added sectool check

1 files changed, 36 insertions, 0 deletions

diff --git a/cron-sh/scripts/06_sectool.sh b/cron-sh/scripts/06_sectool.sh
new file mode 100755
index 0000000..0617bd8
--- /dev/null
+++ b/cron-sh/scripts/06_sectool.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# msec: sectool check
+
+# check if we are run from main script
+if [ -z "$MSEC_TMP" -o -z "$INFOS" -o -z "$SECURITY" -o -z "$DIFF" -o -z "$SECURITY_LOG" ]; then
+        # variables are set in security.sh and propagated to the subscripts
+        echo "Error: this check should be run by the main msec security check!"
+        echo "       do not run it directly unless you know what you are doing."
+        return 1
+fi
+
+# check for changes in users
+SECTOOL_TODAY="/var/log/security/sectool.today"
+SECTOOL_YESTERDAY="/var/log/security/sectool.yesterday"
+SECTOOL_DIFF="/var/log/security/sectool.diff"
+
+if [[ -f ${SECTOOL_TODAY} ]]; then
+    mv ${SECTOOL_TODAY} ${SECTOOL_YESTERDAY};
+fi
+
+# check for changes in sectool results
+if check_is_enabled "${CHECK_SECTOOL}" ; then
+    if [ -x /usr/sbin/sectool ]; then
+        if [ ! -z "$CHECK_SECTOOL_LEVEL" ]; then
+            sectool_params="-L ${CHECK_SECTOOL_LEVEL}"
+        else
+            sectool_params="-a"
+        fi
+        sectool $sectool_params > ${SECTOOL_TODAY}
+        Filter ${SECTOOL_TODAY} CHECK_SECTOOL
+        Diffcheck ${SECTOOL_TODAY} ${SECTOOL_YESTERDAY} ${SECTOOL_DIFF} "sectool results"
+    else
+        printf "\nSectool check skipped: sectool not found" >> ${SECURITY}
+        echo "Sectool check: skipped (sectool not found)" >> ${INFOS}
+    fi
+fi