYSTEMD_UNIT_DIR}")
elseif(ROOTGUARD_DETECTED_INIT STREQUAL "openrc")
install(PROGRAMS packaging/openrc/bastionguard-rootguard
DESTINATION "${ROOTGUARD_OPENRC_INIT_DIR}")
install(FILES packaging/openrc/bastionguard-rootguard.conf
DESTINATION "${ROOTGUARD_OPENRC_CONF_DIR}"
RENAME bastionguard-rootguard)
elseif(ROOTGUARD_DETECTED_INIT STREQUAL "dinit")
install(FILES packaging/dinit/bastionguard-rootguard
DESTINATION "${ROOTGUARD_DINIT_DIR}")
elseif(ROOTGUARD_DETECTED_INIT STREQUAL "sysvinit")
install(PROGRAMS packaging/sysvinit/bastionguard-rootguard
DESTINATION "${ROOTGUARD_SYSVINIT_DIR}")
install(FILES packaging/sysvinit/bastionguard-rootguard.default
DESTINATION "/etc/default"
RENAME bastionguard-rootguard)
elseif(NOT ROOTGUARD_DETECTED_INIT STREQUAL "none")
message(FATAL_ERROR
"Unknown ROOTGUARD_INIT_SYSTEM: ${ROOTGUARD_DETECTED_INIT}")
endif()

674
src/rootguard/COPYING Normal file
View file

@ -0,0 +1,674 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.

106
src/rootguard/README.md Normal file
View file

@ -0,0 +1,106 @@
# BastionGuard RootGuard
RootGuard is BastionGuard's eBPF LSM privilege-escalation and filesystem
metadata monitor. It filters global metadata activity down to privilege-relevant
transitions and performs complete baseline monitoring on explicitly protected
system identities, where changes can be denied before they are committed.
## Protection model
RootGuard deliberately separates four concepts:
- **Global surveillance** records privilege-relevant transitions with an eBPF
per-execution-domain sample budget, and separately counts destructive
permission/ownership storms in-kernel. The domain includes cgroup plus actor
and parent executable identity, avoiding cross-talk inside a broad user slice.
Routine activity therefore does not become a ring-buffer or popup storm.
- **Protected paths** provide enforcement, integrity baselines, Restore and
Quarantine.
- **Trusted applications** classify routine global metadata produced by desktop
applications or an exact trusted orchestrator and its descendant helpers. They
receive no privilege-transition trust and never bypass protected-path
enforcement. Do not trust generic tools such as `rsync`, `tar` or `chmod`; trust
the specific backup/application orchestrator instead.
- **Privilege-trusted and denied executables** participate only in
privilege-transition decisions.
The default policy keeps user home directories audit-only even when immediate
blocking is enabled. BastionGuard Anti-Ransomware remains responsible for
user-data enforcement. Immediate blocking applies to protected system paths,
including service definitions; blocked service-definition changes can trigger
native service containment.
## GTK page
`RootGuardPage` uses compact tabs:
1. Overview
2. Incidents
3. Events
4. Application rules
The Overview tab contains an information popover explaining the system/home
scope. The Application rules tab contains nested editors for trusted
applications, privilege-trusted executables and blocked/denied executables. A convenience
button adds only installed known desktop/browser executables for review. Saving is
explicit, policy validation is atomic, administrator authentication is used,
and RootGuard is restarted only after a successful save.
Protected-path audit notifications are acknowledgement-only. Individual global
metadata records are observations and never open a popup. A high-volume destructive permission pattern is aggregated by eBPF into one metadata-burst incident; the
GTK client caps burst interruptions to one every 15 minutes while keeping the
complete sampled history available for investigation.
## Path transparency
For chmod/chown, the BPF LSM path hook captures the mount-aware target path
before `inode_setattr`; Linux 6.12 and newer use the optional
`bpf_path_d_path` kfunc. Protected baselines, open process descriptors and the
process working directory remain additional resolution sources.
The executable identity is captured at exec time and copied into later events,
so short-lived actors remain identifiable after `/proc/<pid>` disappears.
Notifications show PID, TGID, PPID, parent process, actor and parent executable,
EUID, target path/directory and device/inode identities. If an operation reaches
only an inode hook and no exact mount-aware path is available, RootGuard reports
that limitation and never invents a directory.
## Policy additions
```ini
[engine]
block_user_home = false
monitor_global_privilege_metadata = true
detect_global_metadata_bursts = true
global_metadata_sample_limit = 3
metadata_burst_threshold = 32
metadata_burst_window_ms = 5000
metadata_burst_cooldown_ms = 300000
[trusted-applications]
path = /usr/bin/gnome-shell
path = /usr/bin/plasmashell
path = /usr/bin/firefox
```
`[trusted-applications]` is intentionally separate from
`[trusted-executables]`.
## Native CMake integration
The module belongs at `src/rootguard` and is included directly:
```cmake
add_subdirectory(
"${CMAKE_SOURCE_DIR}/src/rootguard"
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
target_link_libraries(BastionGuard PRIVATE BastionGuard::RootGuardUI)
```
The build supports systemd, OpenRC, dinit and SysV init. Set
`ROOTGUARD_INIT_SYSTEM` explicitly when producing a distribution package.
The installed `rootguard.conf` is preserved across later `cmake --install`
runs. The packaged reference policy is installed as `rootguard.conf.default`.

550
src/rootguard/RootGuardClient.cpp Normal file
View file

@ -0,0 +1,550 @@
/*
* BastionGuard™ RootGuard GTK integration
* Copyright (C) 2025–2026 Calogero Scarnà
* SPDX-License-Identifier: GPL-3.0-or-later
*/
#include "RootGuardClient.hpp"
#include <algorithm>
#include <array>
#include <cerrno>
#include <deque>
#include <filesystem>
#include <fstream>
#include <sstream>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#ifndef BASTIONGUARD_ROOTGUARD_SERVICE_HELPER
#define BASTIONGUARD_ROOTGUARD_SERVICE_HELPER "/usr/libexec/bastionguard/bastionguard-rootguard-service"
#endif
#ifndef BASTIONGUARD_ROOTGUARD_ACTION_HELPER
#define BASTIONGUARD_ROOTGUARD_ACTION_HELPER "/usr/libexec/bastionguard/bastionguard-rootguard-action"
#endif
#ifndef BASTIONGUARD_ROOTGUARD_EVENT_LOG
#define BASTIONGUARD_ROOTGUARD_EVENT_LOG "/var/log/bastionguard/rootguard-events.jsonl"
#endif
#ifndef BASTIONGUARD_ROOTGUARD_POLICY
#define BASTIONGUARD_ROOTGUARD_POLICY "/etc/bastionguard/rootguard.conf"
#endif
#ifndef BASTIONGUARD_ROOTGUARD_POLICY_VIEW
#define BASTIONGUARD_ROOTGUARD_POLICY_VIEW "/run/bastionguard-rootguard.policy-view"
#endif
#ifndef BASTIONGUARD_PKEXEC
#define BASTIONGUARD_PKEXEC "/usr/bin/pkexec"
#endif
namespace BastionGuard::RootGuard {
namespace {
struct CommandResult {
int exit_code{127};
std::string output;
};
CommandResult run_command(const std::vector<std::string>& arguments)
{
CommandResult result;
if (arguments.empty())
return result;
int descriptors[2]{};
if (::pipe(descriptors) != 0)
return result;
const pid_t child = ::fork();
if (child < 0) {
::close(descriptors[0]);
::close(descriptors[1]);
return result;
}
if (child == 0) {
::close(descriptors[0]);
::dup2(descriptors[1], STDOUT_FILENO);
::dup2(descriptors[1], STDERR_FILENO);
::close(descriptors[1]);
std::vector<char*> argv;
argv.reserve(arguments.size() + 1);
for (const auto& argument : arguments)
argv.push_back(const_cast<char*>(argument.c_str()));
argv.push_back(nullptr);
::execv(argv.front(), argv.data());
_exit(127);
}
::close(descriptors[1]);
std::array<char, 4096> buffer{};
for (;;) {
const ssize_t count = ::read(descriptors[0], buffer.data(), buffer.size());
if (count > 0) {
result.output.append(buffer.data(), static_cast<std::size_t>(count));
continue;
}
if (count < 0 && errno == EINTR)
continue;
break;
}
::close(descriptors[0]);
int status = 0;
while (::waitpid(child, &status, 0) < 0 && errno == EINTR) {
}
if (WIFEXITED(status))
result.exit_code = WEXITSTATUS(status);
else if (WIFSIGNALED(status))
result.exit_code = 128 + WTERMSIG(status);
return result;
}
std::string trim(std::string value)
{
const auto first = value.find_first_not_of(" \t\r\n");
if (first == std::string::npos)
return {};
const auto last = value.find_last_not_of(" \t\r\n");
return value.substr(first, last - first + 1);
}
bool parse_bool(const std::string& value)
{
return value == "true" || value == "1" || value == "yes" || value == "on";
}
ServiceStatus parse_status(const std::string& text)
{
ServiceStatus status;
std::istringstream input(text);
std::string line;
while (std::getline(input, line)) {
const auto separator = line.find('=');
if (separator == std::string::npos)
continue;
const std::string key = trim(line.substr(0, separator));
const std::string value = trim(line.substr(separator + 1));
if (key == "active") status.active = parse_bool(value);
else if (key == "init") status.init_system = value;
else if (key == "state") status.state = value;
else if (key == "mode") status.mode = value;
else if (key == "metadata_action") status.metadata_action = value;
else if (key == "global_metadata_action") status.global_metadata_action = value;
else if (key == "auto_block_services") status.autoBlockServices = parse_bool(value);
else if (key == "block_user_home") status.blockUserHome = parse_bool(value);
else if (key == "pid") status.pid = value;
}
status.immediateProtection = status.mode == "enforce" &&
status.metadata_action == "block";
return status;
}
struct IgnoredPathRule {
std::filesystem::path path;
bool recursive{};
};
bool path_starts_with(const std::filesystem::path& path,
const std::filesystem::path& prefix)
{
const auto normalized_path = path.lexically_normal();
const auto normalized_prefix = prefix.lexically_normal();
auto path_iterator = normalized_path.begin();
for (auto prefix_iterator = normalized_prefix.begin();
prefix_iterator != normalized_prefix.end();
++prefix_iterator, ++path_iterator) {
if (path_iterator == normalized_path.end() ||
*path_iterator != *prefix_iterator)
return false;
}
return true;
}
std::vector<IgnoredPathRule> read_ignored_paths()
{
std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
if (!input)
return {};
std::vector<IgnoredPathRule> rules;
std::string line;
while (std::getline(input, line)) {
const auto separator = line.find('=');
if (separator == std::string::npos)
continue;
const std::string key = trim(line.substr(0, separator));
const std::string value = trim(line.substr(separator + 1));
if (value.empty() || value.front() != '/')
continue;
if (key == "ignored_path") {
rules.push_back(IgnoredPathRule{
std::filesystem::path(value).lexically_normal(), false});
} else if (key == "ignored_recursive") {
rules.push_back(IgnoredPathRule{
std::filesystem::path(value).lexically_normal(), true});
}
}
return rules;
}
bool is_ignored_event_path(const std::string& filename,
const std::vector<IgnoredPathRule>& rules)
{
if (filename.empty() || filename == "--" || filename.front() != '/')
return false;
const std::filesystem::path path(filename);
for (const auto& rule : rules) {
if (rule.recursive ? path_starts_with(path, rule.path)
: path.lexically_normal() == rule.path)
return true;
}
return false;
}
ApplicationRules read_application_rules()
{
std::ifstream input(BASTIONGUARD_ROOTGUARD_POLICY_VIEW);
ApplicationRules rules;
if (!input)
return rules;
std::string line;
while (std::getline(input, line)) {
const auto separator = line.find('=');
if (separator == std::string::npos)
continue;
const std::string key = trim(line.substr(0, separator));
const std::string value = trim(line.substr(separator + 1));
if (value.empty())
continue;
if (key == "trusted_application")
rules.trustedApplications.push_back(value);
else if (key == "trusted_executable")
rules.trustedExecutables.push_back(value);
else if (key == "denied_executable")
rules.deniedExecutables.push_back(value);
}
return rules;
}
std::vector<Event> read_recent_events(const std::size_t maximum)
{
const auto ignored_paths = read_ignored_paths();
std::ifstream stream(BASTIONGUARD_ROOTGUARD_EVENT_LOG, std::ios::binary);
if (!stream)
return {};
constexpr std::streamoff kMaximumTailBytes = 2 * 1024 * 1024;
stream.seekg(0, std::ios::end);
const std::streamoff end = stream.tellg();
if (end < 0)
return {};
const std::streamoff start = end > kMaximumTailBytes
? end - kMaximumTailBytes : 0;
stream.seekg(start, std::ios::beg);
std::string line;
if (start > 0)
std::getline(stream, line); // discard a potentially partial JSON line
std::deque<std::string> lines;
while (std::getline(stream, line)) {
lines.push_back(std::move(line));
if (lines.size() > maximum)
lines.pop_front();
}
std::vector<Event> events;
events.reserve(lines.size());
for (const auto& item : lines) {
if (auto event = parse_event_json(item)) {
if (!is_ignored_event_path(event->filename, ignored_paths))
events.push_back(std::move(*event));
}
}
return events;
}
std::string octal_argument(const std::uint32_t value)
{
std::ostringstream output;
output << std::oct << (value & 07777U);
return output.str();
}
bool command_success(const CommandResult& result, const std::string& successFallback,
std::string& message)
{
message = trim(result.output);
const bool success = result.exit_code == 0;
if (message.empty()) {
if (success) {
message = successFallback;
} else {
message = "RootGuard command failed with exit code " +
std::to_string(result.exit_code) + ".";
}
}
return success;
}
} // namespace
Client::Client()
{
dispatcher_.connect(sigc::mem_fun(*this, &Client::on_dispatch));
worker_ = std::thread(&Client::worker_loop, this);
}
Client::~Client()
{
{
std::lock_guard lock(mutex_);
stopping_ = true;
requests_.clear();
requests_.push_front(Request{Action::Quit, false, std::nullopt, {}});
}
condition_.notify_one();
if (worker_.joinable())
worker_.join();
}
sigc::signal<void(const Snapshot&)>& Client::signal_updated() noexcept
{
return signal_updated_;
}
void Client::refresh() { enqueue(Request{Action::Refresh, false, std::nullopt, {}}); }
void Client::start_service() { enqueue(Request{Action::Start, false, std::nullopt, {}}); }
void Client::stop_service() { enqueue(Request{Action::Stop, false, std::nullopt, {}}); }
void Client::reload_policy() { enqueue(Request{Action::Reload, false, std::nullopt, {}}); }
void Client::restart_service() { enqueue(Request{Action::Restart, false, std::nullopt, {}}); }
void Client::set_immediate_protection(const bool enabled)
{
enqueue(Request{Action::SetProtection, enabled, std::nullopt, {}});
}
void Client::restore_event(const Event& event)
{
enqueue(Request{Action::Restore, false, event, {}});
}
void Client::remove_event(const Event& event)
{
enqueue(Request{Action::Remove, false, event, {}});
}
void Client::save_application_rules(ApplicationRules rules)
{
enqueue(Request{Action::SaveApplicationRules, false, std::nullopt,
std::move(rules)});
}
void Client::enqueue(Request request)
{
{
std::lock_guard lock(mutex_);
if (stopping_)
return;
if (request.action == Action::Refresh) {
const bool refreshAlreadyQueued = std::any_of(
requests_.begin(), requests_.end(),
[](const Request& queued) { return queued.action == Action::Refresh; });
if (refreshAlreadyQueued)
return;
}
requests_.push_back(std::move(request));
}
condition_.notify_one();
}
Snapshot Client::collect_snapshot(const std::string& operation_message,
const bool operation_success) const
{
const CommandResult status_result = run_command({
BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "status"
});
Snapshot snapshot;
snapshot.service = parse_status(status_result.output);
snapshot.events = read_recent_events(400);
snapshot.application_rules = read_application_rules();
snapshot.operation_message = operation_message;
snapshot.operation_success = operation_success;
if (snapshot.service.state == "unknown" && status_result.exit_code != 0)
snapshot.service.state = "unavailable";
return snapshot;
}
bool Client::run_request(const Request& request, std::string& message) const
{
if (request.action == Action::Refresh)
return true;
if (request.action == Action::Start || request.action == Action::Stop ||
request.action == Action::Reload || request.action == Action::Restart) {
const char* action = request.action == Action::Start ? "start" :
request.action == Action::Stop ? "stop" :
request.action == Action::Reload ? "reload" : "restart";
return command_success(run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, action
}), std::string("RootGuard action completed: ") + action, message);
}
if (request.action == Action::SetProtection) {
const auto result = run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"set-protection", "--state", request.enabled ? "on" : "off"
});
if (!command_success(result, "RootGuard protection mode updated.", message))
return false;
const auto reload = run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_SERVICE_HELPER, "reload"
});
std::string reloadMessage;
const bool reloadSuccess = command_success(
reload, "RootGuard policy reloaded.", reloadMessage);
if (!reloadMessage.empty())
message += " " + reloadMessage;
if (!reloadSuccess && request.enabled) {
const auto rollback = run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"set-protection", "--state", "off"
});
std::string rollbackMessage;
const bool rollbackSuccess = command_success(
rollback, "Unsafe future enablement was rolled back to audit mode.",
rollbackMessage);
message += rollbackSuccess
? " " + rollbackMessage
: " WARNING: the policy rollback to audit mode failed: " + rollbackMessage;
}
return reloadSuccess;
}
if (request.action == Action::SaveApplicationRules) {
std::vector<std::string> command {
BASTIONGUARD_PKEXEC,
BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"set-application-rules"
};
const auto appendRules = [&command](const char* option,
const std::vector<std::string>& entries) {
for (const auto& entry : entries) {
command.emplace_back(option);
command.push_back(entry);
}
};
appendRules("--trusted-application",
request.application_rules.trustedApplications);
appendRules("--trusted-executable",
request.application_rules.trustedExecutables);
appendRules("--denied-executable",
request.application_rules.deniedExecutables);
const auto saveResult = run_command(command);
if (!command_success(saveResult,
"RootGuard application rules saved.", message))
return false;
const auto restartResult = run_command({
BASTIONGUARD_PKEXEC,
BASTIONGUARD_ROOTGUARD_SERVICE_HELPER,
"restart"
});
std::string restartMessage;
const bool restartSuccess = command_success(
restartResult, "RootGuard restarted with the new rules.",
restartMessage);
if (!restartMessage.empty())
message += " " + restartMessage;
return restartSuccess;
}
if (!request.event)
return false;
const Event& event = *request.event;
if (event.filename.empty()) {
message = "The incident has no actionable path.";
return false;
}
if (request.action == Action::Restore) {
const bool metadataAvailable = event.old_mode != 0 || event.new_mode != 0 ||
event.old_uid != 0 || event.new_uid != 0 ||
event.old_gid != 0 || event.new_gid != 0;
if (!metadataAvailable) {
if (is_system_service_path(event.filename)) {
return command_success(run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"unblock-service", "--path", event.filename
}), "The blocked service was unmasked. It was not restarted.", message);
}
message = "The change was denied before it was committed; no metadata restoration was required.";
return true;
}
return command_success(run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"restore", "--path", event.filename,
"--mode", octal_argument(event.old_mode),
"--uid", std::to_string(event.old_uid),
"--gid", std::to_string(event.old_gid),
"--device", std::to_string(event.device),
"--inode", std::to_string(event.inode)
}), "Protected metadata restored.", message);
}
if (request.action == Action::Remove) {
return command_success(run_command({
BASTIONGUARD_PKEXEC, BASTIONGUARD_ROOTGUARD_ACTION_HELPER,
"remove", "--path", event.filename,
"--device", std::to_string(event.device),
"--inode", std::to_string(event.inode)
}), "The file was removed and quarantined.", message);
}
return false;
}
void Client::worker_loop()
{
for (;;) {
Request request;
{
std::unique_lock lock(mutex_);
condition_.wait(lock, [this] { return !requests_.empty(); });
request = std::move(requests_.front());
requests_.pop_front();
}
if (request.action == Action::Quit)
break;
std::string message;
const bool success = run_request(request, message);
Snapshot snapshot = collect_snapshot(message, success);
{
std::lock_guard lock(mutex_);
pending_snapshot_ = std::move(snapshot);
snapshot_ready_ = true;
}
dispatcher_.emit();
}
}
void Client::on_dispatch()
{
Snapshot snapshot;
{
std::lock_guard lock(mutex_);
if (!snapshot_ready_)
return;
snapshot = std::move(pending_snapshot_);
snapshot_ready_ = false;
}
signal_updated_.emit(snapshot);
}
} // namespace BastionGuard::RootGuard

111
src/rootguard/RootGuardClient.hpp Normal file
View file

@ -0,0 +1,111 @@
/*
* BastionGuard™ RootGuard GTK integration
* Copyright (C) 2025–2026 Calogero Scarnà
* SPDX-License-Identifier: GPL-3.0-or-later
*/
#pragma once
#include "RootGuardEvent.hpp"
#include <glibmm/dispatcher.h>
#include <sigc++/sigc++.h>
#include <condition_variable>
#include <cstddef>
#include <deque>
#include <mutex>
#include <optional>
#include <string>
#include <thread>
#include <vector>
namespace BastionGuard::RootGuard {
struct ServiceStatus {
bool active{};
bool immediateProtection{};
bool autoBlockServices{};
bool blockUserHome{};
std::string init_system{"unknown"};
std::string state{"unknown"};
std::string mode{"unknown"};
std::string metadata_action{"unknown"};
std::string global_metadata_action{"unknown"};
std::string pid;
};
struct ApplicationRules {
std::vector<std::string> trustedApplications;
std::vector<std::string> trustedExecutables;
std::vector<std::string> deniedExecutables;
};
struct Snapshot {
ServiceStatus service;
std::vector<Event> events;
ApplicationRules application_rules;
std::string operation_message;
bool operation_success{true};
};
class Client {
public:
Client();
~Client();
Client(const Client&) = delete;
Client& operator=(const Client&) = delete;
sigc::signal<void(const Snapshot&)>& signal_updated() noexcept;
void refresh();
void start_service();
void stop_service();
void reload_policy();
void restart_service();
void set_immediate_protection(bool enabled);
void restore_event(const Event& event);
void remove_event(const Event& event);
void save_application_rules(ApplicationRules rules);
private:
enum class Action {
Refresh,
Start,
Stop,
Reload,
Restart,
SetProtection,
Restore,
Remove,
SaveApplicationRules,
Quit,
};
struct Request {
Action action{Action::Refresh};
bool enabled{};
std::optional<Event> event;
ApplicationRules application_rules;
};
void enqueue(Request request);
void worker_loop();
void on_dispatch();
Snapshot collect_snapshot(const std::string& operation_message,
bool operation_success) const;
bool run_request(const Request& request, std::string& message) const;
Glib::Dispatcher dispatcher_;
sigc::signal<void(const Snapshot&)> signal_updated_;
mutable std::mutex mutex_;
std::condition_variable condition_;
std::deque<Request> requests_;
Snapshot pending_snapshot_;
bool snapshot_ready_{};
bool stopping_{};
std::thread worker_;
};
} // namespace BastionGuard::RootGuard

291
src/rootguard/RootGuardEvent.cpp Normal file
View file

@ -0,0 +1,291 @@
/*
* BastionGuard™ RootGuard GTK integration
* Copyright (C) 2025–2026 Calogero Scarnà
* SPDX-License-Identifier: GPL-3.0-or-later
*/
#include "RootGuardEvent.hpp"
#include "rootguard/rootguard_shared.h"
#include <functional>
#include <iomanip>
#include <limits>
#include <sstream>
namespace BastionGuard::RootGuard {
namespace {
std::optional<std::string> json_string(const std::string& json,
const std::string& key)
{
const std::string marker = "\"" + key + "\":\"";
const auto begin = json.find(marker);
if (begin == std::string::npos)
return std::nullopt;
std::string result;
bool escaped = false;
for (std::size_t index = begin + marker.size(); index < json.size(); ++index) {
const char character = json[index];
if (escaped) {
switch (character) {
case 'n': result.push_back('\n'); break;
case 'r': result.push_back('\r'); break;
case 't': result.push_back('\t'); break;
case '\\': result.push_back('\\'); break;
case '"': result.push_back('"'); break;
default: result.push_back(character); break;
}
escaped = false;
} else if (character == '\\') {
escaped = true;
} else if (character == '"') {
return result;
} else {
result.push_back(character);
}
}
return std::nullopt;
}
std::optional<std::uint64_t> json_u64(const std::string& json,
const std::string& key)
{
const std::string marker = "\"" + key + "\":";
const auto begin = json.find(marker);
if (begin == std::string::npos)
return std::nullopt;
std::size_t consumed = 0;
try {
const unsigned long long value =
std::stoull(json.substr(begin + marker.size()), &consumed, 10);
if (consumed == 0)
return std::nullopt;
return static_cast<std::uint64_t>(value);
} catch (...) {
return std::nullopt;
}
}
std::optional<std::int64_t> json_i64(const std::string& json,
const std::string& key)
{
const std::string marker = "\"" + key + "\":";
const auto begin = json.find(marker);
if (begin == std::string::npos)
return std::nullopt;
std::size_t consumed = 0;
try {
const long long value =
std::stoll(json.substr(begin + marker.size()), &consumed, 10);
if (consumed == 0)
return std::nullopt;
return static_cast<std::int64_t>(value);
} catch (...) {
return std::nullopt;
}
}
std::uint32_t as_u32(const std::optional<std::uint64_t>& value)
{
return value && *value <= 0xffffffffULL
? static_cast<std::uint32_t>(*value) : 0U;
}
std::int32_t as_i32(const std::optional<std::int64_t>& value)
{
if (!value ||
*value < std::numeric_limits<std::int32_t>::min() ||
*value > std::numeric_limits<std::int32_t>::max())
return 0;
return static_cast<std::int32_t>(*value);
}
std::string octal_mode(const std::uint32_t mode)
{
std::ostringstream output;
output << std::oct << (mode & 07777U);
return output.str();
}
bool has_prefix(const std::string& path, const std::string& prefix)
{
return path == prefix ||
(path.size() > prefix.size() && path.compare(0, prefix.size(), prefix) == 0 &&
path[prefix.size()] == '/');
}
} // namespace
std::optional<Event> parse_event_json(const std::string& line)
{
Event event;
event.raw_json = line;
const auto event_name = json_string(line, "event");
const auto verdict = json_string(line, "verdict");
if (!event_name || !verdict)
return std::nullopt;
event.received_at = json_string(line, "received_at").value_or("");
event.event = *event_name;
event.verdict = *verdict;
event.pid = as_u32(json_u64(line, "pid"));
event.tgid = as_u32(json_u64(line, "tgid"));
event.ppid = as_u32(json_u64(line, "ppid"));
event.old_euid = as_u32(json_u64(line, "old_euid"));
event.new_euid = as_u32(json_u64(line, "new_euid"));
event.rule_id = as_u32(json_u64(line, "rule_id"));
event.reason_flags = as_u32(json_u64(line, "reason_flags"));
event.lsm_flags = as_i32(json_i64(line, "lsm_flags"));
event.auxiliary = as_u32(json_u64(line, "auxiliary"));
event.device = json_u64(line, "device").value_or(0);
event.inode = json_u64(line, "inode").value_or(0);
event.actor_device = json_u64(line, "actor_device").value_or(0);
event.actor_inode = json_u64(line, "actor_inode").value_or(0);
event.parent_device = json_u64(line, "parent_device").value_or(0);
event.parent_inode = json_u64(line, "parent_inode").value_or(0);
event.actor_start_boottime_ns =
json_u64(line, "actor_start_boottime_ns").value_or(0);
event.old_mode = as_u32(json_u64(line, "old_mode"));
event.new_mode = as_u32(json_u64(line, "new_mode"));
event.old_uid = as_u32(json_u64(line, "old_uid"));
event.new_uid = as_u32(json_u64(line, "new_uid"));
event.old_gid = as_u32(json_u64(line, "old_gid"));
event.new_gid = as_u32(json_u64(line, "new_gid"));
event.comm = json_string(line, "comm").value_or("unknown");
event.parent_comm = json_string(line, "parent_comm").value_or("");
event.actor_executable = json_string(line, "actor_executable").value_or("");
event.parent_executable = json_string(line, "parent_executable").value_or("");
event.filename = json_string(line, "filename").value_or("");
event.path_resolution = json_string(line, "path_resolution").value_or("basename-only");
return event;
}
std::string format_event(const Event& event)
{
std::ostringstream output;
output << '[' << (event.received_at.empty() ? "unknown time" : event.received_at)
<< "] [" << event.verdict << "] " << event.event
<< " process=" << event.comm
<< " pid=" << event.pid
<< " tgid=" << event.tgid
<< " ppid=" << event.ppid;
if (event.old_euid != event.new_euid)
output << " euid=" << event.old_euid << "->" << event.new_euid;
if (event.old_mode != event.new_mode)
output << " mode=" << octal_mode(event.old_mode)
<< "->" << octal_mode(event.new_mode);
if (event.old_uid != event.new_uid || event.old_gid != event.new_gid)
output << " owner=" << event.old_uid << ':' << event.old_gid
<< "->" << event.new_uid << ':' << event.new_gid;
if (event.rule_id != 0)
output << " rule=" << event.rule_id;
if (!event.parent_comm.empty())
output << " parent=" << event.parent_comm;
if (!event.parent_executable.empty())
output << " parent-exe=" << event.parent_executable;
if (event.parent_device != 0 || event.parent_inode != 0)
output << " parent-identity=" << event.parent_device
<< ':' << event.parent_inode;
if (!event.actor_executable.empty())
output << " actor=" << event.actor_executable;
if (event.actor_device != 0 || event.actor_inode != 0)
output << " actor-identity=" << event.actor_device
<< ':' << event.actor_inode;
if (!event.filename.empty())
output << " file=" << event.filename
<< " path-resolution=" << event.path_resolution;
if (event.device != 0 || event.inode != 0)
output << " identity=" << event.device << ':' << event.inode;
output << " reason=0x" << std::hex << event.reason_flags << std::dec;
return output.str();
}
std::string event_fingerprint(const Event& event)
{
const auto hash = std::hash<std::string>{}(event.raw_json);
std::ostringstream output;
output << std::hex << hash;
return output.str();
}
EventSeverity classify_event(const Event& event) noexcept
{
if (event.filename.empty() || event.filename == "--")
return EventSeverity::Telemetry;
if (event.verdict != "blocked" && event.verdict != "alert" &&
event.verdict != "audit")
return EventSeverity::Telemetry;
if (event.event == "service-blocked")
return EventSeverity::Incident;
const bool metadataEvent =
event.event == "permission-change" ||
event.event == "owner-change" ||
event.event == "xattr-change" ||
event.event == "acl-change";
if (metadataEvent) {
/*
* Explicitly protected identities retain their existing incident
* semantics because they have a baseline and may have been blocked.
*/
if (event.rule_id != 0)
return EventSeverity::Incident;
/*
* Desktop policy: unprotected global privilege metadata is diagnostic
* telemetry only. Keep it visible as an observation when explicitly
* enabled, but never let backup/package metadata replay interrupt the
* user with a popup. Historical broad-surveillance records remain
* telemetry-only.
*/
if ((event.reason_flags & RG_REASON_GLOBAL_METADATA) != 0)
return (event.reason_flags & RG_REASON_METADATA_BURST) != 0
? EventSeverity::Incident
: EventSeverity::Observation;
return EventSeverity::Telemetry;
}
if (event.event == "protected-unlink" ||
event.event == "protected-rename" ||
event.event == "protected-hardlink" ||
event.event == "integrity-drift")
return event.rule_id != 0
? EventSeverity::Incident
: EventSeverity::Telemetry;
return EventSeverity::Telemetry;
}
bool is_security_observation(const Event& event) noexcept
{
return classify_event(event) != EventSeverity::Telemetry;
}
bool is_actionable_incident(const Event& event) noexcept
{
return classify_event(event) == EventSeverity::Incident;
}
bool is_system_service_path(const std::string& path) noexcept
{
if (path.empty())
return false;
const bool systemd = has_prefix(path, "/etc/systemd/system") ||
has_prefix(path, "/usr/lib/systemd/system") ||
has_prefix(path, "/lib/systemd/system");
const bool initScript = has_prefix(path, "/etc/init.d") ||
has_prefix(path, "/etc/conf.d");
const bool dinit = has_prefix(path, "/etc/dinit.d") ||
has_prefix(path, "/usr/lib/dinit.d");
return systemd || initScript || dinit;
}
} // namespace BastionGuard::RootGuard

63
src/rootguard/RootGuardEvent.hpp Normal file
View file

@ -0,0 +1,63 @@
/*
* BastionGuard™ RootGuard GTK integration
* Copyright (C) 2025–2026 Calogero Scarnà
* SPDX-License-Identifier: GPL-3.0-or-later
*/
#pragma once
#include <cstdint>
#include <optional>
#include <string>
namespace BastionGuard::RootGuard {
enum class EventSeverity {
Telemetry,
Observation,
Incident,
};
struct Event {
std::string received_at;
std::string event;
std::string verdict;
std::uint32_t pid{};
std::uint32_t tgid{};
std::uint32_t ppid{};
std::uint32_t old_euid{};
std::uint32_t new_euid{};
std::uint32_t rule_id{};
std::uint32_t reason_flags{};
std::int32_t lsm_flags{};
std::uint32_t auxiliary{};
std::uint64_t device{};
std::uint64_t inode{};
std::uint64_t actor_device{};
std::uint64_t actor_inode{};
std::uint64_t parent_device{};
std::uint64_t parent_inode{};
std::uint64_t actor_start_boottime_ns{};
std::uint32_t old_mode{};
std::uint32_t new_mode{};
std::uint32_t old_uid{};
std::uint32_t new_uid{};
std::uint32_t old_gid{};
std::uint32_t new_gid{};
std::string comm;
std::string parent_comm;
std::string actor_executable;
std::string parent_executable;
std::string filename;
std::string path_resolution{"basename-only"};
std::string raw_json;
};
std::optional<Event> parse_event_json(const std::string& line);
std::string format_event(const Event& event);
std::string event_fingerprint(const Event& event);
EventSeverity classify_event(const Event& event) noexcept;
bool is_security_observation(const Event& event) noexcept;
bool is_actionable_incident(const Event& event) noexcept;
bool is_system_service_path(const std::string& path) noexcept;
} // namespace BastionGuard::RootGuard

1302
src/rootguard/RootGuardPage.cpp Normal file
View file

File diff suppressed because it is too large Load diff

113
src/rootguard/RootGuardPage.hpp Normal file
View file

@ -0,0 +1,113 @@
/*
* BastionGuard™ RootGuard GTK integration
* Copyright (C) 2025–2026 Calogero Scarnà
* SPDX-License-Identifier: GPL-3.0-or-later
*/
#pragma once
#include "RootGuardClient.hpp"
#include <gtkmm.h>
#include <atomic>
#include <chrono>
#include <memory>
#include <optional>
#include <queue>
#include <set>
#include <string>
#include <vector>
class RootGuardPage : public Gtk::Box {
public:
RootGuardPage();
~RootGuardPage() override;
private:
void on_snapshot(const BastionGuard::RootGuard::Snapshot& snapshot);
void render_incidents(const BastionGuard::RootGuard::Snapshot& snapshot);
void render_events(const BastionGuard::RootGuard::Snapshot& snapshot);
void queue_new_alerts(const BastionGuard::RootGuard::Snapshot& snapshot);
void show_next_alert();
void close_current_alert();
void dismiss_alert(const BastionGuard::RootGuard::Event& event);
void dismiss_event(const BastionGuard::RootGuard::Event& event);
void restore_event(const BastionGuard::RootGuard::Event& event);
void remove_event(const BastionGuard::RootGuard::Event& event);
bool on_auto_refresh();
void on_protection_toggled();
Gtk::Box* make_rule_editor(const Glib::ustring& title,
const Glib::ustring& description,
Gtk::ListBox& list,
Gtk::Entry& entry);
void add_rule_from_entry(Gtk::Entry& entry, Gtk::ListBox& list);
void add_installed_application_defaults();
void remove_selected_rule(Gtk::ListBox& list);
void mark_rules_dirty();
void populate_application_rules(
const BastionGuard::RootGuard::ApplicationRules& rules);
std::vector<std::string> collect_rules(const Gtk::ListBox& list) const;
void save_application_rules();
BastionGuard::RootGuard::Client client_;
Gtk::Label title_;
Gtk::Label service_value_;
Gtk::Label mode_value_;
Gtk::Label init_value_;
Gtk::Label pid_value_;
Gtk::Stack page_stack_;
Gtk::StackSwitcher page_switcher_;
Gtk::Switch protection_switch_;
Gtk::Label protection_label_;
Gtk::Popover protection_info_popover_;
Gtk::MenuButton protection_info_button_;
Gtk::Label system_scope_value_;
Gtk::Label home_scope_value_;
Gtk::Button start_button_;
Gtk::Button stop_button_;
Gtk::Button reload_button_;
Gtk::Button restart_button_;
Gtk::Button refresh_button_;
Gtk::Label incidents_title_;
Gtk::ScrolledWindow incidents_scroller_;
Gtk::ListBox incidents_list_;
Gtk::CheckButton show_trusted_;
Gtk::ScrolledWindow events_scroller_;
Gtk::TextView events_view_;
Gtk::Stack rules_stack_;
Gtk::StackSwitcher rules_switcher_;
Gtk::ListBox trusted_applications_list_;
Gtk::Entry trusted_applications_entry_;
Gtk::ListBox trusted_executables_list_;
Gtk::Entry trusted_executables_entry_;
Gtk::ListBox denied_executables_list_;
Gtk::Entry denied_executables_entry_;
Gtk::Button save_rules_button_;
Gtk::Label rules_status_;
Gtk::Label status_;
sigc::connection client_update_connection_;
sigc::connection auto_refresh_connection_;
bool updating_switch_{};
bool initial_snapshot_{true};
bool rules_dirty_{};
bool rules_saving_{};
std::string rules_signature_;
std::optional<BastionGuard::RootGuard::Snapshot> last_snapshot_;
std::set<std::string> seen_events_;
std::set<std::string> dismissed_events_;
std::set<std::string> dismissed_paths_;
std::set<std::string> notified_paths_;
std::queue<BastionGuard::RootGuard::Event> alert_queue_;
std::chrono::steady_clock::time_point last_global_burst_alert_shown_{};
std::unique_ptr<Gtk::Window> current_alert_;
std::shared_ptr<std::atomic_bool> alive_{std::make_shared<std::atomic_bool>(true)};
};

68
src/rootguard/SOURCE_SHA256SUMS Normal file
View file

@ -0,0 +1,68 @@
5111edbd2162ef6bd63a5ab0856a9ec1ab81ba2d1c6b59fef0d5f3a0fe54f703 ./CHANGELOG.md
6b9f5342a8ba37d6753e8e86b58f08cb72d326952330d2213e9aefce7ea4b5c4 ./CMakeLists.txt
3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 ./COPYING
b7945a3568b97ba73349e84803a81e2df578ee5fc37530360f1cc6240b9248f5 ./README.md
47ed619c7e1b2a59e70d9a01232795f72b099fec3ba725962717a263cf901745 ./RootGuardClient.cpp
aa2625f3dde46217fecbd61af784835db05800bf7bc2b4b5958fa45e90d996f6 ./RootGuardClient.hpp
e554d2fc689f3b6236e92315d9de7681e4084cbb3f0a949417ecf17ecc46d328 ./RootGuardEvent.cpp
12a4a7be44198f17a5514d6d25d69601ba800d4e62de113a8ef43b5d55a41bc4 ./RootGuardEvent.hpp
ae44155dc7b8caa0cf64fb1e99a91610b2dc77724eaf859b1c48866ab44e8ef0 ./RootGuardPage.cpp
bc601093800381c42e3e24bf4c0d4ea1c7736250468f4902ef04a8d929555504 ./RootGuardPage.hpp
02384c9de7e571fc67a1862fa1c5e3a0fe7041ab77c2f252d6f1a4878daee8eb ./bastionguard-rootguard.pot
b2a278fda378093612a9412871beebdc677d8b52aa27840cd2d67b115cc21c74 ./bpf/rootguard.bpf.c
68d2caab8364865282ca8dbfd1e959d87ea3c88ee96e8ac25d3c3ff7e0e73814 ./cmake/BastionGuardRootGuard.cmake
082bd47224d9a11a2026629a6bc9f4454054f28e13f8a001969e0ad1b42bdcc9 ./cmake/GenerateSkeleton.cmake
acb4b334c54bf339c2b78751114faae468201ad2cd80e51654d7f5b093558e7a ./cmake/GenerateVmlinux.cmake
94ea35bcda0aa6c4e1140f7ae0b7fd250849c60e7bacee401ed16a876a363f74 ./cmake/StripOuterQuotes.cmake
d6ec94dbab8aaa0d28c84f3e9135a1b4bf9e62163bf1cd1eb70a2d92c9ab1179 ./config/rootguard.conf
c2b61b5e31ad81ecf89b63aaa6a7d06388fe48b65fb6291c0854c33b56dd0d19 ./demo/RootGuardPageDemo.cpp
d927a79f9569a3e7f6a56811063042e7ad370ece89aacf637804a59ace78f1ec ./docs/CMAKE_INTEGRATION.md
be1f596fec9e5135c2adf004ffcb17ca619eba8d257c898a80ed5d275ab8af41 ./docs/GTKMM_INTEGRATION.md
453689b65a9f5f171c00b2e0d0e8b2c9612edd16f4ba4066fc0ff9f37e362f72 ./docs/INCIDENT_RESPONSE.md
1d93284288e59a5f8e8864fe1286123892fe3b8c05135bcd0493af7b2eacf909 ./docs/INIT_SYSTEMS.md
be52022c53733ee5d90207afe8fc58e574e3ea6695c3aed5248592ce51521bd5 ./docs/KERNEL_HARDENING.md
3fb1b9bb6d8d3dd47eecfb5eb6982cb4cfac50c0d09ce8d6dcd544e7cef75c74 ./docs/UPGRADE_2_5_0.md
c13333a1c2d82f002f0cab63d06e0afe6612c840383ef002507aa25175dcac5c ./docs/USER_HOME_AND_APPLICATION_TRUST.md
953233c447411582fb0c2121e2c197d86399e63a7a1708ba0920d855d17dc11c ./docs/VALIDATION_STATUS.md
cfd56e80a1ad6a1a7de553715443e988e5a86ef7a7c9d7575a1d2a70fe7a2d94 ./docs/VM_TESTING.md
3d95dd19701e20a8bcc384a44f5db1b345c1f30ca8c620391bc5c8bf8a3ab469 ./include/rootguard/AutomaticResponseSink.hpp
72f6b2b82d3e544fa1ec9c467ae3de87371eae967606610c4af1979008d9f639 ./include/rootguard/ConsoleEventSink.hpp
a306d2921c649068e27d5408ca4e8625c422ec361c8f3e21dea34958015ceb4c ./include/rootguard/FileIdentity.hpp
8f576cec73c66c079c4e098a96248c132534686ce12e07ca117b8a41d34c5e94 ./include/rootguard/IEventSink.hpp
85cc7d350a9a5dbdf2c99025a6df23078d9e853c538f6f23f759829f26e691e8 ./include/rootguard/JsonEventSink.hpp
eda55c2f5d7e3368a188853bde53d4c73414b129426b59c50596d43362553d62 ./include/rootguard/MultiEventSink.hpp
295d07d466555f07a68b80bd6e9a173de3a47b4616bd279bdb3ec7e2a012a837 ./include/rootguard/Policy.hpp
8a167e0821122b54d30c36411003babf20cba24f66ca788ff710d458ba0e797b ./include/rootguard/PolicyLoader.hpp
ca8d8c1aa9c6f3a0c075e22e4e1d6d02cda97ea476588a7579baffc756df9fe1 ./include/rootguard/PolicySecurity.hpp
f1e067452e332df6ce96cf7f90743f54356237fd9c01f98602a1cbf472ee3f3c ./include/rootguard/RootGuardEngine.hpp
b7398cef8f882ffa8031addfc424e8fe4c5a499ca0c27178c250f7454a2fefe6 ./include/rootguard/SystemServiceControl.hpp
ce70165165999a1fcbd149d8c2511a56a863e4018b125a70380406d26dbdc7cf ./include/rootguard/rootguard_shared.h
dd718f1f0a585db7426cbdb7ac7c5e40e91c650f26a77279fab2a7dfaf5882ef ./packaging/dinit/bastionguard-rootguard
db916c94045c82ee31c76dd03304030e49585bfbaa5d1f6004b6b27144d50190 ./packaging/openrc/bastionguard-rootguard
b6bf1735e818a3f62c26e9e7814acd226f513b9d6ba9d58b3941546bfd3f0c5a ./packaging/openrc/bastionguard-rootguard.conf
1484684df29a333ee5d363ee086ee5d4d84417418efcc22c20f34d43d2a91388 ./packaging/polkit/org.bastionguard.rootguard.policy
2774439ea0a2f3a9ece7efa54c97ade72df19e7fe9d8cedda7e77886e017b762 ./packaging/systemd/bastionguard-rootguard.service
6171d6b72b2e75605420c8d15444febda03f6a44388257d3278b616ca1d7a7f6 ./packaging/sysvinit/bastionguard-rootguard
fee7156e1cc706ba6bf2bb57800c248220ceeee8012b1c0a916c193e5b0a1e41 ./packaging/sysvinit/bastionguard-rootguard.default
3d1cb7d2263683ea7201d3e51c3d2eed3fff9f0c5098cd20fa51b288e6839d8a ./resources/icons/rootguard.svg
24ffa2d4c6e7ebd7a523cc93e211244a747a1a4ea9b9a1444ea865972af7fe62 ./scripts/bastionguard-rootguard-service
621fe124a01b56cca290d8017f1662161f0de9c36a11fdec09c02cab34446220 ./scripts/check-environment.sh
f21f933a290250919e27af196421ab14cd8b9ae9ff8fcf55ed753c34f32b849e ./scripts/enable-service.sh
2f19dfe13fb27ca0e6c2606ea16bea0ec2555317ebb7517cab856abc89af71a2 ./scripts/prepare-metadata-probe.sh
fe9b58f3aab05fb91d2e1cf13adc8f75dbf2c2791c87f6c9ee21e95498c308cf ./scripts/prepare-vm-probe.sh
4301f8c7126e9dcca03cf642dc8583c2bba449ada8085128d743fa5c1331109d ./src/ActionHelper.cpp
2d13119b21754dc3af6cad3f2cb4b88faa9caa30f3409b80b5c0a1b6cf154da6 ./src/AutomaticResponseSink.cpp
be57d11cd1ec502e607da5a6204bad89a3c6d7ba282f1590485a66b1fb801b4e ./src/ConsoleEventSink.cpp
5d9b98876e74b95e2d046d03b06322101c3899ecc027404c2b2dca1a39a70b3a ./src/FileIdentity.cpp
701458f4ef7aeecd597f425796096a9d5fb0a67d0b4495d86150221b9b4fd7e1 ./src/JsonEventSink.cpp
43d6e45e59af30f78943db8c66e72799f39185d9b99f50cd8e2c4fa208bad156 ./src/MultiEventSink.cpp
851206c0779cf35f78661eb4d8d7780cf9452131020071e123a6e6148abede40 ./src/Policy.cpp
abc2cd681f42be681d2b8667b6a3cc1210d3a02eabf44619e63802999f730aa2 ./src/PolicyLoader.cpp
2cd01bef69cc185908768e8bb26a8c43f11e0c82a7d29c15be1d9c55bbb0f675 ./src/PolicySecurity.cpp
732e328d3b24d63f36e08cc1407038d2d461ad714acedd19b50b0d6199b3ae30 ./src/RootGuardEngine.cpp
e719685f80ef2d896c77011761df598f4f068cf81bfd71d8ccb426ed763dd167 ./src/SystemServiceControl.cpp
786211a640aecafba1fb9acceb9400c9dac985e475c59fa828f69e25797e0076 ./src/main.cpp
9f8dc632cdf8c15e49a0bba53b7d02c683b62c20c064b57781ec2dc589a4ed40 ./tests/FileIdentityTests.cpp
4f33650b46da7956564d14ad45c740575b10fb8bf37dd6754292d92129882286 ./tests/PolicyLoaderTests.cpp
897f0dd7050cd2bdd6557faf87e5ee20d58e070fc0c8d7899f50c6baf2e9a6a2 ./tests/RootGuardEventTests.cpp
fab2add591f06fad01bf6ff5713b52dd9bc174d571862d6bf1d8a14dfc1c90ae ./tests/helpers/unknown-setuid-test.c

1556
src/rootguard/bpf/rootguard.bpf.c Normal file
View file

File diff suppressed because it is too large Load diff

59
src/rootguard/cmake/BastionGuardRootGuard.cmake Normal file
View file

@ -0,0 +1,59 @@
include_guard(GLOBAL)
include(CMakeParseArguments)
# Native integration helper for a module located inside the BastionGuard tree.
# It uses add_subdirectory(); it does not create an ExternalProject.
#
# Example (after add_executable(BastionGuard ...)):
# include(src/rootguard/cmake/BastionGuardRootGuard.cmake)
# bastionguard_enable_rootguard(
# TARGET BastionGuard
# SOURCE_DIR "${CMAKE_SOURCE_DIR}/src/rootguard"
# BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
# )
function(bastionguard_enable_rootguard)
set(options BUILD_TESTS)
set(oneValueArgs TARGET SOURCE_DIR BINARY_DIR INIT_SYSTEM BTF)
cmake_parse_arguments(RG "${options}" "${oneValueArgs}" "" ${ARGN})
if(NOT RG_TARGET OR NOT TARGET ${RG_TARGET})
message(FATAL_ERROR
"bastionguard_enable_rootguard requires TARGET naming an existing target")
endif()
if(NOT RG_SOURCE_DIR)
set(RG_SOURCE_DIR "${CMAKE_SOURCE_DIR}/src/rootguard")
endif()
if(NOT RG_BINARY_DIR)
set(RG_BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-rootguard-build")
endif()
if(NOT RG_INIT_SYSTEM)
set(RG_INIT_SYSTEM auto)
endif()
if(NOT RG_BTF)
set(RG_BTF /sys/kernel/btf/vmlinux)
endif()
if(NOT EXISTS "${RG_SOURCE_DIR}/CMakeLists.txt")
message(FATAL_ERROR
"RootGuard module not found: ${RG_SOURCE_DIR}/CMakeLists.txt")
endif()
set(ROOTGUARD_BUILD_DAEMON ON CACHE BOOL "" FORCE)
set(ROOTGUARD_BUILD_GTK_PAGE ON CACHE BOOL "" FORCE)
set(ROOTGUARD_BUILD_GTK_DEMO OFF CACHE BOOL "" FORCE)
set(ROOTGUARD_BUILD_TESTS ${RG_BUILD_TESTS} CACHE BOOL "" FORCE)
set(ROOTGUARD_INIT_SYSTEM "${RG_INIT_SYSTEM}" CACHE STRING "" FORCE)
set(ROOTGUARD_VMLINUX_BTF "${RG_BTF}" CACHE FILEPATH "" FORCE)
if(NOT TARGET BastionGuard::RootGuardUI)
add_subdirectory("${RG_SOURCE_DIR}" "${RG_BINARY_DIR}")
endif()
target_link_libraries(${RG_TARGET} PRIVATE BastionGuard::RootGuardUI)
if(TARGET bastionguard-rootguard)
add_dependencies(${RG_TARGET} bastionguard-rootguard)
endif()
if(TARGET bastionguard-rootguard-action)
add_dependencies(${RG_TARGET} bastionguard-rootguard-action)
endif()
endfunction()

27
src/rootguard/cmake/GenerateSkeleton.cmake Normal file
View file

@ -0,0 +1,27 @@
include("${CMAKE_CURRENT_LIST_DIR}/StripOuterQuotes.cmake")
rootguard_strip_outer_quotes(BPFTOOL)
rootguard_strip_outer_quotes(INPUT_OBJECT)
rootguard_strip_outer_quotes(OUTPUT_FILE)
if(NOT DEFINED BPFTOOL OR NOT DEFINED INPUT_OBJECT OR NOT DEFINED OUTPUT_FILE)
message(FATAL_ERROR "GenerateSkeleton.cmake requires BPFTOOL, INPUT_OBJECT and OUTPUT_FILE")
endif()
set(TEMP_FILE "${OUTPUT_FILE}.tmp")
file(REMOVE "${TEMP_FILE}")
execute_process(
COMMAND "${BPFTOOL}" gen skeleton "${INPUT_OBJECT}"
OUTPUT_FILE "${TEMP_FILE}"
ERROR_VARIABLE BPFTOOL_ERROR
RESULT_VARIABLE BPFTOOL_RESULT
)
if(NOT BPFTOOL_RESULT EQUAL 0)
file(REMOVE "${TEMP_FILE}")
message(FATAL_ERROR "bpftool failed while generating the BPF skeleton: ${BPFTOOL_ERROR}")
endif()
file(SIZE "${TEMP_FILE}" GENERATED_SIZE)
if(GENERATED_SIZE EQUAL 0)
file(REMOVE "${TEMP_FILE}")
message(FATAL_ERROR "Generated BPF skeleton is empty")
endif()
file(RENAME "${TEMP_FILE}" "${OUTPUT_FILE}")

66
src/rootguard/cmake/GenerateVmlinux.cmake Normal file
View file

@ -0,0 +1,66 @@
include("${CMAKE_CURRENT_LIST_DIR}/StripOuterQuotes.cmake")
rootguard_strip_outer_quotes(BPFTOOL)
rootguard_strip_outer_quotes(INPUT_BTF)
rootguard_strip_outer_quotes(OUTPUT_FILE)
if(NOT DEFINED BPFTOOL OR NOT DEFINED INPUT_BTF OR NOT DEFINED OUTPUT_FILE)
message(FATAL_ERROR "GenerateVmlinux.cmake requires BPFTOOL, INPUT_BTF and OUTPUT_FILE")
endif()
if(NOT EXISTS "${BPFTOOL}")
message(FATAL_ERROR "bpftool executable does not exist: ${BPFTOOL}")
endif()
if(NOT EXISTS "${INPUT_BTF}")
message(FATAL_ERROR "Kernel BTF file does not exist: ${INPUT_BTF}")
endif()
get_filename_component(OUTPUT_DIRECTORY "${OUTPUT_FILE}" DIRECTORY)
file(MAKE_DIRECTORY "${OUTPUT_DIRECTORY}")
set(TEMP_FILE "${OUTPUT_FILE}.tmp")
file(REMOVE "${TEMP_FILE}")
execute_process(
COMMAND "${BPFTOOL}" btf dump file "${INPUT_BTF}" format c
OUTPUT_FILE "${TEMP_FILE}"
ERROR_VARIABLE BPFTOOL_ERROR
RESULT_VARIABLE BPFTOOL_RESULT
)
if(NOT BPFTOOL_RESULT EQUAL 0)
file(REMOVE "${TEMP_FILE}")
message(FATAL_ERROR "bpftool failed while generating vmlinux.h: ${BPFTOOL_ERROR}")
endif()
file(SIZE "${TEMP_FILE}" GENERATED_SIZE)
if(GENERATED_SIZE LESS 512)
file(REMOVE "${TEMP_FILE}")
message(FATAL_ERROR "Generated vmlinux.h is unexpectedly small (${GENERATED_SIZE} bytes)")
endif()
# bpftool's BTF type order is kernel-dependent. In particular, Arch kernels
# may place Linux __u* typedefs well beyond the beginning of the generated
# header, so checking only the first fixed-size chunk is invalid. Validate
# the stable header guard instead; Clang will perform the authoritative syntax
# and type validation when rootguard.bpf.c is compiled.
file(READ "${TEMP_FILE}" GENERATED_PREAMBLE LIMIT 16384)
if(NOT GENERATED_PREAMBLE MATCHES "#[ \t]*(ifndef|define)[ \t]+__VMLINUX_H__")
file(REMOVE "${TEMP_FILE}")
message(FATAL_ERROR
"bpftool output does not look like a generated vmlinux.h "
"(missing __VMLINUX_H__ header guard)")
endif()
# Kernel BTF is the source of truth for kfunc prototypes. In particular,
# bpf_path_d_path() exists with a non-const struct path * argument on some
# kernels and a const-qualified argument on newer kernels. Record only the
# presence of the declaration here so BPF sources can use the exact prototype
# emitted by bpftool instead of redeclaring it with a kernel-version-specific
# signature.
file(READ "${TEMP_FILE}" GENERATED_VMLINUX)
if(GENERATED_VMLINUX MATCHES
"extern[ \t\r\n]+int[ \t\r\n]+bpf_path_d_path[ \t\r\n]*\\(")
file(APPEND "${TEMP_FILE}"
"\n#define ROOTGUARD_VMLINUX_HAS_BPF_PATH_D_PATH 1\n")
endif()
file(RENAME "${TEMP_FILE}" "${OUTPUT_FILE}")

11
src/rootguard/cmake/StripOuterQuotes.cmake Normal file
View file

@ -0,0 +1,11 @@
# Normalize command-line cache values accidentally passed as -DNAME="/path".
# Correct callers should pass "-DNAME:FILEPATH=/path" as one CMake argument.
function(rootguard_strip_outer_quotes variable_name)
if(NOT DEFINED ${variable_name})
return()
endif()
set(value "${${variable_name}}")
string(REGEX REPLACE "^\"(.*)\"$" "\\1" value "${value}")
set(${variable_name} "${value}" PARENT_SCOPE)
endfunction()

122
src/rootguard/config/rootguard.conf Normal file
View file

@ -0,0 +1,122 @@
# BastionGuard RootGuard policy v2
# Default deliberately safe for the first VM runs.
# RootGuard uses a desktop-safe two-lane policy. Explicit protected paths retain
# complete baseline monitoring and enforcement. Unprotected privilege metadata is
# sampled at the eBPF source, while destructive permission/ownership storms are
# aggregated per execution domain (cgroup + actor/parent identity) into one signal.
# This preserves ransomware-style permission-change detection without flooding
# the desktop during backup/restore or package work.
[engine]
version = 2
mode = audit
unknown_action = audit
metadata_action = audit
global_metadata_action = audit
credential_anomaly_action = audit
allow_missing_paths = true
require_root_owned_trusted_executables = true
protect_trusted_executables = true
# Keep direct privilege primitives visible, but sample only a few per
# execution-domain window.
# Individual unprotected global events are observations, never popups.
monitor_global_privilege_metadata = true
detect_global_metadata_bursts = true
global_metadata_sample_limit = 3
# A destructive permission/ownership storm is one incident after 32 candidates
# in 5 seconds. The same execution domain cannot emit another for 5 minutes.
metadata_burst_threshold = 32
metadata_burst_window_ms = 5000
metadata_burst_cooldown_ms = 300000
# /run is volatile and BastionGuard Backup uses it as a temporary mount root.
# Suppress only unprotected global metadata events there; protected identities
# and privilege/credential-transition checks remain active.
ignore_run_global_metadata = true
integrity_poll_seconds = 5
log_trusted = true
auto_block_system_services = true
# Home directories are always audit-only by default. BastionGuard Anti-Ransomware
# is responsible for user-data enforcement.
block_user_home = false
event_log = /var/log/bastionguard/rootguard-events.jsonl
# Exact file identities are resolved to device+inode at startup/reload.
# Missing entries are warnings because paths vary across distributions.
[trusted-applications]
# These applications remain visible as trusted events when log_trusted=true,
# but they do not generate incident popups for routine user-space metadata work.
# This list never grants privilege-escalation trust. For backup software, add
# the exact orchestrator executable here rather than generic rsync/tar/chmod.
# Global events from its descendant helpers are also classified as trusted.
# Missing paths are tolerated.
path = /usr/bin/gnome-shell
path = /usr/bin/nautilus
path = /usr/bin/plasmashell
path = /usr/bin/kwin_wayland
path = /usr/bin/dolphin
path = /usr/bin/xfdesktop
path = /usr/bin/xfwm4
path = /usr/bin/thunar
path = /usr/bin/cinnamon
path = /usr/bin/nemo
path = /usr/bin/mate-panel
path = /usr/bin/caja
path = /usr/bin/firefox
path = /usr/lib/firefox/firefox
path = /usr/bin/chromium
path = /usr/bin/google-chrome-stable
path = /usr/bin/brave
path = /usr/bin/vivaldi-stable
[trusted-executables]
path = /usr/bin/sudo
path = /usr/bin/su
path = /usr/bin/pkexec
path = /usr/bin/doas
path = /usr/bin/passwd
path = /usr/bin/chsh
path = /usr/bin/chfn
path = /usr/bin/gpasswd
path = /usr/bin/newgrp
path = /usr/bin/mount
path = /usr/bin/umount
path = /usr/lib/polkit-1/polkit-agent-helper-1
path = /usr/lib/ssh/ssh-keysign
# Add exact executables that must always be denied here.
[denied-executables]
# required_path = /opt/bastionguard-rootguard-test/known-denied-test
# Exact or recursive paths excluded from RootGuard protection.
# BastionGuard owns and rotates these cron definitions itself; protecting them
# would generate false incidents during normal backup schedule maintenance.
[ignored-paths]
path = /etc/cron.d/bastionguard-backup-hourly
path = /etc/cron.d/bastionguard-backup-boot
# File and directory inodes whose mode, owner, ACL, security xattrs,
# unlink, rename and hardlink operations must be monitored/protected.
# Start with audit. Enable metadata_action=block only after validating updates.
[protected-paths]
path = /etc/sudoers
path = /etc/passwd
path = /etc/shadow
path = /etc/group
path = /etc/gshadow
recursive_path = /etc/pam.d
recursive_path = /etc/polkit-1
recursive_path = /etc/systemd/system
recursive_path = /usr/lib/systemd/system
recursive_path = /etc/init.d
recursive_path = /etc/conf.d
recursive_path = /etc/dinit.d
recursive_path = /usr/lib/dinit.d
path = /etc/ld.so.preload
path = /etc/crontab
recursive_path = /etc/sudoers.d
recursive_path = /etc/security
recursive_path = /etc/cron.d
recursive_path = /etc/modules-load.d
recursive_path = /etc/modprobe.d
recursive_path = /etc/sysctl.d

21
src/rootguard/demo/RootGuardPageDemo.cpp Normal file
View file

@ -0,0 +1,21 @@
#include "RootGuardPage.hpp"
#include <gtkmm.h>
class DemoWindow final : public Gtk::Window {
public:
DemoWindow()
{
set_title("BastionGuard RootGuard");
set_default_size(1000, 680);
set_child(page_);
}
private:
RootGuardPage page_;
};
int main(int argc, char* argv[])
{
auto application = Gtk::Application::create("eu.bastionguard.rootguard.demo");
return application->make_window_and_run<DemoWindow>(argc, argv);
}

31
src/rootguard/docs/CMAKE_INTEGRATION.md Normal file
View file

@ -0,0 +1,31 @@
# Native BastionGuard CMake integration
RootGuard is a regular CMake subdirectory at `src/rootguard`. Do not wrap it in
`ExternalProject_Add` and do not create a staged Meson installation.
Place the contents of:
```text
src/rootguard/integration/CMakeLists.rootguard.fragment.txt
```
after the main `add_executable(BastionGuard ...)` declaration.
The module creates:
- `bastionguard-rootguard`;
- `bastionguard-rootguard-action`;
- `bastionguard-rootguard-gtk`;
- alias `BastionGuard::RootGuardUI`.
The main target links to the alias. Its public build include directory is the
parent of `src/rootguard`, allowing:
```cpp
#include "rootguard/RootGuardPage.hpp"
```
All backend, polkit, policy and selected init-system install rules are inherited
by the normal top-level `cmake --install` operation. Existing
`/etc/bastionguard/rootguard.conf` is preserved; the packaged reference is
installed as `rootguard.conf.default`.

83
src/rootguard/docs/GTKMM_INTEGRATION.md Normal file
View file

@ -0,0 +1,83 @@
# GTK4/gtkmm integration
`RootGuardPage` is a non-privileged `Gtk::Box` located directly in
`src/rootguard`. It does not load BPF programs or edit protected files itself.
Privileged service, policy and incident actions are delegated through the
installed helpers using `pkexec`; JSONL reads and command execution occur in
the client worker thread.
## Compact page structure
The page uses a `Gtk::Stack` and `Gtk::StackSwitcher` so it does not force the
main BastionGuard window to grow vertically:
- **Overview** — service state, immediate-blocking switch, scope warning and
service controls.
- **Incidents** — current observations and blocked protected changes.
- **Events** — terminal-style JSONL summary with an optional trusted-event
filter.
- **Application rules** — nested tabs for routine trusted applications,
privilege-trusted executables and denied executables.
## Immediate-blocking scope
The information control beside the switch explains that immediate blocking is
for protected system identities and service definitions. User home directories
remain audit-only by default and are enforced by BastionGuard Anti-Ransomware.
The helper writes `global_metadata_action = audit` and
`block_user_home = false` when the switch is changed from the GUI.
## Application rules
Routine desktop and browser applications may remain in `[trusted-applications]`
for compatibility with informational global events. Production filtering now
drops ordinary chmod/chown/ACL traffic before it reaches the UI. High-confidence
privilege metadata is never downgraded merely because the actor is a desktop
application. This list never grants privilege-transition trust and never bypasses
protected-path enforcement.
The other editors map to `[trusted-executables]` and `[denied-executables]`.
The UI presents the latter as **Blocked** while stating that it is a
privilege-transition policy, not a general application-launch blacklist. A
convenience button adds only installed known desktop/browser executables to the
trusted-applications editor for review before saving.
Saving rules performs these steps:
1. validate absolute paths and conflicts;
2. atomically rewrite the three policy sections while preserving ownership and
permissions;
3. validate the complete policy;
4. restart RootGuard;
5. refresh the page from the daemon's policy view.
## Event transparency
The page shows the event path, how that path was resolved, device/inode identity
when applicable, the actor executable and PID. A basename-only event is labelled
as such and Restore/Quarantine are disabled. Audit notifications contain only
**Acknowledge**; trusted events generate no popup.
## MainWindow
```cpp
#include "rootguard/RootGuardPage.hpp"
rootguard_page_ = Gtk::make_managed<RootGuardPage>();
stack_.add(*rootguard_page_, "rootguard");
```
## Native CMake integration
After the main `add_executable(BastionGuard ...)`:
```cmake
add_subdirectory(
"${CMAKE_SOURCE_DIR}/src/rootguard"
"${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
)
target_link_libraries(BastionGuard PRIVATE BastionGuard::RootGuardUI)
```
No `ExternalProject`, Meson stage or second installation pass is used.

69
src/rootguard/docs/INCIDENT_RESPONSE.md Normal file
View file

@ -0,0 +1,69 @@
# RootGuard incident response
## Immediate blocking
The GTK switch does not perform security enforcement itself. It atomically
updates the installed policy and reloads the daemon. In the enabled state the
kernel BPF LSM programs return `-EPERM` for protected metadata operations.
This design keeps enforcement active when BastionGuard is minimized or closed.
## Incident states
The page reads the JSONL event stream and displays the newest unresolved event
for each protected path. A later `file-restored`, `file-quarantined`, or
`integrity-restored` event closes the older incident in the page.
### Restore
Restore is allowed only when the current path still has the baseline device and
inode. The privileged helper opens it with `O_NOFOLLOW`, verifies it with
`fstat`, and applies owner/group and mode using `fchown` and `fchmod`.
For a systemd unit, restoration also removes its runtime mask. RootGuard does
not restart the service automatically.
### Remove
Remove is implemented as quarantine. The helper first stops a recognized
service, then atomically renames the file into:
```text
/var/lib/bastionguard/rootguard/quarantine
```
The quarantined file receives mode `0000`, and a sidecar manifest records its
original path, mode, owner, device, and inode. The GUI passes the protected
device/inode identity to the helper. A replaced OpenRC/SysV script is never
executed as root during quarantine; the page reports that its process may need
manual containment.
### Missing or replaced files
RootGuard deliberately does not copy protected file contents. Protected paths
can include `/etc/shadow`, PAM configuration, and other sensitive data for
which a broad userspace backup would create a second high-value secret store.
For a missing or replaced inode, the page disables metadata restoration.
Restore content through the package manager, an authenticated backup, or
configuration management; quarantine a replacement before restoration.
## System services
The daemon recognizes:
- systemd unit files and drop-ins under `/etc/systemd/system`,
`/usr/lib/systemd/system`, and `/lib/systemd/system`;
- OpenRC/SysV scripts under `/etc/init.d`;
- OpenRC service configuration under `/etc/conf.d`;
- dinit service definitions under `/etc/dinit.d` and `/usr/lib/dinit.d`.
The response runs in the daemon, not the GUI, and therefore remains active when
no desktop session is available.
## Init-script safety
A denied LSM event guarantees that the OpenRC/SysV script on disk was not
changed, so RootGuard can use the normal stop command. For an after-the-fact
integrity drift, RootGuard does not execute the affected OpenRC/SysV script as
root. It reports a service-block failure and leaves manual containment to the
administrator. systemd and dinit can stop the already loaded service without
executing the changed definition.

34
src/rootguard/docs/INIT_SYSTEMS.md Normal file
View file

@ -0,0 +1,34 @@
# Init-system integration
RootGuard ships native definitions for systemd, OpenRC, dinit and SysV init.
Select one explicitly for distribution packaging:
```bash
cmake -S . -B build -DROOTGUARD_INIT_SYSTEM=openrc
```
Accepted values are:
```text
auto systemd openrc dinit sysvinit none
```
The compatibility aliases `sysv` and `dninit` are normalized to `sysvinit` and
`dinit`. The canonical spelling is **dinit**.
For local builds, `auto` checks PID 1 first and then runtime markers. It does
not select systemd merely because a compatibility `systemctl` binary exists.
OpenRC and SysV definitions are never installed together because both own
`/etc/init.d/bastionguard-rootguard`.
All init definitions are also installed as samples below
`/usr/share/bastionguard-rootguard/init-samples/`.
The GTK client calls the multi-init controller:
```text
/usr/libexec/bastionguard/bastionguard-rootguard-service
```
Read-only status is unprivileged. Start, stop, restart and policy reload are
executed through `pkexec` and the bundled polkit action.

59
src/rootguard/docs/KERNEL_HARDENING.md Normal file
View file

@ -0,0 +1,59 @@
# Hardening del kernel attorno a RootGuard
RootGuard è un livello di enforcement e telemetria, non una nuova radice di
fiducia. Un attaccante che controlla completamente il kernel può tentare di
rimuovere i link BPF, falsificare le letture VFS o modificare direttamente le
mappe. La VM di collaudo dovrebbe quindi separare tre livelli.
## 1. Prevenzione della modifica del kernel
- avvio verificato con Secure Boot quando disponibile;
- kernel lockdown in modalità `integrity` o `confidentiality`;
- verifica obbligatoria delle firme dei moduli;
- disabilitazione definitiva del caricamento moduli soltanto su immagini in cui
tutti i driver necessari sono già caricati;
- BPF non privilegiato disabilitato.
Verifiche non invasive:
```sh
cat /sys/kernel/security/lockdown 2>/dev/null || true
cat /proc/sys/kernel/unprivileged_bpf_disabled 2>/dev/null || true
cat /proc/sys/kernel/module_sig_enforce 2>/dev/null || true
cat /sys/module/module/parameters/sig_enforce 2>/dev/null || true
```
## 2. Integrità di file e metadati
RootGuard protegge gli inode mentre il sistema è in esecuzione. Per aggiungere
una radice crittografica:
- IMA appraisal verifica contenuto o firma dei file secondo policy;
- EVM protegge i metadati di sicurezza, inclusi gli xattr coperti dalla policy;
- fs-verity è adatto a file immutabili verificati individualmente;
- dm-verity è adatto a immagini o filesystem di sola lettura.
L'attivazione di IMA/EVM non va improvvisata su una macchina reale: policy,
chiavi, initramfs e xattr devono essere preparati prima, altrimenti il sistema
può non avviarsi. Il primo collaudo va svolto in una VM con snapshot.
## 3. RootGuard
RootGuard aggiunge:
- controllo delle transizioni verso EUID 0;
- sentinel di provenienza consultata da `capable`, `inode_permission`,
`file_open` e dagli hook di modifica dei metadati;
- blocco delle modifiche a mode, owner, ACL e xattr di sicurezza sugli inode
protetti;
- policy separata per bloccare globalmente aggiunte setuid/setgid, cambi di
owner verso root e `security.capability`;
- blocco di unlink, rename e hardlink sugli inode protetti, con espansione
ricorsiva opzionale delle directory senza seguire symlink;
- confronto periodico della baseline dal daemon, utile per rilevare drift
ancora visibile anche quando il percorso LSM è stato aggirato;
- caricamento della policy da un unico file descriptor `O_NOFOLLOW`, con
controllo ownership/mode e verifica che il file non cambi durante la lettura.
La combinazione è intenzionalmente ridondante: un singolo bypass non deve
eliminare ogni segnale.

40
src/rootguard/docs/UPGRADE_2_5_0.md Normal file
View file

@ -0,0 +1,40 @@
# Upgrade to RootGuard 2.5.0
RootGuard 2.5.0 changes the shared BPF/userspace event ABI. Rebuild and install
the daemon, generated BPF object, action helper and GTK page together. Do not
mix 2.4 binaries with the 2.5 BPF object.
From the BastionGuard source root:
```bash
sudo cp -a /etc/bastionguard/rootguard.conf \
/var/tmp/rootguard.conf.before-2.5.0
cmake -S . -B build
cmake --build build --target bastionguard-rootguard \
bastionguard-rootguard-action BastionGuard -j"$(nproc)"
sudo cmake --install build
```
The installer preserves an existing `rootguard.conf`. The new packaged
reference is available at:
```text
/etc/bastionguard/rootguard.conf.default
```
Restart the service using the active init system. For systemd:
```bash
sudo systemctl reset-failed bastionguard-rootguard.service
sudo systemctl restart bastionguard-rootguard.service
sudo systemctl status bastionguard-rootguard.service --no-pager
```
Open RootGuardPage, select **Application rules**, use **Add installed
desktop/browser defaults**, review the detected paths, then select **Save rules
and restart RootGuard**.
The UI save operation adds `[trusted-applications]`,
`[trusted-executables]` and `[denied-executables]` as needed. Existing policy
sections outside those three are preserved.

25
src/rootguard/docs/USER_HOME_AND_APPLICATION_TRUST.md Normal file
View file

@ -0,0 +1,25 @@
# User home and application trust
RootGuard observes metadata changes globally, but user home directories are
high-churn environments. Browsers, desktop shells, file managers, package
sandboxes and applications routinely create, rename and chmod cache, profile,
socket, lock and journal files.
The default split is therefore:
- global home activity: audit;
- trusted desktop/browser actors: logged as trusted, no popup;
- protected system paths: enforceable by RootGuard;
- user-data content protection: BastionGuard Anti-Ransomware.
Do not place a browser or desktop environment in `[trusted-executables]` merely
to reduce event noise. That section participates in privilege-transition
policy. Use `[trusted-applications]` instead.
An entry is resolved to the executable's device/inode at policy load. Package
upgrades can replace that inode, which is why saving from the UI restarts the
service and why a policy reload/restart is required after relevant application
updates.
Trusted applications do not bypass `[protected-paths]`: only rule-zero global
surveillance events are reclassified as trusted.

65
src/rootguard/docs/VALIDATION_STATUS.md Normal file
View file

@ -0,0 +1,65 @@
# Validation status — RootGuard 2.5.3
Validated in the artifact environment:
- CMake configure, build and CTest with daemon and GTK components disabled;
- `rootguard-policy-tests`, including trusted-application parsing and conflict
validation;
- `rootguard-file-identity-tests`;
- `rootguard-event-tests`, including actor and path-resolution fields;
- warning-enabled C++17 syntax checks for the daemon engine with generated
libbpf/skeleton stubs;
- warning-enabled C++17 syntax checks for the action helper, service response,
JSON sink, client and tabbed GTK page;
- action-helper atomic policy rewrite for trusted, privilege-trusted and denied
application rules;
- CMake staged installation preserving an existing `rootguard.conf`;
- CMake configuration for systemd, OpenRC, dinit, SysV init and `none`;
- shell syntax for helper and init scripts;
- XML parsing of the polkit policy.
Target-system validation still required:
- generation of `vmlinux.h` from the target kernel BTF;
- Clang BPF compilation, bpftool skeleton generation and verifier acceptance;
- full GTK4/gtkmm compilation inside the BastionGuard source tree;
- live path-resolution timing under desktop and browser workloads;
- polkit authorization and service restart from RootGuardPage;
- service containment on each supported init system;
- boot, package upgrade and Anti-Ransomware coexistence tests before immediate
protection is enabled in production.
## 2.5.6 desktop incident triage
The 2.5.6 source keeps the 2.5.4/2.5.5 production emission filter, but separates
what is recorded from what interrupts the desktop user. Global privilege metadata
is classified as Telemetry, Observation or Incident. Only direct/high-signal
transitions create popup incidents; lower-confidence global events remain visible
as observations. Protected-path semantics are unchanged. Xattr events now carry
the target inode mode and parses the LSM operation flag so `security.capability`
additions/replacements are promoted only when the target is executable; removals
remain observations.
## 2.5.4 production filtering
The 2.5.4 source narrows global metadata emission to privilege-relevant
transitions and adds a UI-side compatibility filter so historical broad-audit
records cannot create incident popup storms. Protected-path semantics are
unchanged.
## 2.5.7 adaptive desktop guard
Global metadata remains enabled, but eBPF now samples only a bounded number of
high-signal records per execution-domain window and counts destructive
permission/ownership storms without emitting one record per operation. The
domain combines cgroup with actor/parent executable identity so unrelated
desktop processes do not share a cooldown. A threshold crossing emits one
`RG_REASON_METADATA_BURST` record and then observes a kernel cooldown. Explicit
protected identities bypass sampling and retain their original block/audit
semantics. The GTK layer treats normal global records as observations, limits
burst popups, and prioritizes protected/service incidents.
The C++ policy, file-identity and event-classification test suites pass in a
daemon/GTK-disabled CMake build. Full eBPF verifier/load and GTK linkage still
require a target Linux host with kernel BTF, libbpf/bpftool and gtkmm-4.0.

147
src/rootguard/docs/VM_TESTING.md Normal file
View file

@ -0,0 +1,147 @@
# Piano di prova VM
Creare uno snapshot prima di iniziare e mantenere aperta una console root.
## 1. Prerequisiti
Servono Clang con target BPF, bpftool, libbpf, libelf, zlib, pkg-config, g++ e
make. Il kernel della VM deve esporre `/sys/kernel/btf/vmlinux` e avere BPF LSM
abilitato.
```sh
./scripts/check-environment.sh
```
Nell'elenco `/sys/kernel/security/lsm` deve comparire `bpf`. Lo script mostra
anche lockdown, BPF non privilegiato, firma moduli, IMA/EVM e fs-verity: i primi
requisiti sono bloccanti, gli altri sono avvisi di hardening.
## 2. Build e test parser
```sh
make test
make
```
## 3. Installazione policy sicura
```sh
sudo install -d -m 0755 /etc/bastionguard /var/log/bastionguard
sudo install -o root -g root -m 0600 config/rootguard.conf \
/etc/bastionguard/rootguard.conf
```
## 4. Prima esecuzione: audit
```sh
sudo ./build/bastionguard-rootguard \
--policy /etc/bastionguard/rootguard.conf
```
Eseguire normali operazioni `sudo`, `su` o `pkexec` e verificare che siano
classificate come `TRUSTED`.
## 5. Probe setuid innocuo
```sh
sudo ./scripts/prepare-vm-probe.sh
/opt/bastionguard-rootguard-test/unknown-setuid-test
```
In audit deve comparire un evento `AUDIT` per eseguibile sconosciuto.
## 6. Probe dei metadati
```sh
sudo ./scripts/prepare-metadata-probe.sh
```
Aggiungere alla policy e ricaricare:
```ini
[protected-paths]
required_path = /opt/bastionguard-rootguard-test/protected-metadata.txt
# Per testare anche l'espansione di directory:
recursive_path = /opt/bastionguard-rootguard-test
```
In audit, questi comandi devono riuscire ma produrre eventi:
```sh
sudo chmod 0666 /opt/bastionguard-rootguard-test/protected-metadata.txt
sudo chmod 0644 /opt/bastionguard-rootguard-test/protected-metadata.txt
sudo chown nobody:nobody /opt/bastionguard-rootguard-test/protected-metadata.txt
sudo chown root:root /opt/bastionguard-rootguard-test/protected-metadata.txt
sudo ln /opt/bastionguard-rootguard-test/protected-metadata.txt \
/opt/bastionguard-rootguard-test/protected-metadata.link
sudo rm -f /opt/bastionguard-rootguard-test/protected-metadata.link
```
Il controllo periodico deve inoltre produrre `integrity-drift` dopo una modifica
e `integrity-restored` quando mode e owner tornano alla baseline. Creare un nuovo
file dentro una directory ricorsiva richiede un reload per inserirne il nuovo
inode nella baseline; prima del reload resta coperto soltanto il monitoraggio
globale dei metadati privilegiati.
## 7. Enforcement
Dopo avere ripristinato baseline e policy:
```ini
mode = enforce
unknown_action = block
metadata_action = block
global_metadata_action = block
credential_anomaly_action = block
```
Ricaricare con `SIGHUP`. Il probe setuid sconosciuto deve fallire con `EPERM`.
Sul file protetto, `chmod`, `chown`, `setfacl`, `setcap`, `rm`, `mv` e la
creazione di hardlink devono essere rifiutati quando attraversano gli hook
coperti. `sudo` e gli altri eseguibili trusted devono continuare a funzionare.
## 8. Aggiornamenti e recovery
Prima di aggiornare pacchetti che sostituiscono file protetti:
1. portare `metadata_action`, `global_metadata_action` e, preferibilmente,
`mode` in audit;
2. ricaricare la policy;
3. eseguire l'aggiornamento;
4. ricaricare nuovamente la policy per acquisire i nuovi inode;
5. riattivare l'enforcement.
In caso di policy errata:
```sh
sudo systemctl stop bastionguard-rootguard
```
La chiusura del daemon distrugge i link BPF e rimuove l'enforcement.
## 9. Test controllato della corruzione credenziali
Usare soltanto una VM isolata e sacrificabile, senza rete o dati reali. Con un
PoC già noto e mantenuto privatamente dal ricercatore, verificare separatamente:
1. audit: il task nasce non-root, appare UID/EUID 0 senza transizione riconosciuta
e deve produrre `credential-anomaly`;
2. enforcement: il primo uso di una capability, apertura/controllo permessi o
modifica dei metadati deve ricevere `EPERM`;
3. controllare che PID/TGID/PPID, UID baseline, operazione e inode siano nel log;
4. ripetere con `credential_anomaly_action=audit` per distinguere detection da
prevention;
5. misurare latenza e overhead di `inode_permission` sotto carico I/O.
Non esiste un test generico sicuro che dimostri resistenza a ogni exploit kernel.
Un exploit con scrittura arbitraria può manomettere RootGuard, le mappe BPF o i
risultati restituiti al daemon; i risultati devono quindi indicare il PoC, il
kernel, la configurazione e gli hook effettivamente attraversati.
## 10. Test di manomissione fuori dagli hook
Per simulare la parte rilevabile dal controllo periodico, fermare temporaneamente
RootGuard, modificare mode/owner o sostituire un file di prova, quindi riavviare
con la stessa baseline solo in audit. Il daemon deve produrre
`integrity-drift`. Questo test verifica il rilevamento userspace, non dimostra
che una scrittura arbitraria nel kernel non possa falsificare `stat(2)`.

51
src/rootguard/include/rootguard/AutomaticResponseSink.hpp Normal file
View file

@ -0,0 +1,51 @@
#pragma once
#include "rootguard/IEventSink.hpp"
#include <atomic>
#include <condition_variable>
#include <deque>
#include <filesystem>
#include <mutex>
#include <set>
#include <string>
#include <thread>
namespace bastionguard::rootguard {
class AutomaticResponseSink final : public IEventSink {
public:
explicit AutomaticResponseSink(IEventSink& downstream,
bool autoBlockSystemServices);
~AutomaticResponseSink() override;
AutomaticResponseSink(const AutomaticResponseSink&) = delete;
AutomaticResponseSink& operator=(const AutomaticResponseSink&) = delete;
void onEvent(const rg_event& event) noexcept override;
void setAutoBlockSystemServices(bool enabled) noexcept;
private:
void workerLoop() noexcept;
void enqueueService(const std::filesystem::path& path,
const rg_event& source) noexcept;
void emitServiceResult(const std::filesystem::path& path,
const rg_event& source,
bool success) noexcept;
struct PendingService {
std::filesystem::path path;
rg_event source{};
};
IEventSink& downstream_;
std::atomic<bool> autoBlockSystemServices_{true};
std::mutex mutex_;
std::condition_variable condition_;
std::deque<PendingService> queue_;
std::set<std::string> queuedPaths_;
bool stopping_{};
std::thread worker_;
};
} // namespace bastionguard::rootguard

16
src/rootguard/include/rootguard/ConsoleEventSink.hpp Normal file
View file

@ -0,0 +1,16 @@
#pragma once
#include "rootguard/IEventSink.hpp"
namespace bastionguard::rootguard {
class ConsoleEventSink final : public IEventSink {
public:
void onEvent(const rg_event& event) noexcept override;
private:
static const char* eventName(__u32 type) noexcept;
static const char* verdictName(__u32 verdict) noexcept;
};
} // namespace bastionguard::rootguard

30
src/rootguard/include/rootguard/FileIdentity.hpp Normal file
View file

@ -0,0 +1,30 @@
#pragma once
#include <cstdint>
#include <filesystem>
#include <sys/types.h>
#include "rootguard/rootguard_shared.h"
namespace bastionguard::rootguard {
struct FileIdentity {
rg_file_key key{};
std::filesystem::path canonicalPath;
std::uint32_t mode{};
std::uint32_t uid{};
std::uint32_t gid{};
bool regularFile{};
bool directory{};
};
class FileIdentityResolver final {
public:
[[nodiscard]] static __u64 kernelDeviceNumber(dev_t encodedDevice);
[[nodiscard]] static FileIdentity resolve(
const std::filesystem::path& path,
bool requireRegularFile,
bool requireRootOwnedAndNotWritable);
};
} // namespace bastionguard::rootguard

13
src/rootguard/include/rootguard/IEventSink.hpp Normal file
View file

@ -0,0 +1,13 @@
#pragma once
#include "rootguard/rootguard_shared.h"
namespace bastionguard::rootguard {
class IEventSink {
public:
virtual ~IEventSink() = default;
virtual void onEvent(const rg_event& event) noexcept = 0;
};
} // namespace bastionguard::rootguard

23
src/rootguard/include/rootguard/JsonEventSink.hpp Normal file
View file

@ -0,0 +1,23 @@
#pragma once
#include <filesystem>
#include <fstream>
#include <mutex>
#include <string>
#include "rootguard/IEventSink.hpp"
namespace bastionguard::rootguard {
class JsonEventSink final : public IEventSink {
public:
explicit JsonEventSink(const std::filesystem::path& path);
void onEvent(const rg_event& event) noexcept override;
private:
static std::string escape(const char* value);
std::ofstream stream_;
std::mutex mutex_;
};
} // namespace bastionguard::rootguard

18
src/rootguard/include/rootguard/MultiEventSink.hpp Normal file
View file

@ -0,0 +1,18 @@
#pragma once
#include <functional>
#include <vector>
#include "rootguard/IEventSink.hpp"
namespace bastionguard::rootguard {
class MultiEventSink final : public IEventSink {
public:
void add(IEventSink& sink);
void onEvent(const rg_event& event) noexcept override;
private:
std::vector<std::reference_wrapper<IEventSink>> sinks_;
};
} // namespace bastionguard::rootguard

65
src/rootguard/include/rootguard/Policy.hpp Normal file
View file

@ -0,0 +1,65 @@
#pragma once
#include <cstdint>
#include <filesystem>
#include <string>
#include <vector>
namespace bastionguard::rootguard {
enum class Mode : std::uint32_t {
Audit = 0,
Enforce = 1,
};
enum class Action : std::uint32_t {
Audit = 0,
Block = 1,
};
struct PolicyPath {
std::uint32_t id{};
std::filesystem::path path;
bool required{};
bool recursive{};
};
struct Policy {
std::uint32_t version{2};
Mode mode{Mode::Audit};
Action unknownAction{Action::Audit};
Action metadataAction{Action::Audit};
Action globalMetadataAction{Action::Audit};
Action credentialAnomalyAction{Action::Audit};
bool allowMissingPaths{true};
bool requireRootOwnedTrustedExecutables{true};
bool protectTrustedExecutables{true};
// Direct privilege primitives stay visible, but the eBPF source samples them
// per execution domain so backup/restore work cannot fill the ring buffer.
bool monitorGlobalPrivilegeMetadata{true};
// Count only destructive unprotected permission/ownership patterns inside the
// kernel and emit one aggregate signal instead of one popup per file.
bool detectGlobalMetadataBursts{true};
std::uint32_t globalMetadataSampleLimit{3};
std::uint32_t metadataBurstThreshold{32};
std::uint32_t metadataBurstWindowMs{5000};
std::uint32_t metadataBurstCooldownMs{300000};
// Suppress unprotected global metadata noise below /run. Protected identities
// and credential/privilege-transition checks always take precedence.
bool ignoreRunGlobalMetadata{true};
bool logTrusted{true};
bool autoBlockSystemServices{true};
bool blockUserHome{false};
std::uint32_t integrityPollSeconds{5};
std::filesystem::path eventLog{"/var/log/bastionguard/rootguard-events.jsonl"};
std::vector<PolicyPath> trustedApplications;
std::vector<PolicyPath> trustedExecutables;
std::vector<PolicyPath> deniedExecutables;
std::vector<PolicyPath> protectedPaths;
std::vector<PolicyPath> ignoredPaths;
};
[[nodiscard]] const char* toString(Mode mode) noexcept;
[[nodiscard]] const char* toString(Action action) noexcept;
} // namespace bastionguard::rootguard

17
src/rootguard/include/rootguard/PolicyLoader.hpp Normal file
View file

@ -0,0 +1,17 @@
#pragma once
#include <filesystem>
#include <string>
#include "rootguard/Policy.hpp"
namespace bastionguard::rootguard {
class PolicyLoader final {
public:
[[nodiscard]] static Policy load(const std::filesystem::path& path);
[[nodiscard]] static Policy loadFromText(
const std::string& content,
const std::filesystem::path& source = "<memory>");
};
} // namespace bastionguard::rootguard

20
src/rootguard/include/rootguard/PolicySecurity.hpp Normal file
View file

@ -0,0 +1,20 @@
#pragma once
#include <filesystem>
#include <string>
namespace bastionguard::rootguard {
class PolicySecurity final {
public:
/*
* Opens the policy with O_NOFOLLOW, validates the already-open descriptor
* and reads from that same descriptor. This removes the validate/open
* time-of-check/time-of-use window.
*/
[[nodiscard]] static std::string read(
const std::filesystem::path& path,
bool requireSecureOwnership);
};
} // namespace bastionguard::rootguard

115
src/rootguard/include/rootguard/RootGuardEngine.hpp Normal file
View file

@ -0,0 +1,115 @@
#pragma once
#include <chrono>
#include <cstddef>
#include <cstdint>
#include <filesystem>
#include <memory>
#include <string>
#include <unordered_set>
#include <vector>
#include <sys/stat.h>
#include "rootguard/IEventSink.hpp"
#include "rootguard/Policy.hpp"
#include "rootguard/rootguard_shared.h"
struct ring_buffer;
struct rootguard_bpf;
namespace bastionguard::rootguard {
struct PolicyApplyReport {
std::size_t trustedApplicationsLoaded{};
std::size_t trustedLoaded{};
std::size_t deniedLoaded{};
std::size_t protectedLoaded{};
std::vector<std::string> warnings;
};
class RootGuardEngine final {
public:
explicit RootGuardEngine(IEventSink& sink) noexcept;
~RootGuardEngine();
RootGuardEngine(const RootGuardEngine&) = delete;
RootGuardEngine& operator=(const RootGuardEngine&) = delete;
RootGuardEngine(RootGuardEngine&&) = delete;
RootGuardEngine& operator=(RootGuardEngine&&) = delete;
[[nodiscard]] PolicyApplyReport start(const Policy& policy);
[[nodiscard]] PolicyApplyReport reloadPolicy(const Policy& policy);
void enterAuditMode();
int pollOnce(int timeoutMilliseconds) noexcept;
void runIntegrityCheckIfDue() noexcept;
void authorizeProcess(std::uint32_t tgid,
std::uint32_t targetEuid,
std::chrono::milliseconds ttl,
std::uint32_t issuerPid);
private:
struct SkeletonDeleter {
void operator()(rootguard_bpf* value) const noexcept;
};
struct RingBufferDeleter {
void operator()(ring_buffer* value) const noexcept;
};
struct ProtectedSnapshot {
std::filesystem::path path;
rg_file_key key{};
std::uint32_t ruleId{};
std::uint32_t mode{};
std::uint32_t uid{};
std::uint32_t gid{};
bool drifted{};
std::uint32_t lastReasons{};
};
using SkeletonPtr = std::unique_ptr<rootguard_bpf, SkeletonDeleter>;
using RingBufferPtr = std::unique_ptr<ring_buffer, RingBufferDeleter>;
static int handleEvent(void* context, void* data, std::size_t size) noexcept;
[[nodiscard]] bool shouldIgnoreEvent(const rg_event& event) const noexcept;
[[nodiscard]] bool enrichEventPath(rg_event& event) const noexcept;
[[nodiscard]] bool enrichActorExecutable(rg_event& event) const noexcept;
[[nodiscard]] bool isTrustedApplicationEvent(const rg_event& event) const noexcept;
[[nodiscard]] PolicyApplyReport applyPolicy(const Policy& policy);
void setKernelConfig(Mode mode,
Action unknownAction,
bool logTrusted,
Action metadataAction,
Action globalMetadataAction,
Action credentialAction,
bool monitorGlobalPrivilegeMetadata,
bool ignoreRunGlobalMetadata,
bool detectGlobalMetadataBursts,
std::uint32_t globalMetadataSampleLimit,
std::uint32_t metadataBurstThreshold,
std::uint32_t metadataBurstWindowMs,
std::uint32_t metadataBurstCooldownMs);
static void clearMap(int mapFd);
void emitIntegrityEvent(ProtectedSnapshot& snapshot,
std::uint32_t eventType,
std::uint32_t verdict,
std::uint32_t reasons,
const struct stat* current) noexcept;
IEventSink& sink_;
SkeletonPtr skeleton_;
RingBufferPtr ringBuffer_;
std::vector<ProtectedSnapshot> protectedSnapshots_;
std::vector<PolicyPath> ignoredPaths_;
std::unordered_set<std::string> trustedApplicationKeys_;
std::unordered_set<std::string> trustedApplicationPaths_;
std::unordered_set<std::string> ignoredExactNames_;
bool logTrusted_{true};
bool blockUserHome_{false};
bool ignoreRunGlobalMetadata_{true};
std::chrono::seconds integrityInterval_{0};
std::chrono::steady_clock::time_point nextIntegrityCheck_{};
};
} // namespace bastionguard::rootguard

38
src/rootguard/include/rootguard/SystemServiceControl.hpp Normal file
View file

@ -0,0 +1,38 @@
#pragma once
#include <filesystem>
#include <optional>
#include <string>
#include <vector>
namespace bastionguard::rootguard {
enum class InitSystem {
None,
Systemd,
OpenRC,
Dinit,
SysVInit,
};
struct ServiceTarget {
InitSystem init{InitSystem::None};
std::string name;
std::filesystem::path definition;
};
struct ServiceActionResult {
bool success{};
std::string message;
};
[[nodiscard]] InitSystem detectInitSystem() noexcept;
[[nodiscard]] const char* toString(InitSystem init) noexcept;
[[nodiscard]] std::optional<ServiceTarget>
identifySystemService(const std::filesystem::path& path) noexcept;
[[nodiscard]] ServiceActionResult
blockSystemService(const std::filesystem::path& path) noexcept;
[[nodiscard]] ServiceActionResult
unblockSystemService(const std::filesystem::path& path) noexcept;
} // namespace bastionguard::rootguard

188
src/rootguard/include/rootguard/rootguard_shared.h Normal file
View file

@ -0,0 +1,188 @@
#ifndef BASTIONGUARD_ROOTGUARD_SHARED_H
#define BASTIONGUARD_ROOTGUARD_SHARED_H
#ifndef __VMLINUX_H__
#include <linux/types.h>
#endif
#define RG_COMM_LEN 16
#define RG_FILENAME_LEN 256
#define RG_XATTR_NAME_LEN 32
#define RG_POLICY_ABI_VERSION 7U
enum rg_event_type {
RG_EVENT_SETUID = 1,
RG_EVENT_EXEC_PRIV = 2,
RG_EVENT_CREDENTIAL_ANOMALY = 3,
RG_EVENT_PERMISSION_CHANGE = 4,
RG_EVENT_OWNER_CHANGE = 5,
RG_EVENT_XATTR_CHANGE = 6,
RG_EVENT_ACL_CHANGE = 7,
RG_EVENT_PROTECTED_UNLINK = 8,
RG_EVENT_PROTECTED_RENAME = 9,
RG_EVENT_PROTECTED_HARDLINK = 10,
RG_EVENT_INTEGRITY_DRIFT = 11,
RG_EVENT_INTEGRITY_RESTORED = 12,
RG_EVENT_SERVICE_BLOCKED = 13,
RG_EVENT_FILE_RESTORED = 14,
RG_EVENT_FILE_QUARANTINED = 15,
RG_EVENT_PROTECTION_MODE_CHANGED = 16,
};
enum rg_verdict {
RG_VERDICT_AUDIT = 0,
RG_VERDICT_AUTHORIZED = 1,
RG_VERDICT_BLOCKED = 2,
RG_VERDICT_TRUSTED = 3,
RG_VERDICT_ALERT = 4,
RG_VERDICT_RESTORED = 5,
};
enum rg_kernel_mode {
RG_MODE_AUDIT = 0,
RG_MODE_ENFORCE = 1,
};
enum rg_action {
RG_ACTION_AUDIT = 0,
RG_ACTION_BLOCK = 1,
};
enum rg_reason_flags {
RG_REASON_NONE = 0,
RG_REASON_AUTH_TOKEN = 1U << 0,
RG_REASON_TRUSTED_EXEC = 1U << 1,
RG_REASON_DENIED_EXEC = 1U << 2,
RG_REASON_UNKNOWN_EXEC = 1U << 3,
RG_REASON_FILE_ID_UNAVAILABLE = 1U << 4,
RG_REASON_DIRECT_CRED_ANOMALY = 1U << 5,
RG_REASON_PROTECTED_MODE = 1U << 6,
RG_REASON_PROTECTED_OWNER = 1U << 7,
RG_REASON_SECURITY_CAPABILITY = 1U << 8,
RG_REASON_INTEGRITY_XATTR = 1U << 9,
RG_REASON_SECURITY_LABEL = 1U << 10,
RG_REASON_PROTECTED_ACL = 1U << 11,
RG_REASON_PROTECTED_UNLINK = 1U << 12,
RG_REASON_PROTECTED_RENAME = 1U << 13,
RG_REASON_PROTECTED_HARDLINK = 1U << 14,
RG_REASON_SETID_ADDED = 1U << 15,
RG_REASON_OWNER_TO_ROOT = 1U << 16,
RG_REASON_GLOBAL_METADATA = 1U << 17,
RG_REASON_BASELINE_MODE_MISMATCH = 1U << 18,
RG_REASON_BASELINE_OWNER_MISMATCH = 1U << 19,
RG_REASON_BASELINE_FILE_REPLACED = 1U << 20,
RG_REASON_PROTECTED_MISSING = 1U << 21,
RG_REASON_GLOBAL_SURVEILLANCE = 1U << 22,
/* High-confidence global signal: a root-owned object gained group/other write access. */
RG_REASON_ROOT_OWNED_WRITE_EXPOSURE = 1U << 23,
/* Aggregated signal: many chmod/chown operations from one cgroup in a short window. */
RG_REASON_METADATA_BURST = 1U << 24,
};
enum rg_path_resolution {
RG_PATH_BASENAME = 0,
RG_PATH_PROTECTED_BASELINE = 1,
RG_PATH_PROC_FD = 2,
RG_PATH_PROCESS_CWD = 3,
RG_PATH_KERNEL_EXACT = 4,
RG_PATH_LSM_EXACT = 5,
};
enum rg_protection_flags {
RG_PROTECT_MODE = 1U << 0,
RG_PROTECT_OWNER = 1U << 1,
RG_PROTECT_CAPABILITY_XATTR = 1U << 2,
RG_PROTECT_INTEGRITY_XATTR = 1U << 3,
RG_PROTECT_SECURITY_LABEL = 1U << 4,
RG_PROTECT_ACL = 1U << 5,
RG_PROTECT_UNLINK = 1U << 6,
RG_PROTECT_RENAME = 1U << 7,
RG_PROTECT_HARDLINK = 1U << 8,
/* Never enforce this identity; it remains audit-only (normally user home). */
RG_PROTECT_AUDIT_ONLY = 1U << 31,
};
#define RG_PROTECT_DEFAULT \
(RG_PROTECT_MODE | RG_PROTECT_OWNER | RG_PROTECT_CAPABILITY_XATTR | \
RG_PROTECT_INTEGRITY_XATTR | RG_PROTECT_SECURITY_LABEL | \
RG_PROTECT_ACL | RG_PROTECT_UNLINK | RG_PROTECT_RENAME | \
RG_PROTECT_HARDLINK)
struct rg_file_key {
__u64 device;
__u64 inode;
};
struct rg_rule_value {
__u32 rule_id;
__u32 flags;
};
struct rg_protected_value {
__u32 rule_id;
__u32 flags;
__u32 baseline_mode;
__u32 baseline_uid;
__u32 baseline_gid;
__u32 reserved;
};
struct rg_kernel_config {
__u32 abi_version;
__u32 mode;
__u32 unknown_action;
__u32 log_trusted;
__u32 metadata_action;
__u32 credential_action;
__u32 monitor_global_privilege_metadata;
__u32 global_metadata_action;
__u32 ignore_run_global_metadata;
__u32 detect_global_metadata_bursts;
__u32 global_metadata_sample_limit;
__u32 metadata_burst_threshold;
__u32 metadata_burst_window_ms;
__u32 metadata_burst_cooldown_ms;
};
struct rg_event {
__u64 timestamp_ns;
__u32 pid;
__u32 tgid;
__u32 ppid;
__u32 old_euid;
__u32 new_euid;
__u32 event_type;
__u32 verdict;
__u32 reason_flags;
__u32 rule_id;
__s32 lsm_flags;
__u32 auxiliary;
__u32 path_resolution;
__u32 reserved_event;
struct rg_file_key file;
struct rg_file_key actor_file;
struct rg_file_key parent_file;
__u64 actor_start_boottime_ns;
__u32 old_mode;
__u32 new_mode;
__u32 old_uid;
__u32 new_uid;
__u32 old_gid;
__u32 new_gid;
char comm[RG_COMM_LEN];
char parent_comm[RG_COMM_LEN];
char filename[RG_FILENAME_LEN];
char actor_executable[RG_FILENAME_LEN];
char parent_executable[RG_FILENAME_LEN];
char xattr_name[RG_XATTR_NAME_LEN];
};
/* One-shot authorization token for a future PAM/polkit/sudo bridge. */
struct rg_auth_token {
__u64 expires_ns;
__u32 target_euid;
__u32 issuer_pid;
};
#endif

7
src/rootguard/packaging/dinit/bastionguard-rootguard Normal file
View file

@ -0,0 +1,7 @@
type = process
command = /usr/libexec/bastionguard/bastionguard-rootguard --policy /etc/bastionguard/rootguard.conf
restart = on-failure
smooth-recovery = true
restart-delay = 2
stop-timeout = 10
@meta enable-via boot

32
src/rootguard/packaging/openrc/bastionguard-rootguard Executable file
View file

@ -0,0 +1,32 @@
#!/sbin/openrc-run
name="BastionGuard RootGuard"
description="Privilege-escalation and metadata-integrity monitor"
supervisor="supervise-daemon"
command="/usr/libexec/bastionguard/bastionguard-rootguard"
command_args="--policy /etc/bastionguard/rootguard.conf"
pidfile="/run/${RC_SVCNAME}.pid"
respawn_delay=2
respawn_max=0
output_logger="logger -t ${RC_SVCNAME}"
error_logger="logger -t ${RC_SVCNAME}"
start_pre() {
checkpath --directory --mode 0755 /var/log/bastionguard
[ -r /sys/kernel/btf/vmlinux ] || {
eerror "Kernel BTF is unavailable: /sys/kernel/btf/vmlinux"
return 1
}
}
reload() {
ebegin "Reloading BastionGuard RootGuard policy"
start-stop-daemon --signal HUP --pidfile "${pidfile}"
eend $?
}
depend() {
need localmount
after bootmisc
}

2
src/rootguard/packaging/openrc/bastionguard-rootguard.conf Normal file
View file

@ -0,0 +1,2 @@
# Override command_args or supervise_daemon_args here when required.
# command_args="--policy /etc/bastionguard/rootguard.conf"

32
src/rootguard/packaging/polkit/org.bastionguard.rootguard.policy Normal file
View file

@ -0,0 +1,32 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>
<vendor>BastionGuard</vendor>
<vendor_url>https://www.bastionguard.eu/</vendor_url>
<action id="org.bastionguard.rootguard.manage">
<description>Manage the BastionGuard RootGuard service</description>
<message>Authentication is required to manage BastionGuard RootGuard</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.exec.path">/usr/libexec/bastionguard/bastionguard-rootguard-service</annotate>
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
</action>
<action id="org.bastionguard.rootguard.respond">
<description>Manage BastionGuard RootGuard policy and incident response</description>
<message>Authentication is required to save RootGuard rules or act on a protected system file</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.exec.path">/usr/libexec/bastionguard/bastionguard-rootguard-action</annotate>
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
</action>
</policyconfig>

27
src/rootguard/packaging/systemd/bastionguard-rootguard.service Normal file
View file

@ -0,0 +1,27 @@
[Unit]
Description=BastionGuard RootGuard privilege-escalation and metadata-integrity monitor
Documentation=file:/usr/share/doc/bastionguard-rootguard/README.md
After=local-fs.target
ConditionPathExists=/sys/kernel/btf/vmlinux
[Service]
Type=simple
ExecStart=/usr/libexec/bastionguard/bastionguard-rootguard --policy /etc/bastionguard/rootguard.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=2
LimitMEMLOCK=infinity
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=read-only
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
RestrictSUIDSGID=yes
LockPersonality=yes
ReadWritePaths=/var/log/bastionguard
[Install]
WantedBy=multi-user.target

77
src/rootguard/packaging/sysvinit/bastionguard-rootguard Executable file
View file

@ -0,0 +1,77 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: bastionguard-rootguard
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: BastionGuard RootGuard security monitor
# Description: Monitors anomalous root transitions and protected metadata.
### END INIT INFO
PATH=/sbin:/usr/sbin:/bin:/usr/bin
NAME=bastionguard-rootguard
DAEMON=/usr/libexec/bastionguard/bastionguard-rootguard
PIDFILE=/run/$NAME.pid
POLICY=/etc/bastionguard/rootguard.conf
DESC="BastionGuard RootGuard"
DAEMON_ARGS="--policy $POLICY"
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
is_running() {
[ -r "$PIDFILE" ] || return 1
pid=$(cat "$PIDFILE" 2>/dev/null) || return 1
kill -0 "$pid" 2>/dev/null
}
start_service() {
if is_running; then
echo "$DESC is already running."
return 0
fi
install -d -m 0755 /run /var/log/bastionguard
start-stop-daemon --start --quiet --background --make-pidfile \
--pidfile "$PIDFILE" --exec "$DAEMON" -- $DAEMON_ARGS
}
stop_service() {
start-stop-daemon --stop --quiet --retry=TERM/10/KILL/5 \
--remove-pidfile --pidfile "$PIDFILE" --exec "$DAEMON" || true
}
case "${1:-}" in
start)
echo "Starting $DESC"
start_service
;;
stop)
echo "Stopping $DESC"
stop_service
;;
restart|force-reload)
stop_service
start_service
;;
reload)
if is_running; then
kill -HUP "$(cat "$PIDFILE")"
else
echo "$DESC is not running." >&2
exit 3
fi
;;
status)
if is_running; then
echo "$DESC is running (PID $(cat "$PIDFILE"))."
exit 0
fi
echo "$DESC is not running."
exit 3
;;
*)
echo "Usage: $0 {start|stop|restart|reload|force-reload|status}" >&2
exit 2
;;
esac
exit 0

2
src/rootguard/packaging/sysvinit/bastionguard-rootguard.default Normal file
View file

@ -0,0 +1,2 @@
# Additional daemon arguments for SysV init.
DAEMON_ARGS="--policy /etc/bastionguard/rootguard.conf"

3
src/rootguard/resources/icons/rootguard.svg Normal file
View file

@ -0,0 +1,3 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" role="img" aria-label="RootGuard shield">
<path fill="currentColor" d="M12 2 4 5v6c0 5.2 3.4 9.8 8 11 4.6-1.2 8-5.8 8-11V5l-8-3Zm0 3.1 5 1.9v4c0 3.7-2.2 7-5 8.1-2.8-1.1-5-4.4-5-8.1V7l5-1.9Zm0 2.4a2.5 2.5 0 0 0-1 4.8V16h2v-3.7a2.5 2.5 0 0 0-1-4.8Z"/>
</svg>
Side by side

After

Width:  |  Height:  |  Size: 319 B

203
src/rootguard/scripts/bastionguard-rootguard-service Executable file
View file

@ -0,0 +1,203 @@
#!/bin/sh
# BastionGuard RootGuard multi-init service controller.
# SPDX-License-Identifier: GPL-3.0-or-later
set -eu
SERVICE="bastionguard-rootguard"
DAEMON="${ROOTGUARD_DAEMON:-/usr/libexec/bastionguard/bastionguard-rootguard}"
POLICY="${ROOTGUARD_POLICY:-/etc/bastionguard/rootguard.conf}"
STATUS_FILE="${ROOTGUARD_STATUS_FILE:-/run/bastionguard-rootguard.status}"
usage() {
echo "Usage: $0 {status|start|stop|restart|reload}" >&2
exit 2
}
need_root() {
[ "$(id -u)" -eq 0 ] || {
echo "Administrative privileges are required for this action." >&2
exit 77
}
}
detect_init() {
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
echo systemd
elif command -v rc-service >/dev/null 2>&1 && command -v openrc-run >/dev/null 2>&1; then
echo openrc
elif command -v dinitctl >/dev/null 2>&1 && dinitctl --quiet list >/dev/null 2>&1; then
echo dinit
elif [ -x "/etc/init.d/$SERVICE" ]; then
echo sysvinit
else
echo none
fi
}
read_engine_value() {
key=$1
if [ -r "$POLICY" ]; then
awk -v wanted="$key" '
/^\[engine\][[:space:]]*$/ { in_engine=1; next }
/^\[/ { in_engine=0 }
in_engine {
line=$0
sub(/^[[:space:]]*/, "", line)
split(line, parts, "=")
k=parts[1]
gsub(/[[:space:]]/, "", k)
if (k == wanted) {
sub(/^[^=]*=[[:space:]]*/, "", line)
sub(/[[:space:]#;].*$/, "", line)
print line
exit
}
}
' "$POLICY"
fi
}
read_runtime_value() {
key=$1
if [ -r "$STATUS_FILE" ]; then
awk -F= -v wanted="$key" '
$1 == wanted {
sub(/^[^=]*=/, "")
print
exit
}
' "$STATUS_FILE"
fi
}
find_pid() {
if command -v pgrep >/dev/null 2>&1; then
pgrep -o -f "^${DAEMON}([[:space:]]|$)" 2>/dev/null || true
fi
}
status_output() {
init_system=$(detect_init)
active=false
state=inactive
case "$init_system" in
systemd)
if systemctl is-active --quiet "$SERVICE.service"; then
active=true
state=active
else
state=$(systemctl is-active "$SERVICE.service" 2>/dev/null || true)
[ -n "$state" ] || state=inactive
fi
;;
openrc)
if rc-service "$SERVICE" status >/dev/null 2>&1; then
active=true
state=active
fi
;;
dinit)
if dinitctl --quiet is-started "$SERVICE" >/dev/null 2>&1; then
active=true
state=active
else
state=inactive
fi
;;
sysvinit)
if "/etc/init.d/$SERVICE" status >/dev/null 2>&1; then
active=true
state=active
fi
;;
none)
pid=$(find_pid)
if [ -n "$pid" ]; then
active=true
state=active
else
state=unavailable
fi
;;
esac
pid=$(find_pid)
mode=
metadata_action=
global_metadata_action=
auto_block_services=
block_user_home=
if [ "$active" = true ]; then
mode=$(read_runtime_value mode)
metadata_action=$(read_runtime_value metadata_action)
global_metadata_action=$(read_runtime_value global_metadata_action)
auto_block_services=$(read_runtime_value auto_block_services)
block_user_home=$(read_runtime_value block_user_home)
fi
[ -n "$mode" ] || mode=$(read_engine_value mode)
[ -n "$metadata_action" ] || metadata_action=$(read_engine_value metadata_action)
[ -n "$global_metadata_action" ] || global_metadata_action=$(read_engine_value global_metadata_action)
[ -n "$auto_block_services" ] || auto_block_services=$(read_engine_value auto_block_system_services)
[ -n "$block_user_home" ] || block_user_home=$(read_engine_value block_user_home)
[ -n "$mode" ] || mode=unknown
[ -n "$metadata_action" ] || metadata_action=unknown
[ -n "$global_metadata_action" ] || global_metadata_action=unknown
[ -n "$auto_block_services" ] || auto_block_services=unknown
[ -n "$block_user_home" ] || block_user_home=false
printf 'init=%s\n' "$init_system"
printf 'active=%s\n' "$active"
printf 'state=%s\n' "$state"
printf 'mode=%s\n' "$mode"
printf 'metadata_action=%s\n' "$metadata_action"
printf 'global_metadata_action=%s\n' "$global_metadata_action"
printf 'auto_block_services=%s\n' "$auto_block_services"
printf 'block_user_home=%s\n' "$block_user_home"
printf 'pid=%s\n' "$pid"
}
control() {
action=$1
init_system=$(detect_init)
case "$init_system" in
systemd)
case "$action" in
reload) systemctl reload "$SERVICE.service" ;;
*) systemctl "$action" "$SERVICE.service" ;;
esac
;;
openrc)
rc-service "$SERVICE" "$action"
;;
dinit)
case "$action" in
reload) dinitctl signal HUP "$SERVICE" ;;
*) dinitctl "$action" "$SERVICE" ;;
esac
;;
sysvinit)
"/etc/init.d/$SERVICE" "$action"
;;
none)
echo "No supported init system was detected." >&2
exit 69
;;
esac
}
[ "$#" -eq 1 ] || usage
case "$1" in
status)
status_output
;;
start|stop|restart|reload)
need_root
control "$1"
echo "RootGuard $1 completed."
;;
*)
usage
;;
esac

124
src/rootguard/scripts/check-environment.sh Executable file
View file

@ -0,0 +1,124 @@
#!/usr/bin/env bash
set -u
failed=0
warning=0
ok() { printf '[OK] %s\n' "$*"; }
info() { printf '[INFO] %s\n' "$*"; }
warn() { printf '[WARNING] %s\n' "$*"; warning=1; }
missing() { printf '[MISSING] %s\n' "$*"; failed=1; }
for command in clang bpftool pkg-config g++ make; do
if command -v "$command" >/dev/null 2>&1; then
ok "$command"
else
missing "$command"
fi
done
if pkg-config --exists libbpf 2>/dev/null; then
ok "libbpf $(pkg-config --modversion libbpf)"
else
missing 'libbpf development files'
fi
if [[ -r /sys/kernel/btf/vmlinux ]]; then
ok '/sys/kernel/btf/vmlinux'
else
missing 'kernel BTF: /sys/kernel/btf/vmlinux'
fi
if [[ -r /sys/kernel/security/lsm ]]; then
lsm=$(cat /sys/kernel/security/lsm)
info "LSM attivi: $lsm"
if [[ ",$lsm," == *,bpf,* ]]; then
ok 'BPF LSM attivo'
else
missing 'bpf non compare nella lista LSM attiva'
fi
else
warn 'impossibile leggere /sys/kernel/security/lsm'
fi
config_file=''
if [[ -r /proc/config.gz ]]; then
config_file='/proc/config.gz'
elif [[ -r "/boot/config-$(uname -r)" ]]; then
config_file="/boot/config-$(uname -r)"
fi
read_config() {
if [[ -z "$config_file" ]]; then
return 1
fi
if [[ "$config_file" == *.gz ]]; then
zgrep -E "^$1=" "$config_file" 2>/dev/null || true
else
grep -E "^$1=" "$config_file" 2>/dev/null || true
fi
}
check_required_config() {
local symbol=$1 value
value=$(read_config "$symbol")
if [[ "$value" == "$symbol=y" ]]; then
ok "$value"
elif [[ -z "$config_file" ]]; then
warn "config kernel non disponibile: impossibile verificare $symbol"
else
missing "$symbol deve essere y"
fi
}
check_optional_config() {
local symbol=$1 value
value=$(read_config "$symbol")
if [[ "$value" == "$symbol=y" ]]; then
ok "$value"
elif [[ -z "$config_file" ]]; then
warn "config kernel non disponibile: impossibile verificare $symbol"
else
warn "$symbol non risulta abilitato"
fi
}
check_required_config CONFIG_BPF
check_required_config CONFIG_BPF_SYSCALL
check_required_config CONFIG_BPF_LSM
check_required_config CONFIG_DEBUG_INFO_BTF
check_optional_config CONFIG_SECURITY_PATH
check_optional_config CONFIG_SECURITY_LOCKDOWN_LSM
check_optional_config CONFIG_MODULE_SIG
check_optional_config CONFIG_MODULE_SIG_FORCE
check_optional_config CONFIG_IMA
check_optional_config CONFIG_EVM
check_optional_config CONFIG_FS_VERITY
if [[ -r /sys/kernel/security/lockdown ]]; then
lockdown=$(cat /sys/kernel/security/lockdown)
info "lockdown: $lockdown"
if [[ "$lockdown" == *'[integrity]'* || "$lockdown" == *'[confidentiality]'* ]]; then
ok 'kernel lockdown attivo'
else
warn 'kernel lockdown non attivo'
fi
else
warn 'stato kernel lockdown non disponibile'
fi
if [[ -r /proc/sys/kernel/unprivileged_bpf_disabled ]]; then
unprivileged=$(cat /proc/sys/kernel/unprivileged_bpf_disabled)
info "kernel.unprivileged_bpf_disabled=$unprivileged"
if [[ "$unprivileged" == 1 || "$unprivileged" == 2 ]]; then
ok 'BPF non privilegiato disabilitato'
else
warn 'BPF non privilegiato risulta abilitato'
fi
fi
if (( warning != 0 )); then
info 'ambiente utilizzabile solo dopo aver valutato gli avvisi sopra'
fi
exit "$failed"

24
src/rootguard/scripts/enable-service.sh Executable file
View file

@ -0,0 +1,24 @@
#!/bin/sh
# Enable and start the service for the init system currently running.
# SPDX-License-Identifier: GPL-3.0-or-later
set -eu
SERVICE=bastionguard-rootguard
[ "$(id -u)" -eq 0 ] || { echo "Run as root." >&2; exit 77; }
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
systemctl daemon-reload
systemctl enable --now "$SERVICE.service"
elif command -v rc-update >/dev/null 2>&1 && command -v rc-service >/dev/null 2>&1; then
rc-update add "$SERVICE" default
rc-service "$SERVICE" start
elif command -v dinitctl >/dev/null 2>&1; then
dinitctl enable "$SERVICE"
dinitctl start "$SERVICE"
elif command -v update-rc.d >/dev/null 2>&1; then
update-rc.d "$SERVICE" defaults
service "$SERVICE" start
else
echo "No supported init system was detected." >&2
exit 69
fi

9
src/rootguard/scripts/prepare-metadata-probe.sh Executable file
View file

@ -0,0 +1,9 @@
#!/usr/bin/env bash
set -euo pipefail
install -d -o root -g root -m 0755 /opt/bastionguard-rootguard-test
printf 'BastionGuard RootGuard metadata probe\n' \
> /opt/bastionguard-rootguard-test/protected-metadata.txt
chown root:root /opt/bastionguard-rootguard-test/protected-metadata.txt
chmod 0644 /opt/bastionguard-rootguard-test/protected-metadata.txt
printf 'Creato /opt/bastionguard-rootguard-test/protected-metadata.txt (root:root 0644)\n'

18
src/rootguard/scripts/prepare-vm-probe.sh Executable file
View file

@ -0,0 +1,18 @@
#!/usr/bin/env bash
set -euo pipefail
if [[ ${EUID} -ne 0 ]]; then
echo "Eseguire come root dentro una VM." >&2
exit 1
fi
src=${1:-tests/helpers/unknown-setuid-test.c}
out=/opt/bastionguard-rootguard-test/unknown-setuid-test
install -d -m 0755 /opt/bastionguard-rootguard-test
cc -O2 -Wall -Wextra "$src" -o "$out"
chown root:root "$out"
chmod 4755 "$out"
echo "Probe installato in $out"
echo "Non apre shell e non esegue comandi: stampa gli UID e termina."

643
src/rootguard/src/ActionHelper.cpp Normal file
View file

@ -0,0 +1,643 @@
// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/FileIdentity.hpp"
#include "rootguard/JsonEventSink.hpp"
#include "rootguard/PolicyLoader.hpp"
#include "rootguard/PolicySecurity.hpp"
#include "rootguard/SystemServiceControl.hpp"
#include <algorithm>
#include <cerrno>
#include <chrono>
#include <cstring>
#include <filesystem>
#include <fstream>
#include <fcntl.h>
#include <iomanip>
#include <iostream>
#include <map>
#include <optional>
#include <sstream>
#include <set>
#include <vector>
#include <stdexcept>
#include <string>
#include <string_view>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
namespace fs = std::filesystem;
using namespace bastionguard::rootguard;
namespace {
constexpr const char* kDefaultPolicy = "/etc/bastionguard/rootguard.conf";
constexpr const char* kQuarantineDir = "/var/lib/bastionguard/rootguard/quarantine";
struct Options {
std::string command;
fs::path policy{kDefaultPolicy};
fs::path path;
std::optional<std::uint32_t> mode;
std::optional<std::uint32_t> uid;
std::optional<std::uint32_t> gid;
std::optional<std::uint64_t> device;
std::optional<std::uint64_t> inode;
std::string protection;
std::vector<fs::path> trustedApplications;
std::vector<fs::path> trustedExecutables;
std::vector<fs::path> deniedExecutables;
};
[[noreturn]] void fail(const std::string& message)
{
throw std::runtime_error(message);
}
std::uint64_t parseUnsigned(const std::string& value, const char* label,
const int base = 10)
{
std::size_t consumed = 0;
unsigned long long parsed = 0;
try {
parsed = std::stoull(value, &consumed, base);
} catch (...) {
fail(std::string("Invalid ") + label + ": " + value);
}
if (consumed != value.size())
fail(std::string("Invalid ") + label + ": " + value);
return static_cast<std::uint64_t>(parsed);
}
Options parseOptions(const int argc, char* argv[])
{
if (argc < 2)
fail("Usage: bastionguard-rootguard-action <set-protection|set-application-rules|restore|remove|block-service|unblock-service> [options]");
Options options;
options.command = argv[1];
for (int index = 2; index < argc; ++index) {
const std::string key = argv[index];
if (index + 1 >= argc)
fail("Missing value for " + key);
const std::string value = argv[++index];
if (key == "--policy") options.policy = value;
else if (key == "--path") options.path = value;
else if (key == "--mode") options.mode = static_cast<std::uint32_t>(parseUnsigned(value, "mode", 8));
else if (key == "--uid") options.uid = static_cast<std::uint32_t>(parseUnsigned(value, "uid"));
else if (key == "--gid") options.gid = static_cast<std::uint32_t>(parseUnsigned(value, "gid"));
else if (key == "--device") options.device = parseUnsigned(value, "device");
else if (key == "--inode") options.inode = parseUnsigned(value, "inode");
else if (key == "--state") options.protection = value;
else if (key == "--trusted-application") options.trustedApplications.emplace_back(value);
else if (key == "--trusted-executable") options.trustedExecutables.emplace_back(value);
else if (key == "--denied-executable") options.deniedExecutables.emplace_back(value);
else fail("Unknown option: " + key);
}
return options;
}
bool pathStartsWith(const fs::path& path, const fs::path& prefix)
{
const auto normalizedPath = path.lexically_normal();
const auto normalizedPrefix = prefix.lexically_normal();
auto pathIt = normalizedPath.begin();
for (auto prefixIt = normalizedPrefix.begin(); prefixIt != normalizedPrefix.end();
++prefixIt, ++pathIt) {
if (pathIt == normalizedPath.end() || *pathIt != *prefixIt)
return false;
}
return true;
}
fs::path normalizedAbsolute(const fs::path& path)
{
if (path.empty() || !path.is_absolute())
fail("An absolute path is required.");
const auto normalized = path.lexically_normal();
for (const auto& component : normalized) {
if (component == "..")
fail("Parent traversal is not allowed.");
}
return normalized;
}
bool isIgnoredPath(const Policy& policy, const fs::path& requested)
{
const auto path = normalizedAbsolute(requested);
for (const auto& rule : policy.ignoredPaths) {
const auto ignoredPath = rule.path.lexically_normal();
if (rule.recursive ? pathStartsWith(path, ignoredPath)
: path == ignoredPath)
return true;
}
return false;
}
bool isProtectedPath(const Policy& policy, const fs::path& requested)
{
const auto path = normalizedAbsolute(requested);
if (isIgnoredPath(policy, path))
return false;
for (const auto& rule : policy.protectedPaths) {
const auto protectedPath = rule.path.lexically_normal();
if (rule.recursive ? pathStartsWith(path, protectedPath)
: path == protectedPath)
return true;
}
return false;
}
void requireProtectedPath(const Policy& policy, const fs::path& path)
{
if (!isProtectedPath(policy, path))
fail("The requested path is not covered by the RootGuard protected-path policy.");
}
std::string timestamp()
{
const auto now = std::chrono::system_clock::now();
const auto time = std::chrono::system_clock::to_time_t(now);
std::tm tm{};
localtime_r(&time, &tm);
std::ostringstream output;
output << std::put_time(&tm, "%Y%m%d-%H%M%S");
return output.str();
}
void copyString(char* destination, const std::size_t size,
const std::string& source)
{
if (size == 0)
return;
const auto count = std::min(size - 1, source.size());
std::memcpy(destination, source.data(), count);
destination[count] = '\0';
}
void logAction(const Policy& policy, const fs::path& path,
const std::uint32_t eventType,
const std::uint32_t verdict,
const struct stat* before = nullptr,
const struct stat* after = nullptr)
{
if (policy.eventLog.empty())
return;
try {
if (const auto parent = policy.eventLog.parent_path(); !parent.empty())
fs::create_directories(parent);
JsonEventSink sink(policy.eventLog);
rg_event event{};
event.pid = static_cast<__u32>(::getpid());
event.tgid = event.pid;
event.ppid = static_cast<__u32>(::getppid());
event.event_type = eventType;
event.verdict = verdict;
if (before) {
event.file.device = FileIdentityResolver::kernelDeviceNumber(before->st_dev);
event.file.inode = static_cast<__u64>(before->st_ino);
event.old_mode = static_cast<__u32>(before->st_mode & 07777U);
event.old_uid = static_cast<__u32>(before->st_uid);
event.old_gid = static_cast<__u32>(before->st_gid);
}
if (after) {
event.new_mode = static_cast<__u32>(after->st_mode & 07777U);
event.new_uid = static_cast<__u32>(after->st_uid);
event.new_gid = static_cast<__u32>(after->st_gid);
}
event.path_resolution = RG_PATH_PROTECTED_BASELINE;
copyString(event.comm, sizeof(event.comm), "rootguard-action");
std::error_code actorError;
const fs::path actor = fs::read_symlink("/proc/self/exe", actorError);
if (!actorError)
copyString(event.actor_executable,
sizeof(event.actor_executable), actor.string());
copyString(event.filename, sizeof(event.filename), path.string());
sink.onEvent(event);
} catch (...) {
// The privileged action must not fail only because logging failed.
}
}
Policy loadPolicy(const fs::path& path)
{
return PolicyLoader::loadFromText(PolicySecurity::read(path, true), path);
}
std::string trim(std::string value)
{
const auto first = value.find_first_not_of(" \t\r\n");
if (first == std::string::npos)
return {};
const auto last = value.find_last_not_of(" \t\r\n");
return value.substr(first, last - first + 1);
}
void rewriteProtectionPolicy(const fs::path& policyPath, const bool enabled)
{
struct stat metadata{};
if (::lstat(policyPath.c_str(), &metadata) != 0)
fail(std::string("Cannot stat policy: ") + std::strerror(errno));
if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
fail("The RootGuard policy must be a regular non-symlink file.");
std::ifstream input(policyPath);
if (!input)
fail("Cannot read the RootGuard policy.");
std::vector<std::string> lines;
std::string line;
while (std::getline(input, line))
lines.push_back(line);
const std::map<std::string, std::string> replacements{
{"mode", enabled ? "enforce" : "audit"},
{"metadata_action", enabled ? "block" : "audit"},
{"global_metadata_action", "audit"},
{"block_user_home", "false"},
};
std::map<std::string, bool> found;
bool inEngine = false;
std::size_t insertion = lines.size();
for (std::size_t index = 0; index < lines.size(); ++index) {
const std::string stripped = trim(lines[index]);
if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
if (inEngine && stripped != "[engine]") {
insertion = index;
inEngine = false;
} else {
inEngine = stripped == "[engine]";
}
continue;
}
if (!inEngine || stripped.empty() || stripped.front() == '#' || stripped.front() == ';')
continue;
const auto separator = stripped.find('=');
if (separator == std::string::npos)
continue;
const std::string key = trim(stripped.substr(0, separator));
const auto replacement = replacements.find(key);
if (replacement != replacements.end()) {
lines[index] = key + " = " + replacement->second;
found[key] = true;
}
}
if (insertion == lines.size() && inEngine)
insertion = lines.size();
for (auto iterator = replacements.rbegin(); iterator != replacements.rend(); ++iterator) {
if (!found[iterator->first])
lines.insert(lines.begin() + static_cast<std::ptrdiff_t>(insertion),
iterator->first + " = " + iterator->second);
}
const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
std::to_string(::getpid());
{
std::ofstream output(temporary, std::ios::trunc);
if (!output)
fail("Cannot create the temporary policy file.");
for (const auto& item : lines)
output << item << '\n';
output.flush();
if (!output)
fail("Cannot write the temporary policy file.");
}
if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
fs::remove(temporary);
fail(std::string("Cannot preserve policy ownership/mode: ") + std::strerror(errno));
}
if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
fs::remove(temporary);
fail(std::string("Cannot atomically replace the policy: ") + std::strerror(errno));
}
}
std::vector<fs::path> normalizeApplicationEntries(
const std::vector<fs::path>& entries,
const char* label)
{
std::vector<fs::path> normalized;
std::set<std::string> seen;
for (const auto& entry : entries) {
const fs::path path = normalizedAbsolute(entry);
struct stat metadata {};
const bool exists = ::stat(path.c_str(), &metadata) == 0;
if (!exists && errno != ENOENT)
fail(std::string("Cannot inspect ") + label + ": " + path.string() +
": " + std::strerror(errno));
if (exists && !S_ISREG(metadata.st_mode))
fail(std::string(label) + " is not a regular file: " + path.string());
if (exists && ::access(path.c_str(), X_OK) != 0)
fail(std::string(label) + " is not executable: " + path.string());
/*
* Cross-distribution policy files legitimately contain executable
* paths that are absent on the current desktop. Preserve those entries
* so saving from the UI does not silently delete rules for another DE
* or browser. Existing files are still validated strictly.
*/
std::error_code error;
const fs::path canonical = fs::weakly_canonical(path, error);
const fs::path finalPath = error ? path : canonical;
if (seen.insert(finalPath.string()).second)
normalized.push_back(finalPath);
}
std::sort(normalized.begin(), normalized.end());
return normalized;
}
void writePolicyAtomically(const fs::path& policyPath,
const std::vector<std::string>& lines,
const struct stat& metadata)
{
const fs::path temporary = policyPath.string() + ".rootguard.tmp." +
std::to_string(::getpid());
{
std::ofstream output(temporary, std::ios::trunc);
if (!output)
fail("Cannot create the temporary policy file.");
for (const auto& item : lines)
output << item << '\n';
output.flush();
if (!output)
fail("Cannot write the temporary policy file.");
}
std::ifstream validationInput(temporary);
std::ostringstream validationText;
validationText << validationInput.rdbuf();
try {
(void)PolicyLoader::loadFromText(validationText.str(), temporary);
} catch (const std::exception& error) {
fs::remove(temporary);
fail(std::string("Refusing to install an invalid RootGuard policy: ") +
error.what());
}
if (::chmod(temporary.c_str(), metadata.st_mode & 07777U) != 0 ||
::chown(temporary.c_str(), metadata.st_uid, metadata.st_gid) != 0) {
fs::remove(temporary);
fail(std::string("Cannot preserve policy ownership/mode: ") +
std::strerror(errno));
}
if (::rename(temporary.c_str(), policyPath.c_str()) != 0) {
fs::remove(temporary);
fail(std::string("Cannot atomically replace the policy: ") +
std::strerror(errno));
}
}
void rewriteApplicationRules(const Options& options)
{
struct stat metadata {};
if (::lstat(options.policy.c_str(), &metadata) != 0)
fail(std::string("Cannot stat policy: ") + std::strerror(errno));
if (!S_ISREG(metadata.st_mode) || S_ISLNK(metadata.st_mode))
fail("The RootGuard policy must be a regular non-symlink file.");
const auto trustedApplications = normalizeApplicationEntries(
options.trustedApplications, "Trusted application");
const auto trustedExecutables = normalizeApplicationEntries(
options.trustedExecutables, "Privilege-trusted executable");
const auto deniedExecutables = normalizeApplicationEntries(
options.deniedExecutables, "Denied executable");
std::set<std::string> trustedKeys;
for (const auto& path : trustedApplications)
trustedKeys.insert(path.string());
for (const auto& path : trustedExecutables)
trustedKeys.insert(path.string());
for (const auto& path : deniedExecutables) {
if (trustedKeys.count(path.string()) != 0)
fail("An executable cannot be both trusted and denied: " + path.string());
}
std::ifstream input(options.policy);
if (!input)
fail("Cannot read the RootGuard policy.");
std::vector<std::string> sourceLines;
std::string line;
while (std::getline(input, line))
sourceLines.push_back(line);
const std::map<std::string, std::vector<fs::path>> replacements {
{"trusted-applications", trustedApplications},
{"trusted-executables", trustedExecutables},
{"denied-executables", deniedExecutables},
};
std::set<std::string> emitted;
std::vector<std::string> output;
std::string skippedSection;
const auto emitSection = [&](const std::string& section,
std::vector<std::string>& destination) {
destination.push_back("[" + section + "]");
if (section == "trusted-applications") {
destination.push_back(
"# Routine user-space metadata activity only. This never grants privilege trust.");
} else if (section == "trusted-executables") {
destination.push_back(
"# Executables trusted specifically for privilege transitions.");
} else {
destination.push_back(
"# Executables denied during RootGuard privilege-transition checks.");
}
for (const auto& path : replacements.at(section))
destination.push_back("path = " + path.string());
destination.push_back("");
};
for (const auto& sourceLine : sourceLines) {
const std::string stripped = trim(sourceLine);
if (!stripped.empty() && stripped.front() == '[' && stripped.back() == ']') {
const std::string section = stripped.substr(1, stripped.size() - 2);
skippedSection.clear();
if (replacements.count(section) != 0) {
skippedSection = section;
if (emitted.insert(section).second)
emitSection(section, output);
continue;
}
}
if (!skippedSection.empty())
continue;
output.push_back(sourceLine);
}
for (const auto& [section, entries] : replacements) {
(void)entries;
if (emitted.insert(section).second) {
if (!output.empty() && !output.back().empty())
output.push_back("");
emitSection(section, output);
}
}
writePolicyAtomically(options.policy, output, metadata);
std::cout << "RootGuard application rules saved. A service restart is required.\n";
}
void restoreFile(const Options& options, const Policy& policy)
{
if (!options.mode || !options.uid || !options.gid)
fail("restore requires --mode, --uid and --gid.");
const auto path = normalizedAbsolute(options.path);
requireProtectedPath(policy, path);
struct stat before{};
if (::lstat(path.c_str(), &before) != 0)
fail(std::string("Cannot restore missing path: ") + std::strerror(errno));
if (S_ISLNK(before.st_mode))
fail("Refusing to restore metadata through a symbolic link.");
if (options.device && *options.device != 0 &&
FileIdentityResolver::kernelDeviceNumber(before.st_dev) != *options.device)
fail("The file device no longer matches the protected baseline.");
if (options.inode && *options.inode != 0 &&
static_cast<std::uint64_t>(before.st_ino) != *options.inode)
fail("The file inode no longer matches the protected baseline. Quarantine the replacement instead.");
const int openFlags = O_RDONLY | O_CLOEXEC | O_NOFOLLOW |
(S_ISDIR(before.st_mode) ? O_DIRECTORY : O_NONBLOCK);
const int descriptor = ::open(path.c_str(), openFlags);
if (descriptor < 0)
fail(std::string("Secure open failed: ") + std::strerror(errno));
struct stat verified{};
if (::fstat(descriptor, &verified) != 0 ||
verified.st_dev != before.st_dev || verified.st_ino != before.st_ino) {
::close(descriptor);
fail("The protected path changed during the restore operation.");
}
if (::fchown(descriptor, static_cast<uid_t>(*options.uid),
static_cast<gid_t>(*options.gid)) != 0) {
const std::string error = std::strerror(errno);
::close(descriptor);
fail("fchown failed: " + error);
}
if (::fchmod(descriptor, static_cast<mode_t>(*options.mode & 07777U)) != 0) {
const std::string error = std::strerror(errno);
::close(descriptor);
fail("fchmod failed: " + error);
}
::close(descriptor);
const auto serviceResult = unblockSystemService(path);
(void)serviceResult;
struct stat after{};
::lstat(path.c_str(), &after);
logAction(policy, path, RG_EVENT_FILE_RESTORED, RG_VERDICT_RESTORED,
&before, &after);
std::cout << "Protected metadata restored. A system service, when applicable, was unmasked but not restarted.\n";
}
void quarantineFile(const Options& options, const Policy& policy)
{
const auto path = normalizedAbsolute(options.path);
requireProtectedPath(policy, path);
struct stat before{};
if (::lstat(path.c_str(), &before) != 0)
fail(std::string("Cannot remove path: ") + std::strerror(errno));
if (S_ISDIR(before.st_mode))
fail("Directory removal is not supported by the RootGuard incident action.");
std::string serviceWarning;
if (const auto target = identifySystemService(path)) {
const bool identityMatches = options.device && options.inode &&
*options.device != 0 && *options.inode != 0 &&
FileIdentityResolver::kernelDeviceNumber(before.st_dev) == *options.device &&
static_cast<std::uint64_t>(before.st_ino) == *options.inode;
const bool scriptBased = target->init == InitSystem::OpenRC ||
target->init == InitSystem::SysVInit;
if (scriptBased && !identityMatches) {
serviceWarning =
"The affected OpenRC/SysV definition may have been replaced; "
"RootGuard did not execute it as root. The service process may require manual containment.";
} else {
const auto result = blockSystemService(path);
if (!result.success)
serviceWarning = "Service blocking was not confirmed: " + result.message;
}
}
fs::create_directories(kQuarantineDir);
::chmod(kQuarantineDir, 0700);
const fs::path destination = fs::path(kQuarantineDir) /
(timestamp() + "-" + std::to_string(::getpid()) + "-" + path.filename().string());
if (::rename(path.c_str(), destination.c_str()) != 0)
fail(std::string("Quarantine rename failed: ") + std::strerror(errno));
std::ofstream manifest(destination.string() + ".manifest", std::ios::trunc);
manifest << "original_path=" << path.string() << '\n'
<< "mode=" << std::oct << (before.st_mode & 07777U) << std::dec << '\n'
<< "uid=" << before.st_uid << '\n'
<< "gid=" << before.st_gid << '\n'
<< "device=" << FileIdentityResolver::kernelDeviceNumber(before.st_dev) << '\n'
<< "inode=" << before.st_ino << '\n';
manifest.close();
::chmod(destination.c_str(), 0000);
logAction(policy, path, RG_EVENT_FILE_QUARANTINED, RG_VERDICT_BLOCKED,
&before, nullptr);
std::cout << "The file was removed from its original location and quarantined at "
<< destination << ".\n";
}
} // namespace
int main(const int argc, char* argv[])
{
try {
if (::geteuid() != 0)
fail("Administrative privileges are required.");
const Options options = parseOptions(argc, argv);
const Policy policy = loadPolicy(options.policy);
if (options.command == "set-protection") {
if (options.protection != "on" && options.protection != "off")
fail("set-protection requires --state on|off.");
const bool enabled = options.protection == "on";
rewriteProtectionPolicy(options.policy, enabled);
const Policy updated = loadPolicy(options.policy);
logAction(updated, options.policy, RG_EVENT_PROTECTION_MODE_CHANGED,
enabled ? RG_VERDICT_BLOCKED : RG_VERDICT_AUDIT);
std::cout << (enabled
? "Immediate blocking enabled for protected system paths; user home remains audit-only."
: "Immediate metadata blocking disabled.") << '\n';
} else if (options.command == "set-application-rules") {
rewriteApplicationRules(options);
} else if (options.command == "restore") {
restoreFile(options, policy);
} else if (options.command == "remove") {
quarantineFile(options, policy);
} else if (options.command == "block-service") {
const auto path = normalizedAbsolute(options.path);
requireProtectedPath(policy, path);
if (const auto target = identifySystemService(path)) {
if (target->init == InitSystem::OpenRC || target->init == InitSystem::SysVInit) {
struct stat current{};
if (!options.device || !options.inode ||
::lstat(path.c_str(), &current) != 0 ||
FileIdentityResolver::kernelDeviceNumber(current.st_dev) != *options.device ||
static_cast<std::uint64_t>(current.st_ino) != *options.inode) {
fail("Refusing to execute an OpenRC/SysV service definition without a matching protected identity.");
}
}
}
const auto result = blockSystemService(path);
if (!result.success) fail(result.message);
logAction(policy, path, RG_EVENT_SERVICE_BLOCKED, RG_VERDICT_BLOCKED);
std::cout << result.message << '\n';
} else if (options.command == "unblock-service") {
const auto path = normalizedAbsolute(options.path);
requireProtectedPath(policy, path);
const auto result = unblockSystemService(path);
if (!result.success) fail(result.message);
std::cout << result.message << '\n';
} else {
fail("Unknown action: " + options.command);
}
return 0;
} catch (const std::exception& error) {
std::cerr << "RootGuard action: " << error.what() << '\n';
return 1;
}
}

147
src/rootguard/src/AutomaticResponseSink.cpp Normal file
View file

@ -0,0 +1,147 @@
// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/AutomaticResponseSink.hpp"
#include "rootguard/SystemServiceControl.hpp"
#include <algorithm>
#include <cstring>
namespace bastionguard::rootguard {
namespace {
bool isActionableMetadataEvent(const rg_event& event) noexcept
{
switch (event.event_type) {
case RG_EVENT_PERMISSION_CHANGE:
case RG_EVENT_OWNER_CHANGE:
case RG_EVENT_XATTR_CHANGE:
case RG_EVENT_ACL_CHANGE:
case RG_EVENT_PROTECTED_UNLINK:
case RG_EVENT_PROTECTED_RENAME:
case RG_EVENT_PROTECTED_HARDLINK:
case RG_EVENT_INTEGRITY_DRIFT:
break;
default:
return false;
}
/*
* Automatic containment is a state-changing operation and must never run
* for audit/alert events. It is allowed only after the kernel has denied
* the metadata change and reported RG_VERDICT_BLOCKED.
*/
return event.verdict == RG_VERDICT_BLOCKED;
}
void copyString(char* destination, const std::size_t size,
const std::string& source) noexcept
{
if (!destination || size == 0)
return;
const auto count = std::min(size - 1, source.size());
std::memcpy(destination, source.data(), count);
destination[count] = '\0';
}
} // namespace
AutomaticResponseSink::AutomaticResponseSink(IEventSink& downstream,
const bool autoBlockSystemServices)
: downstream_(downstream),
autoBlockSystemServices_(autoBlockSystemServices),
worker_(&AutomaticResponseSink::workerLoop, this)
{
}
AutomaticResponseSink::~AutomaticResponseSink()
{
{
std::lock_guard lock(mutex_);
stopping_ = true;
}
condition_.notify_one();
if (worker_.joinable())
worker_.join();
}
void AutomaticResponseSink::setAutoBlockSystemServices(const bool enabled) noexcept
{
autoBlockSystemServices_.store(enabled, std::memory_order_release);
}
void AutomaticResponseSink::onEvent(const rg_event& event) noexcept
{
try {
downstream_.onEvent(event);
if (!autoBlockSystemServices_.load(std::memory_order_acquire) ||
!isActionableMetadataEvent(event))
return;
const std::filesystem::path path(event.filename);
const auto target = identifySystemService(path);
if (!target)
return;
/*
* The LSM denied the operation, therefore the service definition
* remains unchanged. Stopping it cannot execute attacker-controlled
* replacement content.
*/
enqueueService(path, event);
} catch (...) {
// Automatic reaction must never terminate RootGuard.
}
}
void AutomaticResponseSink::enqueueService(const std::filesystem::path& path,
const rg_event& source) noexcept
{
try {
const std::string key = path.lexically_normal().string();
std::lock_guard lock(mutex_);
if (stopping_ || !queuedPaths_.insert(key).second)
return;
queue_.push_back(PendingService{path, source});
condition_.notify_one();
} catch (...) {
}
}
void AutomaticResponseSink::workerLoop() noexcept
{
for (;;) {
PendingService pending;
{
std::unique_lock lock(mutex_);
condition_.wait(lock, [this] { return stopping_ || !queue_.empty(); });
if (stopping_ && queue_.empty())
break;
pending = std::move(queue_.front());
queue_.pop_front();
}
const auto result = blockSystemService(pending.path);
emitServiceResult(pending.path, pending.source, result.success);
std::lock_guard lock(mutex_);
queuedPaths_.erase(pending.path.lexically_normal().string());
}
}
void AutomaticResponseSink::emitServiceResult(const std::filesystem::path& path,
const rg_event& source,
const bool success) noexcept
{
try {
rg_event event = source;
event.event_type = RG_EVENT_SERVICE_BLOCKED;
event.verdict = success ? RG_VERDICT_BLOCKED : RG_VERDICT_ALERT;
copyString(event.comm, sizeof(event.comm), "rootguard-react");
copyString(event.filename, sizeof(event.filename), path.string());
downstream_.onEvent(event);
} catch (...) {
}
}
} // namespace bastionguard::rootguard

109
src/rootguard/src/ConsoleEventSink.cpp Normal file
View file

@ -0,0 +1,109 @@
// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/ConsoleEventSink.hpp"
#include <iomanip>
#include <iostream>
namespace bastionguard::rootguard {
const char* ConsoleEventSink::eventName(const __u32 type) noexcept
{
switch (type) {
case RG_EVENT_SETUID: return "setuid";
case RG_EVENT_EXEC_PRIV: return "exec-priv";
case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
case RG_EVENT_OWNER_CHANGE: return "owner-change";
case RG_EVENT_XATTR_CHANGE: return "xattr-change";
case RG_EVENT_ACL_CHANGE: return "acl-change";
case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
case RG_EVENT_FILE_RESTORED: return "file-restored";
case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
default: return "unknown";
}
}
const char* ConsoleEventSink::verdictName(const __u32 verdict) noexcept
{
switch (verdict) {
case RG_VERDICT_AUDIT: return "AUDIT";
case RG_VERDICT_AUTHORIZED: return "AUTHORIZED";
case RG_VERDICT_BLOCKED: return "BLOCKED";
case RG_VERDICT_TRUSTED: return "TRUSTED";
case RG_VERDICT_ALERT: return "ALERT";
case RG_VERDICT_RESTORED: return "RESTORED";
default: return "UNKNOWN";
}
}
namespace {
const char* pathResolutionName(const __u32 resolution) noexcept
{
switch (resolution) {
case RG_PATH_PROTECTED_BASELINE: return "protected-baseline";
case RG_PATH_PROC_FD: return "proc-fd";
case RG_PATH_PROCESS_CWD: return "process-cwd";
case RG_PATH_KERNEL_EXACT: return "kernel-exact";
case RG_PATH_LSM_EXACT: return "lsm-exact";
case RG_PATH_BASENAME:
default: return "basename-only";
}
}
} // namespace
void ConsoleEventSink::onEvent(const rg_event& event) noexcept
{
try {
std::cout << '[' << verdictName(event.verdict) << "] "
<< "type=" << eventName(event.event_type)
<< " pid=" << event.pid
<< " tgid=" << event.tgid
<< " ppid=" << event.ppid
<< " comm=" << event.comm
<< " parent-comm=" << event.parent_comm
<< " actor-dev=" << event.actor_file.device
<< " actor-ino=" << event.actor_file.inode
<< " parent-dev=" << event.parent_file.device
<< " parent-ino=" << event.parent_file.inode
<< " actor-start=" << event.actor_start_boottime_ns
<< " euid=" << event.old_euid << "->" << event.new_euid
<< " rule=" << event.rule_id
<< " reason=0x" << std::hex << event.reason_flags << std::dec
<< " aux=" << event.auxiliary
<< " dev=" << event.file.device
<< " ino=" << event.file.inode;
if (event.old_mode != 0 || event.new_mode != 0) {
std::cout << " mode=" << std::oct << event.old_mode
<< "->" << event.new_mode << std::dec;
}
if (event.old_uid != 0 || event.new_uid != 0 ||
event.old_gid != 0 || event.new_gid != 0) {
std::cout << " owner=" << event.old_uid << ':' << event.old_gid
<< "->" << event.new_uid << ':' << event.new_gid;
}
if (event.xattr_name[0] != '\0')
std::cout << " xattr=" << event.xattr_name;
std::cout << " file="
<< (event.filename[0] != '\0' ? event.filename : "-")
<< " path-resolution=" << pathResolutionName(event.path_resolution);
if (event.actor_executable[0] != '\0')
std::cout << " actor=" << event.actor_executable;
if (event.parent_executable[0] != '\0')
std::cout << " parent-exe=" << event.parent_executable;
std::cout << '\n';
std::cout.flush();
} catch (...) {
// Never allow an exception to cross the libbpf callback boundary.
}
}
} // namespace bastionguard::rootguard

76
src/rootguard/src/FileIdentity.cpp Normal file
View file

@ -0,0 +1,76 @@
// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/FileIdentity.hpp"
#include <cerrno>
#include <cstring>
#include <stdexcept>
#include <string>
#include <sys/stat.h>
#include <sys/sysmacros.h>
namespace bastionguard::rootguard {
__u64 FileIdentityResolver::kernelDeviceNumber(const dev_t encodedDevice)
{
constexpr std::uint64_t minorBits = 20U;
constexpr std::uint64_t maxMajor = (1ULL << 12U) - 1ULL;
constexpr std::uint64_t maxMinor = (1ULL << minorBits) - 1ULL;
const auto deviceMajor = static_cast<std::uint64_t>(major(encodedDevice));
const auto deviceMinor = static_cast<std::uint64_t>(minor(encodedDevice));
if (deviceMajor > maxMajor || deviceMinor > maxMinor)
throw std::runtime_error("numero di device non rappresentabile nel formato kernel dev_t");
return static_cast<__u64>((deviceMajor << minorBits) | deviceMinor);
}
FileIdentity FileIdentityResolver::resolve(
const std::filesystem::path& path,
const bool requireRegularFile,
const bool requireRootOwnedAndNotWritable)
{
struct stat linkStatus {};
if (::lstat(path.c_str(), &linkStatus) != 0)
throw std::runtime_error(path.string() + ": " + std::strerror(errno));
if (S_ISLNK(linkStatus.st_mode))
throw std::runtime_error(path.string() + ": i link simbolici non sono ammessi nelle policy");
struct stat status {};
if (::stat(path.c_str(), &status) != 0)
throw std::runtime_error(path.string() + ": " + std::strerror(errno));
if (requireRegularFile && !S_ISREG(status.st_mode))
throw std::runtime_error(path.string() + ": non è un file regolare");
if (!S_ISREG(status.st_mode) && !S_ISDIR(status.st_mode))
throw std::runtime_error(path.string() +
": sono supportati soltanto file regolari e directory");
if (requireRootOwnedAndNotWritable) {
if (status.st_uid != 0)
throw std::runtime_error(path.string() + ": eseguibile trusted non appartenente a root");
if ((status.st_mode & (S_IWGRP | S_IWOTH)) != 0)
throw std::runtime_error(path.string() +
": eseguibile trusted scrivibile da gruppo o altri");
}
FileIdentity identity;
/*
* stat(2) exposes the userspace-encoded dev_t, while inode->i_sb->s_dev
* in BPF uses the kernel-internal MKDEV(major, minor) layout. Store the
* latter so trusted/protected map lookups use exactly the same key.
*/
identity.key.device = FileIdentityResolver::kernelDeviceNumber(status.st_dev);
identity.key.inode = static_cast<__u64>(status.st_ino);
identity.canonicalPath = std::filesystem::canonical(path);
identity.mode = static_cast<std::uint32_t>(status.st_mode & 07777U);
identity.uid = static_cast<std::uint32_t>(status.st_uid);
identity.gid = static_cast<std::uint32_t>(status.st_gid);
identity.regularFile = S_ISREG(status.st_mode);
identity.directory = S_ISDIR(status.st_mode);
return identity;
}
} // namespace bastionguard::rootguard

148
src/rootguard/src/JsonEventSink.cpp Normal file
View file

@ -0,0 +1,148 @@
// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/JsonEventSink.hpp"
#include <chrono>
#include <iomanip>
#include <sstream>
#include <stdexcept>
namespace bastionguard::rootguard {
namespace {
const char* eventName(const __u32 type) noexcept
{
switch (type) {
case RG_EVENT_SETUID: return "setuid";
case RG_EVENT_EXEC_PRIV: return "exec-priv";
case RG_EVENT_CREDENTIAL_ANOMALY: return "credential-anomaly";
case RG_EVENT_PERMISSION_CHANGE: return "permission-change";
case RG_EVENT_OWNER_CHANGE: return "owner-change";
case RG_EVENT_XATTR_CHANGE: return "xattr-change";
case RG_EVENT_ACL_CHANGE: return "acl-change";
case RG_EVENT_PROTECTED_UNLINK: return "protected-unlink";
case RG_EVENT_PROTECTED_RENAME: return "protected-rename";
case RG_EVENT_PROTECTED_HARDLINK: return "protected-hardlink";
case RG_EVENT_INTEGRITY_DRIFT: return "integrity-drift";
case RG_EVENT_INTEGRITY_RESTORED: return "integrity-restored";
case RG_EVENT_SERVICE_BLOCKED: return "service-blocked";
case RG_EVENT_FILE_RESTORED: return "file-restored";
case RG_EVENT_FILE_QUARANTINED: return "file-quarantined";
case RG_EVENT_PROTECTION_MODE_CHANGED: return "protection-mode-changed";
default: return "unknown";
}
}
const char* verdictName(const __u32 verdict) noexcept
{
switch (verdict) {
case RG_VERDICT_AUDIT: return "audit";
case RG_VERDICT_AUTHORIZED: return "authorized";
case RG_VERDICT_BLOCKED: return "blocked";
case RG_VERDICT_TRUSTED: return "trusted";
case RG_VERDICT_ALERT: return "alert";
case RG_VERDICT_RESTORED: return "restored";
default: return "unknown";
}
}
const char* pathResolutionName(const __u32 value) noexcept
{
switch (value) {
case RG_PATH_PROTECTED_BASELINE: return "protected-baseline";
case RG_PATH_PROC_FD: return "proc-fd";
case RG_PATH_PROCESS_CWD: return "process-cwd";
case RG_PATH_KERNEL_EXACT: return "kernel-exact";
case RG_PATH_LSM_EXACT: return "lsm-exact";
default: return "basename-only";
}
}
std::string receivedAtUtc()
{
const auto now = std::chrono::system_clock::now();
const auto time = std::chrono::system_clock::to_time_t(now);
std::tm tm {};
gmtime_r(&time, &tm);
std::ostringstream output;
output << std::put_time(&tm, "%Y-%m-%dT%H:%M:%SZ");
return output.str();
}
} // namespace
JsonEventSink::JsonEventSink(const std::filesystem::path& path)
: stream_(path, std::ios::app)
{
if (!stream_)
throw std::runtime_error("impossibile aprire il log JSON: " + path.string());
}
std::string JsonEventSink::escape(const char* value)
{
std::ostringstream output;
for (const unsigned char character : std::string(value ? value : "")) {
switch (character) {
case '"': output << "\\\""; break;
case '\\': output << "\\\\"; break;
case '\b': output << "\\b"; break;
case '\f': output << "\\f"; break;
case '\n': output << "\\n"; break;
case '\r': output << "\\r"; break;
case '\t': output << "\\t"; break;
default:
if (character < 0x20)
output << "\\u" << std::hex << std::setw(4) << std::setfill('0')
<< static_cast<unsigned int>(character) << std::dec;
else
output << static_cast<char>(character);
}
}
return output.str();
}
void JsonEventSink::onEvent(const rg_event& event) noexcept
{
try {
std::lock_guard lock(mutex_);
stream_ << '{'
<< "\"received_at\":\"" << receivedAtUtc() << "\","
<< "\"kernel_monotonic_ns\":" << event.timestamp_ns << ','
<< "\"event\":\"" << eventName(event.event_type) << "\","
<< "\"verdict\":\"" << verdictName(event.verdict) << "\","
<< "\"pid\":" << event.pid << ','
<< "\"tgid\":" << event.tgid << ','
<< "\"ppid\":" << event.ppid << ','
<< "\"old_euid\":" << event.old_euid << ','
<< "\"new_euid\":" << event.new_euid << ','
<< "\"rule_id\":" << event.rule_id << ','
<< "\"reason_flags\":" << event.reason_flags << ','
<< "\"lsm_flags\":" << event.lsm_flags << ','
<< "\"auxiliary\":" << event.auxiliary << ','
<< "\"path_resolution\":\"" << pathResolutionName(event.path_resolution) << "\","
<< "\"device\":" << event.file.device << ','
<< "\"inode\":" << event.file.inode << ','
<< "\"actor_device\":" << event.actor_file.device << ','
<< "\"actor_inode\":" << event.actor_file.inode << ','
<< "\"parent_device\":" << event.parent_file.device << ','
<< "\"parent_inode\":" << event.parent_file.inode << ','
<< "\"actor_start_boottime_ns\":" << event.actor_start_boottime_ns << ','
<< "\"old_mode\":" << event.old_mode << ','
<< "\"new_mode\":" << event.new_mode << ','
<< "\"old_uid\":" << event.old_uid << ','
<< "\"new_uid\":" << event.new_uid << ','
<< "\"old_gid\":" << event.old_gid << ','
<< "\"new_gid\":" << event.new_gid << ','
<< "\"comm\":\"" << escape(event.comm) << "\","
<< "\"parent_comm\":\"" << escape(event.parent_comm) << "\","
<< "\"actor_executable\":\"" << escape(event.actor_executable) << "\","
<< "\"parent_executable\":\"" << escape(event.parent_executable) << "\","
<< "\"filename\":\"" << escape(event.filename) << "\","
<< "\"xattr_name\":\"" << escape(event.xattr_name) << "\""
<< "}\n";
stream_.flush();
} catch (...) {
// Logging must never crash the security engine.
}
}
} // namespace bastionguard::rootguard

Some files were not shown because too many files have changed in this diff Show more