Shell Programming and Scripting

#!/bin/sh
#######################################################################################################
#
# Package            : XCCDF Scripts
# description        :
# filename           : GEN001200.sh
# client_loc         : /usr/local/scripts/xccdf/gen/
# platform           : all
# owner              : root|root
# perms              : 0500
# host               : all
#
# Company            : XXXXXX
# Author             : XXXXXX
# Revision           : 1
#
#######################################################################################################

#######################################################################################################
#
# CHANGELOG
#
# Jun 13 2012   : First version
#
#######################################################################################################

#######################################################################################################
# XCCDF Definitions
#######################################################################################################
Group_ID='V-794'
Group_Title='GEN001200'
Rule_ID='SV-037205r1_rule'
Rule_Severity='CAT II'
Rule_Version='GEN001200'
Rule_Title='All system command files must have mode 0755 or less permissive.'
Rule_Fix_Text='Change the mode for system command files to 0755 or less permissive.'

#######################################################################################################
# Header Definitions/Initializations
#######################################################################################################
## Include generic header file
BASEDIR="$(echo $0 | sed -e "s=^\.\(.*\)=$(pwd)\1=g" -e "s/\/\.\//\//g" -e 's/\/[^\/]*\/[^\/]*$//g')"
HeaderRC="${BASEDIR}/xccdfrc.sh"
FuncRC="${BASEDIR}/xccdffn.sh"

if [ -z "${__HEADER_RC_DEF__}" ]; then
    ## RC file not defined, do so.
    . ${HeaderRC}
    ## Rewrite the log functions to not go to a file.
    ## This would only need to be redefined when called alone, ergo no need for the logging to file.
    logmessage()    {   echo "${Rule_Version}: $@";     }
    logerror()      {   logmessage "Finding found!";    }
    logsuccess()    {   echo "" >/dev/null 2>&1;        }
    logcmd() {  
        logmessage "Running CMD: $@"
        eval $@ 
    }
else
    . ${FuncRC}
fi

## Check all values are defined before actually running anything.
CheckValues

#######################################################################################################
# Begin testing.
#######################################################################################################
DIRS="/etc /bin /usr/bin /usr/lbin /usr/ucb /usr/usb /sbin /usr/sbin"

errfiles=""
logmessage "Checking all relevant dirs for permission violations."
for dir in ${DIRS}; do 
    if [ -d "${dir}" ]; then
        find ${dir} -type f -exec ls -l {} \; | while read file; do
            # Grab the filename so we can report properly.
            fn="$(echo $file | awk '{print $9}')"
            # Get the file permissions into octal and separate it out.
            perm="$(ConvertPermOctal $file | awk '{print $1}')"
            relevantperm="$(echo $perm | sed 's/\(..\)\(..\)/\2/g')"
            # Quick way to find a violation...
            chkperm="$(echo $relevantperm | sed 's/.*[236].*$/yes/g')"
            if [ "${chkperm}" = "yes" ]; then
                logmessage "Investigate: (${perm}) ${fn}"
                # The ending space is important as we're going to delimiter off it in the fix.
                errfiles="${errfiles}${perm}:${fn} "
            fi
        done
    fi
done

if [ ! -z "${errfiles}" ]; then
    logerror 
else
    logsuccess
    logmessage "Not a finding."
    exit ${SUCCESS}
fi

#######################################################################################################
# Fix open issue if appropriate
#######################################################################################################

if [ $# -eq 1 ]; then
    ## Only perform actions for applicable flag(s).
    case "$1" in
        -F)
            ## We'll process fixes here, case statement for continuity and error catching.
            logmessage "Performing fix in accordance with ${OS} specifications."
            case "${OS}" in
                "${OS_AIX}" | \
                "${OS_SUN}" | \
                "${OS_LNX}")
                    for i in ${errfiles}; do 
                        owner="$(echo $i | cut -c2)"
                        group="$(echo $i | cut -c3)"
                        other="$(echo $i | cut -c4)"
                        file="$(echo $i | awk -F':' '{print $2}')"
                        perm="${owner}$(echo ${group}${other} | sed -e 's/2/0/g' -e 's/3/1/g' -e 's/6/4/g' -e 's/7/5/g')"
                        logmessage "Resolving File: ${file}: NewPerm: ${perm}"
                        logcmd "chmod ${perm} ${file}"
                        CheckCmdStatus
                    done
                    ;;
                *)
                    logmessage "OS Detection Failure: Exiting with error."
                    exit ${ERR_OSDETECT}
                    ;;
            esac
            ;;
        *)
            logmessage "Passed parameter invalid."
            ;;
    esac
fi
exit ${SUCCESS}