#!/bin/bash
#
#    Copyright (C) 2005-2006 nickelplated.net
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
#
#    GNU/GPL license can be found here: http://www.gnu.org/licenses/gpl.txt
#
# permcheck.sh
# Script to find and remove suid/sgid flags from all but necessary binaries like 
# passwd and su and to find questionably unsafe file permissions and attributes 
# on your filesystem and fix them. There are 4 modes of operation, --checksuid, 
# --removesuid, --checkperm, and --removeperm. Use --checksuid to find any files 
# with suid or sgid flags. Next use --removesuid and enter any files to exclude. 
# Use --checkperm to find any unsafe file and directory permissions. Next use 
# --removeperm and enter any files to exclude. Viola! All of the questionably 
# unsafe file and directory permissions have been removed.
#
# version: 0.2 (051606002)
# - added support for solaris
# - updated flags
# - updated find directives
# - still not completed (existing functions tested and working)
# version: 0.1
# - initial release

usage() {
   echo "usage: $1 <option>"
   echo "       -h or --help: prints this usage message."
   echo "       -s or --checksuid: checks for suid/gid files permissions."
   echo "       -S or --removesuid: remove suid/gid file permissions."
   echo "       -p or --checkperm: check for rwx global file/directory permissions."
   echo "       -P or --removeperm: remove rwx global file/directory permissions."
}

checksuid() {
   echo "checking for suid files.."
   $SUIDFINDCMD
   echo "checking for sgid files.."
   $SGIDFINDCMD
}

removesuid() {
   echo "enter a space seperated list of filenames to exclude from suid/gid permission removal. (su and passwd are automatic exceptions)"
   echo -n "exceptions: "
   read SUIDEXCEPTIONS
   if [ -z $SUIDEXCEPTIONS ]; then
      SUIDEXCEPTIONS="someridiculousvariablesotheforloopwillwork"
   fi

   echo "finding suid permissions.."
   SUIDPERMS=`$SUIDFINDCMD`
   for suidfile in $SUIDPERMS; do
      for suidexcept in $SUIDEXCEPTIONS; do
         case $suidfile in
            */$suidexcept)
               continue
               ;;
            */su)
               continue
               ;;
            */passwd)
               continue
               ;;
            *)
               if [ "`uname`" == "FreeBSD" ]; then
                  # this is needed because freebsd links passwd and yppasswd
                  if [ "$suidfile" == "/usr/bin/yppasswd" ]; then
                     continue
                  fi
                  if [ -n "`/bin/ls -lo $suidfile|grep chg`" ]; then
                     echo "chflags noschg $suidfile"
                     chflags noschg $suidfile
                  fi
               fi
               echo "chmod -s $suidfile"
               chmod -s $suidfile
               ;;
         esac
      done
   done
   echo "suid removal completed."

   echo "finding sgid permissions.."
   SGIDPERMS=`$SGIDFINDCMD`
   for sgidfile in $SGIDPERMS; do
      for sgidexcept in $SUIDEXCEPTIONS; do
         case $sgidfile in
            */$sgidexcept)
               continue
               ;;
            */su)
               continue
               ;;
            */passwd)
               continue
               ;;
            *)
               if [ "`uname`" == "FreeBSD" ]; then
                  # this is needed because freebsd links passwd and yppasswd
                  if [ "$sgidfile" == "/usr/bin/yppasswd" ]; then
                     continue
                  fi
                  if [ -n "`/bin/ls -lo $sgidfile|grep chg`" ]; then
                     echo "chflags noschg $sgidfile"
                     chflags noschg $sgidfile
                  fi
               fi
               echo "chmod -s $sgidfile"
               chmod -s $sgidfile
               ;;
         esac
      done
   done
   echo "sgid removal completed."
}

checkperm() {
   echo "checking for global writable suid files.."
   $GFSUFINDCMD
   echo "checking for global writable suid directories.."
   $GDSUFINDCMD
   echo "checking for global writable sgid files.."
   $GFSGFINDCMD
   echo "checking for global writable sgid directories.."
   $GDSGFINDCMD
   echo "checking for global writable files.."
   $GFFINDCMD
   echo "checking for global writable directories.."
   $GDFINDCMD
}

removeperm() {
   echo "removing unsafe file/directory permissions"
}

# script start
if ! [ $# == "1" ]; then
   usage $0
   exit 99
fi
if ! [ $EUID == "0" ]; then
   echo "ERROR: script must run as root!"
   exit 110
fi

SUIDFINDCMD="find / -perm -4000 -type f -print"
SGIDFINDCMD="find / -perm -2000 -type f -print"
GFFINDCMD="find / -perm -0002 -type f -print"
GDFINDCMD="find / -perm -0002 -type d -print"
GFSUFINDCMD="find / -perm -4002 -type f -print"
GDSUFINDCMD="find / -perm -4002 -type d -print"
GFSGFINDCMD="find / -perm -2002 -type f -print"
GDSGFINDCMD="find / -perm -2002 -type d -print"

if [ -n $1 ]; then
   case $1 in
      -h|--help)
         usage $0
         ;;
      -s|--checksuid)
         checksuid
         ;;
      -S|--removesuid)
         removesuid
         ;;
      -p|--checkperm)
         checkperm
         ;;
      -P|--removeperm)
         removeperm
         ;;
      *)
         usage $0
         ;;
   esac
fi