cfg/bin/system-audit

96 lines
2.3 KiB
Text
Raw Normal View History

#!/bin/bash
set -o pipefail
set -e
BASE_PATH=/tmp/system-audit
GIT_DIR=/var/local/system-audit
function collect_hashes() {
target=$1
shift
for dir in $@; do
if ! [ -e "${dir}" ]; then
echo "${dir}" >>${BASE_PATH}/missing
wrap_git add --intent-to-add ${BASE_PATH}/missing
continue
fi
find ${dir} -mindepth 1 \( -type f -or -type l \) -print0 | xargs -0 shasum -a 512 >>${target}
done
if [ -e ${target} ]; then
wrap_git add --intent-to-add ${target}
fi
}
function wrap_git() {
git --work-tree=${BASE_PATH} --git-dir=${GIT_DIR} "$@"
return $?
}
# Create target directory
mkdir -p ${BASE_PATH}
# Initialize the dir repo if not present
if ! [ -e "${GIT_DIR}" ]; then
mkdir -p $(dirname ${GIT_DIR})
wrap_git init
fi
if [ $# -lt 1 ]; then
echo "Usage: $0 <collect|freeze|init|check>"
exit 1
fi
case "$1" in
"collect")
# Remove old hash-files
rm -rf ${BASE_PATH}/*
# [OSX / Linux] Changing this script will cause a different behaviour
# so also this needs to be monitored.
collect_hashes ${BASE_PATH}/script $0
# [OSX only] LaunchAgents and LaunchDaemons can be used to execute
# programs on behalf of the user or the root user. They may be used
# as attack vectors.
collect_hashes ${BASE_PATH}/agents_daemons /System/Library/LaunchDaemons /Library/LaunchDaemons /System/Library/LaunchAgents /Library/LaunchAgents ~/Library/LaunchAgents
# [OSX / Linux ] /etc (or /private/etc on OSX) does contain configuration
# for system applications and might be used to change their behaviour.
collect_hashes ${BASE_PATH}/etc /etc /private/etc
# [OSX / Linux] Binary folders do contain the executables used by the
# system itself. Exchanging them can cause harm to the system or leak
# data.
collect_hashes ${BASE_PATH}/bin /usr/bin /usr/local/bin ~/bin
;;
"freeze")
wrap_git commit -S -a -m "Status freeze as of $(date)"
;;
"check")
$0 collect
$0 diff --exit-code
echo "Everything is still in recorded state"
;;
"init")
if [ $($0 log --pretty=format:'%h [%G?]%d %s (%cr) <%an>' --abbrev-commit | wc -l) -gt 0 ]; then
echo "The status was already initialized. Use 'collect' and 'diff' to review the state and 'freeze' to save it"
exit 1
fi
$0 collect
$0 freeze
;;
*)
wrap_git "$@"
;;
esac