Documentation
¶
Overview ¶
Package guardsvc hosts the Extension Guard as a long-running service and its watchdog companion. The service applies the force-install policy on start, re-applies it on registry tamper (via the watcher) and on a backstop timer, and spawns a watchdog process. The watchdog re-asserts service recovery, restarts the service if it is stopped or disabled, and re-installs it if the service entry is deleted - so stopping or killing the guard does not stick.
Index ¶
- Constants
- func Disable(cfg policy.Config, configPath string) error
- func Enable(cfg policy.Config, configPath string) error
- func Install(cfg policy.Config, configPath string) error
- func New(cfg policy.Config, configPath string) (service.Service, error)
- func RunWatchdog(cfg policy.Config, configPath string) error
- func Uninstall(cfg policy.Config, configPath string) error
Constants ¶
const (
// ServiceName is the SCM service name; the watchdog references it too.
ServiceName = "ExtensionGuard"
)
Variables ¶
This section is empty.
Functions ¶
func Disable ¶
Disable temporarily turns protection off. It performs the same teardown as an uninstall - stop and remove the service and lift the browser lock so browsing is unfiltered - but the caller deliberately keeps the stored uninstall password so Enable can restore protection later. The disabled sentinel it sets also stops the watchdog from resurrecting anything, and because the service entry is removed nothing auto-starts on reboot.
func Enable ¶
Enable restores protection after a Disable: it clears the disabled sentinel and reinstalls, hardens, and starts the service, which re-applies the browser lock. It assumes an uninstall password is already stored (set at install).
func Install ¶
Install registers the service, hardens it (recovery + Automatic start), clears the disabled sentinel, and starts it.
func New ¶
New builds the service. configPath is embedded into the service's launch arguments so the Service Control Manager passes it back to `guard run` - a service's working directory is System32, so the config can't be located by walking up the tree. Flags precede the subcommand because Go's flag parser stops at the first non-flag argument.
func RunWatchdog ¶
RunWatchdog is the watchdog companion loop. A single instance runs at a time; it exits when the disabled sentinel is set.
Types ¶
This section is empty.
Source Files