#!/bin/sh
#
# Script for setting chflags
# Last modified: 09-12-2007

set_dirs[0]='/bin'
set_dirs[1]='/sbin'
set_dirs[2]='/usr/bin'
set_dirs[3]='/usr/libexec'
set_dirs[4]='/usr/sbin'
set_dirs[5]='/usr/X11R6/bin'

set_files[0]='/bsd'
set_files[1]='/etc/changelist'
set_files[2]='/etc/daily'
set_files[3]='/etc/inetd.conf'
set_files[4]='/etc/netstart'
set_files[5]='/etc/pf.conf'
set_files[6]='/etc/rc'
set_files[7]='/etc/rc.conf'
set_files[8]='/etc/rc.conf.local'
set_files[9]='/etc/rc.local'
set_files[10]='/etc/rc.shutdown'
set_files[11]='/etc/security'
set_files[12]='/etc/mtree/special'

######################################################

test=$(sysctl kern.securelevel | grep "\-1")

if [ "$(id -u)" != "0" ]; then 
    echo "This script must be run as root!" 
    exit 67
elif [ "$test" == "" ]; then
    echo "Changing chflags is only possible at securelevel -1"
    echo "Current $(sysctl kern.securelevel), so please change securelevel to -1 first"
    exit 67
fi

if [[ "$*" == "-h" || "$*" == "-high" ]]; then
    echo -n "Setting chflags to high security settings..."
    element_count=${#set_dirs[@]}
    index=0
    while [ "$index" -lt "$element_count" ]
    do
        chflags -R schg "${set_dirs[$index]}"
        let "index = $index + 1"
    done
    element_count=${#set_files[@]}
    index=0
    while [ "$index" -lt "$element_count" ]
    do
        chflags schg "${set_files[$index]}"
        let "index = $index + 1"
    done
    echo "     done"
elif [[ "$*" == "-l" || "$*" == "-low" ]]; then
    echo -n "Setting chflags to low security settings..."
    element_count=${#set_dirs[@]}
    index=0
    while [ "$index" -lt "$element_count" ]
    do
        chflags -R noschg "${set_dirs[$index]}"
        let "index = $index + 1"
    done
    element_count=${#set_files[@]}
    index=0
    while [ "$index" -lt "$element_count" ]
    do
        chflags noschg "${set_files[$index]}"
        let "index = $index + 1"
    done
    echo "     done"
else
    if [ "$*" == "" ]; then
        echo "setchflags.sh: missing option"
    else
        echo "setchflags.sh: unknown option $*"
    fi
    echo "usage: setchflags.sh [-l, -low, -h, -high]"
    echo "-l, -low  = low security  (noschg)"
    echo "-h, -high = high security (schg)" 
    echo ""
    exit 67
fi