#!/bin/sh -e

# Copyright (C) 2001, 2002, 2003, 2004, 2008 Joost van Baal
# 
#     This program is free software; you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation; either version 2 of the License, or
#     (at your option) any later version.
# 
#     This program is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
# 
#     You should have received a copy of the GNU General Public License
#     along with this program (see COPYING); if not, check with
#     http://www.gnu.org/copyleft/gpl.html or write to the Free Software 
#     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
#

# st_snapshot - calculate md5sum and stat ownership and
#              permissions of critical system files

patterns=$1     # typically /usr/local/etc/systraq/snapshot_${mode}.list,
                #    ${mode} is either root or pub
homepatterns=$2 # typically /usr/local/etc/systraq/snapshot_${mode}.homelist
                #
                # in case mode is pub, typically ST_OPHOMES is set to a
                # non-empty value

test $# -eq 2 || {
    echo >&2 $0: give 2 args indicating patterns homepatterns, not $# && exit 1
}

test -r $patterns || {
    echo >&2 $0: patterns file $patterns not readable && exit 1
}

test -r $homepatterns || {
    echo >&2 $0: homepatterns file $homepatterns not readable && exit 1
}

HOMES=
for h in `getent passwd | cut -d: -f6 | sort -u`
do
  [ -d $h ] && HOMES="$HOMES $h"
done

# monitor homedir's, but do not descend in them
if test -n "$ST_OPHOMES"
then
    echo '# ownership and permissions of homedirs'
    for h in $HOMES
    do
        if test -e $h
        then
            # suppress timestamp
            ls -ld $h | {
                while read p n u g s m d t f
                do
                    echo $p $u $g $f
                done
            }
        fi
    done
fi

files=`grep -v '^#' $patterns`

{
    while read p
    do
        if echo $p | grep -qv '^#'
        then
            for h in $HOMES
            do
                # exclude / as homedir: this would interact terribly with
                # monitoring ~/etc/ .
                [ "$h" != "/" ] && files="$h/$p $files"
            done
        fi
    done
} < $homepatterns

fs=
for f in $files
do
    if test -e $f
    then
        fs="$fs $f"
    fi
done

echo "# remainder of file built from $patterns and $homepatterns"

if test -n "$ST_SUM"
then
    echo "# $ST_SUM of critical files"
    find $fs -type f -print0 | xargs -0 $ST_SUM
else
    echo >&2 "$0: warning: environment variable ST_SUM unset, skipping generating checksums for files in $fs.  Please set ST_SUM to sha256sum."
fi

echo "# ownership and permissions of critical files"
find $fs -type f -ls | {
    # change
    # 223325 3 -rwxrwxr-x 1 joostvb joostvb 2733 Aug 18 22:04 cdrip
    # into
    # -rwxrwxr-x joostvb joostvb cdrip
    while read i m p n u g s m d t f
    do
        echo $p $u $g $f
    done
}