specialworld83/BastionGuard
1
0
Fork 0
Code Issues Activity

add multi-init support and Gentoo/Alpine packaging

Browse source 
* add support for systemd, OpenRC, SysVinit, and Dinit
* add automatic init-system detection through CMake
* make libsystemd optional for non-systemd builds
* add native service definitions for all supported init systems
* add Gentoo ebuild and Alpine APKBUILD packaging support
* publish the official BastionGuard source repository
* update the README with supported distributions, init systems, repository information, and build documentation
This commit is contained in:
specialworld83 2026-07-21 14:15:32 +02:00
commit 588e87590d
68 changed files with 5049 additions and 1066 deletions
Download patch file Download diff file Expand all files Collapse all files

335
CMakeLists.txt
View file

@ -1,6 +1,29 @@
cmake_minimum_required(VERSION 3.16)
project(BastionGuard LANGUAGES CXX)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
# ============================================================
# Optional CEF support and Fedora/RHEL-family hard disable
@ -55,15 +78,22 @@ find_package(Gettext REQUIRED)
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It is optional so OpenRC/SysVinit/Dinit distributions without
# libsystemd can still build BastionGuard.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
# ==============================
# Controllo NGINX
@ -96,7 +126,6 @@ endif()
include(GNUInstallDirs)
# ============================================================
# BastionGuard – RPATH centralizzato (SAFE)
@ -121,8 +150,12 @@ function(bg_set_rpath target)
endfunction()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
# --- Percorso dati installati (es: /usr/share/BastionGuard/data) ---
install(DIRECTORY data/
@ -454,7 +487,7 @@ target_link_libraries(password_manager
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -533,7 +566,6 @@ target_link_libraries(BastionGuard
password_manager
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
if(ENABLE_CEF)
@ -1025,7 +1057,7 @@ bg_set_rpath(BastionGuard-first-run)
install(TARGETS BastionGuard-first-run RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# Gira come servizio utente, senza privilegi root
# ======================
add_executable(BastionGuard-mailproxy
@ -1057,11 +1089,8 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il file di servizio per BastionGuard-mailproxy viene installato nella
# sezione init-system centralizzata più avanti.
# ======================
# Helper privilegiato — bastionguard-privhelper
@ -1182,14 +1211,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1206,7 +1236,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1706,7 +1736,7 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
pkg_check_modules(BGSC_GTKMM REQUIRED gtkmm-4.0)
pkg_check_modules(BGSC_GLIBMM REQUIRED glibmm-2.68)
pkg_check_modules(BGSC_GIOMM REQUIRED giomm-2.68)
pkg_check_modules(BGSC_SYSTEMD REQUIRED libsystemd)
pkg_check_modules(BGSC_SYSTEMD QUIET libsystemd)
pkg_check_modules(BGSC_SHUMATE REQUIRED shumate-1.0)
pkg_check_modules(BGSC_LIBBPF REQUIRED libbpf)
@ -1729,7 +1759,7 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
message(STATUS "[BG-SC] gtkmm-4.0 : ${BGSC_GTKMM_FOUND}")
message(STATUS "[BG-SC] glibmm-2.68 : ${BGSC_GLIBMM_FOUND}")
message(STATUS "[BG-SC] giomm-2.68 : ${BGSC_GIOMM_FOUND}")
message(STATUS "[BG-SC] libsystemd : ${BGSC_SYSTEMD_FOUND}")
message(STATUS "[BG-SC] libsystemd (tray) : ${BGSC_SYSTEMD_FOUND} (optional)")
message(STATUS "[BG-SC] shumate-1.0 : ${BGSC_SHUMATE_FOUND}")
message(STATUS "[BG-SC] libbpf : ${BGSC_LIBBPF_FOUND}")
message(STATUS "[BG-SC] libnetfilter_queue : ${BGSC_NFQ_FOUND} (optional)")
@ -1745,13 +1775,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2205,7 +2237,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2281,38 +2315,194 @@ install(FILES actions/policy/it.BastionGuard.camera.policy
# Services
# ======================
# opzione per abilitare auto attivazione user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare auto attivazione user services durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Compatibility dispatcher used by the application on every init system.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_CEF)
install(FILES data/service/BastionGuard-cef.service
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_CEF)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
if(ENABLE_CEF)
bg_install_dinit_user_service(BastionGuard-cef true 3)
endif()
# Starts enabled Dinit user services when a user manager is available;
# otherwise the dispatcher transparently uses its existing supervisor.
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
@ -2458,36 +2648,41 @@ install(CODE "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
install(CODE "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================
# Installazione automatica regola udev per BastionGuard USB
# ============================================================

185
README.md
View file

@ -2,43 +2,174 @@
BastionGuard is a Linux security platform designed for users who want deterministic behavior, explicit policies, and visible decisions — not opaque “trust us” protection.
## Release Status
BastionGuard 2.0 was officially released on July 15, 2026.
Version 2.0 is the current stable production-ready release. It builds on
the original 1.0 release of February 27, 2026 and follows extensive
development, production use, and testing.
Version 2.0 is the current stable, production-ready release. It builds on the original 1.0 release of February 27, 2026 and follows extensive development, production use, and testing.
## Official Linux Repositories
BastionGuard is available through official Linux package repositories for the supported distributions.
Repository configuration instructions and distribution-specific installation commands are available at:
https://bastionguard.eu/documentation/bastionguard-documentation/technical-documentation-application-install/install-bastionguard-from-the-official-linux-repositories/
This page explains how to add the official BastionGuard repository and install or update the application using the native package manager of each supported Linux distribution.
## Build and Installation
Detailed instructions for compiling and installing BastionGuard are available in the official documentation.
Please refer to:
Detailed instructions for compiling and installing BastionGuard are available in the official documentation:
https://bastionguard.eu/documentation/
Section: **BastionGuard - Technical Documentation – Application Install**
See the section:
**BastionGuard – Technical Documentation – Application Install**
When compiling BastionGuard from source, use the CMake configuration prepared for your Linux distribution. Each configuration includes distribution-specific dependency handling, packaging policies, CEF options, paths, and compatibility adjustments.
BastionGuard supports the following CMake init-system values:
```text
AUTO
SYSTEMD
OPENRC
SYSVINIT
DINIT
```
`AUTO` detects the active init system during CMake configuration.
For reproducible distribution packages, an explicit init system should be selected instead of `AUTO`.
Example:
```bash
cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr \
-DCMAKE_INSTALL_SYSCONFDIR=/etc \
-DBG_PACKAGING=ON \
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
-DENABLE_SYSTEMD_SERVICES=OFF \
-DENABLE_USER_AGENT_AUTO=OFF \
-DINSTALL_NGINX_DEFAULTS=OFF \
-DBASTIONGUARD_INIT_SYSTEM=OPENRC
```
Supported explicit values are:
```text
SYSTEMD
OPENRC
SYSVINIT
DINIT
```
Use a separate build directory for each init-system configuration.
## Supported Init Systems
BastionGuard provides native service integration for:
* systemd
* OpenRC
* SysVinit
* Dinit
Only the service definitions for the selected init system are installed.
The build system also makes `libsystemd` optional where possible, allowing BastionGuard to be built on distributions that do not use systemd.
The Secure Connection service uses the canonical service name:
```text
bsc-daemon
```
## Supported Distributions
# When compiling BastionGuard from source, you need to use the CMake file specific to your Linux distribution, as each configuration has been prepared specifically for the corresponding distro.
BastionGuard officially supports the following Linux distributions:
- Debian
- Ubuntu
- openSUSE
- Fedora
- Arch Linux
- OpenMandriva Lx
- Mageia 10
* Debian
* Ubuntu
* Fedora
* Arch Linux
* openSUSE
* OpenMandriva Lx
* Mageia 10
* Gentoo Linux
* Alpine Linux
In general, BastionGuard is compatible with all modern Linux distributions that use **systemd** as their init system.
Distribution-specific CMake files are provided where required.
Other distributions may work but are not officially tested.
### Gentoo Linux
Gentoo packaging is provided through an EAPI 8 ebuild.
The ebuild supports init-system selection through USE flags:
```text
systemd
sysvinit
dinit
```
When none of these flags is selected, OpenRC is used.
Optional build features include:
```text
cef
secure-connection
```
### Alpine Linux
Alpine Linux packaging is provided through an `APKBUILD`.
The Alpine package uses OpenRC:
```text
BASTIONGUARD_INIT_SYSTEM=OPENRC
```
The precompiled embedded CEF runtime is disabled in the Alpine package because Alpine uses musl libc and the bundled CEF runtime is not treated as a native musl-compatible component.
The rest of BastionGuard, including supported native services and Secure Connection, is built using Alpine-compatible dependencies.
## Packaging
BastionGuard includes or supports packaging configurations for:
* Debian and Ubuntu packages
* RPM-based distributions
* Arch Linux packages
* Gentoo ebuilds
* Alpine APKBUILD packages
Packaging builds should use:
```text
BG_PACKAGING=ON
BG_DEBIAN_NO_INSTALL_CODE=ON
ENABLE_SYSTEMD_SERVICES=OFF
ENABLE_USER_AGENT_AUTO=OFF
INSTALL_NGINX_DEFAULTS=OFF
```
These options prevent the build process from starting services, restarting system components, modifying user sessions, or performing privileged installation actions on the build host.
Package installation should be staged with `DESTDIR`.
Example:
```bash
DESTDIR="$PWD/pkg" cmake --install build
```
## Development and Release Process
@ -48,17 +179,19 @@ Development changes are tested extensively before being published. Commits are p
The main branch is not used to publish intentionally broken, incomplete, or untested development snapshots. Repository activity may therefore be less frequent than in projects that expose every intermediate development step.
This release model prioritizes reliability, deterministic behavior, and production safety.
This release model prioritizes reliability, deterministic behavior, compatibility, and production safety.
## License
This project is licensed under the GNU GPLv3.
See the LICENSE file for details.
This project is licensed under the GNU General Public License version 3.
See the `LICENSE` file for details.
## Trademark
"BastionGuard" and related branding are protected.
See TRADEMARK.md for details.
“BastionGuard” and related branding are protected.
See `TRADEMARK.md` for details.
## Issue Tracking
@ -70,4 +203,4 @@ https://bastionguard.eu/issues
## Contact
info@bastionguard.eu
[info@bastionguard.eu](mailto:info@bastionguard.eu)

123
alpine/APKBUILD Normal file
View file

@ -0,0 +1,123 @@
# Contributor: BastionGuard <info@bastionguard.eu>
# Maintainer: BastionGuard <info@bastionguard.eu>
pkgname=bastionguard
pkgver=2.0
pkgrel=0
pkgdesc="Transparent security control plane for Linux desktops"
url="https://bastionguard.eu/"
arch="x86_64"
license="GPL-3.0-only"
# Alpine uses OpenRC. The embedded upstream CEF binary is disabled because this
# recipe targets Alpine's musl userspace. Secure Browser requires an upstream
# musl-compatible CEF implementation before it can be enabled here.
options="!check net"
source="$pkgname-$pkgver.tar.gz::https://git.bastionguard.eu/specialworld83/BastionGuard/archive/v$pkgver.tar.gz"
builddir="$srcdir/BastionGuard"
# Runtime command dependencies. Shared-library dependencies are also discovered
# automatically by abuild from the installed ELF binaries.
depends="
bash
bubblewrap
clamav
dnsmasq
nginx
openrc
php84
polkit
rsync
sudo
"
makedepends="
build-base
cmake
gettext-dev
git
meson
ninja
pkgconf
python3
boost-dev
curl-dev
eudev-dev
glib-dev
glibmm-dev
grpc-dev
gtk4.0-dev
gtkmm4-dev
json-glib-dev
libbpf-dev
libgee-dev
libidn2-dev
libnetfilter_queue-dev
libsecret-dev
libshumate-dev
libsigc++-dev
libsoup3-dev
lzo-dev
nlohmann-json
openssl-dev
pangomm-dev
protobuf-dev
re2-dev
samba-dev
sqlite-dev
vala
vectorscan-dev
vte3-dev
yara-dev
zstd-dev
go
clang
linux-headers
help2man
mm-common
"
prepare() {
default_prepare
# Avoid reusing a CMake cache shipped accidentally in a source archive.
rm -rf build
}
build() {
cmake -S . -B build \
-G Ninja \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr \
-DCMAKE_INSTALL_SYSCONFDIR=/etc \
-DBG_PACKAGING=ON \
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
-DENABLE_SYSTEMD_SERVICES=OFF \
-DENABLE_USER_AGENT_AUTO=OFF \
-DINSTALL_NGINX_DEFAULTS=OFF \
-DBASTIONGUARD_INIT_SYSTEM=OPENRC \
-DENABLE_CEF=OFF \
-DENABLE_EMBEDDED_CEF=OFF \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DENABLE_BASTIONGUARD_SECURE_CONNECTION=ON
# Preserve the conservative single-job build used by the upstream PKGBUILD.
cmake --build build -- -j1
}
package() {
DESTDIR="$pkgdir" cmake --install build
install -dm750 \
"$pkgdir"/var/lib/bastionguard-webui/cache \
"$pkgdir"/var/lib/bastionguard-webui/quarantine \
"$pkgdir"/var/lib/bastionguard-webui/sessions \
"$pkgdir"/var/lib/bastionguard-webui/tmp
install -dm755 "$pkgdir"/var/log/bastionguard-webui
}
# Replace SKIP with a real checksum before submitting this recipe to aports:
# abuild checksum
sha512sums="SKIP"

85
cmake/BastionGuardInit.cmake Normal file
View file

@ -0,0 +1,85 @@
# BastionGuard init-system selection.
#
# BASTIONGUARD_INIT_SYSTEM may be AUTO, SYSTEMD, OPENRC, SYSVINIT or DINIT.
# AUTO is suitable for local builds. Distribution packages should pass an
# explicit value because the build host/chroot init may differ from the target.
set(BASTIONGUARD_INIT_SYSTEM "AUTO" CACHE STRING
"Init system used by BastionGuard: AUTO, SYSTEMD, OPENRC, SYSVINIT or DINIT")
set_property(CACHE BASTIONGUARD_INIT_SYSTEM PROPERTY STRINGS
AUTO SYSTEMD OPENRC SYSVINIT DINIT)
function(bastionguard_detect_init_system out_var)
string(TOUPPER "${BASTIONGUARD_INIT_SYSTEM}" _requested)
if(NOT _requested MATCHES "^(AUTO|SYSTEMD|OPENRC|SYSVINIT|DINIT)$")
message(FATAL_ERROR
"Invalid BASTIONGUARD_INIT_SYSTEM='${BASTIONGUARD_INIT_SYSTEM}'. "
"Use AUTO, SYSTEMD, OPENRC, SYSVINIT or DINIT.")
endif()
if(NOT _requested STREQUAL "AUTO")
set(${out_var} "${_requested}" PARENT_SCOPE)
return()
endif()
find_program(_BG_RC_SERVICE rc-service)
find_program(_BG_OPENRC_RUN openrc-run)
find_program(_BG_SYSTEMCTL systemctl)
find_program(_BG_DINITCTL dinitctl)
find_program(_BG_SERVICE service)
find_program(_BG_UPDATE_RC_D update-rc.d)
find_program(_BG_CHKCONFIG chkconfig)
# Prefer runtime markers, then the configured PID 1 implementation.
# Tool presence alone is only a fallback because compatibility commands
# can coexist with another init system.
set(_BG_INIT_REAL "")
if(EXISTS "/sbin/init")
get_filename_component(_BG_INIT_REAL "/sbin/init" REALPATH)
elseif(EXISTS "/usr/sbin/init")
get_filename_component(_BG_INIT_REAL "/usr/sbin/init" REALPATH)
endif()
string(TOLOWER "${_BG_INIT_REAL}" _BG_INIT_REAL_LOWER)
if(EXISTS "/run/openrc")
set(_detected "OPENRC")
elseif(EXISTS "/run/systemd/system")
set(_detected "SYSTEMD")
elseif(EXISTS "/dev/dinitctl" OR EXISTS "/run/dinitctl")
set(_detected "DINIT")
elseif(_BG_INIT_REAL_LOWER MATCHES "openrc")
set(_detected "OPENRC")
elseif(_BG_INIT_REAL_LOWER MATCHES "systemd")
set(_detected "SYSTEMD")
elseif(_BG_INIT_REAL_LOWER MATCHES "(^|/)dinit($|[-.])")
set(_detected "DINIT")
elseif(_BG_INIT_REAL_LOWER MATCHES "sysvinit")
set(_detected "SYSVINIT")
elseif(_BG_RC_SERVICE AND _BG_OPENRC_RUN)
set(_detected "OPENRC")
elseif(_BG_DINITCTL AND NOT _BG_SYSTEMCTL)
set(_detected "DINIT")
message(WARNING
"No active init marker found; selecting DINIT because dinitctl is "
"available and systemctl is not. Set -DBASTIONGUARD_INIT_SYSTEM "
"explicitly for reproducible packages.")
elseif(_BG_SYSTEMCTL)
# Packaging fallback when configuring in a chroot without a running
# PID 1. Pass an explicit value for reproducible packages.
set(_detected "SYSTEMD")
message(WARNING
"No active init marker found; selecting SYSTEMD because systemctl "
"is available. Set -DBASTIONGUARD_INIT_SYSTEM explicitly for "
"reproducible packages.")
elseif(EXISTS "/etc/init.d" AND
(_BG_SERVICE OR _BG_UPDATE_RC_D OR _BG_CHKCONFIG))
set(_detected "SYSVINIT")
else()
message(FATAL_ERROR
"Unable to detect the init system. Set "
"-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD|OPENRC|SYSVINIT|DINIT.")
endif()
set(${out_var} "${_detected}" PARENT_SCOPE)
endfunction()

4
data/init/common/bastionguard-init-config.in Normal file
View file

@ -0,0 +1,4 @@
# Generated by CMake. Sourced by bastionguard-service.
BG_DINIT_SYSTEM_DIR='@BASTIONGUARD_DINIT_SYSTEM_DIR@'
BG_DINIT_USER_DIR='@BASTIONGUARD_DINIT_USER_DIR@'
BG_DINIT_ENABLE_DIR='@BG_DINIT_ENABLE_DIR@'

69
data/init/common/bastionguard-periodic Executable file
View file

@ -0,0 +1,69 @@
#!/bin/sh
# Run a command repeatedly without depending on systemd timers or cron.
set -u
interval=7200
delay=0
usage() {
echo "usage: $0 [--delay SECONDS] [--interval SECONDS] -- command [args...]" >&2
exit 64
}
while [ "$#" -gt 0 ]; do
case "$1" in
--delay)
[ "$#" -ge 2 ] || usage
delay=$2
shift 2
;;
--interval)
[ "$#" -ge 2 ] || usage
interval=$2
shift 2
;;
--)
shift
break
;;
*) usage ;;
esac
done
[ "$#" -gt 0 ] || usage
case "$delay:$interval" in
*[!0-9:]*|:*|*:0) usage ;;
esac
running=1
child=""
terminate() {
running=0
if [ -n "$child" ]; then
kill "$child" 2>/dev/null || true
fi
}
trap terminate INT TERM HUP
sleep_interruptible() {
seconds=$1
[ "$seconds" -eq 0 ] && return 0
sleep "$seconds" &
child=$!
wait "$child" 2>/dev/null || true
child=""
}
sleep_interruptible "$delay"
while [ "$running" -eq 1 ]; do
"$@" || true
[ "$running" -eq 1 ] || break
sleep_interruptible "$interval"
done
exit 0

14
data/init/common/bastionguard-sanesecurity-update Executable file
View file

@ -0,0 +1,14 @@
#!/bin/sh
set -u
SERVICECTL=/usr/libexec/bastionguard/bastionguard-service
/usr/bin/BastionGuard --update-sanesecurity
status=$?
if [ "$status" -eq 0 ]; then
"$SERVICECTL" --system try-reload-or-restart clamav-daemon.service 2>/dev/null || \
"$SERVICECTL" --system try-reload-or-restart clamd.service 2>/dev/null || true
fi
exit "$status"

1041
data/init/common/bastionguard-service Executable file
View file

File diff suppressed because it is too large Load diff

113
data/init/common/bastionguard-supervise Executable file
View file

@ -0,0 +1,113 @@
#!/bin/sh
# Minimal foreground supervisor for init systems without native Restart=.
set -u
restart=on-failure
delay=5
workdir=/
logfile=""
usage() {
echo "usage: $0 [--restart always|on-failure|never] [--delay SEC] [--chdir DIR] [--log FILE] -- command [args...]" >&2
exit 64
}
while [ "$#" -gt 0 ]; do
case "$1" in
--restart)
[ "$#" -ge 2 ] || usage
restart=$2
shift 2
;;
--delay)
[ "$#" -ge 2 ] || usage
delay=$2
shift 2
;;
--chdir)
[ "$#" -ge 2 ] || usage
workdir=$2
shift 2
;;
--log)
[ "$#" -ge 2 ] || usage
logfile=$2
shift 2
;;
--)
shift
break
;;
*) usage ;;
esac
done
[ "$#" -gt 0 ] || usage
case "$restart" in always|on-failure|never) ;; *) usage ;; esac
case "$delay" in ""|*[!0-9]*) usage ;; esac
[ -d "$workdir" ] || mkdir -p "$workdir" 2>/dev/null || exit 73
if [ -n "$logfile" ]; then
logdir=$(dirname "$logfile")
[ -d "$logdir" ] || mkdir -p "$logdir" 2>/dev/null || exit 73
fi
stopping=0
child=""
forward_term() {
stopping=1
if [ -n "$child" ]; then
target=$child
kill -TERM "$target" 2>/dev/null || true
count=0
while kill -0 "$target" 2>/dev/null && [ "$count" -lt 30 ]; do
sleep 0.1
count=$((count + 1))
done
kill -KILL "$target" 2>/dev/null || true
fi
}
forward_hup() {
if [ -n "$child" ]; then
kill -HUP "$child" 2>/dev/null || true
fi
}
trap forward_term INT TERM
trap forward_hup HUP
while [ "$stopping" -eq 0 ]; do
(
cd "$workdir" || exit 73
if [ -n "$logfile" ]; then
exec "$@" >>"$logfile" 2>&1
fi
exec "$@"
) &
child=$!
wait "$child"
status=$?
child=""
[ "$stopping" -eq 0 ] || exit 0
case "$restart" in
never) exit "$status" ;;
on-failure)
[ "$status" -ne 0 ] || exit 0
;;
always) ;;
esac
[ "$delay" -eq 0 ] || {
sleep "$delay" &
child=$!
wait "$child" 2>/dev/null || true
child=""
}
done
exit 0

9
data/init/common/bastionguard-user-services.desktop Normal file
View file

@ -0,0 +1,9 @@
[Desktop Entry]
Type=Application
Name=BastionGuard user services
Comment=Start enabled BastionGuard per-user services
Exec=/usr/libexec/bastionguard/bastionguard-service --user start-enabled
Terminal=false
NoDisplay=true
X-GNOME-Autostart-enabled=true
X-KDE-autostart-after=panel

4
data/init/dinit/bastionguard-dinit-root.in Normal file
View file

@ -0,0 +1,4 @@
# BastionGuard Dinit service group.
type = internal
waits-for.d = @BG_DINIT_ENABLE_DIR@
@meta enable-via boot

57
data/init/dinit/bastionguard-dinit-run Executable file
View file

@ -0,0 +1,57 @@
#!/bin/sh
# Execute one BastionGuard system service under Dinit supervision.
set -eu
name=${1-}
[ "$#" -eq 1 ] || {
echo "usage: bastionguard-dinit-run SERVICE" >&2
exit 64
}
case "$name" in
BastionGuard-phishing-scanner)
cd /usr/share/BastionGuard
exec /usr/bin/BastionGuard-daemon \
--http-port=81 --https-port=444 \
--bind-address=127.0.0.2 \
--page-warning=/usr/share/BastionGuard/data/blocking/block.html
;;
BastionGuard-phishing-updater)
exec /usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-phishing-updater-timer)
exec /usr/libexec/bastionguard/bastionguard-periodic \
--delay 600 --interval 7200 -- \
/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-ransomware-realtime)
exec /usr/bin/BastionGuard-ransomware-realtime
;;
bastionguard-sanesecurity)
exec /usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
bastionguard-sanesecurity-timer)
exec /usr/libexec/bastionguard/bastionguard-periodic \
--delay 300 --interval 7200 -- \
/usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
BastionGuard-usbd)
exec /usr/bin/BastionGuard-usbd
;;
bsc-daemon)
exec /usr/sbin/bsc-daemon \
--rules-path /etc/bastionguard-secure-connectiond/rules \
--ui-socket unix:///tmp/bsd-daemon.sock
;;
clamav-clamonacc)
exec /usr/sbin/clamonacc \
-F --fdpass \
--log=/var/log/clamav/clamonacc.log \
--move=/root/quarantine
;;
*)
echo "Unknown BastionGuard Dinit system service: $name" >&2
exit 5
;;
esac

8
data/init/dinit/bastionguard-dinit-service.in Normal file
View file

@ -0,0 +1,8 @@
# Generated BastionGuard Dinit system service.
type = @BG_DINIT_SERVICE_TYPE@
command = /usr/libexec/bastionguard/bastionguard-dinit-run @BG_DINIT_SERVICE_NAME@
restart = @BG_DINIT_SERVICE_RESTART@
@BG_DINIT_SERVICE_RESTART_OPTIONS@
log-type = buffer
log-buffer-size = 1048576
@meta enable-via bastionguard

51
data/init/dinit/bastionguard-dinit-user-run Executable file
View file

@ -0,0 +1,51 @@
#!/bin/sh
# Execute one BastionGuard per-user service under a Dinit user manager.
set -eu
name=${1-}
[ "$#" -eq 1 ] || {
echo "usage: bastionguard-dinit-user-run SERVICE" >&2
exit 64
}
case "$name" in
BastionGuard-useragent|BastionGuard-ransomware-alert)
exec /usr/bin/BastionGuard-ransomware-alert
;;
BastionGuard-privacyd)
exec /usr/bin/BastionGuard-privacyd
;;
BastionGuard-ransomware-realtime-alert)
exec /usr/bin/BastionGuard-ransomware-realtime-alert
;;
BastionGuard-ransomware-scanner)
workdir=${HOME:-/tmp}/.local/share/BastionGuard
mkdir -p "$workdir"
cd "$workdir"
exec /usr/bin/BastionGuard-ransomware-scanner \
--0day-protection \
/usr/share/BastionGuard/data/0day_ransomware_protection/ZeroDay.yara
;;
BastionGuard-pacd|bastionguard-pacd)
exec /usr/bin/bastionguard-pacd \
--listen 127.0.0.1 --port 8765 \
--stub-host 127.0.0.1 --stub-port 3129 \
--backend-host 127.0.0.1 --backend-port 3130 \
--trigger-cmd "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service" \
--backend-wait-ms 4000
;;
BastionGuard-mailproxy)
exec /usr/bin/BastionGuard-mailproxy
;;
BastionGuard-user-session-watch)
exec /usr/share/BastionGuard/data/scripts/BastionGuard-user-session-watch.sh
;;
BastionGuard-cef)
exec /usr/bin/bastionguard-cef --listen 127.0.0.1 --port 3130
;;
*)
echo "Unknown BastionGuard Dinit user service: $name" >&2
exit 5
;;
esac

10
data/init/dinit/bastionguard-dinit-user-service.in Normal file
View file

@ -0,0 +1,10 @@
# Generated BastionGuard Dinit user service.
type = process
command = /usr/libexec/bastionguard/bastionguard-dinit-user-run @BG_DINIT_USER_SERVICE_NAME@
restart = @BG_DINIT_USER_SERVICE_RESTART@
restart-delay = @BG_DINIT_USER_RESTART_DELAY@
restart-limit-count = 0
log-type = buffer
log-buffer-size = 1048576
load-options = export-passwd-vars
@meta enable-via boot

142
data/init/openrc/bastionguard-openrc-service Executable file
View file

@ -0,0 +1,142 @@
#!/sbin/openrc-run
# Generic OpenRC dispatcher installed under each BastionGuard service name.
name="${RC_SVCNAME:-$(basename "$0")}"
description="BastionGuard service: ${name}"
pidfile="/run/${name}.pid"
logdir=/var/log/BastionGuard
extra_commands="reload"
is_oneshot() {
case "$name" in
BastionGuard-phishing-updater|bastionguard-sanesecurity) return 0 ;;
*) return 1 ;;
esac
}
depend() {
need localmount
use net dbus dnsmasq
after bootmisc dbus udev
}
start_pre() {
checkpath --directory --mode 0755 "$logdir"
checkpath --directory --mode 0755 /run
}
start_bg() {
daemon=$1
shift
start-stop-daemon --start --quiet --background --make-pidfile \
--pidfile "$pidfile" --startas "$daemon" -- "$@"
}
start_supervised() {
policy=$1
delay=$2
workdir=$3
daemon=$4
shift 4
start_bg /usr/libexec/bastionguard/bastionguard-supervise \
--restart "$policy" --delay "$delay" --chdir "$workdir" \
--log "$logdir/$name.log" -- \
"$daemon" "$@"
}
start() {
ebegin "Starting ${name}"
case "$name" in
BastionGuard-phishing-scanner)
start_supervised on-failure 5 /usr/share/BastionGuard \
/usr/bin/BastionGuard-daemon \
--http-port=81 --https-port=444 \
--bind-address=127.0.0.2 \
--page-warning=/usr/share/BastionGuard/data/blocking/block.html
;;
BastionGuard-phishing-updater)
/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-phishing-updater-timer)
start_supervised on-failure 5 / \
/usr/libexec/bastionguard/bastionguard-periodic \
--delay 600 --interval 7200 -- \
/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-ransomware-realtime)
start_supervised on-failure 5 / \
/usr/bin/BastionGuard-ransomware-realtime
;;
bastionguard-sanesecurity)
/usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
bastionguard-sanesecurity-timer)
start_supervised on-failure 5 / \
/usr/libexec/bastionguard/bastionguard-periodic \
--delay 300 --interval 7200 -- \
/usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
BastionGuard-usbd)
start_supervised on-failure 5 / \
/usr/bin/BastionGuard-usbd
;;
bsc-daemon)
start_supervised on-failure 5 / \
/usr/sbin/bsc-daemon \
--rules-path /etc/bastionguard-secure-connectiond/rules \
--ui-socket unix:///tmp/bsd-daemon.sock
;;
clamav-clamonacc)
start_supervised on-failure 5 / /usr/sbin/clamonacc \
-F --fdpass \
--log=/var/log/clamav/clamonacc.log \
--move=/root/quarantine
;;
*)
eerror "Unknown BastionGuard OpenRC service: ${name}"
eend 1
return 1
;;
esac
eend $?
}
stop() {
if is_oneshot; then
return 0
fi
ebegin "Stopping ${name}"
start-stop-daemon --stop --quiet --retry TERM/10/KILL/5 --pidfile "$pidfile"
rc=$?
rm -f "$pidfile"
eend "$rc"
}
status() {
if is_oneshot; then
return 3
fi
start-stop-daemon --stop --test --quiet --pidfile "$pidfile"
}
reload() {
ebegin "Reloading ${name}"
case "$name" in
BastionGuard-phishing-scanner)
/usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service
;;
bsc-daemon)
ewarn "bsc-daemon does not support reload; use restart"
return 3
;;
*)
if [ -r "$pidfile" ]; then
kill -HUP "$(cat "$pidfile")" 2>/dev/null
else
return 3
fi
;;
esac
eend $?
}

183
data/init/sysvinit/bastionguard-sysv-service.in Executable file
View file

@ -0,0 +1,183 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: @BG_SYSV_SERVICE_NAME@
# Required-Start: $local_fs $remote_fs $network
# Required-Stop: $local_fs $remote_fs $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: BastionGuard service dispatcher
### END INIT INFO
PATH=/sbin:/usr/sbin:/bin:/usr/bin
name=$(basename "$0")
pidfile="/run/${name}.pid"
logdir=/var/log/BastionGuard
mkdir -p "$logdir" /run 2>/dev/null || true
is_oneshot() {
case "$name" in
BastionGuard-phishing-updater|bastionguard-sanesecurity) return 0 ;;
*) return 1 ;;
esac
}
is_running() {
[ -r "$pidfile" ] || return 1
pid=$(cat "$pidfile" 2>/dev/null || true)
case "$pid" in *[!0-9]*|"") return 1 ;; esac
kill -0 "$pid" 2>/dev/null
}
start_bg() {
daemon=$1
shift
if is_running; then
return 0
fi
if command -v start-stop-daemon >/dev/null 2>&1; then
start-stop-daemon --start --quiet --background --make-pidfile \
--pidfile "$pidfile" --startas "$daemon" -- "$@"
else
nohup "$daemon" "$@" >>"$logdir/$name.log" 2>&1 &
printf '%s\n' "$!" > "$pidfile"
fi
}
start_supervised() {
policy=$1
delay=$2
workdir=$3
daemon=$4
shift 4
start_bg /usr/libexec/bastionguard/bastionguard-supervise \
--restart "$policy" --delay "$delay" --chdir "$workdir" \
--log "$logdir/$name.log" -- \
"$daemon" "$@"
}
start_service() {
case "$name" in
BastionGuard-phishing-scanner)
start_supervised on-failure 5 /usr/share/BastionGuard \
/usr/bin/BastionGuard-daemon \
--http-port=81 --https-port=444 \
--bind-address=127.0.0.2 \
--page-warning=/usr/share/BastionGuard/data/blocking/block.html
;;
BastionGuard-phishing-updater)
/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-phishing-updater-timer)
start_supervised on-failure 5 / \
/usr/libexec/bastionguard/bastionguard-periodic \
--delay 600 --interval 7200 -- \
/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
;;
BastionGuard-ransomware-realtime)
start_supervised on-failure 5 / \
/usr/bin/BastionGuard-ransomware-realtime
;;
bastionguard-sanesecurity)
/usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
bastionguard-sanesecurity-timer)
start_supervised on-failure 5 / \
/usr/libexec/bastionguard/bastionguard-periodic \
--delay 300 --interval 7200 -- \
/usr/libexec/bastionguard/bastionguard-sanesecurity-update
;;
BastionGuard-usbd)
start_supervised on-failure 5 / \
/usr/bin/BastionGuard-usbd
;;
bsc-daemon)
start_supervised on-failure 5 / \
/usr/sbin/bsc-daemon \
--rules-path /etc/bastionguard-secure-connectiond/rules \
--ui-socket unix:///tmp/bsd-daemon.sock
;;
clamav-clamonacc)
start_supervised on-failure 5 / /usr/sbin/clamonacc \
-F --fdpass \
--log=/var/log/clamav/clamonacc.log \
--move=/root/quarantine
;;
*)
echo "Unknown BastionGuard SysV service: $name" >&2
return 5
;;
esac
}
stop_service() {
if is_oneshot; then
return 0
fi
[ -r "$pidfile" ] || return 0
if command -v start-stop-daemon >/dev/null 2>&1; then
start-stop-daemon --stop --quiet --retry TERM/10/KILL/5 --pidfile "$pidfile" || true
else
pid=$(cat "$pidfile" 2>/dev/null || true)
case "$pid" in
*[!0-9]*|"") ;;
*)
kill "$pid" 2>/dev/null || true
count=0
while kill -0 "$pid" 2>/dev/null && [ "$count" -lt 100 ]; do
sleep 0.1
count=$((count + 1))
done
kill -KILL "$pid" 2>/dev/null || true
;;
esac
fi
rm -f "$pidfile"
}
reload_service() {
case "$name" in
BastionGuard-phishing-scanner)
/usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service
;;
bsc-daemon)
echo "bsc-daemon does not support reload; use restart" >&2
return 3
;;
*)
is_running || return 3
kill -HUP "$(cat "$pidfile")"
;;
esac
}
case "${1-}" in
start)
echo "Starting $name"
start_service
;;
stop)
echo "Stopping $name"
stop_service
;;
restart|force-reload)
stop_service
start_service
;;
reload)
reload_service
;;
status)
if is_running; then
echo "$name is running"
exit 0
fi
echo "$name is not running"
exit 3
;;
*)
echo "Usage: $0 {start|stop|restart|reload|force-reload|status}" >&2
exit 64
;;
esac

567
data/scripts/install-ca-system.sh
View file

@ -1,11 +1,26 @@
#!/bin/bash
# /usr/share/BastionGuard/data/scripts/install-ca-system.sh
set -euo pipefail
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
CA_NAME="BastionGuard-CA"
# Unica identità della CA usata dal proxy, dai trust store e dai database NSS.
CA_NICKNAME="BastionGuard Intercept CA"
CA_FILE_BASENAME="BastionGuard-Intercept-CA"
CA_DEFAULT_SUBJECT="/O=BastionGuard/CN=BastionGuard Intercept CA"
CA_VALIDITY_DAYS="${BASTIONGUARD_CA_VALIDITY_DAYS:-3650}"
CA_RENEW_BEFORE_DAYS="${BASTIONGUARD_CA_RENEW_BEFORE_DAYS:-30}"
[[ "$CA_VALIDITY_DAYS" =~ ^[0-9]+$ ]] && (( CA_VALIDITY_DAYS >= 365 )) || {
echo "[BastionGuard] ❌ BASTIONGUARD_CA_VALIDITY_DAYS deve essere un intero >= 365" >&2
exit 1
}
[[ "$CA_RENEW_BEFORE_DAYS" =~ ^[0-9]+$ ]] || {
echo "[BastionGuard] ❌ BASTIONGUARD_CA_RENEW_BEFORE_DAYS deve essere un intero >= 0" >&2
exit 1
}
log() { echo "[BastionGuard] $*"; }
warn() { echo "[BastionGuard] ⚠️ $*" >&2; }
@ -318,6 +333,16 @@ validate_ca() {
err "Il certificato non ha Basic Constraints CA:TRUE"
exit 1
fi
if ! openssl x509 -in "$CA_SRC" -noout -text 2>/dev/null \
| grep -A3 -i "X509v3 Key Usage" \
| grep -qiE "Certificate Sign|keyCertSign"; then
err "Il certificato non permette la firma di certificati (keyCertSign)"
exit 1
fi
if ! openssl verify -CAfile "$CA_SRC" "$CA_SRC" >/dev/null 2>&1; then
err "La CA non è autofirmata correttamente: $CA_SRC"
exit 1
fi
}
@ -336,40 +361,26 @@ current_ca_fingerprint_sha256() {
ca_fingerprint_sha256 "$CA_SRC"
}
is_current_ca_file() {
local cert="$1"
[[ -f "$cert" && -f "$CA_SRC" ]] || return 1
local fp_current fp_candidate
fp_current="$(current_ca_fingerprint_sha256 || true)"
fp_candidate="$(ca_fingerprint_sha256 "$cert" || true)"
[[ -n "$fp_current" && -n "$fp_candidate" && "$fp_current" == "$fp_candidate" ]]
}
remove_old_ca_file_if_needed() {
local cert="$1"
[[ -n "$cert" && -f "$cert" ]] || return 0
# Mai rimuovere il sorgente della CA corrente, anche se è in /etc.
# Non eliminare mai il certificato sorgente usato dal proxy.
if [[ "$(readlink -m -- "$cert")" == "$(readlink -m -- "$CA_SRC")" ]]; then
return 0
fi
# Rimuove solo file che sembrano davvero CA/cert BastionGuard.
# Tocca soltanto certificati che dichiarano BastionGuard/intercept nel subject
# o nell'issuer. In questo modo non rimuove CA estranee dal trust store.
if ! openssl x509 -in "$cert" -noout >/dev/null 2>&1; then
return 0
fi
if ! openssl x509 -in "$cert" -noout -subject -issuer 2>/dev/null | grep -qiE 'BastionGuard|intercept'; then
if ! openssl x509 -in "$cert" -noout -subject -issuer 2>/dev/null \
| grep -qi 'BastionGuard'; then
return 0
fi
if is_current_ca_file "$cert"; then
log "CA già aggiornata nel trust store: $cert"
return 0
fi
log "Rimuovo vecchia CA BastionGuard: $cert"
log "Rimuovo copia CA BastionGuard preesistente: $cert"
rm -f -- "$cert" 2>/dev/null || warn "Impossibile rimuovere vecchia CA: $cert"
}
@ -450,13 +461,13 @@ nss_delete_matching_nicknames_root() {
local nick line
# Nickname noti.
for nick in "$CA_NAME" "BastionGuard Intercept CA" "BastionGuard CA" "BastionGuard-ca"; do
for nick in "$CA_NICKNAME" "BastionGuard-CA" "BastionGuard CA" "BastionGuard-ca"; do
certutil -D -d "$prefix" -n "$nick" >/dev/null 2>&1 || true
done
# Nickname imprevisti ma riconoscibili in certutil -L.
while IFS= read -r line; do
[[ "$line" =~ [Bb]astion[Gg]uard|[Ii]ntercept ]] || continue
[[ "$line" =~ [Bb]astion[Gg]uard ]] || continue
[[ "$line" =~ ^Certificate ]] && continue
[[ "$line" =~ ^-+ ]] && continue
nick="$(printf '%s\n' "$line" | sed -E 's/[[:space:]]+[A-Za-z,]+$//; s/[[:space:]]+$//')"
@ -473,13 +484,13 @@ nss_delete_matching_nicknames_user() {
local nick line
# Nickname noti.
for nick in "$CA_NAME" "BastionGuard Intercept CA" "BastionGuard CA" "BastionGuard-ca"; do
for nick in "$CA_NICKNAME" "BastionGuard-CA" "BastionGuard CA" "BastionGuard-ca"; do
run_as_real_user certutil -D -d "$prefix" -n "$nick" >/dev/null 2>&1 || true
done
# Nickname imprevisti ma riconoscibili in certutil -L.
while IFS= read -r line; do
[[ "$line" =~ [Bb]astion[Gg]uard|[Ii]ntercept ]] || continue
[[ "$line" =~ [Bb]astion[Gg]uard ]] || continue
[[ "$line" =~ ^Certificate ]] && continue
[[ "$line" =~ ^-+ ]] && continue
nick="$(printf '%s\n' "$line" | sed -E 's/[[:space:]]+[A-Za-z,]+$//; s/[[:space:]]+$//')"
@ -547,278 +558,185 @@ close_running_browsers() {
done
sleep 1
}
# ── Controlla e corregge il mismatch tra certificato e chiave privata ─────────
#
# Logica:
# 1. Cerca la chiave privata nello stesso percorso del certificato,
# oppure nelle posizioni canoniche di BastionGuard.
# 2. Confronta il modulus/pubkey del cert con quello della chiave.
# 3. Se combaciano → tutto OK, nessuna azione.
# 4. Se NON combaciano → rigenera SOLO il certificato (self-signed) usando
# la chiave esistente, mantenendo i metadati originali (CN, days).
# 5. Se la chiave non esiste affatto → genera ex-novo coppia chiave + cert.
#
check_and_fix_key_mismatch() {
log "Controllo mismatch chiave/certificato…"
# ── Mantiene una sola coppia CA/chiave canonica ───────────────────────────────
# La CA del proxy è sempre CA_SRC; la chiave canonica è intercept-ca.key.pem
# accanto al certificato. Lo script rigenera il certificato quando è assente,
# corrotto, non-CA, non autofirmato, non corrisponde alla chiave oppure è
# scaduto/in scadenza. Tutti i trust store ricevono poi esattamente CA_SRC.
canonical_ca_key_path() {
local dir base
dir="$(dirname "$CA_SRC")"
base="$(basename "$CA_SRC")"
base="${base%.crt.pem}"
base="${base%.crt}"
base="${base%.pem}"
printf '%s/%s.key.pem' "$dir" "$base"
}
# Se il certificato non esiste affatto, salta direttamente al CASO B
if [[ ! -f "$CA_SRC" ]]; then
warn "Certificato non trovato: $CA_SRC — genero nuova coppia chiave+certificato"
mkdir -p "$(dirname "$CA_SRC")"
fix_user_ca_permissions
local new_key_path
new_key_path="$(dirname "$CA_SRC")/$(basename "${CA_SRC%.crt.pem}").key.pem"
new_key_path="${new_key_path%.pem.pem}.pem"
local orig_subject="/CN=${CA_NAME}/O=BastionGuard/OU=Security"
if ! openssl genrsa -out "$new_key_path" 4096 >/dev/null 2>&1; then
err "Generazione chiave RSA fallita"; exit 1
fi
chmod 600 "$new_key_path"
[[ -n "${REAL_USER:-}" ]] && chown "$REAL_USER:$REAL_GROUP" "$new_key_path" 2>/dev/null || true
log "Nuova chiave privata: $new_key_path"
if openssl req -new -x509 -key "$new_key_path" -out "$CA_SRC" -days 3650 \
-subj "$orig_subject" \
-addext "basicConstraints=critical,CA:TRUE" \
-addext "keyUsage=critical,keyCertSign,cRLSign" \
>/dev/null 2>&1; then
log "✅ Nuova coppia chiave+certificato generata (3650 giorni)"
else
local tmp_ext; tmp_ext="$(mktemp /tmp/ca_ext_XXXXXX.cnf)"
printf '[req]
pubkey_fingerprint_from_cert() {
openssl x509 -in "$1" -pubkey -noout 2>/dev/null \
| openssl pkey -pubin -outform DER 2>/dev/null \
| sha256sum | awk '{print $1}'
}
pubkey_fingerprint_from_key() {
openssl pkey -in "$1" -pubout -outform DER 2>/dev/null \
| sha256sum | awk '{print $1}'
}
certificate_has_expected_subject() {
openssl x509 -in "$CA_SRC" -noout -subject -nameopt RFC2253 2>/dev/null \
| grep -Fq "CN=${CA_NICKNAME}"
}
certificate_is_usable_ca() {
[[ -f "$CA_SRC" ]] || return 1
openssl x509 -in "$CA_SRC" -noout >/dev/null 2>&1 || return 1
openssl x509 -in "$CA_SRC" -noout -text 2>/dev/null | grep -q 'CA:TRUE' || return 1
openssl x509 -in "$CA_SRC" -noout -text 2>/dev/null \
| grep -A3 -i 'X509v3 Key Usage' \
| grep -qiE 'Certificate Sign|keyCertSign' || return 1
openssl verify -CAfile "$CA_SRC" "$CA_SRC" >/dev/null 2>&1 || return 1
return 0
}
generate_ca_certificate_with_key() {
local key="$1"
local tmp_ext=""
if openssl req -new -x509 \
-key "$key" \
-out "$CA_SRC" \
-days "$CA_VALIDITY_DAYS" \
-subj "$CA_DEFAULT_SUBJECT" \
-addext 'basicConstraints=critical,CA:TRUE,pathlen:0' \
-addext 'keyUsage=critical,keyCertSign,cRLSign' \
-addext 'subjectKeyIdentifier=hash' \
-addext 'authorityKeyIdentifier=keyid:always' \
>/dev/null 2>&1; then
return 0
fi
# Compatibilità con OpenSSL senza -addext.
tmp_ext="$(mktemp /tmp/bastionguard-ca.XXXXXX.cnf)"
cat > "$tmp_ext" <<'EOF_CA_CONF'
[req]
distinguished_name = req_dn
x509_extensions = v3_ca
prompt = no
[req_dn]
CN = %s
O = BastionGuard
OU = Security
CN = BastionGuard Intercept CA
[v3_ca]
basicConstraints = critical, CA:TRUE
basicConstraints = critical, CA:TRUE, pathlen:0
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
' "${CA_NAME}" > "$tmp_ext"
openssl req -new -x509 -key "$new_key_path" -out "$CA_SRC" -days 3650 -config "$tmp_ext" >/dev/null 2>&1 \
&& log "✅ Nuova coppia chiave+certificato generata (compat mode, 3650 giorni)" \
|| { err "Impossibile generare il certificato"; rm -f "$tmp_ext"; exit 1; }
rm -f "$tmp_ext"
fi
[[ -n "${REAL_USER:-}" ]] && chown "$REAL_USER:$REAL_GROUP" "$CA_SRC" 2>/dev/null || true
fix_user_ca_permissions
log "✅ Certificato generato, procedo con l'installazione"
return 0
authorityKeyIdentifier = keyid:always
EOF_CA_CONF
if ! openssl req -new -x509 \
-key "$key" \
-out "$CA_SRC" \
-days "$CA_VALIDITY_DAYS" \
-config "$tmp_ext" \
>/dev/null 2>&1; then
rm -f "$tmp_ext"
return 1
fi
rm -f "$tmp_ext"
}
check_and_fix_key_mismatch() {
log "Controllo CA canonica, chiave, validità ed estensioni…"
local canonical_key
canonical_key="$(canonical_ca_key_path)"
mkdir -p "$(dirname "$canonical_key")"
# Recupera una chiave legacy soltanto se quella canonica non esiste.
if [[ ! -f "$canonical_key" ]]; then
local candidate
for candidate in \
"$(dirname "$CA_SRC")/intercept-ca.key" \
"$(dirname "$CA_SRC")/BastionGuard-CA.key.pem" \
"$(dirname "$CA_SRC")/BastionGuard-CA.key" \
/etc/BastionGuard/certs/intercept-ca.key.pem \
/etc/BastionGuard/certs/intercept-ca.key \
/etc/BastionGuard/certs/BastionGuard-CA.key.pem \
/etc/BastionGuard/certs/BastionGuard-CA.key
do
[[ -f "$candidate" ]] || continue
if openssl pkey -in "$candidate" -noout >/dev/null 2>&1; then
install -m 0600 "$candidate" "$canonical_key"
log "Chiave legacy copiata nel percorso canonico: $canonical_key"
break
fi
done
fi
# ── Individua la chiave privata ──────────────────────────────────────────
local key_candidates=()
# 1. Stesso basename del cert, estensione .key o .key.pem
local base="${CA_SRC%.crt.pem}"
base="${base%.crt}"
base="${base%.pem}"
key_candidates+=( "${base}.key" "${base}.key.pem" )
# 2. Posizioni canoniche BastionGuard
local cert_dir
cert_dir="$(dirname "$CA_SRC")"
key_candidates+=(
"${cert_dir}/intercept-ca.key.pem"
"${cert_dir}/intercept-ca.key"
"${cert_dir}/${CA_NAME}.key.pem"
"${cert_dir}/${CA_NAME}.key"
"/etc/BastionGuard/certs/intercept-ca.key.pem"
"/etc/BastionGuard/certs/intercept-ca.key"
"/etc/BastionGuard/certs/${CA_NAME}.key.pem"
"/etc/BastionGuard/certs/${CA_NAME}.key"
)
# Se l'utente reale ha una home, aggiungi anche lì
if [[ -n "${REAL_HOME:-}" ]]; then
local ud="$REAL_HOME/.local/share/BastionGuard/certs"
key_candidates+=(
"${ud}/intercept-ca.key.pem"
"${ud}/intercept-ca.key"
"${ud}/${CA_NAME}.key.pem"
"${ud}/${CA_NAME}.key"
)
fi
local CA_KEY=""
for c in "${key_candidates[@]}"; do
if [[ -f "$c" ]]; then
CA_KEY="$c"
break
fi
done
# ── Funzione interna: ottieni fingerprint pubkey di cert o key ───────────
_pubkey_fp_from_cert() { openssl x509 -in "$1" -noout -pubkey 2>/dev/null | openssl pkey -pubin -noout -text 2>/dev/null | sha256sum; }
_pubkey_fp_from_key() { openssl pkey -in "$1" -pubout 2>/dev/null | openssl pkey -pubin -noout -text 2>/dev/null | sha256sum; }
# ── CASO A: chiave trovata ───────────────────────────────────────────────
if [[ -n "$CA_KEY" ]]; then
log "Chiave privata trovata: $CA_KEY"
# Verifica che la chiave sia leggibile/valida
if ! openssl pkey -in "$CA_KEY" -noout >/dev/null 2>&1; then
warn "Chiave privata non valida o corrotta: $CA_KEY"
warn "Genero nuova coppia chiave+certificato"
CA_KEY="" # cade nel CASO B
fi
fi
if [[ -n "$CA_KEY" ]]; then
local fp_cert fp_key
fp_cert="$(_pubkey_fp_from_cert "$CA_SRC")"
fp_key="$( _pubkey_fp_from_key "$CA_KEY")"
if [[ "$fp_cert" == "$fp_key" ]]; then
fix_user_ca_permissions
log "✅ Chiave e certificato combaciano — nessun intervento necessario"
return 0
fi
warn "⚠️ MISMATCH rilevato: la chiave pubblica nel certificato NON corrisponde a $CA_KEY"
log "Rigenero il certificato usando la chiave esistente…"
# Leggo i metadati dall'attuale certificato
local subject days_left not_after now_ts exp_ts remaining_days
subject="$(openssl x509 -in "$CA_SRC" -noout -subject 2>/dev/null | sed 's/^subject=//')"
not_after="$(openssl x509 -in "$CA_SRC" -noout -enddate 2>/dev/null | cut -d= -f2)"
now_ts="$(date +%s)"
exp_ts="$(date -d "$not_after" +%s 2>/dev/null || python3 -c "import ssl,time; print(int(time.mktime(__import__('email.utils',fromlist=['parsedate']).parsedate('$not_after'))))" 2>/dev/null || echo 0)"
if [[ "$exp_ts" -gt "$now_ts" ]]; then
remaining_days=$(( (exp_ts - now_ts) / 86400 ))
# Proroga al massimo a 3650 gg se il residuo è troppo basso
[[ "$remaining_days" -lt 365 ]] && remaining_days=3650
else
remaining_days=3650
warn "Certificato scaduto — uso validità predefinita di 3650 giorni"
fi
# Backup del vecchio certificato
local backup="${CA_SRC}.bak.$(date +%Y%m%d%H%M%S)"
cp -a "$CA_SRC" "$backup"
log "Backup vecchio certificato: $backup"
# Genera nuovo certificato self-signed con la stessa chiave
if openssl req -new -x509 \
-key "$CA_KEY" \
-out "$CA_SRC" \
-days "$remaining_days" \
-subj "$subject" \
-addext "basicConstraints=critical,CA:TRUE" \
-addext "keyUsage=critical,keyCertSign,cRLSign" \
>/dev/null 2>&1; then
log "✅ Certificato rigenerato con la chiave esistente ($remaining_days giorni)"
else
# Fallback: openssl < 1.1.1 non supporta -addext
local tmp_ext
tmp_ext="$(mktemp /tmp/ca_ext_XXXXXX.cnf)"
cat > "$tmp_ext" <<EOF
[req]
distinguished_name = req_dn
x509_extensions = v3_ca
prompt = no
[req_dn]
$(echo "$subject" | sed 's|/\([^=]*\)=|\1 = |g; s|^ ||')
[v3_ca]
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
EOF
openssl req -new -x509 \
-key "$CA_KEY" \
-out "$CA_SRC" \
-days "$remaining_days" \
-config "$tmp_ext" \
>/dev/null 2>&1 \
&& log "✅ Certificato rigenerato (compat mode, $remaining_days giorni)" \
|| { err "Impossibile rigenerare il certificato"; rm -f "$tmp_ext"; exit 1; }
rm -f "$tmp_ext"
fi
# Se non esiste una chiave valida, crea una nuova coppia canonica.
if [[ ! -f "$canonical_key" ]] || ! openssl pkey -in "$canonical_key" -noout >/dev/null 2>&1; then
[[ -f "$canonical_key" ]] && mv -f "$canonical_key" "${canonical_key}.invalid.$(date +%Y%m%d%H%M%S)" || true
log "Genero nuova chiave privata RSA 4096: $canonical_key"
openssl genrsa -out "$canonical_key" 4096 >/dev/null 2>&1 \
|| { err "Generazione chiave RSA fallita"; exit 1; }
chmod 600 "$canonical_key"
[[ -f "$CA_SRC" ]] && cp -a "$CA_SRC" "${CA_SRC}.bak.$(date +%Y%m%d%H%M%S)" || true
generate_ca_certificate_with_key "$canonical_key" \
|| { err "Impossibile generare la CA canonica"; exit 1; }
log "✅ Nuova coppia CA/chiave generata ($CA_VALIDITY_DAYS giorni)"
else
# ── CASO B: chiave non trovata — genera nuova coppia ─────────────────
warn "Nessuna chiave privata trovata per $CA_SRC"
log "Genero nuova coppia chiave RSA 4096 + certificato CA self-signed…"
local regenerate=0 reason=""
# Scelgo il percorso di output per la nuova chiave
local new_key_path
new_key_path="$(dirname "$CA_SRC")/$(basename "${CA_SRC%.crt.pem}").key.pem"
new_key_path="${new_key_path%.pem.pem}.pem" # evita doppia estensione
local backup="${CA_SRC}.bak.$(date +%Y%m%d%H%M%S)"
[[ -f "$CA_SRC" ]] && { cp -a "$CA_SRC" "$backup"; log "Backup vecchio certificato: $backup"; }
# Cerca di mantenere il subject originale
local orig_subject="/CN=${CA_NAME}/O=BastionGuard/OU=Security"
if [[ -f "$backup" ]]; then
orig_subject="$(openssl x509 -in "$backup" -noout -subject 2>/dev/null | sed 's/^subject=//')" || true
fi
# Genera chiave privata
if ! openssl genrsa -out "$new_key_path" 4096 >/dev/null 2>&1; then
err "Generazione chiave RSA fallita"
exit 1
fi
chmod 600 "$new_key_path"
[[ -n "${REAL_USER:-}" ]] && chown "$REAL_USER:$REAL_GROUP" "$new_key_path" 2>/dev/null || true
log "Nuova chiave privata: $new_key_path"
# Genera certificato self-signed
if openssl req -new -x509 \
-key "$new_key_path" \
-out "$CA_SRC" \
-days 3650 \
-subj "$orig_subject" \
-addext "basicConstraints=critical,CA:TRUE" \
-addext "keyUsage=critical,keyCertSign,cRLSign" \
>/dev/null 2>&1; then
log "✅ Nuova coppia chiave+certificato generata (3650 giorni)"
if ! certificate_is_usable_ca; then
regenerate=1
reason="certificato assente, corrotto o privo delle corrette estensioni CA"
else
local tmp_ext
tmp_ext="$(mktemp /tmp/ca_ext_XXXXXX.cnf)"
cat > "$tmp_ext" <<EOF
[req]
distinguished_name = req_dn
x509_extensions = v3_ca
prompt = no
local cert_fp key_fp
cert_fp="$(pubkey_fingerprint_from_cert "$CA_SRC" || true)"
key_fp="$(pubkey_fingerprint_from_key "$canonical_key" || true)"
[req_dn]
$(echo "$orig_subject" | sed 's|/\([^=]*\)=|\1 = |g; s|^ ||')
[v3_ca]
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
EOF
openssl req -new -x509 \
-key "$new_key_path" \
-out "$CA_SRC" \
-days 3650 \
-config "$tmp_ext" \
>/dev/null 2>&1 \
&& log "✅ Nuova coppia chiave+certificato generata (compat mode, 3650 giorni)" \
|| { err "Impossibile generare il certificato"; rm -f "$tmp_ext"; exit 1; }
rm -f "$tmp_ext"
if [[ -z "$cert_fp" || -z "$key_fp" || "$cert_fp" != "$key_fp" ]]; then
regenerate=1
reason="certificato e chiave privata non coincidono"
elif ! certificate_has_expected_subject; then
regenerate=1
reason="subject CA non canonico"
elif ! openssl x509 -in "$CA_SRC" -checkend "$((CA_RENEW_BEFORE_DAYS * 86400))" -noout >/dev/null 2>&1; then
regenerate=1
reason="certificato scaduto o in scadenza entro ${CA_RENEW_BEFORE_DAYS} giorni"
fi
fi
CA_KEY="$new_key_path"
if (( regenerate )); then
warn "$reason: rigenero il certificato usando la chiave canonica"
[[ -f "$CA_SRC" ]] && cp -a "$CA_SRC" "${CA_SRC}.bak.$(date +%Y%m%d%H%M%S)" || true
generate_ca_certificate_with_key "$canonical_key" \
|| { err "Impossibile rigenerare la CA canonica"; exit 1; }
log "✅ Certificato CA rigenerato ($CA_VALIDITY_DAYS giorni)"
else
log "✅ CA e chiave canoniche valide — nessuna rigenerazione necessaria"
fi
fi
chmod 600 "$canonical_key"
chmod 644 "$CA_SRC"
[[ -n "${REAL_USER:-}" && -n "${REAL_GROUP:-}" ]] \
&& chown "$REAL_USER:$REAL_GROUP" "$canonical_key" "$CA_SRC" 2>/dev/null || true
fix_user_ca_permissions
validate_ca
# Ri-valida dopo ogni intervento
if ! openssl x509 -in "$CA_SRC" -noout >/dev/null 2>&1; then
err "Il certificato rigenerato non è valido: $CA_SRC"
exit 1
fi
log "✅ Verifica post-fix superata"
local cert_fp key_fp
cert_fp="$(pubkey_fingerprint_from_cert "$CA_SRC")"
key_fp="$(pubkey_fingerprint_from_key "$canonical_key")"
[[ "$cert_fp" == "$key_fp" ]] \
|| { err "Verifica finale fallita: CA e chiave non coincidono"; exit 1; }
log "CA sorgente: $CA_SRC"
log "Fingerprint SHA-256: $(current_ca_fingerprint_sha256)"
}
# ── Helper Debian ─────────────────────────────────────────────────────────────
@ -826,6 +744,7 @@ install_debian_style() {
local dst="$1"
local conf_entry="$2"
SYSTEM_CA_DST="$dst"
mkdir -p "$(dirname "$dst")"
rm -f \
@ -1098,6 +1017,8 @@ restart_bastionguard_cef_user_service_if_active() {
return 0
fi
user_systemctl daemon-reload >/dev/null 2>&1 || true
if user_systemctl is-active --quiet "$CEF_USER_SERVICE_NAME"; then
log "Riavvio servizio utente $CEF_USER_SERVICE_NAME per ricaricare CA/policy…"
if user_systemctl restart "$CEF_USER_SERVICE_NAME"; then
@ -1117,19 +1038,21 @@ close_running_browsers
purge_old_system_ca_copies
installed_sys=false
SYSTEM_CA_DST=""
if distro_is "debian" || distro_is "ubuntu"; then
log "Rilevato: Debian/Ubuntu"
install_debian_style \
"/usr/share/ca-certificates/local/${CA_NAME}.crt" \
"local/${CA_NAME}.crt"
"/usr/share/ca-certificates/local/${CA_FILE_BASENAME}.crt" \
"local/${CA_FILE_BASENAME}.crt"
log "✅ CA installata (Debian/Ubuntu)"
installed_sys=true
elif distro_is "fedora" || distro_is "rhel" || distro_is "centos"; then
log "Rilevato: Fedora/RHEL/CentOS"
DST="/etc/pki/ca-trust/source/anchors/${CA_NAME}.pem"
DST="/etc/pki/ca-trust/source/anchors/${CA_FILE_BASENAME}.pem"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
# Su Fedora/RHEL il label SELinux errato su /etc/pki/ca-trust può impedire
@ -1142,16 +1065,25 @@ elif distro_is "fedora" || distro_is "rhel" || distro_is "centos"; then
elif distro_is "arch" || distro_is "archlinux"; then
log "Rilevato: Arch Linux"
DST="/etc/ca-certificates/trust-source/anchors/${CA_NAME}.crt"
DST="/etc/ca-certificates/trust-source/anchors/${CA_FILE_BASENAME}.crt"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
trust extract-compat
if have_cmd update-ca-trust; then
update-ca-trust extract
elif have_cmd trust; then
trust extract-compat
else
err "Arch Linux: né update-ca-trust né trust sono disponibili"
exit 1
fi
log "✅ CA installata (Arch Linux)"
installed_sys=true
elif distro_is "opensuse" || distro_is "suse"; then
log "Rilevato: openSUSE/SLES"
DST="/etc/pki/trust/anchors/${CA_NAME}.pem"
DST="/etc/pki/trust/anchors/${CA_FILE_BASENAME}.pem"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
update-ca-certificates
@ -1160,7 +1092,8 @@ elif distro_is "opensuse" || distro_is "suse"; then
elif distro_is "alpine"; then
log "Rilevato: Alpine Linux"
DST="/usr/local/share/ca-certificates/${CA_NAME}.crt"
DST="/usr/local/share/ca-certificates/${CA_FILE_BASENAME}.crt"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
update-ca-certificates
@ -1169,12 +1102,13 @@ elif distro_is "alpine"; then
elif distro_is "void"; then
log "Rilevato: Void Linux"
DST="/usr/share/ca-certificates/bastionguard/${CA_NAME}.pem"
DST="/usr/share/ca-certificates/bastionguard/${CA_FILE_BASENAME}.pem"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
CONF="/etc/ca-certificates/update.d/bastionguard.conf"
mkdir -p "$(dirname "$CONF")"
echo "bastionguard/${CA_NAME}.pem" > "$CONF"
echo "bastionguard/${CA_FILE_BASENAME}.pem" > "$CONF"
update-ca-certificates
log "✅ CA installata (Void Linux)"
installed_sys=true
@ -1184,7 +1118,8 @@ if ! $installed_sys; then
warn "Distro non riconosciuta (ID='${ID:-?}', ID_LIKE='${ID_LIKE:-?}') — fallback"
if have_cmd trust; then
DST="/etc/ca-certificates/trust-source/anchors/${CA_NAME}.crt"
DST="/etc/ca-certificates/trust-source/anchors/${CA_FILE_BASENAME}.crt"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
trust extract-compat
@ -1192,7 +1127,8 @@ if ! $installed_sys; then
installed_sys=true
elif have_cmd update-ca-trust; then
DST="/etc/pki/ca-trust/source/anchors/${CA_NAME}.pem"
DST="/etc/pki/ca-trust/source/anchors/${CA_FILE_BASENAME}.pem"
SYSTEM_CA_DST="$DST"
mkdir -p "$(dirname "$DST")"
install -m 0644 "$CA_SRC" "$DST"
restore_selinux_context "$DST" "$(dirname "$DST")" /etc/pki/ca-trust
@ -1203,8 +1139,8 @@ if ! $installed_sys; then
elif have_cmd update-ca-certificates; then
install_debian_style \
"/usr/share/ca-certificates/local/${CA_NAME}.crt" \
"local/${CA_NAME}.crt"
"/usr/share/ca-certificates/local/${CA_FILE_BASENAME}.crt" \
"local/${CA_FILE_BASENAME}.crt"
log "✅ CA installata (fallback: update-ca-certificates)"
installed_sys=true
fi
@ -1215,6 +1151,16 @@ if ! $installed_sys; then
exit 1
fi
if [[ -z "$SYSTEM_CA_DST" || ! -f "$SYSTEM_CA_DST" ]]; then
err "Copia CA di sistema non trovata dopo l'installazione"
exit 1
fi
if [[ "$(ca_fingerprint_sha256 "$SYSTEM_CA_DST" || true)" != "$(current_ca_fingerprint_sha256 || true)" ]]; then
err "La CA nel trust store di sistema non coincide con la CA usata dal proxy"
exit 1
fi
log "✅ Fingerprint CA di sistema verificata: $SYSTEM_CA_DST"
# Ripristina label SELinux sui trust store toccati, senza rendere obbligatorio SELinux.
fix_selinux_system_trust_contexts
fix_user_ca_permissions
@ -1229,9 +1175,18 @@ if have_cmd certutil; then
prefix="dbm:"
[ -f "$db/cert9.db" ] && prefix="sql:"
nss_delete_matching_nicknames_root "${prefix}${db}"
certutil -A -d "${prefix}${db}" -n "$CA_NAME" -t "CT,," -i "$CA_SRC" 2>/dev/null \
&& log "✅ NSS system: $db" \
|| warn "NSS system $db: certutil fallito (non fatale)"
if certutil -A -d "${prefix}${db}" -n "$CA_NICKNAME" -t "CT,," -i "$CA_SRC" 2>/dev/null; then
nss_sys_fp="$(certutil -L -d "${prefix}${db}" -n "$CA_NICKNAME" -a 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256 2>/dev/null \
| sed 's/^sha256 Fingerprint=//; s/^SHA256 Fingerprint=//' || true)"
if [[ "$nss_sys_fp" == "$(current_ca_fingerprint_sha256)" ]]; then
log "✅ NSS system verificato: $db"
else
warn "NSS system $db: fingerprint diversa dopo l'import"
fi
else
warn "NSS system $db: certutil fallito (non fatale)"
fi
restore_selinux_context "$db"
done
else
@ -1243,6 +1198,21 @@ nss_db_prefix() {
[[ -f "$1/cert9.db" ]] && printf 'sql:%s' "$1" || printf 'dbm:%s' "$1"
}
nss_user_ca_fingerprint() {
local prefix="$1"
run_as_real_user certutil -L -d "$prefix" -n "$CA_NICKNAME" -a 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256 2>/dev/null \
| sed 's/^sha256 Fingerprint=//; s/^SHA256 Fingerprint=//'
}
verify_nss_user_ca() {
local prefix="$1"
local expected actual
expected="$(current_ca_fingerprint_sha256 || true)"
actual="$(nss_user_ca_fingerprint "$prefix" || true)"
[[ -n "$expected" && "$actual" == "$expected" ]]
}
import_nss_db() {
local db="$1"
[[ -d "$db" ]] || return 0
@ -1252,8 +1222,12 @@ import_nss_db() {
prefix="$(nss_db_prefix "$db")"
nss_delete_matching_nicknames_user "$prefix"
if run_as_real_user certutil -A -d "$prefix" -n "$CA_NAME" -t "CT,," -i "$CA_SRC" >/dev/null 2>&1; then
log "✅ NSS utente: $db"
if run_as_real_user certutil -A -d "$prefix" -n "$CA_NICKNAME" -t "CT,," -i "$CA_SRC" >/dev/null 2>&1; then
if verify_nss_user_ca "$prefix"; then
log "✅ NSS utente verificato: $db"
else
warn "NSS utente $db: fingerprint diversa dopo l'import"
fi
else
warn "NSS utente $db: import fallito (non fatale)"
fi
@ -1595,7 +1569,7 @@ if have_cmd certutil && [[ -n "${REAL_USER:-}" && -n "${REAL_HOME:-}" ]]; then
if run_as_real_user certutil -A \
-d "sql:$FINAL_NSS_DB" \
-n "$CA_NAME" \
-n "$CA_NICKNAME" \
-t "CT,," \
-i "$CA_SRC" >/dev/null 2>&1; then
log "✅ Step finale NSS utente completato"
@ -1604,7 +1578,7 @@ if have_cmd certutil && [[ -n "${REAL_USER:-}" && -n "${REAL_HOME:-}" ]]; then
nss_delete_matching_nicknames_user "dbm:$FINAL_NSS_DB"
if run_as_real_user certutil -A \
-d "dbm:$FINAL_NSS_DB" \
-n "$CA_NAME" \
-n "$CA_NICKNAME" \
-t "CT,," \
-i "$CA_SRC" >/dev/null 2>&1; then
log "✅ Step finale NSS utente completato (dbm)"
@ -1627,10 +1601,10 @@ if have_cmd update-ca-certificates && [[ -d /etc/ssl/certs ]]; then
fi
if have_cmd certutil && [[ -n "${REAL_USER:-}" && -n "${REAL_HOME:-}" ]]; then
if run_as_real_user certutil -L -d "sql:$REAL_HOME/.pki/nssdb" -n "$CA_NAME" >/dev/null 2>&1; then
log "✅ Verifica NSS utente OK: $REAL_HOME/.pki/nssdb"
if verify_nss_user_ca "sql:$REAL_HOME/.pki/nssdb"; then
log "✅ Verifica NSS utente/fingerprint OK: $REAL_HOME/.pki/nssdb"
else
warn "Verifica NSS utente non riuscita su sql:$REAL_HOME/.pki/nssdb"
warn "Verifica NSS utente non riuscita o fingerprint errata su sql:$REAL_HOME/.pki/nssdb"
fi
fi
@ -1639,5 +1613,6 @@ fix_user_ca_permissions
fix_selinux_system_trust_contexts
fix_selinux_user_browser_contexts
restart_bastionguard_cef_user_service_if_active
log "CA attiva (SHA-256): $(current_ca_fingerprint_sha256)"
log "✅ Installazione completata"
exit 0

2
data/service/BastionGuard-pacd.service
View file

@ -9,7 +9,7 @@ ExecStart=/usr/bin/bastionguard-pacd \
--listen 127.0.0.1 --port 8765 \
--stub-host 127.0.0.1 --stub-port 3129 \
--backend-host 127.0.0.1 --backend-port 3130 \
--trigger-cmd "systemctl --user start BastionGuard-cef.service" \
--trigger-cmd "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service" \
--backend-wait-ms 4000
Restart=always

2
data/service/BastionGuard-phishing-scanner.service
View file

@ -27,7 +27,7 @@ ExecStart=/usr/bin/BastionGuard-daemon \
--page-warning=/usr/share/BastionGuard/data/blocking/block.html
# Reload: ricarica dnsmasq in caso di aggiornamento blocklist
ExecReload=/usr/bin/systemctl reload dnsmasq.service
ExecReload=/usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service
# Restart automatico su crash
Restart=on-failure

2
data/service/bastionguard-sanesecurity.service
View file

@ -5,4 +5,4 @@ After=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/bin/BastionGuard --update-sanesecurity
ExecStartPost=/bin/systemctl reload clamav-daemon.service
ExecStartPost=/usr/libexec/bastionguard/bastionguard-service --system reload clamav-daemon.service

181
gentoo/app-antivirus/bastionguard/bastionguard-2.0.ebuild Normal file
View file

@ -0,0 +1,181 @@
# Copyright 2025-2026 Calogero Scarnà
# Distributed under the terms of the GNU General Public License v3
EAPI=8
CMAKE_BUILD_TYPE=Release
inherit cmake
DESCRIPTION="Transparent security control plane for Linux desktops"
HOMEPAGE="https://bastionguard.eu/"
SRC_URI="https://git.bastionguard.eu/specialworld83/BastionGuard/archive/v${PV}.tar.gz -> ${P}.tar.gz"
# Gitea archives use the repository name as their top-level directory.
S="${WORKDIR}/BastionGuard"
LICENSE="GPL-3"
SLOT="0"
KEYWORDS="~amd64"
# OpenRC is selected when none of systemd, sysvinit or dinit is enabled.
# The dinit flag expects a dinit package from a user overlay because dinit is
# not assumed to be available in the main Gentoo repository.
IUSE="cef dinit secure-connection systemd sysvinit"
REQUIRED_USE="?? ( dinit systemd sysvinit )"
RESTRICT="test"
RDEPEND="
app-admin/sudo
app-antivirus/clamav
app-antivirus/yara
app-crypt/libsecret
dev-cpp/glibmm:2.68
dev-cpp/gtkmm:4.0
dev-cpp/nlohmann_json
dev-cpp/pangomm:2.48
dev-db/sqlite:3
dev-libs/boost
dev-libs/libsigc++:3
dev-libs/openssl
dev-libs/re2
gui-libs/gtk:4
net-dns/dnsmasq
net-dns/libidn2
net-fs/samba
net-libs/libsoup:3.0
net-misc/curl
net-misc/rsync
sys-apps/bubblewrap
sys-auth/polkit
virtual/udev
www-servers/nginx
dev-lang/php
cef? (
app-crypt/nss
dev-libs/nspr
media-libs/alsa-lib
media-libs/mesa
sys-apps/dbus
x11-libs/libXcomposite
x11-libs/libXdamage
x11-libs/libXfixes
x11-libs/libXrandr
x11-libs/libxkbcommon
)
secure-connection? (
dev-libs/json-glib
dev-libs/libbpf
dev-libs/libgee
dev-libs/protobuf
gui-libs/libshumate
net-libs/grpc
net-libs/libnetfilter_queue
x11-libs/vte:2.91[gtk4]
)
systemd? ( sys-apps/systemd )
sysvinit? ( sys-apps/sysvinit )
!systemd? (
!sysvinit? (
!dinit? ( sys-apps/openrc )
)
)
"
DEPEND="
${RDEPEND}
dev-libs/hyperscan
"
BDEPEND="
app-alternatives/ninja
dev-build/cmake
dev-build/meson
dev-cpp/mm-common
dev-lang/python
sys-devel/gettext
virtual/pkgconfig
secure-connection? (
app-text/help2man
dev-lang/go
dev-lang/vala
llvm-core/clang
)
"
src_prepare() {
cmake_src_prepare
# Never reuse an upstream build directory from a source archive.
rm -rf build || die
}
src_configure() {
local init_system="OPENRC"
if use systemd; then
init_system="SYSTEMD"
elif use sysvinit; then
init_system="SYSVINIT"
elif use dinit; then
init_system="DINIT"
fi
local mycmakeargs=(
-DCMAKE_INSTALL_PREFIX="${EPREFIX}/usr"
-DCMAKE_INSTALL_SYSCONFDIR="${EPREFIX}/etc"
-DBG_PACKAGING=ON
-DBG_DEBIAN_NO_INSTALL_CODE=ON
-DENABLE_SYSTEMD_SERVICES=OFF
-DENABLE_USER_AGENT_AUTO=OFF
-DINSTALL_NGINX_DEFAULTS=OFF
-DBASTIONGUARD_INIT_SYSTEM="${init_system}"
-DENABLE_CEF="$(usex cef ON OFF)"
-DENABLE_EMBEDDED_CEF="$(usex cef ON OFF)"
-DENABLE_CEF_DAEMON=OFF
-DENABLE_SYSTEM_CA_INSTALL=OFF
-DENABLE_BASTIONGUARD_SECURE_CONNECTION="$(usex secure-connection ON OFF)"
)
cmake_src_configure
}
src_compile() {
# Preserve the conservative single-job build used by the upstream PKGBUILD.
cmake_build -j1
}
src_install() {
cmake_src_install
keepdir \
/var/lib/bastionguard-webui/cache \
/var/lib/bastionguard-webui/quarantine \
/var/lib/bastionguard-webui/sessions \
/var/lib/bastionguard-webui/tmp \
/var/log/bastionguard-webui
fperms 0750 \
/var/lib/bastionguard-webui \
/var/lib/bastionguard-webui/cache \
/var/lib/bastionguard-webui/quarantine \
/var/lib/bastionguard-webui/sessions \
/var/lib/bastionguard-webui/tmp
fperms 0755 /var/log/bastionguard-webui
}
pkg_postinst() {
elog "BastionGuard was built for the selected init backend."
elog "OpenRC is used by default when systemd, sysvinit and dinit are disabled."
elog "Service activation is intentionally left to the administrator."
if use dinit; then
ewarn "The dinit USE flag installs BastionGuard dinit descriptions."
ewarn "Install dinit from your chosen Gentoo overlay before enabling them."
fi
if use cef; then
ewarn "The bundled CEF runtime is large and architecture-specific."
fi
}

22
gentoo/app-antivirus/bastionguard/metadata.xml Normal file
View file

@ -0,0 +1,22 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="person">
<email>info@bastionguard.eu</email>
<name>BastionGuard</name>
</maintainer>
<longdescription lang="en">
BastionGuard is a desktop security control plane that integrates malware,
phishing, ransomware, USB, privacy, backup and secure-connection services.
</longdescription>
<use>
<flag name="cef">Build and install the embedded Chromium Embedded Framework runtime.</flag>
<flag name="secure-connection">Build the BastionGuard Secure Connection component and bsc-daemon.</flag>
<flag name="dinit">Install Dinit service descriptions instead of OpenRC scripts.</flag>
<flag name="sysvinit">Install SysVinit scripts instead of OpenRC scripts.</flag>
</use>
<upstream>
<remote-id type="gitea">specialworld83/BastionGuard</remote-id>
<bugs-to>mailto:info@bastionguard.eu</bugs-to>
</upstream>
</pkgmetadata>

1
mageia/bastionguard-mageia10.spec
View file

@ -285,6 +285,7 @@ export LDFLAGS="${LDFLAGS:-} -L$YARA_LIBDIR"
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF

335
mageia/change_cmake_mageia/CMakeLists.txt
View file

@ -219,6 +219,28 @@ find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
find_package(Threads REQUIRED)
# ============================================================
# BastionGuard – RPATH centralizzato
@ -245,15 +267,21 @@ endfunction()
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
bg_link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
@ -302,8 +330,12 @@ else()
message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
install(DIRECTORY data/
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
@ -669,7 +701,7 @@ target_link_libraries(firewall
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -748,7 +780,6 @@ target_link_libraries(BastionGuard
OpenSSL::SSL
OpenSSL::Crypto
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
if(ENABLE_EMBEDDED_CEF)
@ -1354,14 +1385,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1378,7 +1410,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1700,11 +1732,7 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il service file viene installato nella sezione init-system centralizzata.
# ============================================================
# BastionGuard WebUI
@ -1923,13 +1951,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2361,7 +2391,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2440,38 +2472,196 @@ endif()
# Services
# ======================
# opzione per abilitare automaticamente le user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
bg_install_dinit_user_service(BastionGuard-cef true 3)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
# Mantiene la copia dati dell'unità CEF prevista da questo CMake.
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
)
@ -2487,6 +2677,7 @@ install(PROGRAMS
data/scripts/BastionGuard-export-env.sh
data/scripts/BastionGuard-locale.sh
data/scripts/BastionGuard-setup-clamav-daemon.sh
data/scripts/BastionGuard-restart-user-services.sh
data/scripts/BastionGuard-user-session-watch.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
@ -2618,40 +2809,38 @@ bg_install_code( "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
bg_install_code( "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl enable BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl start BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================

1
openmandriva/bastionguard-openmandriva6-rock.spec
View file

@ -375,6 +375,7 @@ cmake -S . -B build \
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DCMAKE_BUILD_RPATH="$YARA_LIBDIR" \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \

351
openmandriva/change_cmake_openmandriva/CMakeLists.txt
View file

@ -241,6 +241,28 @@ find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
find_package(Threads REQUIRED)
# ============================================================
# BastionGuard – RPATH centralizzato
@ -267,29 +289,25 @@ endfunction()
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if (SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
endif()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
# ======================
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
bg_link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(WARNING "⚠ libsystemd non trovato (libsystemd-dev). Alcune feature potrebbero non compilare.")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
function(bg_link_systemd tgt)
if (SYSTEMD_FOUND AND TARGET ${tgt})
if(SYSTEMD_FOUND AND TARGET ${tgt})
target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
@ -324,8 +342,12 @@ else()
message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
install(DIRECTORY data/
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
@ -685,7 +707,7 @@ target_link_libraries(firewall
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -764,7 +786,6 @@ target_link_libraries(BastionGuard
OpenSSL::SSL
OpenSSL::Crypto
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
if(ENABLE_EMBEDDED_CEF)
@ -1370,14 +1391,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1394,7 +1416,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1682,7 +1704,7 @@ endif()
# ======================
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# Gira come servizio utente, senza privilegi root
# ======================
add_executable(BastionGuard-mailproxy
@ -1714,11 +1736,7 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il service file viene installato nella sezione init-system centralizzata.
# ============================================================
# BastionGuard WebUI
@ -1937,13 +1955,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2375,7 +2395,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2454,38 +2476,196 @@ endif()
# Services
# ======================
# opzione per abilitare automaticamente le user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
bg_install_dinit_user_service(BastionGuard-cef true 3)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
# Mantiene la copia dati dell'unità CEF prevista da questo CMake.
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
)
@ -2501,6 +2681,7 @@ install(PROGRAMS
data/scripts/BastionGuard-export-env.sh
data/scripts/BastionGuard-locale.sh
data/scripts/BastionGuard-setup-clamav-daemon.sh
data/scripts/BastionGuard-restart-user-services.sh
data/scripts/BastionGuard-user-session-watch.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
@ -2632,40 +2813,38 @@ bg_install_code( "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
bg_install_code( "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl enable BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl start BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================

1
opensuse_leap16/bastionguard.spec
View file

@ -230,6 +230,7 @@ cmake -S . -B build -G Ninja \
-DENABLE_EMBEDDED_CEF=ON \
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \

352
opensuse_leap16/cmake_opensuse/CMakeLists.txt
View file

@ -191,6 +191,28 @@ find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
find_package(Threads REQUIRED)
# ============================================================
# BastionGuard – RPATH centralizzato
@ -215,37 +237,34 @@ function(bg_set_rpath target)
endif()
endfunction()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
# libsystemd / sd-bus
# ======================
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
bg_link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(WARNING "⚠ libsystemd non trovato (libsystemd-dev). Alcune feature potrebbero non compilare.")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
function(bg_link_systemd tgt)
if (SYSTEMD_FOUND AND TARGET ${tgt})
if(SYSTEMD_FOUND AND TARGET ${tgt})
target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
target_compile_options(${tgt} PRIVATE ${SYSTEMD_CFLAGS_OTHER})
endif()
endfunction()
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if (SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
endif()
# ==============================
# Controllo NGINX
# ==============================
@ -273,8 +292,12 @@ else()
message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
install(DIRECTORY data/
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
@ -642,7 +665,7 @@ target_link_libraries(firewall
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -719,7 +742,6 @@ target_link_libraries(BastionGuard
OpenSSL::SSL
OpenSSL::Crypto
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
if(ENABLE_EMBEDDED_CEF)
@ -1325,14 +1347,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1349,7 +1372,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1638,7 +1661,7 @@ endif()
# ======================
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# Gira come servizio utente, senza privilegi root
# ======================
add_executable(BastionGuard-mailproxy
@ -1670,11 +1693,7 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il service file viene installato nella sezione init-system centralizzata.
# ============================================================
@ -1894,13 +1913,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2333,7 +2354,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2412,38 +2435,196 @@ endif()
# Services
# ======================
# opzione per abilitare automaticamente le user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
bg_install_dinit_user_service(BastionGuard-cef true 3)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
# Mantiene la copia dati dell'unità CEF prevista da questo CMake.
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
)
@ -2459,6 +2640,7 @@ install(PROGRAMS
data/scripts/BastionGuard-export-env.sh
data/scripts/BastionGuard-locale.sh
data/scripts/BastionGuard-setup-clamav-daemon.sh
data/scripts/BastionGuard-restart-user-services.sh
data/scripts/BastionGuard-user-session-watch.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
@ -2590,40 +2772,38 @@ bg_install_code( "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
bg_install_code( "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl enable BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl start BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================

1
opensuse_rpm/bastionguard_opensuse.spec
View file

@ -212,6 +212,7 @@ unset LDFLAGS
-DENABLE_CEF_DAEMON=OFF \
-DENABLE_SYSTEM_CA_INSTALL=OFF \
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \

352
opensuse_rpm/cmake_change_build/CMakeLists.txt
View file

@ -191,6 +191,28 @@ find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
find_package(Threads REQUIRED)
# ============================================================
# BastionGuard – RPATH centralizzato
@ -215,37 +237,34 @@ function(bg_set_rpath target)
endif()
endfunction()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
# libsystemd / sd-bus
# ======================
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
bg_link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(WARNING "⚠ libsystemd non trovato (libsystemd-dev). Alcune feature potrebbero non compilare.")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
function(bg_link_systemd tgt)
if (SYSTEMD_FOUND AND TARGET ${tgt})
if(SYSTEMD_FOUND AND TARGET ${tgt})
target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
target_compile_options(${tgt} PRIVATE ${SYSTEMD_CFLAGS_OTHER})
endif()
endfunction()
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if (SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
endif()
# ==============================
# Controllo NGINX
# ==============================
@ -273,8 +292,12 @@ else()
message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
install(DIRECTORY data/
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
@ -642,7 +665,7 @@ target_link_libraries(firewall
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -719,7 +742,6 @@ target_link_libraries(BastionGuard
OpenSSL::SSL
OpenSSL::Crypto
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
if(ENABLE_EMBEDDED_CEF)
@ -1325,14 +1347,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1349,7 +1372,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1638,7 +1661,7 @@ endif()
# ======================
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# Gira come servizio utente, senza privilegi root
# ======================
add_executable(BastionGuard-mailproxy
@ -1670,11 +1693,7 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il service file viene installato nella sezione init-system centralizzata.
# ============================================================
@ -1894,13 +1913,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2333,7 +2354,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2412,38 +2435,196 @@ endif()
# Services
# ======================
# opzione per abilitare automaticamente le user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
bg_install_dinit_user_service(BastionGuard-cef true 3)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
# Mantiene la copia dati dell'unità CEF prevista da questo CMake.
if(ENABLE_EMBEDDED_CEF AND ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
)
@ -2459,6 +2640,7 @@ install(PROGRAMS
data/scripts/BastionGuard-export-env.sh
data/scripts/BastionGuard-locale.sh
data/scripts/BastionGuard-setup-clamav-daemon.sh
data/scripts/BastionGuard-restart-user-services.sh
data/scripts/BastionGuard-user-session-watch.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
@ -2590,40 +2772,38 @@ bg_install_code( "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
bg_install_code( "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl enable BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl start BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================

3
pkgbuild/PKGBUILD
View file

@ -88,7 +88,8 @@ build() {
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
-DENABLE_SYSTEMD_SERVICES=OFF \
-DENABLE_USER_AGENT_AUTO=OFF \
-DINSTALL_NGINX_DEFAULTS=OFF
-DINSTALL_NGINX_DEFAULTS=OFF \
-DBASTIONGUARD_INIT_SYSTEM=AUTO \
cmake --build build -- -j1
}

357
pkgbuild/cmake_archlinux/CMakeLists.txt
View file

@ -117,6 +117,28 @@ find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)
set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
"Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
"Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
"${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
data/init/common/bastionguard-init-config.in
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
@ONLY
NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)
find_package(Threads REQUIRED)
# ============================================================
# BastionGuard – RPATH centralizzato
@ -143,16 +165,32 @@ endfunction()
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
if(SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
include_directories(${SYSTEMD_INCLUDE_DIRS})
link_directories(${SYSTEMD_LIBRARY_DIRS})
bg_link_directories(${SYSTEMD_LIBRARY_DIRS})
add_definitions(${SYSTEMD_CFLAGS_OTHER})
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
function(bg_link_systemd tgt)
if(SYSTEMD_FOUND AND TARGET ${tgt})
target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
target_compile_options(${tgt} PRIVATE ${SYSTEMD_CFLAGS_OTHER})
endif()
endfunction()
# ==============================
# Controllo NGINX
# ==============================
@ -169,26 +207,6 @@ else()
message(STATUS "✔ NGINX trovato: ${NGINX_EXECUTABLE} (${NGINX_VERSION})")
endif()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
# ======================
pkg_check_modules(SYSTEMD QUIET libsystemd)
if (SYSTEMD_FOUND)
message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
else()
message(WARNING "⚠ libsystemd non trovato (libsystemd-dev). Alcune feature potrebbero non compilare.")
endif()
function(bg_link_systemd tgt)
if (SYSTEMD_FOUND AND TARGET ${tgt})
target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
target_compile_options(${tgt} PRIVATE ${SYSTEMD_CFLAGS_OTHER})
endif()
endfunction()
# ==============================
# Controllo RSYNC
# ==============================
@ -200,8 +218,12 @@ else()
message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()
# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
set(ENABLE_INIT_SERVICES ON)
endif()
install(DIRECTORY data/ DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data)
@ -564,7 +586,7 @@ target_link_libraries(firewall
set(BastionGuard_SOURCES
src/main.cpp
src/MainWindow.cpp
src/TrayIcon.cpp
${BG_TRAYICON_SOURCE}
src/Backend.cpp
src/DashboardPage.cpp
src/ScanPage.cpp
@ -637,7 +659,6 @@ target_link_libraries(BastionGuard
OpenSSL::SSL
OpenSSL::Crypto
)
target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)
# ============================================================
@ -1267,14 +1288,15 @@ install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR
# Demone USB (BastionGuard-usbd)
# ======================
# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)
if(SYSTEMD_FOUND)
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()
set(USBD_SOURCES
src/usb/BastionGuard-usbd.cpp
${BG_USBD_BUS_SOURCE}
src/usb/LiveScanDialog.cpp
)
add_executable(BastionGuard-usbd ${USBD_SOURCES})
@ -1291,7 +1313,7 @@ target_link_libraries(BastionGuard-usbd
${GIOMM_LIBRARIES}
${SIGC_LIBRARIES}
${UDEV_LIBRARIES}
${SYSTEMD_LIBRARIES} # <── FIX CRITICO
${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
@ -1573,7 +1595,7 @@ install(TARGETS BastionGuard-secure-gui RUNTIME DESTINATION ${CMAKE_INSTALL_BIND
# ======================
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# Gira come servizio utente, senza privilegi root
# ======================
add_executable(BastionGuard-mailproxy
@ -1605,11 +1627,7 @@ install(TARGETS BastionGuard-mailproxy
WORLD_READ WORLD_EXECUTE
)
# Installa il service file systemd --user
install(FILES
data/service/BastionGuard-mailproxy.service
DESTINATION /usr/lib/systemd/user
)
# Il service file viene installato nella sezione init-system centralizzata.
# ============================================================
@ -1829,13 +1847,15 @@ if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
--sysconfdir=/etc
--localedir=share/locale
--buildtype=release
-Dinstall_systemd_service=false
--reconfigure
BUILD_COMMAND
${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"
INSTALL_COMMAND
${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"
BUILD_ALWAYS 1
@ -2268,7 +2288,9 @@ if (INSTALL_NGINX_DEFAULTS)
message(STATUS \"[NGINX] Testo configurazione...\")
execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
if(nginx_test EQUAL 0)
execute_process(COMMAND systemctl restart nginx)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
)
message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
else()
message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
@ -2337,36 +2359,186 @@ install(PROGRAMS
# Services
# ======================
# opzione per abilitare automaticamente le user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)
# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)
# install system units (system-wide)
# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
data/init/common/bastionguard-service
data/init/common/bastionguard-supervise
data/init/common/bastionguard-periodic
data/init/common/bastionguard-sanesecurity-update
DESTINATION /usr/libexec/bastionguard
)
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
DESTINATION /usr/lib/systemd/system
"${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
DESTINATION /usr/libexec/bastionguard
)
# install user units (systemd --user services)
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-cef.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
install(FILES
data/service/BastionGuard-phishing-scanner.service
data/service/BastionGuard-phishing-updater.service
data/service/BastionGuard-phishing-updater.timer
data/service/BastionGuard-ransomware-realtime.service
data/service/bastionguard-sanesecurity.service
data/service/bastionguard-sanesecurity.timer
data/service/BastionGuard-usbd.service
data/service/clamav-clamonacc.service
DESTINATION /usr/lib/systemd/system
)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
install(FILES
thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
DESTINATION /usr/lib/systemd/system
)
endif()
install(FILES
data/service/BastionGuard-useragent.service
data/service/BastionGuard-privacyd.service
data/service/BastionGuard-ransomware-alert.service
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-cef.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
function(bg_install_openrc_service service_name)
install(PROGRAMS data/init/openrc/bastionguard-openrc-service
DESTINATION /etc/init.d
RENAME "${service_name}")
endfunction()
bg_install_openrc_service(BastionGuard-phishing-scanner)
bg_install_openrc_service(BastionGuard-phishing-updater)
bg_install_openrc_service(BastionGuard-phishing-updater-timer)
bg_install_openrc_service(BastionGuard-ransomware-realtime)
bg_install_openrc_service(bastionguard-sanesecurity)
bg_install_openrc_service(bastionguard-sanesecurity-timer)
bg_install_openrc_service(BastionGuard-usbd)
bg_install_openrc_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_openrc_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
function(bg_install_sysv_service service_name)
set(BG_SYSV_SERVICE_NAME "${service_name}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
configure_file(
data/init/sysvinit/bastionguard-sysv-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(PROGRAMS "${_generated_service}"
DESTINATION /etc/init.d)
endfunction()
bg_install_sysv_service(BastionGuard-phishing-scanner)
bg_install_sysv_service(BastionGuard-phishing-updater)
bg_install_sysv_service(BastionGuard-phishing-updater-timer)
bg_install_sysv_service(BastionGuard-ransomware-realtime)
bg_install_sysv_service(bastionguard-sanesecurity)
bg_install_sysv_service(bastionguard-sanesecurity-timer)
bg_install_sysv_service(BastionGuard-usbd)
bg_install_sysv_service(clamav-clamonacc)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_sysv_service(bsc-daemon)
endif()
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
install(PROGRAMS
data/init/dinit/bastionguard-dinit-run
data/init/dinit/bastionguard-dinit-user-run
DESTINATION /usr/libexec/bastionguard
)
set(_generated_dinit_root
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
configure_file(
data/init/dinit/bastionguard-dinit-root.in
"${_generated_dinit_root}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_dinit_root}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")
function(bg_install_dinit_service service_name service_type restart_policy)
set(BG_DINIT_SERVICE_NAME "${service_name}")
set(BG_DINIT_SERVICE_TYPE "${service_type}")
set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
if(service_type STREQUAL "process")
set(BG_DINIT_SERVICE_RESTART_OPTIONS
"restart-delay = 5\nrestart-limit-count = 0")
else()
set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
endif()
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
endfunction()
bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
bg_install_dinit_service(BastionGuard-phishing-updater process false)
bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
bg_install_dinit_service(bastionguard-sanesecurity process false)
bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
bg_install_dinit_service(BastionGuard-usbd process on-failure)
bg_install_dinit_service(clamav-clamonacc process on-failure)
if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
bg_install_dinit_service(bsc-daemon process on-failure)
endif()
function(bg_install_dinit_user_service service_name restart_policy restart_delay)
set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
set(_generated_service
"${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
configure_file(
data/init/dinit/bastionguard-dinit-user-service.in
"${_generated_service}"
@ONLY
NEWLINE_STYLE UNIX
)
install(FILES "${_generated_service}"
DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
endfunction()
bg_install_dinit_user_service(BastionGuard-useragent true 3)
bg_install_dinit_user_service(BastionGuard-privacyd true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
bg_install_dinit_user_service(BastionGuard-pacd true 3)
bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
bg_install_dinit_user_service(BastionGuard-cef true 3)
install(FILES data/init/common/bastionguard-user-services.desktop
DESTINATION /etc/xdg/autostart)
endif()
# helper script to enable user agents for logged-in users
install(PROGRAMS
@ -2376,6 +2548,7 @@ install(PROGRAMS
data/scripts/BastionGuard-export-env.sh
data/scripts/BastionGuard-locale.sh
data/scripts/BastionGuard-setup-clamav-daemon.sh
data/scripts/BastionGuard-restart-user-services.sh
data/scripts/BastionGuard-user-session-watch.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
@ -2501,40 +2674,38 @@ bg_install_code( "
if(ENABLE_SYSTEMD_SERVICES)
if(ENABLE_INIT_SERVICES)
bg_install_code( "
message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
execute_process(COMMAND systemctl daemon-reload)
if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
else()
message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
)
message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)
message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)
if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
)
endif()
message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)
message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl enable BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner on graphical...\")
execute_process(COMMAND systemctl start BastionGuard-restart-on-graphical.service)
message(STATUS \"[Systemd] Riavvio polkit ...\")
execute_process(COMMAND systemctl start polkit.service)
execute_process(
COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
)
endif()
")
else()
message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()
# ============================================================

40
src/Backend.cpp
View file

@ -300,11 +300,11 @@ std::pair<int,int> read_ports_from_conf()
}
static void restart_clamd() {
if (std::system("systemctl is-active --quiet clamav-daemon") == 0) {
std::system("pkexec systemctl restart clamav-daemon");
if (std::system("/usr/libexec/bastionguard/bastionguard-service --system is-active clamav-daemon.service") == 0) {
std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system restart clamav-daemon.service");
std::cout << _("✔ Riavviato clamav-daemon\n");
} else if (std::system("systemctl is-active --quiet clamd") == 0) {
std::system("pkexec systemctl restart clamd");
} else if (std::system("/usr/libexec/bastionguard/bastionguard-service --system is-active clamd.service") == 0) {
std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system restart clamd.service");
std::cout << _("✔ Riavviato clamd\n");
} else {
std::cerr << _("⚠ Nessun servizio clamd/clamav-daemon trovato\n");
@ -439,7 +439,7 @@ static bool copy_to_final(const std::string& src, const std::string& dest) {
static std::string findClamonaccService() {
for (auto service : CLAMONACC_SERVICES) {
std::string cmd = "systemctl is-active --quiet " + std::string(service);
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system is-active " + std::string(service);
if (std::system(cmd.c_str()) == 0) {
return service;
}
@ -451,19 +451,19 @@ static std::string findClamonaccService() {
bool Backend::enableClamonacc() {
auto service = findClamonaccService();
std::string cmd = "systemctl enable --now " + service;
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system enable --now " + service;
return std::system(cmd.c_str()) == 0;
}
bool Backend::disableClamonacc() {
auto service = findClamonaccService();
std::string cmd = "systemctl disable --now " + service;
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system disable --now " + service;
return std::system(cmd.c_str()) == 0;
}
bool Backend::isClamonaccActive() {
for (auto service : CLAMONACC_SERVICES) {
FILE* pipe = popen(("systemctl is-active " + std::string(service) + " 2>&1").c_str(), "r");
FILE* pipe = popen(("/usr/libexec/bastionguard/bastionguard-service --system is-active " + std::string(service) + " 2>&1").c_str(), "r");
if (!pipe) continue;
char buffer[128];
@ -507,7 +507,7 @@ std::string Backend::getQuarantinePath() {
std::vector<std::string> Backend::getClamonaccLogs() {
std::vector<std::string> lines;
for (auto service : CLAMONACC_SERVICES) {
FILE* pipe = popen(("journalctl -u " + std::string(service) + " -n 100 --no-pager").c_str(), "r");
FILE* pipe = popen(("/usr/libexec/bastionguard/bastionguard-service --system logs " + std::string(service) + " 100").c_str(), "r");
if (!pipe) continue;
char buffer[256];
@ -624,7 +624,7 @@ std::vector<std::string> Backend::getOnAccessPaths() {
std::vector<std::string> Backend::getOnAccessEvents() {
std::vector<std::string> events;
for (auto service : CLAMONACC_SERVICES) {
std::string cmd = "journalctl -u " + std::string(service) + " -n 50 --no-pager";
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system logs " + std::string(service) + " 50";
FILE* pipe = popen(cmd.c_str(), "r");
if (!pipe) continue;
@ -847,7 +847,7 @@ Backend& Backend::instance() {
void Backend::start_antiransom() {
std::string user = Glib::get_user_name();
std::string cmd = "runuser -l " + user +
" -c \"systemctl --user start BastionGuard-ransomware-scanner.service\"";
" -c \"/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-ransomware-scanner.service\"";
int ret = std::system(cmd.c_str());
if (ret == 0)
std::cout << _("✔ Servizio Anti-Ransomware avviato\n");
@ -858,7 +858,7 @@ void Backend::start_antiransom() {
void Backend::stop_antiransom() {
std::string user = Glib::get_user_name();
std::string cmd = "runuser -l " + user +
" -c \"systemctl --user stop BastionGuard-ransomware-scanner.service\"";
" -c \"/usr/libexec/bastionguard/bastionguard-service --user stop BastionGuard-ransomware-scanner.service\"";
int ret = std::system(cmd.c_str());
if (ret == 0)
std::cout << _("✔ Servizio Anti-Ransomware fermato\n");
@ -1519,7 +1519,7 @@ bool Backend::updatePhishLists() {
void Backend::start_antiphish() {
std::cout << _("▶ Avvio protezione Anti-Phishing...\n");
int ret = std::system("pkexec systemctl start BastionGuard-phishing-scanner.service");
int ret = std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system start BastionGuard-phishing-scanner.service");
if (ret == 0) {
std::cout << _("✔ Servizio Anti-Phishing avviato\n");
} else {
@ -1529,7 +1529,7 @@ void Backend::start_antiphish() {
void Backend::stop_antiphish() {
std::cout << _("⏹ Arresto protezione Anti-Phishing...\n");
int ret = std::system("pkexec systemctl stop BastionGuard-phishing-scanner.service");
int ret = std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system stop BastionGuard-phishing-scanner.service");
if (ret == 0) {
std::cout << _("✔ Servizio Anti-Phishing fermato\n");
} else {
@ -1612,13 +1612,13 @@ bool Backend::updateSanesecurityDB(std::function<void(int, int, const std::strin
bool Backend::isAntiransomActive() {
std::string user = Glib::get_user_name();
std::string cmd = "runuser -l " + user +
" -c \"systemctl --user is-active --quiet BastionGuard-ransomware-scanner.service\"";
" -c \"/usr/libexec/bastionguard/bastionguard-service --user is-active BastionGuard-ransomware-scanner.service\"";
int ret = std::system(cmd.c_str());
return (ret == 0);
}
bool Backend::isAntiphishActive() {
int ret = std::system("systemctl is-active --quiet BastionGuard-phishing-scanner.service");
int ret = std::system("/usr/libexec/bastionguard/bastionguard-service --system is-active BastionGuard-phishing-scanner.service");
return (ret == 0);
}
@ -1727,14 +1727,14 @@ bool Backend::testGoogleSafeKey() {
}
bool Backend::isPhishAutoUpdateEnabled() {
int ret = std::system("systemctl is-enabled --quiet BastionGuard-phishing-updater.timer");
int ret = std::system("/usr/libexec/bastionguard/bastionguard-service --system is-enabled BastionGuard-phishing-updater.timer");
return (ret == 0);
}
bool Backend::enablePhishAutoUpdate(bool enable) {
std::string cmd = enable
? "pkexec systemctl enable --now BastionGuard-phishing-updater.timer"
: "pkexec systemctl disable --now BastionGuard-phishing-updater.timer";
? "pkexec /usr/libexec/bastionguard/bastionguard-service --system enable --now BastionGuard-phishing-updater.timer"
: "pkexec /usr/libexec/bastionguard/bastionguard-service --system disable --now BastionGuard-phishing-updater.timer";
int ret = std::system(cmd.c_str());
if (ret == 0) {
@ -2954,7 +2954,7 @@ bool Backend::isBankDomain(const std::string& host) const {
}
bool Backend::reload_dnsmasq() {
int ret = std::system("pkexec systemctl reload dnsmasq");
int ret = std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service");
if (ret == 0) {
std::cout << _("✔ dnsmasq ricaricato correttamente.\n");
return true;

1
src/Backend.hpp
View file

@ -195,7 +195,6 @@ private:
Backend(const Backend&) = delete;
Backend& operator=(const Backend&) = delete;
bool useSystemd_ = true;
AntiRansomEngine antiransom_;
sigc::signal<void(const std::string&)> antiransom_signal_;
std::function<void(int, int, const std::string&)> progressCallback_;

2
src/BankPage.cpp
View file

@ -98,7 +98,7 @@ static std::string iso_today_yyyy_mm_dd() {
}
static void restart_cef_service_user() {
int rc = std::system("systemctl --user restart BastionGuard-cef.service >/dev/null 2>&1");
int rc = std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-cef.service >/dev/null 2>&1");
if (rc == 0)
std::cout << _("[BankPage] ✔ BastionGuard-cef.service riavviato\n");
else

2
src/DashboardPage.cpp
View file

@ -73,7 +73,7 @@ static int compare_semver(const std::string& a, const std::string& b)
static bool check_service_active(const std::string& service_name) {
std::string cmd = "systemctl is-active --quiet " + service_name;
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system is-active " + service_name;
return (std::system(cmd.c_str()) == 0);
}

4
src/PrivacyPage.cpp
View file

@ -302,13 +302,13 @@ PrivacyPage::~PrivacyPage() {
bool PrivacyPage::is_daemon_active() {
int rc = std::system("systemctl --user is-active --quiet BastionGuard-privacyd.service");
int rc = std::system("/usr/libexec/bastionguard/bastionguard-service --user is-active BastionGuard-privacyd.service");
return (WIFEXITED(rc) && WEXITSTATUS(rc) == 0);
}
void PrivacyPage::start_privacy_daemon() {
write_log(_("Avvio automatico del servizio BastionGuard-privacyd..."));
std::system("systemctl --user start BastionGuard-privacyd.service");
std::system("/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-privacyd.service");
}

4
src/SaneSecurityUpdater.cpp
View file

@ -34,8 +34,8 @@ static bool reload_clamav_service() {
for (const auto& svc : services) {
std::string cmd =
"systemctl is-active --quiet " + svc +
" && systemctl reload " + svc;
"/usr/libexec/bastionguard/bastionguard-service --system is-active " + svc +
" && /usr/libexec/bastionguard/bastionguard-service --system try-reload-or-restart " + svc;
if (std::system(cmd.c_str()) == 0) {
return true;

96
src/SettingsPage.cpp
View file

@ -100,13 +100,14 @@ namespace {
}
}
static bool pkexec_systemctl(const std::vector<std::string>& args,
static bool pkexec_servicectl(const std::vector<std::string>& args,
std::string* out_stdout = nullptr)
{
std::vector<std::string> argv;
argv.reserve(args.size() + 2);
argv.reserve(args.size() + 3);
argv.push_back("pkexec");
argv.push_back("systemctl");
argv.push_back("/usr/libexec/bastionguard/bastionguard-service");
argv.push_back("--system");
argv.insert(argv.end(), args.begin(), args.end());
return run_cmd(argv, out_stdout, false);
@ -1219,7 +1220,7 @@ bool copy_with_pkexec(const std::string &src, const std::string &dst)
bool restart_service(const std::string &svc)
{
std::ostringstream cmd;
cmd << "pkexec systemctl restart " << Glib::shell_quote(svc);
cmd << "pkexec /usr/libexec/bastionguard/bastionguard-service --system restart " << Glib::shell_quote(svc);
std::cout << "[restart_service] " << cmd.str() << std::endl;
return (std::system(cmd.str().c_str()) == 0);
}
@ -1351,7 +1352,7 @@ static std::string detect_webserver() {
using namespace std;
auto is_active = [](const std::string& svc) -> bool {
std::string cmd = "systemctl is-active --quiet " + svc;
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --system is-active " + svc;
return (std::system(cmd.c_str()) == 0);
};
@ -1509,9 +1510,9 @@ namespace {
bool isServiceActive(const std::string& service, bool user = false) {
std::string cmd;
if (user) {
cmd = "systemctl --user is-active --quiet " + service;
cmd = "/usr/libexec/bastionguard/bastionguard-service --user is-active " + service;
} else {
cmd = "systemctl is-active --quiet " + service;
cmd = "/usr/libexec/bastionguard/bastionguard-service --system is-active " + service;
}
return (std::system(cmd.c_str()) == 0);
}
@ -1975,9 +1976,9 @@ void SettingsPage::build_antiransom_tab() {
void SettingsPage::onAntiransomToggled() {
if (antiransomSwitch.get_active()) {
if (!isServiceActive("BastionGuard-ransomware-scanner.service")) {
if (!isServiceActive("BastionGuard-ransomware-scanner.service", true)) {
antiransomStatus.set_text(_("⏳ Avvio servizio Anti-Ransomware..."));
if (std::system("systemctl --user start BastionGuard-ransomware-scanner.service") != 0) {
if (std::system("/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-ransomware-scanner.service") != 0) {
antiransomStatus.set_text(_("❌ Impossibile avviare il servizio Anti-Ransomware"));
antiransomSwitch.set_active(false);
return;
@ -1986,9 +1987,9 @@ void SettingsPage::onAntiransomToggled() {
Backend::instance().start_antiransom();
antiransomStatus.set_text(_("Protezione Anti-Ransomware: Attiva"));
} else {
if (isServiceActive("BastionGuard-ransomware-scanner.service")) {
if (isServiceActive("BastionGuard-ransomware-scanner.service", true)) {
antiransomStatus.set_text(_("⏳ Arresto servizio Anti-Ransomware..."));
if (std::system("systemctl --user stop BastionGuard-ransomware-scanner.service") != 0) {
if (std::system("/usr/libexec/bastionguard/bastionguard-service --user stop BastionGuard-ransomware-scanner.service") != 0) {
antiransomStatus.set_text(_("❌ Impossibile fermare il servizio Anti-Ransomware"));
antiransomSwitch.set_active(true);
return;
@ -2331,7 +2332,7 @@ void SettingsPage::build_antiphish_tab() {
refreshPhishLists();
if (isServiceActive("BastionGuard-phishing-scanner.service")) {
antiphishStatus.set_text(_("♻ Riavvio servizio Anti-Phishing..."));
int r1 = std::system("pkexec systemctl restart BastionGuard-phishing-scanner.service");
int r1 = std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service");
if (r1 == 0) {
antiphishStatus.set_text(_("✔ Servizio Anti-Phishing riavviato con nuova blacklist"));
} else {
@ -2481,7 +2482,7 @@ void SettingsPage::onAntiphishToggled() {
if (antiphishSwitch.get_active()) {
if (!isServiceActive("BastionGuard-phishing-scanner.service")) {
antiphishStatus.set_text(_("⏳ Avvio servizio Anti-Phishing..."));
if (std::system("pkexec systemctl start BastionGuard-phishing-scanner.service") != 0) {
if (std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system start BastionGuard-phishing-scanner.service") != 0) {
antiphishStatus.set_text(_("❌ Impossibile avviare il servizio Anti-Phishing"));
antiphishSwitch.set_active(false);
return;
@ -2492,7 +2493,7 @@ void SettingsPage::onAntiphishToggled() {
} else {
if (isServiceActive("BastionGuard-phishing-scanner.service")) {
antiphishStatus.set_text(_("⏳ Arresto servizio Anti-Phishing..."));
if (std::system("pkexec systemctl stop BastionGuard-phishing-scanner.service") != 0) {
if (std::system("pkexec /usr/libexec/bastionguard/bastionguard-service --system stop BastionGuard-phishing-scanner.service") != 0) {
antiphishStatus.set_text(_("❌ Impossibile fermare il servizio Anti-Phishing"));
antiphishSwitch.set_active(true);
return;
@ -2670,27 +2671,27 @@ void SettingsPage::build_options_tab() {
int rc = 0;
rc = run_cmd(std::string("systemctl --user restart ") + alert_service);
rc = run_cmd(std::string("/usr/libexec/bastionguard/bastionguard-service --user restart ") + alert_service);
if (rc != 0) {
std::cerr << _("[BastionGuard] ⚠ Impossibile riavviare ") << alert_service
<< _(" tramite systemctl --user") << std::endl;
<< _(" tramite il gestore servizi utente") << std::endl;
}
rc = run_cmd(std::string("systemctl --user restart ") + alert_realtime_service);
rc = run_cmd(std::string("/usr/libexec/bastionguard/bastionguard-service --user restart ") + alert_realtime_service);
if (rc != 0) {
std::cerr << _("[BastionGuard] ⚠ Impossibile riavviare ") << alert_realtime_service
<< _(" tramite systemctl --user") << std::endl;
<< _(" tramite il gestore servizi utente") << std::endl;
}
rc = run_cmd(std::string("systemctl --user restart ") + ransomware_service);
rc = run_cmd(std::string("/usr/libexec/bastionguard/bastionguard-service --user restart ") + ransomware_service);
if (rc != 0) {
std::cerr << _("[BastionGuard] ⚠ Impossibile riavviare ") << ransomware_service
<< _(" tramite systemctl --user") << std::endl;
<< _(" tramite il gestore servizi utente") << std::endl;
}
rc = run_cmd(std::string("pkexec systemctl restart ") + scanner_service);
rc = run_cmd(std::string("pkexec /usr/libexec/bastionguard/bastionguard-service --system restart ") + scanner_service);
if (rc != 0) {
std::string pattern = scanner_service;
int rc_pgrep = run_cmd("pgrep -f " + pattern + " >/dev/null 2>&1");
@ -3030,7 +3031,7 @@ void SettingsPage::build_options_tab() {
script << "install -m 0644 " << tmpfile << " " << target_conf << "\n";
}
script << "nginx -t && systemctl restart nginx\n";
script << "nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service\n";
std::string out;
if (!write_temp_script_and_elevate(script.str(), &out)) {
@ -3389,7 +3390,7 @@ void SettingsPage::build_whitelist_tab() {
"install -D -m 0644 \"" + wlUserPath + "\" \"" + wlSysPath + "\" && "
"install -D -m 0644 \"" + blUserPath + "\" \"" + blSysPath + "\" && "
"install -D -m 0644 \"" + tmpDnsmasqConf + "\" \"" + dnsmasqConfPath + "\" && "
"systemctl reload dnsmasq"
"/usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service"
"'";
int rc = std::system(cmd.c_str());
@ -3402,7 +3403,7 @@ void SettingsPage::build_whitelist_tab() {
std::thread([=]() {
Backend::instance().updatePhishLists();
if (BastionGuard::Platform::cef_available()) {
std::system("systemctl --user restart BastionGuard-cef");
std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-cef");
}
}).detach();
});
@ -3793,7 +3794,7 @@ void SettingsPage::build_secure_payments_tab() {
if (BastionGuard::Platform::cef_available()) {
std::thread([]() {
std::system("systemctl --user restart BastionGuard-cef.service");
std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-cef.service");
}).detach();
}
});
@ -3863,7 +3864,7 @@ void SettingsPage::build_secure_payments_tab() {
final_log += "\n[BastionGuard] Installazione completata. Riavvio BastionGuard-cef.service (user)...\n";
std::string out3, err3;
restart_ok = run_cmd_capture(
{"systemctl", "--user", "restart", "BastionGuard-cef.service"},
{"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-cef.service"},
&out3, &err3
);
@ -4282,7 +4283,7 @@ void SettingsPage::build_proxy_bypass_tab() {
// Riavvia il servizio CEF solo nelle build/distribuzioni che lo supportano.
if (BastionGuard::Platform::cef_available()) {
std::thread([]() {
std::system("systemctl --user restart BastionGuard-cef.service 2>/dev/null || true");
std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-cef.service 2>/dev/null || true");
}).detach();
}
});
@ -4304,13 +4305,13 @@ void SettingsPage::build_user_services_tab()
auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
inner->set_margin(10);
auto title = Gtk::make_managed<Gtk::Label>(_("Servizi Utente (systemd --user)"));
auto title = Gtk::make_managed<Gtk::Label>(_("Servizi utente"));
title->set_halign(Gtk::Align::START);
title->add_css_class("card-title");
inner->append(*title);
auto desc = Gtk::make_managed<Gtk::Label>(
_("Questi servizi vengono gestiti con systemd --user.\n"
_("Questi servizi vengono gestiti dal backend init rilevato.\n"
"Abilitare = avvio automatico al login. Disabilitare = non parte automaticamente.")
);
desc->set_wrap(true);
@ -4319,7 +4320,7 @@ void SettingsPage::build_user_services_tab()
inner->append(*desc);
auto info = Gtk::make_managed<Gtk::Label>(
_("Nota: puoi avviarli manualmente con: systemctl --user start <unit>")
_("Nota: puoi avviarli manualmente con: /usr/libexec/bastionguard/bastionguard-service --user start <unit>")
);
info->set_wrap(true);
info->add_css_class("alert-info");
@ -4368,7 +4369,7 @@ void SettingsPage::build_system_services_tab()
auto desc = Gtk::make_managed<Gtk::Label>(
_("Questi servizi richiedono privilegi amministrativi.\n"
"Vengono gestiti con: pkexec systemctl ...")
"Vengono gestiti con: pkexec /usr/libexec/bastionguard/bastionguard-service --system ...")
);
desc->set_wrap(true);
desc->set_halign(Gtk::Align::START);
@ -4516,13 +4517,14 @@ void SettingsPage::build_services_section(
bool SettingsPage::pkexec_systemctl(const std::vector<std::string>& args,
bool SettingsPage::pkexec_servicectl(const std::vector<std::string>& args,
std::string* out_stdout)
{
std::vector<std::string> argv;
argv.reserve(args.size() + 2);
argv.reserve(args.size() + 3);
argv.push_back("pkexec");
argv.push_back("systemctl");
argv.push_back("/usr/libexec/bastionguard/bastionguard-service");
argv.push_back("--system");
argv.insert(argv.end(), args.begin(), args.end());
return run_cmd(argv, out_stdout, false);
@ -4534,7 +4536,7 @@ bool SettingsPage::is_user_service_enabled(const std::string& service_name)
try
{
auto proc = Gio::Subprocess::create(
{"systemctl", "--user", "is-enabled", service_name},
{"/usr/libexec/bastionguard/bastionguard-service", "--user", "is-enabled", service_name},
Gio::Subprocess::Flags::STDOUT_PIPE |
Gio::Subprocess::Flags::STDERR_PIPE
);
@ -4559,17 +4561,17 @@ bool SettingsPage::is_user_service_enabled(const std::string& service_name)
bool SettingsPage::enable_user_service(const std::string& service_name)
{
if (!run_cmd({"systemctl", "--user", "enable", "--now", service_name}))
if (!run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "enable", "--now", service_name}))
return false;
run_cmd({"systemctl", "--user", "start", service_name});
run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "start", service_name});
return true;
}
bool SettingsPage::disable_user_service(const std::string& service_name)
{
run_cmd({"systemctl", "--user", "stop", service_name});
return run_cmd({"systemctl", "--user", "disable", "--now", service_name});
run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "stop", service_name});
return run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "disable", "--now", service_name});
}
@ -4578,7 +4580,7 @@ bool SettingsPage::is_system_service_enabled(const std::string& unit_name)
try
{
auto proc = Gio::Subprocess::create(
{"systemctl", "is-enabled", unit_name},
{"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-enabled", unit_name},
Gio::Subprocess::Flags::STDOUT_PIPE |
Gio::Subprocess::Flags::STDERR_PIPE
);
@ -4603,17 +4605,17 @@ bool SettingsPage::is_system_service_enabled(const std::string& unit_name)
bool SettingsPage::enable_system_service(const std::string& unit_name)
{
if (!pkexec_systemctl({"enable", "--now", unit_name}, nullptr))
if (!pkexec_servicectl({"enable", "--now", unit_name}, nullptr))
return false;
pkexec_systemctl({"start", unit_name}, nullptr);
pkexec_servicectl({"start", unit_name}, nullptr);
return true;
}
bool SettingsPage::disable_system_service(const std::string& unit_name)
{
pkexec_systemctl({"stop", unit_name}, nullptr);
return pkexec_systemctl({"disable", "--now", unit_name}, nullptr);
pkexec_servicectl({"stop", unit_name}, nullptr);
return pkexec_servicectl({"disable", "--now", unit_name}, nullptr);
}
@ -4833,7 +4835,7 @@ void SettingsPage::show_service_error_dialog(
_("Servizio: %1\n\n"
"Possibili cause:\n"
"• Il file .service non esiste\n"
"• systemd --user non è attivo per l'utente\n"
"• Il gestore servizi utente non è disponibile\n"
"• Problemi di permessi o path\n"
"• Errore di sintassi nel file di servizio"),
service_name
@ -5539,7 +5541,7 @@ void SettingsPage::build_email_security_tab() {
}
if (save_mail_security_config(auto_save)) {
std::system("systemctl --user restart BastionGuard-mailproxy.service 2>/dev/null");
std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-mailproxy.service 2>/dev/null");
tb_status->set_text(Glib::ustring::compose(
_("✔ %1 profili salvati e proxy riavviato."),
(int)auto_save.profiles.size()));
@ -5673,7 +5675,7 @@ void SettingsPage::build_email_security_tab() {
return;
}
std::system("systemctl --user restart BastionGuard-mailproxy.service 2>/dev/null");
std::system("/usr/libexec/bastionguard/bastionguard-service --user restart BastionGuard-mailproxy.service 2>/dev/null");
status->set_text(_("✔ Configurazione salvata in ~/.config/BastionGuard/mail.json"));

2
src/SettingsPage.hpp
View file

@ -216,7 +216,7 @@ private:
std::string* out_stdout = nullptr,
bool silence_stderr = true);
bool pkexec_systemctl(const std::vector<std::string>& args,
bool pkexec_servicectl(const std::vector<std::string>& args,
std::string* out_stdout = nullptr);
void build_services_section(Gtk::Box& parent,

13
src/TrayIcon.hpp
View file

@ -20,7 +20,13 @@
#pragma once
#ifndef BASTIONGUARD_HAS_SDBUS
#define BASTIONGUARD_HAS_SDBUS 0
#endif
#if BASTIONGUARD_HAS_SDBUS
#include <systemd/sd-bus.h>
#endif
#include <glib.h>
#include <atomic>
#include <functional>
@ -50,6 +56,7 @@ public:
void set_on_quit(std::function<void()> cb) { on_quit_cb_ = std::move(cb); }
void bind_ui_context();
#if BASTIONGUARD_HAS_SDBUS
static int sni_method_activate(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
static int sni_method_context_menu(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
static int sni_method_secondary_activate(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
@ -79,6 +86,7 @@ public:
sd_bus_message* reply,
void* userdata,
sd_bus_error* ret_error);
#endif
private:
@ -100,9 +108,11 @@ private:
std::function<void()> on_settings_cb_;
std::function<void()> on_quit_cb_;
#if BASTIONGUARD_HAS_SDBUS
sd_bus* bus_ = nullptr;
sd_bus_slot* sni_slot_ = nullptr;
sd_bus_slot* menu_slot_ = nullptr;
#endif
std::thread bus_thread_;
std::atomic_bool running_{false};
@ -113,6 +123,7 @@ private:
static constexpr int MENU_QUIT = 3;
private:
#if BASTIONGUARD_HAS_SDBUS
static std::string make_service_name();
bool acquire_bus();
@ -127,4 +138,6 @@ private:
void emit_sni_signal(const char* signal_name);
void emit_dbusmenu_layout_updated();
#endif
};

57
src/TrayIconStub.cpp Normal file
View file

@ -0,0 +1,57 @@
/*
* BastionGuard tray fallback for systems built without libsystemd/sd-bus.
* The main window remains fully functional; only the StatusNotifierItem is
* unavailable.
*/
#include "TrayIcon.hpp"
#include <cstdio>
#include <utility>
TrayIcon::TrayIcon() = default;
TrayIcon::~TrayIcon() {
stop();
if (ui_ctx_) {
g_main_context_unref(ui_ctx_);
ui_ctx_ = nullptr;
}
}
bool TrayIcon::start() {
std::fprintf(stderr,
"[TrayIcon] sd-bus non disponibile: icona di notifica disabilitata\n");
return false;
}
void TrayIcon::stop() {
running_ = false;
if (bus_thread_.joinable())
bus_thread_.join();
}
void TrayIcon::bind_ui_context() {
if (ui_ctx_)
g_main_context_unref(ui_ctx_);
ui_ctx_ = g_main_context_ref_thread_default();
if (!ui_ctx_)
ui_ctx_ = g_main_context_ref(g_main_context_default());
}
void TrayIcon::set_icon_file(const std::string&, int) {
have_pixmap_ = false;
pix_rgba_.clear();
}
void TrayIcon::set_icon(const std::string& icon_name) {
icon_name_ = icon_name;
}
void TrayIcon::set_tooltip(const std::string& text) {
tooltip_ = text;
}
void TrayIcon::set_title(const std::string& title) {
title_ = title;
}

14
src/UpdatePage.cpp
View file

@ -105,7 +105,7 @@ bool UpdatePage::checkServiceStatus() {
std::string out;
int status = -1;
try {
Glib::spawn_command_line_sync("systemctl is-active clamav-freshclam.service",
Glib::spawn_command_line_sync("/usr/libexec/bastionguard/bastionguard-service --system is-active clamav-freshclam.service",
&out, nullptr, &status);
return out.find("active") != std::string::npos;
} catch (...) {
@ -115,7 +115,7 @@ bool UpdatePage::checkServiceStatus() {
void UpdatePage::onServiceToggled() {
bool enable = serviceSwitch.get_active();
std::string cmd = std::string("pkexec systemctl ") + (enable ? "enable --now" : "disable --now") + " clamav-freshclam.service";
std::string cmd = std::string("pkexec /usr/libexec/bastionguard/bastionguard-service --system ") + (enable ? "enable --now" : "disable --now") + " clamav-freshclam.service";
buffer->insert(buffer->end(), (enable ? _("Abilito") : _("Disabilito")) + std::string(" il servizio freshclam...\n"));
std::string out, err;
@ -150,7 +150,7 @@ void UpdatePage::onUpdateClicked() {
try {
logSafe(_("⏸️ Arresto servizio clamav-freshclam...\n"));
system("pkexec systemctl stop clamav-freshclam.service");
system("pkexec /usr/libexec/bastionguard/bastionguard-service --system stop clamav-freshclam.service");
logSafe(_("🚀 Avvio aggiornamento con pkexec freshclam...\n"));
try {
Glib::spawn_command_line_sync("pkexec freshclam", &out, &err, &exit_status);
@ -165,7 +165,7 @@ void UpdatePage::onUpdateClicked() {
}
logSafe(Glib::ustring::compose(_("\n🧾 Codice di uscita: %1\n"), exit_status));
logSafe(_("▶️ Riavvio del servizio clamav-freshclam...\n"));
system("pkexec systemctl start clamav-freshclam.service");
system("pkexec /usr/libexec/bastionguard/bastionguard-service --system start clamav-freshclam.service");
logSafe(_("\n🔽 Scarico firme aggiuntive dalle sorgenti configurate...\n"));
if (!alive->load()) return;
@ -176,7 +176,7 @@ void UpdatePage::onUpdateClicked() {
updateSaneSecurity();
logSafe(_("🔁 Ricarico clamd (clamav-daemon)...\n"));
int reload_status = system("pkexec systemctl reload clamav-daemon.service");
int reload_status = system("pkexec /usr/libexec/bastionguard/bastionguard-service --system try-reload-or-restart clamav-daemon.service");
if (reload_status != 0) {
logSafe(_("⚠ Reload clamav-daemon fallito (codice non zero).\n"));
}
@ -652,7 +652,7 @@ bool UpdatePage::checkSaneTimer() {
try {
Glib::spawn_command_line_sync(
"systemctl is-enabled bastionguard-sanesecurity.timer",
"/usr/libexec/bastionguard/bastionguard-service --system is-enabled bastionguard-sanesecurity.timer",
&out, nullptr, &status
);
return out.find("enabled") != std::string::npos;
@ -672,7 +672,7 @@ void UpdatePage::onSaneAutoToggled() {
);
std::string cmd =
std::string("pkexec systemctl ") +
std::string("pkexec /usr/libexec/bastionguard/bastionguard-service --system ") +
(enable ? "enable --now " : "disable --now ") +
"bastionguard-sanesecurity.timer";

27
src/first_run/first-run-services-window.cpp
View file

@ -102,13 +102,14 @@ namespace {
}
}
static bool pkexec_systemctl(const std::vector<std::string>& args,
static bool pkexec_servicectl(const std::vector<std::string>& args,
bool silence_stderr = false)
{
std::vector<std::string> argv;
argv.reserve(args.size() + 2);
argv.reserve(args.size() + 3);
argv.push_back("pkexec");
argv.push_back("systemctl");
argv.push_back("/usr/libexec/bastionguard/bastionguard-service");
argv.push_back("--system");
argv.insert(argv.end(), args.begin(), args.end());
return run_cmd(argv, silence_stderr);
}
@ -655,7 +656,7 @@ bool FirstRunServicesWindow::is_user_service_enabled(const std::string& service_
try
{
auto proc = Gio::Subprocess::create(
{"systemctl", "--user", "is-enabled", service_name},
{"/usr/libexec/bastionguard/bastionguard-service", "--user", "is-enabled", service_name},
Gio::Subprocess::Flags::STDOUT_PIPE |
Gio::Subprocess::Flags::STDERR_PIPE
);
@ -679,17 +680,17 @@ bool FirstRunServicesWindow::is_user_service_enabled(const std::string& service_
bool FirstRunServicesWindow::enable_user_service(const std::string& service_name)
{
if (!run_cmd({"systemctl", "--user", "enable", "--now", service_name}))
if (!run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "enable", "--now", service_name}))
return false;
run_cmd({"systemctl", "--user", "start", service_name});
run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "start", service_name});
return true;
}
bool FirstRunServicesWindow::disable_user_service(const std::string& service_name)
{
run_cmd({"systemctl", "--user", "stop", service_name});
return run_cmd({"systemctl", "--user", "disable", "--now", service_name});
run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "stop", service_name});
return run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "disable", "--now", service_name});
}
bool FirstRunServicesWindow::is_system_service_enabled(const std::string& unit_name)
@ -697,7 +698,7 @@ bool FirstRunServicesWindow::is_system_service_enabled(const std::string& unit_n
try
{
auto proc = Gio::Subprocess::create(
{"systemctl", "is-enabled", unit_name},
{"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-enabled", unit_name},
Gio::Subprocess::Flags::STDOUT_PIPE |
Gio::Subprocess::Flags::STDERR_PIPE
);
@ -721,15 +722,15 @@ bool FirstRunServicesWindow::is_system_service_enabled(const std::string& unit_n
bool FirstRunServicesWindow::enable_system_service(const std::string& unit_name)
{
if (!pkexec_systemctl({"enable", "--now", unit_name}, false))
if (!pkexec_servicectl({"enable", "--now", unit_name}, false))
return false;
pkexec_systemctl({"start", unit_name}, false);
pkexec_servicectl({"start", unit_name}, false);
return true;
}
bool FirstRunServicesWindow::disable_system_service(const std::string& unit_name)
{
pkexec_systemctl({"stop", unit_name}, false);
return pkexec_systemctl({"disable", "--now", unit_name}, false);
pkexec_servicectl({"stop", unit_name}, false);
return pkexec_servicectl({"disable", "--now", unit_name}, false);
}

9
src/main.cpp
View file

@ -299,12 +299,15 @@ private:
const bool is_gnome = is("gnome");
#if BASTIONGUARD_HAS_SDBUS
if (is_gnome) {
tray_ok = true;
}
#else
tray_ok = false;
#endif
const bool hide_on_close = is_gnome ? true : tray_ok;
const bool hide_on_close = tray_ok;
if (hide_on_close && !holding_) {
@ -326,7 +329,7 @@ private:
);
if (start_minimized_ && !tray_ok && !is_gnome) {
if (start_minimized_ && !tray_ok) {
start_minimized_ = false;
}

4
src/pac/BastionGuard-pac.cpp
View file

@ -497,7 +497,7 @@ int main(int argc, char** argv) {
std::string backend_host = "127.0.0.1";
int backend_port = 3130;
std::string trigger_cmd = "systemctl --user start BastionGuard-cef.service";
std::string trigger_cmd = "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service";
int backend_wait_ms = 2000;
@ -530,7 +530,7 @@ int main(int argc, char** argv) {
" --listen 127.0.0.1 --port 8765 (PAC server)\n"
" --stub-host 127.0.0.1 --stub-port 3129 (stub proxy - PAC points here)\n"
" --backend-host 127.0.0.1 --backend-port 3130 (CEF proxy backend)\n"
" --trigger-cmd \"systemctl --user start BastionGuard-cef.service\"\n"
" --trigger-cmd \"/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service\"\n"
" --backend-wait-ms 2000\n";
return 0;
}

28
src/pac/PacManager.cpp
View file

@ -52,42 +52,42 @@ int PacManager::run_cmd(const std::string& cmd, std::string* out) {
}
static bool run_user_systemctl(const std::string& args) {
std::string cmd = "systemctl --user " + args + " >/dev/null 2>&1";
static bool run_user_servicectl(const std::string& args) {
std::string cmd = "/usr/libexec/bastionguard/bastionguard-service --user " + args + " >/dev/null 2>&1";
return (std::system(cmd.c_str()) == 0);
}
PacManager::Result PacManager::start_pacd_user() {
Result r; r.backend = "systemd-user";
Result r; r.backend = "user-service-manager";
if (!cmd_exists("systemctl")) {
r.message = _("systemctl non disponibile");
if (!cmd_exists("/usr/libexec/bastionguard/bastionguard-service")) {
r.message = _("gestore servizi BastionGuard non disponibile");
return r;
}
if (run_user_systemctl("daemon-reload") &&
run_user_systemctl("enable --now bastionguard-pacd.service")) {
if (run_user_servicectl("daemon-reload") &&
run_user_servicectl("enable --now BastionGuard-pacd.service")) {
r.ok = true;
r.message = _("bastionguard-pacd avviato (systemd --user)");
r.message = _("bastionguard-pacd avviato (servizio utente)");
return r;
}
r.message = _("Impossibile avviare bastionguard-pacd (systemd --user)");
r.message = _("Impossibile avviare bastionguard-pacd (servizio utente)");
return r;
}
PacManager::Result PacManager::stop_pacd_user() {
Result r; r.backend = "systemd-user";
Result r; r.backend = "user-service-manager";
if (!cmd_exists("systemctl")) {
r.message = _("systemctl non disponibile");
if (!cmd_exists("/usr/libexec/bastionguard/bastionguard-service")) {
r.message = _("gestore servizi BastionGuard non disponibile");
return r;
}
// stop best-effort
run_user_systemctl("disable --now bastionguard-pacd.service");
run_user_servicectl("disable --now BastionGuard-pacd.service");
r.ok = true;
r.message = _("bastionguard-pacd fermato (systemd --user)");
r.message = _("bastionguard-pacd fermato (servizio utente)");
return r;
}

2
src/phishing/dnsmasq_backend.cpp
View file

@ -210,7 +210,7 @@ bool DnsmasqBackend::write_whitelist(
bool DnsmasqBackend::reload_dnsmasq()
{
int st = system("systemctl --quiet try-reload-or-restart dnsmasq.service");
int st = system("/usr/libexec/bastionguard/bastionguard-service --system try-reload-or-restart dnsmasq.service");
return WIFEXITED(st) && WEXITSTATUS(st) == 0;
}

110
src/scanner-ransomware/BastionGuard-ransomware-realtime.cpp
View file

@ -162,8 +162,12 @@ static bool is_real_desktop_user(const std::string& user)
return true;
}
static std::string detect_desktop_user()
static std::string detect_desktop_user_logind()
{
if (access("/usr/bin/loginctl", X_OK) != 0 &&
access("/bin/loginctl", X_OK) != 0)
return "";
FILE* p = popen("loginctl list-sessions --no-legend", "r");
if (!p)
return "";
@ -182,15 +186,13 @@ static std::string detect_desktop_user()
iss >> session_id >> uid >> user >> seat >> tty;
if (session_id.empty() || user.empty())
continue;
if (!is_real_desktop_user(user))
if (session_id.empty() || user.empty() ||
!is_real_desktop_user(user))
continue;
std::string cmd =
"loginctl show-session " + session_id +
" --property=State --property=Type --property=Class --property=Remote";
"loginctl show-session " + session_id +
" --property=State --property=Type --property=Class --property=Remote";
FILE* pp = popen(cmd.c_str(), "r");
if (!pp)
@ -224,7 +226,6 @@ static std::string detect_desktop_user()
if (active && graphical && user_session && local) {
pclose(p);
log_msg(_("Utente grafico reale rilevato: ") + user);
return user;
}
}
@ -233,6 +234,99 @@ static std::string detect_desktop_user()
return "";
}
static std::string detect_desktop_user_who()
{
FILE* p = popen("who", "r");
if (!p)
return "";
char buf[512];
while (fgets(buf, sizeof(buf), p)) {
std::string line(buf);
std::istringstream iss(line);
std::string user;
std::string tty;
iss >> user >> tty;
if (!is_real_desktop_user(user))
continue;
const bool graphical =
line.find("(:") != std::string::npos ||
tty == "tty7" || tty == "tty1";
if (graphical) {
pclose(p);
return user;
}
}
pclose(p);
return "";
}
static std::string detect_desktop_user_runtime()
{
std::error_code ec;
const std::filesystem::path run_user("/run/user");
if (!std::filesystem::is_directory(run_user, ec))
return "";
for (const auto& entry : std::filesystem::directory_iterator(run_user, ec)) {
if (ec || !entry.is_directory(ec))
continue;
const std::string uid_text = entry.path().filename().string();
if (uid_text.empty() ||
!std::all_of(uid_text.begin(), uid_text.end(), ::isdigit))
continue;
const uid_t uid = static_cast<uid_t>(std::stoul(uid_text));
struct passwd* pw = getpwuid(uid);
if (!pw || !pw->pw_name)
continue;
const std::string user(pw->pw_name);
if (!is_real_desktop_user(user))
continue;
bool graphical = false;
for (const auto& runtime_entry :
std::filesystem::directory_iterator(entry.path(), ec)) {
if (ec) break;
const std::string filename = runtime_entry.path().filename().string();
if (filename.rfind("wayland-", 0) == 0) {
graphical = true;
break;
}
}
// X11 sessions normally expose the session bus even when no Wayland
// socket exists. This is a last-resort fallback after `who`.
if (!graphical)
graphical = std::filesystem::exists(entry.path() / "bus", ec);
if (graphical)
return user;
}
return "";
}
static std::string detect_desktop_user()
{
std::string user = detect_desktop_user_logind();
if (user.empty())
user = detect_desktop_user_who();
if (user.empty())
user = detect_desktop_user_runtime();
if (!user.empty())
log_msg(_("Utente grafico reale rilevato: ") + user);
return user;
}
static bool copy_token_to_user(const std::string& user)
{
if (user.empty()) {

385
src/usb/BastionGuard-usbd-gdbus.cpp Normal file
View file

@ -0,0 +1,385 @@
/*
* BastionGuard™
* Copyright (C) 2025–2026 Calogero Scarnà
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* BastionGuard™ is a trademark of Calogero Scarnà.
* The BastionGuard™ name and branding are not licensed under the GPL.
*/
#include "Resource.hpp"
#include <libudev.h>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <thread>
#include <set>
#include <atomic>
#include <mutex>
#include <chrono>
#include <csignal>
#include <algorithm>
#include <cstdlib>
#include <unistd.h>
#include <gio/gio.h>
#include <glibmm/miscutils.h>
#include <glibmm/i18n.h>
namespace fs = std::filesystem;
static std::atomic<bool> running{true};
static std::mutex log_mutex;
static GDBusConnection *bus = nullptr;
void write_log(const std::string& msg)
{
std::lock_guard<std::mutex> lock(log_mutex);
try {
std::string base_dir;
if (geteuid() == 0)
base_dir = "/var/log/BastionGuard";
else
base_dir = Glib::get_home_dir() + "/.local/share/BastionGuard/logs";
if (!fs::exists(base_dir))
fs::create_directories(base_dir);
auto now = std::time(nullptr);
std::tm tm{};
localtime_r(&now, &tm); // thread-safe
char datebuf[16];
std::strftime(datebuf, sizeof(datebuf), "%Y-%m-%d", &tm);
std::string log_path = base_dir + "/usbd_" + datebuf + ".log";
std::ofstream f(log_path, std::ios::app);
if (!f.is_open()) return;
char timebuf[16];
std::strftime(timebuf, sizeof(timebuf), "%H:%M:%S", &tm);
f << "[" << timebuf << "] " << msg << std::endl;
const auto sys_now = std::chrono::system_clock::now();
const auto limit = std::chrono::hours(24 * 7);
for (const auto& entry : fs::directory_iterator(base_dir)) {
if (!entry.is_regular_file()) continue;
auto ftime = entry.last_write_time();
auto sys_time = std::chrono::time_point_cast<std::chrono::system_clock::duration>(
ftime - fs::file_time_type::clock::now() + sys_now
);
if (sys_now - sys_time > limit)
fs::remove(entry.path());
}
} catch (...) {}
}
struct USBDevice {
std::string name;
std::string devnode;
std::string serial;
};
void send_device_added(const USBDevice &dev)
{
if (!bus) return;
GError* error = nullptr;
g_dbus_connection_emit_signal(
bus,
nullptr,
"/org/BastionGuard/USBD",
"org.BastionGuard.USBD",
"DeviceAdded",
g_variant_new("(sss)",
dev.name.c_str(),
dev.devnode.c_str(),
dev.serial.c_str()),
&error);
if (error) {
write_log(std::string(_("Errore invio segnale DeviceAdded: ")) + error->message);
g_error_free(error);
}
}
void send_device_removed(const std::string &devnode)
{
if (!bus) return;
GError* error = nullptr;
g_dbus_connection_emit_signal(
bus,
nullptr,
"/org/BastionGuard/USBD",
"org.BastionGuard.USBD",
"DeviceRemoved",
g_variant_new("(s)", devnode.c_str()),
&error);
if (error) {
write_log(std::string(_("Errore invio segnale DeviceRemoved: ")) + error->message);
g_error_free(error);
}
}
std::vector<USBDevice> detect_usb_devices()
{
std::vector<USBDevice> result;
struct udev *udev = udev_new();
if (!udev) return result;
struct udev_enumerate *enumerate = udev_enumerate_new(udev);
if (!enumerate) { udev_unref(udev); return result; }
udev_enumerate_add_match_subsystem(enumerate, "block");
udev_enumerate_scan_devices(enumerate);
struct udev_list_entry *entries = udev_enumerate_get_list_entry(enumerate);
struct udev_list_entry *entry;
udev_list_entry_foreach(entry, entries)
{
const char *path = udev_list_entry_get_name(entry);
struct udev_device *dev = udev_device_new_from_syspath(udev, path);
if (!dev) continue;
const char *devtype = udev_device_get_devtype(dev);
if (!devtype || std::string(devtype) != "disk") {
udev_device_unref(dev);
continue;
}
struct udev_device *usb =
udev_device_get_parent_with_subsystem_devtype(
dev, "usb", "usb_device");
if (!usb) {
udev_device_unref(dev);
continue;
}
const char *size = udev_device_get_sysattr_value(dev, "size");
if (!size || std::strtoull(size, nullptr, 10) == 0) {
udev_device_unref(dev);
continue;
}
const char *rem = udev_device_get_sysattr_value(dev, "removable");
if (!rem || std::string(rem) != "1") {
udev_device_unref(dev);
continue;
}
USBDevice info;
const char *devnode = udev_device_get_devnode(dev);
if (!devnode) {
udev_device_unref(dev);
continue;
}
info.devnode = devnode;
const char *vendor = udev_device_get_sysattr_value(usb, "manufacturer");
const char *product = udev_device_get_sysattr_value(usb, "product");
const char *serial = udev_device_get_sysattr_value(usb, "serial");
if (vendor) info.name += vendor;
if (product) {
if (!info.name.empty()) info.name += " ";
info.name += product;
}
if (info.name.empty())
info.name = info.devnode;
if (serial) info.serial = serial;
result.push_back(info);
udev_device_unref(dev);
}
udev_enumerate_unref(enumerate);
udev_unref(udev);
return result;
}
void monitor_loop()
{
write_log(_("Monitor USB avviato."));
std::set<std::string> known;
while (running)
{
auto list = detect_usb_devices();
for (auto &d : list) {
if (!known.count(d.devnode)) {
known.insert(d.devnode);
write_log(_("Collegato USB: ") + d.name + " (" + d.devnode + ")");
send_device_added(d);
}
}
for (auto it = known.begin(); it != known.end(); ) {
bool still = false;
for (auto &d : list)
if (d.devnode == *it) still = true;
if (!still) {
write_log(_("Rimosso USB: ") + *it);
send_device_removed(*it);
it = known.erase(it);
} else {
++it;
}
}
std::this_thread::sleep_for(std::chrono::seconds(2));
}
write_log(_("Monitor USB terminato."));
}
void handle_signal(int) { running = false; }
static bool load_lang_conf()
{
const std::string lang_conf = Glib::get_home_dir() + "/.config/BastionGuard/lang.conf";
std::ifstream f(lang_conf);
if (!f.is_open())
return false;
std::string line;
bool any = false;
while (std::getline(f, line)) {
if (line.empty() || line[0] == '#')
continue;
auto pos = line.find('=');
if (pos == std::string::npos)
continue;
std::string key = line.substr(0, pos);
std::string val = line.substr(pos + 1);
auto ltrim = [](std::string& s){
s.erase(0, s.find_first_not_of(" \t\r\n"));
};
auto rtrim = [](std::string& s){
s.erase(s.find_last_not_of(" \t\r\n") + 1);
};
ltrim(key); rtrim(key);
ltrim(val); rtrim(val);
if (!key.empty() && !val.empty()) {
setenv(key.c_str(), val.c_str(), 1);
any = true;
}
}
return any;
}
int main()
{
bool loaded = load_lang_conf();
std::setlocale(LC_ALL, "");
bindtextdomain("BastionGuard", LOCALEDIR);
bind_textdomain_codeset("BastionGuard", "UTF-8");
textdomain("BastionGuard");
if (loaded) {
std::cerr << _("[Lang] Config caricata da ~/.config/BastionGuard/lang.conf") << "\n";
} else {
std::cerr << _("[Lang] Nessuna config trovata, uso locale di sistema") << "\n";
}
std::signal(SIGINT, handle_signal);
std::signal(SIGTERM, handle_signal);
// D-Bus init through GLib/GIO, independent from the init system.
GError* dbus_error = nullptr;
bus = g_bus_get_sync(G_BUS_TYPE_SYSTEM, nullptr, &dbus_error);
if (!bus) {
std::cerr << _("Errore apertura system bus: ")
<< (dbus_error ? dbus_error->message : _("errore sconosciuto"))
<< "\n";
if (dbus_error) g_error_free(dbus_error);
return 1;
}
GVariant* request_reply = g_dbus_connection_call_sync(
bus,
"org.freedesktop.DBus",
"/org/freedesktop/DBus",
"org.freedesktop.DBus",
"RequestName",
g_variant_new("(su)", "org.BastionGuard.USBD", 0u),
G_VARIANT_TYPE("(u)"),
G_DBUS_CALL_FLAGS_NONE,
-1,
nullptr,
&dbus_error);
if (!request_reply) {
std::cerr << _("Errore registrazione nome DBus: ")
<< (dbus_error ? dbus_error->message : _("errore sconosciuto"))
<< "\n";
if (dbus_error) g_error_free(dbus_error);
g_object_unref(bus);
bus = nullptr;
return 1;
}
guint32 request_result = 0;
g_variant_get(request_reply, "(u)", &request_result);
g_variant_unref(request_reply);
if (request_result != 1u && request_result != 4u) {
std::cerr << _("Nome DBus org.BastionGuard.USBD già occupato.\n");
g_object_unref(bus);
bus = nullptr;
return 1;
}
write_log(_("BastionGuard-usbd avviato."));
std::thread th(monitor_loop);
while (running)
std::this_thread::sleep_for(std::chrono::seconds(1));
if (th.joinable()) th.join();
g_object_unref(bus);
bus = nullptr;
write_log(_("BastionGuard-usbd terminato."));
return 0;
}

35
src/wizard/wizard_setup.cpp
View file

@ -195,7 +195,6 @@ static std::string run_capture(const std::string& cmd) {
static bool detect_resolvectl() {
if (run_cmd_capture("command -v resolvectl >/dev/null 2>&1")) return true;
if (run_cmd_capture("systemctl is-active --quiet systemd-resolved")) return true;
return false;
}
@ -306,7 +305,7 @@ void gen_web_commands(std::vector<std::string>& out, int http_port, int https_po
out.push_back("echo \"" + std::to_string(http_port) + " " + std::to_string(https_port) + "\" > /etc/BastionGuard/webports.conf");
out.push_back("sed -i 's/listen [0-9]\\+/listen " + std::to_string(http_port) + "/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
out.push_back("sed -i 's/listen [0-9]\\+ ssl/listen " + std::to_string(https_port) + " ssl/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
out.push_back("nginx -t && systemctl restart nginx || true");
out.push_back("nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service || true");
}
void gen_blacklist_commands(std::vector<std::string>& out, const std::string& packaged_blacklist) {
@ -442,10 +441,12 @@ bool setup_firewall_ports() {
if (rc_check != 0) {
std::ostringstream cmd;
cmd << "gpasswd -a " << user << " adm && gpasswd -a " << user << " systemd-journal";
cmd << "gpasswd -a " << user << " adm; "
<< "if getent group systemd-journal >/dev/null 2>&1; then "
<< "gpasswd -a " << user << " systemd-journal; fi";
std::string out;
int rc = 0;
std::cout << "[wizard] " << _("Aggiungo l'utente ai gruppi 'adm' e 'systemd-journal'...") << std::endl;
std::cout << "[wizard] " << _("Aggiungo l'utente ai gruppi di log disponibili...") << std::endl;
bool okgrp = run_cmd_capture(elev_cmd(cmd.str()), &out, &rc);
if (okgrp && rc == 0) {
std::cout << "[wizard] ✅ " << _("Utente aggiunto ai gruppi richiesti.") << std::endl;
@ -454,7 +455,7 @@ bool setup_firewall_ports() {
std::cerr << "[wizard] ⚠ " << _("Errore aggiungendo l'utente ai gruppi: ") << out << std::endl;
}
} else {
std::cout << "[wizard] " << _("Utente già presente nei gruppi 'adm' o 'systemd-journal'.") << std::endl;
std::cout << "[wizard] " << _("Utente già presente in un gruppo di accesso ai log.") << std::endl;
}
} else {
std::cerr << "[wizard] ⚠ " << _("Impossibile determinare l'utente effettivo; salto l'aggiunta ai gruppi.") << std::endl;
@ -482,14 +483,14 @@ bool setup_firewall_ports() {
{
std::string out; int rc = 0;
run_cmd_capture("command -v systemctl >/dev/null 2>&1", &out, &rc);
run_cmd_capture("test -x /usr/libexec/bastionguard/bastionguard-service", &out, &rc);
if (rc != 0) {
std::cout << "[wizard] " << _("systemd non presente: salto il riavvio del servizio.") << std::endl;
std::cout << "[wizard] " << _("Gestore servizi non presente: salto il riavvio del servizio.") << std::endl;
} else {
run_cmd_capture(elev_cmd("systemctl list-unit-files BastionGuard-phishing-scanner.service >/dev/null 2>&1"), &out, &rc);
run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1"), &out, &rc);
if (rc == 0) {
run_cmd_capture(elev_cmd("systemctl restart BastionGuard-phishing-scanner.service >/dev/null 2>&1 || true", "org.BastionGuard.service.manage"), &out, &rc);
run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service >/dev/null 2>&1 || true", "org.BastionGuard.service.manage"), &out, &rc);
if (rc == 0) {
std::cout << "[wizard] ✅ " << _("Servizio BastionGuard-phishing-scanner riavviato.") << std::endl;
@ -497,7 +498,7 @@ bool setup_firewall_ports() {
std::cerr << "[wizard] ⚠ " << _("Tentativo di riavvio eseguito (codice ") << rc << _("). Verifica lo stato del servizio.") << std::endl;
}
} else {
std::cout << "[wizard] " << _("Unità systemd BastionGuard-phishing-scanner non trovata: salto il riavvio.") << std::endl;
std::cout << "[wizard] " << _("Servizio BastionGuard-phishing-scanner non trovato: salto il riavvio.") << std::endl;
}
}
}
@ -534,10 +535,10 @@ bool install_nftables_conf() {
script << "install -m 0644 \"" << src_conf << "\" \"" << dst_conf << "\"\n";
script << "nft -f \"" << dst_conf << "\" || true\n";
script << "if ! systemctl is-active --quiet ufw 2>/dev/null && "
"! systemctl is-active --quiet firewalld 2>/dev/null; then\n";
script << "if ! /usr/libexec/bastionguard/bastionguard-service --system is-active ufw.service 2>/dev/null && "
"! /usr/libexec/bastionguard/bastionguard-service --system is-active firewalld.service 2>/dev/null; then\n";
script << _(" echo '[BastionGuard] Abilito e avvio nftables.service...'\n");
script << " systemctl enable --now nftables.service || true\n";
script << " /usr/libexec/bastionguard/bastionguard-service --system enable --now nftables.service || true\n";
script << "else\n";
script << _(" echo '[BastionGuard] UFW o Firewalld rilevati: mantengo configurazione esistente.'\n");
script << "fi\n";
@ -895,10 +896,10 @@ bool run_wizard_setup(const std::vector<std::string>& options) {
}
cmds.push_back(_("echo '[BastionGuard] Riavvio BastionGuard-phishing-scanner...' >&2"));
cmds.push_back("if command -v systemctl >/dev/null 2>&1 && "
"systemctl list-unit-files BastionGuard-phishing-scanner.service >/dev/null 2>&1; then "
"systemctl restart BastionGuard-phishing-scanner.service || true; "
"else echo '[BastionGuard] Nessuna unità BastionGuard-phishing-scanner trovata.' >&2; fi");
cmds.push_back("if [ -x /usr/libexec/bastionguard/bastionguard-service ] && "
"/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1; then "
"/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service || true; "
"else echo '[BastionGuard] Nessun servizio BastionGuard-phishing-scanner trovato.' >&2; fi");
if (!cmds.empty()) {
std::string log;

16
src/wizard/wizard_window.cpp
View file

@ -844,7 +844,7 @@ void WizardWindow::worker_run() {
} catch (...) {}
cmds.push_back("echo '[BastionGuard] Riavvio BastionGuard-phishing-scanner...' >&2");
cmds.push_back("if command -v systemctl >/dev/null 2>&1 && systemctl list-unit-files BastionGuard-phishing-scanner.service >/dev/null 2>&1; then systemctl restart BastionGuard-phishing-scanner.service || true; else echo '[BastionGuard] Unità non trovata.' >&2; fi");
cmds.push_back("if /usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1; then /usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service || true; else echo '[BastionGuard] Servizio non trovato.' >&2; fi");
if (!cmds.empty()) {
append_log(_("Esecuzione privilegiata unica (una sola autenticazione)..."));
@ -932,10 +932,10 @@ bool WizardWindow::configure_dnsmasq() {
sh << "install -m 0644 \"$tmpf\" " << shell_quote(bg_conf) << "\n";
sh << "rm -f \"$tmpf\"\n";
// Restart dnsmasq se gestito da systemd (best effort)
sh << "if command -v systemctl >/dev/null 2>&1; then\n";
sh << " if systemctl list-unit-files dnsmasq.service >/dev/null 2>&1; then\n";
sh << " systemctl restart dnsmasq.service || systemctl try-restart dnsmasq.service || true\n";
// Restart dnsmasq tramite il backend init rilevato (best effort)
sh << "if [ -x /usr/libexec/bastionguard/bastionguard-service ]; then\n";
sh << " if /usr/libexec/bastionguard/bastionguard-service --system exists dnsmasq.service >/dev/null 2>&1; then\n";
sh << " /usr/libexec/bastionguard/bastionguard-service --system restart dnsmasq.service || /usr/libexec/bastionguard/bastionguard-service --system try-restart dnsmasq.service || true\n";
sh << " fi\n";
sh << "fi\n";
@ -1395,7 +1395,7 @@ bool WizardWindow::apply_web_config() {
}
script << "nginx -t && systemctl restart nginx\n";
script << "nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service\n";
std::string tmp_script = "/tmp/BastionGuard_apply_nginx.sh";
@ -1433,8 +1433,8 @@ bool WizardWindow::apply_web_config() {
}
bool WizardWindow::is_firewall_active() {
int rc1 = std::system("systemctl is-active --quiet ufw.service");
int rc2 = std::system("systemctl is-active --quiet firewalld.service");
int rc1 = std::system("/usr/libexec/bastionguard/bastionguard-service --system is-active ufw.service");
int rc2 = std::system("/usr/libexec/bastionguard/bastionguard-service --system is-active firewalld.service");
return (rc1 == 0 || rc2 == 0);
}

2
thirdparty/bastionguard-secure-connection/daemon/src/service/DaemonService.cpp vendored
View file

@ -93,7 +93,7 @@ void DaemonService::run() {
});
// Avvia il thread di connessione/riconnessione in background. Non-blocca:
// se la UI non e' ancora su (es. daemon partito al boot via systemd,
// se la UI non e' ancora su (es. daemon partito dal gestore servizi,
// utente non ancora loggato), il reconnector interno ritentera' ogni 1s
// finche' la UI non compare.
ui_.start();

12
thirdparty/bastionguard-secure-connection/meson.build vendored
View file

@ -78,10 +78,14 @@ install_subdir(
)
# ── Installazione file di sistema ────────────────────────────────────────────
install_data(
'dist/bsc-daemon.service',
install_dir : join_paths(get_option('prefix'), 'lib/systemd/system'),
)
# The integrated BastionGuard build disables this and installs the selected
# systemd/OpenRC/SysVinit/Dinit service through its central init-system layer.
if get_option('install_systemd_service')
install_data(
'dist/bsc-daemon.service',
install_dir : join_paths(get_option('prefix'), 'lib/systemd/system'),
)
endif
install_data(
'dist/eu.bastionguard.sc.policy',

1
thirdparty/bastionguard-secure-connection/meson_options.txt vendored Normal file
View file

@ -0,0 +1 @@
option('install_systemd_service', type : 'boolean', value : true, description : 'Install bsc-daemon systemd unit')

12
thirdparty/bastionguard-secure-connection/po/bastionguard-sc.pot vendored
View file

@ -109,11 +109,11 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr ""
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr ""
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr ""
#: src/MainWindow.cpp:1042
@ -125,11 +125,11 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr ""
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgid "Servizio di sistema abilitato."
msgstr ""
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgid "Servizio di sistema disabilitato."
msgstr ""
#: src/MainWindow.cpp:1047
@ -446,7 +446,7 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr ""
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr ""
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
@ -482,7 +482,7 @@ msgid "disattivato"
msgstr ""
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgid "Servizio di sistema abilitato: "
msgstr ""
#: src/pages/SettingsPage.cpp:298

24
thirdparty/bastionguard-secure-connection/po/de_DE.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Schutz deaktiviert: enabled=false, autostart_enabled=false und daemon_enabled=false gespeichert, bsc-daemon gestoppt/deaktiviert und Autostart entfernt. Backup wurde in /etc/xdg/autostart erstellt."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reaktivierung nicht abgeschlossen. Prüfen Sie PolicyKit, systemd, das Backup in /etc/xdg/autostart und das Speichern der Konfiguration."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reaktivierung nicht abgeschlossen. Prüfen Sie PolicyKit, den Dienstmanager, das Backup in /etc/xdg/autostart und das Speichern der Konfiguration."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Deaktivierung nicht abgeschlossen. Prüfen Sie PolicyKit, systemd, das Backup in /etc/xdg/autostart, bsc-daemon und das Speichern der Konfiguration."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Deaktivierung nicht abgeschlossen. Prüfen Sie PolicyKit, den Dienstmanager, das Backup in /etc/xdg/autostart, bsc-daemon und das Speichern der Konfiguration."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Schutz in den Benutzereinstellungen deaktiviert."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "systemd-Dienst aktiviert."
msgid "Servizio di sistema abilitato."
msgstr "Systemdienst aktiviert."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "systemd-Dienst deaktiviert."
msgid "Servizio di sistema disabilitato."
msgstr "Systemdienst deaktiviert."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Autostart und bsc-daemon aktivieren oder deaktivieren"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Beim Deaktivieren werden diese Vorgänge ausgeführt: Speichern von enabled=false, autostart_enabled=false und daemon_enabled=false, Backup des Autostarts in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, Entfernen des aktiven Autostarts und systemctl disable --now bsc-daemon.service. Beim Reaktivieren wird das Backup wiederhergestellt und der Dienst erneut aktiviert."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Beim Deaktivieren werden diese Vorgänge ausgeführt: Speichern von enabled=false, autostart_enabled=false und daemon_enabled=false, Backup des Autostarts in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, Entfernen des aktiven Autostarts und Deaktivieren von bsc-daemon über den Dienstmanager. Beim Reaktivieren wird das Backup wiederhergestellt und der Dienst erneut aktiviert."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "deaktiviert"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "systemd-Dienst aktiviert: "
msgid "Servizio di sistema abilitato: "
msgstr "Systemdienst aktiviert: "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

24
thirdparty/bastionguard-secure-connection/po/en_US.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Protection disabled: enabled=false, autostart_enabled=false, and daemon_enabled=false saved, bsc-daemon stopped/disabled, and autostart removed. Backup created in /etc/xdg/autostart."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reactivation not completed. Check PolicyKit, systemd, the backup in /etc/xdg/autostart, and config saving."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reactivation not completed. Check PolicyKit, the service manager, the backup in /etc/xdg/autostart, and config saving."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Deactivation not completed. Check PolicyKit, systemd, the backup in /etc/xdg/autostart, bsc-daemon, and config saving."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Deactivation not completed. Check PolicyKit, the service manager, the backup in /etc/xdg/autostart, bsc-daemon, and config saving."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Protection disabled in user settings."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "systemd service enabled."
msgid "Servizio di sistema abilitato."
msgstr "System service enabled."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "systemd service disabled."
msgid "Servizio di sistema disabilitato."
msgstr "System service disabled."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Enable or disable autostart and bsc-daemon"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "When disabling, these operations are performed: saving enabled=false, autostart_enabled=false, and daemon_enabled=false, backing up the autostart file to /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, removing the active autostart entry, and running systemctl disable --now bsc-daemon.service. When reactivating, the backup is restored and the service is re-enabled."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "When disabling, these operations are performed: saving enabled=false, autostart_enabled=false, and daemon_enabled=false, backing up the autostart file to /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, removing the active autostart entry, and disabling bsc-daemon through the service manager. When reactivating, the backup is restored and the service is re-enabled."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "disabled"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "systemd service enabled: "
msgid "Servizio di sistema abilitato: "
msgstr "System service enabled: "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

24
thirdparty/bastionguard-secure-connection/po/es_ES.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Protección desactivada: enabled=false, autostart_enabled=false y daemon_enabled=false guardados, bsc-daemon detenido/deshabilitado y autostart eliminado. Copia de seguridad creada en /etc/xdg/autostart."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reactivación no completada. Comprueba PolicyKit, systemd, la copia de seguridad en /etc/xdg/autostart y el guardado de la configuración."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reactivación no completada. Comprueba PolicyKit, el gestor de servicios, la copia de seguridad en /etc/xdg/autostart y el guardado de la configuración."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Desactivación no completada. Comprueba PolicyKit, systemd, la copia de seguridad en /etc/xdg/autostart, bsc-daemon y el guardado de la configuración."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Desactivación no completada. Comprueba PolicyKit, el gestor de servicios, la copia de seguridad en /etc/xdg/autostart, bsc-daemon y el guardado de la configuración."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Protección desactivada en la configuración de usuario."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "Servicio systemd habilitado."
msgid "Servizio di sistema abilitato."
msgstr "Servicio del sistema habilitado."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "Servicio systemd deshabilitado."
msgid "Servizio di sistema disabilitato."
msgstr "Servicio del sistema deshabilitado."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Activa o desactiva el inicio automático y bsc-daemon"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Al desactivar se realizan estas operaciones: guardado de enabled=false, autostart_enabled=false y daemon_enabled=false, copia de seguridad de autostart en /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, eliminación del autostart activo y systemctl disable --now bsc-daemon.service. Al reactivar, la copia de seguridad se restaura y el servicio se vuelve a habilitar."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Al desactivar se realizan estas operaciones: guardado de enabled=false, autostart_enabled=false y daemon_enabled=false, copia de seguridad de autostart en /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, eliminación del autostart activo y desactivación de bsc-daemon mediante el gestor de servicios. Al reactivar, la copia de seguridad se restaura y el servicio se vuelve a habilitar."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "desactivado"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "Servicio systemd habilitado: "
msgid "Servizio di sistema abilitato: "
msgstr "Servicio del sistema habilitado: "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

24
thirdparty/bastionguard-secure-connection/po/fr_FR.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Protection désactivée : enabled=false, autostart_enabled=false et daemon_enabled=false enregistrés, bsc-daemon arrêté/désactivé et autostart supprimé. Sauvegarde créée dans /etc/xdg/autostart."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Réactivation non terminée. Vérifiez PolicyKit, systemd, la sauvegarde dans /etc/xdg/autostart et l’enregistrement de la configuration."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Réactivation non terminée. Vérifiez PolicyKit, le gestionnaire de services, la sauvegarde dans /etc/xdg/autostart et l’enregistrement de la configuration."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Désactivation non terminée. Vérifiez PolicyKit, systemd, la sauvegarde dans /etc/xdg/autostart, bsc-daemon et l’enregistrement de la configuration."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Désactivation non terminée. Vérifiez PolicyKit, le gestionnaire de services, la sauvegarde dans /etc/xdg/autostart, bsc-daemon et l’enregistrement de la configuration."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Protection désactivée dans les paramètres utilisateur."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "Service systemd activé."
msgid "Servizio di sistema abilitato."
msgstr "Service système activé."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "Service systemd désactivé."
msgid "Servizio di sistema disabilitato."
msgstr "Service système désactivé."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Activer ou désactiver le démarrage automatique et bsc-daemon"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Lors de la désactivation, ces opérations sont effectuées : enregistrement de enabled=false, autostart_enabled=false et daemon_enabled=false, sauvegarde de l’autostart dans /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, suppression de l’autostart actif et systemctl disable --now bsc-daemon.service. Lors de la réactivation, la sauvegarde est restaurée et le service est réactivé."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Lors de la désactivation, ces opérations sont effectuées : enregistrement de enabled=false, autostart_enabled=false et daemon_enabled=false, sauvegarde de l’autostart dans /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, suppression de l’autostart actif et désactivation de bsc-daemon via le gestionnaire de services. Lors de la réactivation, la sauvegarde est restaurée et le service est réactivé."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "désactivé"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "Service systemd activé : "
msgid "Servizio di sistema abilitato: "
msgstr "Service système activé : "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

24
thirdparty/bastionguard-secure-connection/po/it_IT.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_enabled=false salvati, bsc-daemon fermato/disabilitato e autostart rimosso. Backup creato in /etc/xdg/autostart."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Protezione disattivata nelle impostazioni utente."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "Servizio systemd abilitato."
msgid "Servizio di sistema abilitato."
msgstr "Servizio di sistema abilitato."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "Servizio systemd disabilitato."
msgid "Servizio di sistema disabilitato."
msgstr "Servizio di sistema disabilitato."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Attiva o disattiva l'avvio automatico e bsc-daemon"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "disattivato"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "Servizio systemd abilitato: "
msgid "Servizio di sistema abilitato: "
msgstr "Servizio di sistema abilitato: "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

24
thirdparty/bastionguard-secure-connection/po/pt_BR.po vendored
View file

@ -108,12 +108,12 @@ msgid "Protezione disattivata: enabled=false, autostart_enabled=false e daemon_e
msgstr "Proteção desativada: enabled=false, autostart_enabled=false e daemon_enabled=false salvos, bsc-daemon parado/desabilitado e autostart removido. Backup criado em /etc/xdg/autostart."
#: src/MainWindow.cpp:1025
msgid "Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reativação não concluída. Verifique o PolicyKit, o systemd, o backup em /etc/xdg/autostart e o salvamento da configuração."
msgid "Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config."
msgstr "Reativação não concluída. Verifique o PolicyKit, o gerenciador de serviços, o backup em /etc/xdg/autostart e o salvamento da configuração."
#: src/MainWindow.cpp:1026
msgid "Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Desativação não concluída. Verifique o PolicyKit, o systemd, o backup em /etc/xdg/autostart, o bsc-daemon e o salvamento da configuração."
msgid "Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config."
msgstr "Desativação não concluída. Verifique o PolicyKit, o gerenciador de serviços, o backup em /etc/xdg/autostart, o bsc-daemon e o salvamento da configuração."
#: src/MainWindow.cpp:1042
msgid "Protezione attiva nelle impostazioni utente."
@ -124,12 +124,12 @@ msgid "Protezione disattivata nelle impostazioni utente."
msgstr "Proteção desativada nas configurações do usuário."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd abilitato."
msgstr "Serviço systemd habilitado."
msgid "Servizio di sistema abilitato."
msgstr "Serviço do sistema habilitado."
#: src/MainWindow.cpp:1046
msgid "Servizio systemd disabilitato."
msgstr "Serviço systemd desabilitado."
msgid "Servizio di sistema disabilitato."
msgstr "Serviço do sistema desabilitado."
#: src/MainWindow.cpp:1047
msgid "Avvio automatico presente."
@ -447,8 +447,8 @@ msgid "Attiva o disattiva l'avvio automatico e bsc-daemon"
msgstr "Ativar ou desativar a inicialização automática e o bsc-daemon"
#: src/pages/SettingsPage.cpp:145
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Ao desativar, estas operações são executadas: salvamento de enabled=false, autostart_enabled=false e daemon_enabled=false, backup do autostart em /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, remoção do autostart ativo e systemctl disable --now bsc-daemon.service. Ao reativar, o backup é restaurado e o serviço é habilitado novamente."
msgid "Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."
msgstr "Ao desativar, estas operações são executadas: salvamento de enabled=false, autostart_enabled=false e daemon_enabled=false, backup do autostart em /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, remoção do autostart ativo e desativação do bsc-daemon pelo gerenciador de serviços. Ao reativar, o backup é restaurado e o serviço é habilitado novamente."
#: src/pages/SettingsPage.cpp:161 src/pages/SettingsPage.cpp:175
msgid "Stato rilevato"
@ -483,8 +483,8 @@ msgid "disattivato"
msgstr "desativado"
#: src/pages/SettingsPage.cpp:295
msgid "Servizio systemd abilitato: "
msgstr "Serviço systemd habilitado: "
msgid "Servizio di sistema abilitato: "
msgstr "Serviço do sistema habilitado: "
#: src/pages/SettingsPage.cpp:298
msgid "Autostart presente in /etc/xdg/autostart: "

16
thirdparty/bastionguard-secure-connection/ui/meson.build vendored
View file

@ -1,7 +1,7 @@
gtkmm = dependency('gtkmm-4.0', required: true)
glibmm = dependency('glibmm-2.68', required: true)
giomm = dependency('giomm-2.68', required: true)
libsystemd = dependency('libsystemd', required: true)
libsystemd = dependency('libsystemd', required: false)
shumate = dependency('shumate-1.0', required: true)
jsondep = dependency('nlohmann_json', required: true)
threads = dependency('threads', required: true)
@ -23,19 +23,29 @@ sources = [
'src/pages/StatsPage.cpp',
'src/pages/AboutPage.cpp',
'src/pages/SettingsPage.cpp',
'src/TrayIcon.cpp',
libsystemd.found() ? 'src/TrayIcon.cpp' : 'src/TrayIconStub.cpp',
]
inc = include_directories('src')
deps = [
gtkmm, glibmm, giomm, libsystemd, shumate, jsondep, threads,
gtkmm, glibmm, giomm, shumate, jsondep, threads,
]
if libsystemd.found()
deps += [libsystemd]
tray_cpp_args = ['-DBSC_HAS_SDBUS=1']
message('Secure Connection tray: sd-bus enabled')
else
tray_cpp_args = ['-DBSC_HAS_SDBUS=0']
warning('libsystemd not found: Secure Connection tray disabled; UI remains available')
endif
executable('bastionguard-sc-ui',
sources,
include_directories : [inc, common_include_dir, root_include_dir],
dependencies : deps,
cpp_args : tray_cpp_args,
install : true,
install_dir : get_option('bindir'),
)

29
thirdparty/bastionguard-secure-connection/ui/src/MainWindow.cpp vendored
View file

@ -25,6 +25,10 @@
#include <libintl.h>
#define _(text) gettext(text)
#ifndef BSC_SERVICECTL_PATH
#define BSC_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service"
#endif
namespace {
constexpr int kNotifDesktopActive = 15;
@ -91,7 +95,8 @@ namespace {
constexpr const char* kUISocketPath = "unix:///tmp/bsd-daemon.sock";
constexpr const char* kSystemdServiceName = "bsc-daemon.service";
constexpr const char* kServiceName = "bsc-daemon.service";
constexpr const char* kServiceCtlPath = BSC_SERVICECTL_PATH;
constexpr const char* kSystemAutostartDesktop = "/etc/xdg/autostart/bastionguard-sc-autostart.desktop";
constexpr const char* kFallbackSystemAutostartDesktop = "/etc/xdg/autostart/bastionguard-sc.desktop";
constexpr const char* kSystemAutostartBackupDesktop = "/etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak";
@ -125,7 +130,7 @@ namespace {
out << "enabled=" << (enabled ? "true" : "false") << "\n";
out << "autostart_enabled=" << (enabled ? "true" : "false") << "\n";
out << "daemon_enabled=" << (enabled ? "true" : "false") << "\n";
out << "service=" << kSystemdServiceName << "\n";
out << "service=" << kServiceName << "\n";
out << "autostart_path=" << kSystemAutostartDesktop << "\n";
out << "fallback_autostart_path=" << kFallbackSystemAutostartDesktop << "\n";
out << "generated_autostart_file=" << (cfgDir / "bastionguard-sc-autostart.desktop").string() << "\n";
@ -997,16 +1002,18 @@ void MainWindow::applyProtectionEnabled(bool enabled)
script << "if [ ! -f " << shellQuote(backupFile) << " ] && [ -f " << shellQuote(kFallbackSystemAutostartDesktop) << " ]; then "
<< "install -m 0644 " << shellQuote(kFallbackSystemAutostartDesktop) << " " << shellQuote(backupFile) << "; fi; ";
script << "rm -f " << shellQuote(kSystemAutostartDesktop) << " " << shellQuote(kFallbackSystemAutostartDesktop) << "; ";
script << "if systemctl list-unit-files " << shellQuote(kSystemdServiceName) << " --no-legend 2>/dev/null | grep -q .; then "
<< "systemctl disable --now " << shellQuote(kSystemdServiceName) << "; "
<< "else systemctl stop " << shellQuote(kSystemdServiceName) << " 2>/dev/null || true; fi; ";
script << "test -x " << shellQuote(kServiceCtlPath) << "; ";
script << shellQuote(kServiceCtlPath) << " --system disable --now "
<< shellQuote(kServiceName) << "; ";
} else {
script << "mkdir -p " << shellQuote(std::filesystem::path(kSystemAutostartDesktop).parent_path().string()) << "; ";
script << "if [ -f " << shellQuote(backupFile) << " ]; then "
<< "install -D -m 0644 " << shellQuote(backupFile) << " " << shellQuote(kSystemAutostartDesktop) << "; "
<< "else install -D -m 0644 " << shellQuote(generatedAutostart.string()) << " " << shellQuote(kSystemAutostartDesktop) << "; fi; ";
script << "rm -f " << shellQuote(kFallbackSystemAutostartDesktop) << "; ";
script << "systemctl enable --now " << shellQuote(kSystemdServiceName) << "; ";
script << "test -x " << shellQuote(kServiceCtlPath) << "; ";
script << shellQuote(kServiceCtlPath) << " --system enable --now "
<< shellQuote(kServiceName) << "; ";
}
ok = runCommand("pkexec /bin/sh -c " + shellQuote(script.str()));
@ -1028,8 +1035,8 @@ void MainWindow::applyProtectionEnabled(bool enabled)
: _("Protezione disattivata: enabled=false, autostart_enabled=false e daemon_enabled=false salvati, bsc-daemon fermato/disabilitato e autostart rimosso. Backup creato in /etc/xdg/autostart.");
} else if (status.empty()) {
status = enabled
? _("Riattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart e il salvataggio config.")
: _("Disattivazione non completata. Controlla PolicyKit, systemd, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config.");
? _("Riattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart e il salvataggio config.")
: _("Disattivazione non completata. Controlla PolicyKit, il gestore servizi, il backup in /etc/xdg/autostart, bsc-daemon e il salvataggio config.");
}
m_settingsPage.refreshState();
@ -1040,7 +1047,9 @@ void MainWindow::applyProtectionEnabled(bool enabled)
void MainWindow::refreshSystemIntegrationStatus()
{
const bool serviceEnabled = runCommand("systemctl is-enabled --quiet " + std::string(kSystemdServiceName) + " >/dev/null 2>&1");
const bool serviceEnabled = runCommand(
shellQuote(kServiceCtlPath) + " --system is-enabled " +
shellQuote(kServiceName) + " >/dev/null 2>&1");
const bool autostartPresent = std::filesystem::exists(kSystemAutostartDesktop) ||
std::filesystem::exists(kFallbackSystemAutostartDesktop);
std::string text;
@ -1049,7 +1058,7 @@ void MainWindow::refreshSystemIntegrationStatus()
} else {
text = _("Protezione disattivata nelle impostazioni utente.");
}
text += std::string(" ") + (serviceEnabled ? _("Servizio systemd abilitato.") : _("Servizio systemd disabilitato."));
text += std::string(" ") + (serviceEnabled ? _("Servizio di sistema abilitato.") : _("Servizio di sistema disabilitato."));
text += std::string(" ") + (autostartPresent ? _("Avvio automatico presente.") : _("Avvio automatico assente."));
if (!m_autostartBackupFile.empty() && std::filesystem::exists(m_autostartBackupFile)) {
text += std::string(" ") + _("Backup autostart disponibile.");

12
thirdparty/bastionguard-secure-connection/ui/src/TrayIcon.hpp vendored
View file

@ -20,7 +20,13 @@
#pragma once
#ifndef BSC_HAS_SDBUS
#define BSC_HAS_SDBUS 0
#endif
#if BSC_HAS_SDBUS
#include <systemd/sd-bus.h>
#endif
#include <glib.h>
#include <atomic>
#include <functional>
@ -50,6 +56,7 @@ public:
void set_on_quit(std::function<void()> cb) { on_quit_cb_ = std::move(cb); }
void bind_ui_context();
#if BSC_HAS_SDBUS
static int sni_method_activate(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
static int sni_method_context_menu(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
static int sni_method_secondary_activate(sd_bus_message* m, void* userdata, sd_bus_error* ret_error);
@ -79,6 +86,7 @@ public:
sd_bus_message* reply,
void* userdata,
sd_bus_error* ret_error);
#endif
private:
@ -100,9 +108,11 @@ private:
std::function<void()> on_make_startup_persistent_cb_;
std::function<void()> on_quit_cb_;
#if BSC_HAS_SDBUS
sd_bus* bus_ = nullptr;
sd_bus_slot* sni_slot_ = nullptr;
sd_bus_slot* menu_slot_ = nullptr;
#endif
std::thread bus_thread_;
std::atomic_bool running_{false};
@ -113,6 +123,7 @@ private:
static constexpr int MENU_QUIT = 3;
private:
#if BSC_HAS_SDBUS
static std::string make_service_name();
bool acquire_bus();
@ -127,4 +138,5 @@ private:
void emit_sni_signal(const char* signal_name);
void emit_dbusmenu_layout_updated();
#endif
};

64
thirdparty/bastionguard-secure-connection/ui/src/TrayIconStub.cpp vendored Normal file
View file

@ -0,0 +1,64 @@
/*
* BastionGuard Secure Connection tray fallback for builds without sd-bus.
* The main window and XDG autostart remain functional; only the
* StatusNotifierItem integration is unavailable.
*/
#include "TrayIcon.hpp"
#include <cstdio>
TrayIcon::TrayIcon() = default;
TrayIcon::~TrayIcon()
{
stop();
if (ui_ctx_) {
g_main_context_unref(ui_ctx_);
ui_ctx_ = nullptr;
}
}
bool TrayIcon::start()
{
std::fprintf(stderr,
"[BSC TrayIcon] sd-bus unavailable: status icon disabled\n");
return false;
}
void TrayIcon::stop()
{
running_ = false;
if (bus_thread_.joinable())
bus_thread_.join();
}
void TrayIcon::bind_ui_context()
{
if (ui_ctx_)
g_main_context_unref(ui_ctx_);
ui_ctx_ = g_main_context_ref_thread_default();
if (!ui_ctx_)
ui_ctx_ = g_main_context_ref(g_main_context_default());
}
void TrayIcon::set_icon_file(const std::string&, int)
{
have_pixmap_ = false;
pix_rgba_.clear();
}
void TrayIcon::set_icon(const std::string& icon_name)
{
icon_name_ = icon_name;
}
void TrayIcon::set_tooltip(const std::string& text)
{
tooltip_ = text;
}
void TrayIcon::set_title(const std::string& title)
{
title_ = title;
}

11
thirdparty/bastionguard-secure-connection/ui/src/pages/SettingsPage.cpp vendored
View file

@ -5,6 +5,10 @@
#include <glibmm/markup.h>
#include <cstdlib>
#ifndef BSC_SERVICECTL_PATH
#define BSC_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service"
#endif
#include <filesystem>
#include <fstream>
@ -142,7 +146,7 @@ void SettingsPage::buildUi()
m_infoLabel.set_wrap(true);
m_infoLabel.set_halign(Gtk::Align::START);
m_infoLabel.set_xalign(0.0f);
m_infoLabel.set_text(_("Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e systemctl disable --now bsc-daemon.service. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."));
m_infoLabel.set_text(_("Disattivando vengono eseguite queste operazioni: salvataggio di enabled=false, autostart_enabled=false e daemon_enabled=false, backup dell'autostart in /etc/xdg/autostart/bastionguard-sc-autostart.desktop.bak, rimozione dell'autostart attivo e disattivazione di bsc-daemon tramite il gestore servizi. Riattivando, il backup viene ripristinato e il servizio viene riabilitato."));
m_infoLabel.add_css_class("alert-info");
auto buttons = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
@ -254,7 +258,8 @@ void SettingsPage::loadPreference()
bool SettingsPage::serviceEnabled() const
{
const std::string cmd =
std::string("systemctl is-enabled ") + kServiceName + " >/dev/null 2>&1";
std::string(BSC_SERVICECTL_PATH) + " --system is-enabled " +
kServiceName + " >/dev/null 2>&1";
return std::system(cmd.c_str()) == 0;
}
@ -292,7 +297,7 @@ void SettingsPage::refreshState()
std::string(m_savedEnabled ? _("attivo") : _("disattivato")));
m_serviceStateLabel.set_text(
_("Servizio systemd abilitato: ") + boolText(svc));
_("Servizio di sistema abilitato: ") + boolText(svc));
m_autostartStateLabel.set_text(
_("Autostart presente in /etc/xdg/autostart: ") + boolText(autoStart));