94 lines
2.3 KiB
Bash
Executable file
94 lines
2.3 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
set -o pipefail
|
|
set -e
|
|
|
|
BASE_PATH=/tmp/system-audit
|
|
GIT_DIR=/var/local/system-audit
|
|
|
|
function collect_hashes {
|
|
target=$1; shift
|
|
for dir in $@; do
|
|
if ! [ -e "${dir}" ]; then
|
|
echo "${dir}" >> ${BASE_PATH}/missing
|
|
wrap_git add --intent-to-add ${BASE_PATH}/missing
|
|
continue
|
|
fi
|
|
|
|
find ${dir} -mindepth 1 \( -type f -or -type l \) -print0 | xargs -0 shasum -a 512 >> ${target}
|
|
done
|
|
|
|
if [ -e ${target} ]; then
|
|
wrap_git add --intent-to-add ${target}
|
|
fi
|
|
}
|
|
|
|
function wrap_git {
|
|
git --work-tree=${BASE_PATH} --git-dir=${GIT_DIR} "$@"
|
|
return $?
|
|
}
|
|
|
|
# Create target directory
|
|
mkdir -p ${BASE_PATH}
|
|
|
|
# Initialize the dir repo if not present
|
|
if ! [ -e "${GIT_DIR}" ]; then
|
|
mkdir -p $(dirname ${GIT_DIR})
|
|
wrap_git init
|
|
fi
|
|
|
|
if [ $# -lt 1 ]; then
|
|
echo "Usage: $0 <collect|freeze|init|check>"
|
|
exit 1
|
|
fi
|
|
|
|
case "$1" in
|
|
|
|
"collect")
|
|
# Remove old hash-files
|
|
rm -rf ${BASE_PATH}/*
|
|
|
|
# [OSX / Linux] Changing this script will cause a different behaviour
|
|
# so also this needs to be monitored.
|
|
collect_hashes ${BASE_PATH}/script $0
|
|
|
|
# [OSX only] LaunchAgents and LaunchDaemons can be used to execute
|
|
# programs on behalf of the user or the root user. They may be used
|
|
# as attack vectors.
|
|
collect_hashes ${BASE_PATH}/agents_daemons /System/Library/LaunchDaemons /Library/LaunchDaemons /System/Library/LaunchAgents /Library/LaunchAgents ~/Library/LaunchAgents
|
|
|
|
# [OSX / Linux ] /etc (or /private/etc on OSX) does contain configuration
|
|
# for system applications and might be used to change their behaviour.
|
|
collect_hashes ${BASE_PATH}/etc /etc /private/etc
|
|
|
|
# [OSX / Linux] Binary folders do contain the executables used by the
|
|
# system itself. Exchanging them can cause harm to the system or leak
|
|
# data.
|
|
collect_hashes ${BASE_PATH}/bin /usr/bin /usr/local/bin ~/bin
|
|
;;
|
|
|
|
"freeze")
|
|
wrap_git commit -S -a -m "Status freeze as of $(date)"
|
|
;;
|
|
|
|
"check")
|
|
$0 collect
|
|
$0 diff --exit-code
|
|
echo "Everything is still in recorded state"
|
|
;;
|
|
|
|
"init")
|
|
if [ $($0 log --pretty=format:'%h [%G?]%d %s (%cr) <%an>' --abbrev-commit | wc -l) -gt 0 ]; then
|
|
echo "The status was already initialized. Use 'collect' and 'diff' to review the state and 'freeze' to save it"
|
|
exit 1
|
|
fi
|
|
|
|
$0 collect
|
|
$0 freeze
|
|
;;
|
|
|
|
*)
|
|
wrap_git "$@"
|
|
;;
|
|
|
|
esac
|