cfg/bin/system-audit

#!/bin/bash

set -o pipefail
set -e

BASE_PATH=/tmp/system-audit
GIT_DIR=/var/local/system-audit
  
function collect_hashes {
  target=$1; shift
  for dir in $@; do
    if ! [ -e "${dir}" ]; then
      echo "${dir}" >> ${BASE_PATH}/missing
      wrap_git add --intent-to-add ${BASE_PATH}/missing
      continue
    fi

    find ${dir} -mindepth 1 \( -type f -or -type l \) -print0 | xargs -0 shasum -a 512 >> ${target}
  done

  if [ -e ${target} ]; then
    wrap_git add --intent-to-add ${target}
  fi
}

function wrap_git {
  git --work-tree=${BASE_PATH} --git-dir=${GIT_DIR} "$@"
  return $?
}

# Create target directory
mkdir -p ${BASE_PATH}

# Initialize the dir repo if not present
if ! [ -e "${GIT_DIR}" ]; then
  mkdir -p $(dirname ${GIT_DIR})
  wrap_git init
fi

if [ $# -lt 1 ]; then
  echo "Usage: $0 <collect|freeze|init|check>"
  exit 1
fi

case "$1" in

"collect")
  # Remove old hash-files
  rm -rf ${BASE_PATH}/*

  # [OSX / Linux] Changing this script will cause a different behaviour
  # so also this needs to be monitored.
  collect_hashes ${BASE_PATH}/script          $0

  # [OSX only] LaunchAgents and LaunchDaemons can be used to execute
  # programs on behalf of the user or the root user. They may be used
  # as attack vectors.
  collect_hashes ${BASE_PATH}/agents_daemons  /System/Library/LaunchDaemons /Library/LaunchDaemons /System/Library/LaunchAgents /Library/LaunchAgents ~/Library/LaunchAgents

  # [OSX / Linux ] /etc (or /private/etc on OSX) does contain configuration
  # for system applications and might be used to change their behaviour.
  collect_hashes ${BASE_PATH}/etc             /etc /private/etc

  # [OSX / Linux] Binary folders do contain the executables used by the
  # system itself. Exchanging them can cause harm to the system or leak
  # data.
  collect_hashes ${BASE_PATH}/bin             /usr/bin /usr/local/bin ~/bin
  ;;

"freeze")
  wrap_git commit -S -a -m "Status freeze as of $(date)"
  ;;

"check")
  $0 collect
  $0 diff --exit-code
  echo "Everything is still in recorded state"
  ;;

"init")
  if [ $($0 log --pretty=format:'%h [%G?]%d %s (%cr) <%an>' --abbrev-commit | wc -l) -gt 0 ]; then
    echo "The status was already initialized. Use 'collect' and 'diff' to review the state and 'freeze' to save it"
    exit 1
  fi

  $0 collect
  $0 freeze
  ;;

*)
  wrap_git "$@"
  ;;

esac