Mini Shell
Direktori : /bin/ |
|
Current File : //bin/kcare-scanner-interface |
#!/usr/bin/bash
# vi:syntax=sh
set -eo pipefail
progname=$(basename "$0")
sub_help(){
echo "Usage: $progname <subcommand> [options]\n"
echo "Subcommands:"
echo " init [username ...]"
echo " disable"
echo ""
echo "For help with each subcommand run:"
echo "$progname <subcommand> -h|--help"
echo ""
}
subcommand=$1
KCARE_PROFILE='/etc/profile.d/kernelcare.sh'
KCARE_SUDOERS='/etc/sudoers.d/kernelcare'
TMP_SUDOERS="/root/kernelcare.sudoers.tmp"
function clean_env_file(){
[ -f "$1" ] && sed -i '/kpatch_package/d' "$1" || :
}
function patch_env_file(){
clean_env_file "$1"
echo "$2${KCARE_PACKAGE_ENV}$3" >> "$1"
}
function patch_agents(){
# Patch environment of the Qualys agent
patch_env_file "/etc/sysconfig/qualys-cloud-agent" 'export ' '.qualys'
patch_env_file "/etc/default/qualys-cloud-agent" '' '.qualys'
# Patch environment of the Nessus agent
patch_env_file "/etc/sysconfig/nessusagent" '' ''
}
function patch_bashrc(){
BASHRC=$1
SOURCE_LINE="test -f ${KCARE_PROFILE} && source ${KCARE_PROFILE} > /dev/null ||:"
test -f "${BASHRC}" && sed -i "2 i${SOURCE_LINE}" "${BASHRC}" 2> /dev/null || :
}
function patch_user(){
KCARE_SCANNER_USER=$1
# Setup scanner interface for one user defined in $KCARE_SCANNER_USER
if [ "$KCARE_SCANNER_USER" == '*' ]; then
cat >> ${KCARE_PROFILE} << PROFILECONTENT
export ${KCARE_PACKAGE_ENV}
PROFILECONTENT
else
cat >> ${KCARE_PROFILE} << PROFILECONTENT
[ \$(logname 2>/dev/null || echo \${SUDO_USER:-\$USER}) = ${KCARE_SCANNER_USER} ] && export ${KCARE_PACKAGE_ENV}
PROFILECONTENT
fi
chmod 644 "${KCARE_PROFILE}"
rm -rf "${TMP_SUDOERS}"
[ -f ${KCARE_SUDOERS} ] && cp ${KCARE_SUDOERS} ${TMP_SUDOERS}
# Patch environment for sudoers
if [ -f /usr/sbin/visudo ]; then
if [ "$KCARE_SCANNER_USER" == '*' ]; then
echo "Defaults env_file=/usr/libexec/kcare/env" >> "${TMP_SUDOERS}"
else
echo "Defaults:$KCARE_SCANNER_USER env_file=/usr/libexec/kcare/env" >> "${TMP_SUDOERS}"
fi
/usr/sbin/visudo -cf ${TMP_SUDOERS} > /dev/null && cp ${TMP_SUDOERS} ${KCARE_SUDOERS} && chmod 0440 ${KCARE_SUDOERS}
fi
}
sub_disable(){
rm -f ${KCARE_PROFILE}
rm -f ${KCARE_SUDOERS}
sed -i '/^SCANNER_USER=/d' /etc/sysconfig/kcare/kcare.conf || :
sed -i "\,${KCARE_PROFILE},d" /etc/bash.bashrc 2> /dev/null || :
sed -i "\,${KCARE_PROFILE},d" /etc/bashrc 2> /dev/null || :
clean_env_file /etc/sysconfig/qualys-cloud-agent
clean_env_file /etc/default/qualys-cloud-agent
clean_env_file /etc/sysconfig/nessusagent
}
sub_init(){
# Reset all before settings (re)applying
echo 'Resetting.'
sub_disable
KCARE_SCANNER_USERS="$@"
KCARE_PACKAGE_ENV='LD_PRELOAD=/usr/libexec/kcare/kpatch_package.so'
echo "${KCARE_PACKAGE_ENV}" > /usr/libexec/kcare/env
for KCARE_SCANNER_USER in ${KCARE_SCANNER_USERS}
do
if [ "$KCARE_SCANNER_USER" == 'any' ] || [ "$KCARE_SCANNER_USER" == 'root' ]; then
if [ -z "$KCARE_SCANNER_USER_FORCE_ROOT" ]; then
echo "Using 'any' or 'root' is strongly unrecommended."
echo "Use 'KCARE_SCANNER_USER_FORCE_ROOT' environment variable to allow."
exit 1
fi
fi
if [ "$KCARE_SCANNER_USER" == 'any' ] && ! id "$KCARE_SCANNER_USER" >/dev/null 2>&1; then
echo Setting up a scanner-interface for all users
patch_user '*'
elif id "${KCARE_SCANNER_USER}" >/dev/null 2>&1; then
echo Setting up a scanner-interface for "${KCARE_SCANNER_USER}"
patch_user "${KCARE_SCANNER_USER}"
elif [ "$KCARE_SCANNER_USER" == 'none' ] || [ -z "$KCARE_SCANNER_USER" ]; then
echo 'Setting up a scanner-interface for user is skipped. Use `init <username>` for user-based scanners.'
else
echo "User $KCARE_SCANNER_USER does not exist"
exit 2
fi
done
# Config set
echo "SCANNER_USER=$KCARE_SCANNER_USERS" >> /etc/sysconfig/kcare/kcare.conf
# Patch environment for noninterative shells
patch_bashrc /etc/bash.bashrc
patch_bashrc /etc/bashrc
echo Setting up scanner agents
patch_agents
}
case $subcommand in
"" | "-h" | "--help")
sub_help
;;
*)
shift
sub_${subcommand} $@
if [ $? = 127 ]; then
echo "Error: '$subcommand' is not a known subcommand." >&2
echo " Run '$progname --help' for a list of known subcommands." >&2
exit 1
fi
;;
esac
echo "Done."
Zerion Mini Shell 1.0