aboutsummaryrefslogtreecommitdiffstats
path: root/cron-sh/functions.sh
blob: f5ae7a799c4730e9145abf3d1ba3f57b600cf187 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
#!/bin/bash
# msec: shared function

. /etc/sysconfig/i18n
if [[ -f /etc/profile.d/10lang.sh ]]; then
    . /etc/profile.d/10lang.sh
fi

if [[ -f /etc/security/msec/security.conf ]]; then
    . /etc/security/msec/security.conf
else
    echo "/etc/security/msec/security.conf don't exist."
    exit 1
fi

if [ -r /etc/security/shell ]; then
    . /etc/security/shell
fi

umask ${UMASK_ROOT=077}

# main security log
SECURITY_LOG="/var/log/security.log"

# Modified filters coming from debian security scripts.
# rootfs is not listed among excluded types, because
# / is mounted twice, and filtering it would mess with excluded dir list
TYPE_FILTER='(devpts|sysfs|usbfs|tmpfs|binfmt_misc|rpc_pipefs|securityfs|auto|proc|msdos|fat|vfat|iso9660|ncpfs|smbfs|hfs|nfs|afs|coda|cifs|fuse.gvfs-fuse-daemon|vmblock)'
MOUNTPOINT_FILTER='^\/mnt|^\/media'
DIR=`awk '$3 !~ /'$TYPE_FILTER'/ && $2 !~ /'$MOUNTPOINT_FILTER'/ \
        {print $2}' /proc/mounts | uniq`
PRINT="%h/%f\n"
EXCLUDEDIR=`awk '$3 ~ /'$TYPE_FILTER'/ || $2 ~ /'$MOUNTPOINT_FILTER'/ \
        {print $2}' /proc/mounts | uniq`
export EXCLUDEDIR
FILTER="\(`echo $EXCLUDEDIR | sed -e 's/ /\\\|/g'`\)"

### Functions ###

function current_check_type() {
        # determines current check type by matching the directory from where
        # the main script is executed against possible check values. Currently,
        # the following checks are supported: daily, weekly, monthly
        # if nothing matches those directories, it is assumed that the check is "manual"
        SCRIPT_DIR=$(dirname $0)
        for check in daily weekly monthly; do
                echo $SCRIPT_DIR | grep -q $check
                ret=$?
                if [ $ret = "0" ]; then
                        echo $check
                        return
                fi
        done
        # nothing matches, so assuming a manual check
        echo "manual"
        return
}

function check_is_enabled() {
        # checks if a periodic check should run by matching the directory from where
        # the main script is run against check value. E.g., daily checks will work if
        # executed from /etc/cron.daily or any directory containing 'daily'; weekly checks
        # will run if run withing a directory containing 'weekly', and so on
        check=$1
        # is the check there at all?
        if [ -z "$check" ]; then
                return 1
        fi
        current_check=$(current_check_type)
        if [ "$check" = "$current_check" ]; then
                return 0
        fi
        # is the check being run manually (e.g., it is not a crontab symlink?)
        # NOTE: this only checks if the file is a symlink, assuming that the manual check
        # is performed by running the /usr/share/msec/security.sh directly
        if [ "$check" = "manual" -a ! -L $0 ]; then
                return 0
        fi
        return 1
}


Diffcheck() {
    TODAY="$1"
    YESTERDAY="$2"
    DAY_DIFF="$3"
    MESSAGE="$4"
    # give the proper permission to files
    msecperms -q -e "$TODAY" "$YESTERDAY"
    if [[ -f ${YESTERDAY} ]]; then
        if ! diff -u ${YESTERDAY} ${TODAY} > ${DAY_DIFF}; then
            printf "\nSecurity Warning: change in $MESSAGE found :\n" >> ${DIFF}
            grep '^+' ${DAY_DIFF} | grep -vw "^+++ " | sed 's|^.||'|sed -e 's/%/%%/g' | while read file; do
                printf "\t\t-   Added $MESSAGE : ${file}\n"
            done >> ${DIFF}
            grep '^-' ${DAY_DIFF} | grep -vw "^--- " | sed 's|^.||'|sed -e 's/%/%%/g' | while read file; do
                printf "\t\t- Removed $MESSAGE : ${file}\n"
            done >> ${DIFF}
        fi
            msecperms -q -e "$DAY_DIFF"
    fi
}

Count() {
        # counts number of entries in a file
        LOG="$1"
        FILE="$2"
        MESSAGE="$3"
        NUM_ENTRIES=$(wc -l 2>/dev/null < $FILE)
        echo "$MESSAGE: $NUM_ENTRIES" >> $LOG
}

Filter() {
        # filters output according to defined rules
        FILE="$1"
        RULE="$2"
        exceptions=/etc/security/msec/exceptions

        if [ ! -f "$FILE" ]; then
                # file not found - probably test was not run
                return
        fi

        if [ ! -s "$exceptions" -o "a$RULE" = "a" ]; then
                FILTER="cat"
        else
                # get the rules
                EXCEPTIONS=""
                for except in $(cat $exceptions | sed -e "/^\($RULE\|\*\) /!d; s/^\($RULE\|\*\) \(.*\)/\2/g"); do
                        exc=${except//\//\\\/}
                        EXCEPTIONS="$EXCEPTIONS -e /${exc}/d"
                done
                if [ ! -n "$EXCEPTIONS" ]; then
                        FILTER="cat"
                else
                        FILTER="sed $EXCEPTIONS"
                fi
        fi
        $FILTER < $FILE > ${FILE}.tmp
        mv -f ${FILE}.tmp $FILE

}

Syslog() {
    if [[ ${SYSLOG_WARN} == yes ]]; then
    cat ${1} | while read line; do
        logger -t msec -- "${line}"
    done
    fi
}

Ttylog() {
    if [[ ${TTY_WARN} == yes ]]; then
    for i in `w | grep -v "load\|TTY" | grep '^root' | awk '{print $2}'` ; do
        cat ${1} > /dev/$i
    done
    fi
}

Maillog() {
    subject=${1}
    text=${2}
    SOMETHING_TO_SEND=

    if [[ ${MAIL_WARN} == yes ]]; then
        # define a mail user
        if [[ -z ${MAIL_USER} ]]; then
            MAIL_USER="root"
        fi
        if [[ -x /bin/mail ]]; then
            for f in ${text}; do
                if [[ -s $f ]]; then
                    SOMETHING_TO_SEND=1
                    break
                fi
            done
            if [[ -z ${SOMETHING_TO_SEND} ]]; then
                if [[ ${MAIL_EMPTY_CONTENT} != no ]]; then
                    /bin/mail -s "${subject}" "${MAIL_USER}" <<EOF
Nothing has changed since the last run.
EOF
                fi
            else
                # remove non-printable characters,
                # see http://qa.mandriva.com/show_bug.cgi?id=36848 and https://qa.mandriva.com/show_bug.cgi?id=26773
                cat ${text} | sed -e "s,[[:cntrl:]],,g" | LC_CTYPE=$LC_CTYPE /bin/mail -s "${subject}" "${MAIL_USER}"
            fi
        fi
    fi
}

Notifylog() {
        if [[ ${NOTIFY_WARN} == yes ]]; then
                message=${1}
                DBUS_SEND=`which dbus-send 2>/dev/null`
                if [ -x "$DBUS_SEND" ]; then
                        $DBUS_SEND --system --type=signal /com/mandriva/user com.mandriva.user.security_notification string:"$message"
                fi
        fi
}

##################