xref: /freebsd/usr.sbin/periodic/etc/security/security.functions (revision aa48259f337100e79933d660fec8856371f761ed)
1*81ea85a8SBrad Davis#!/bin/sh
2*81ea85a8SBrad Davis#
3*81ea85a8SBrad Davis# Copyright (c) 2001  The FreeBSD Project
4*81ea85a8SBrad Davis# All rights reserved.
5*81ea85a8SBrad Davis#
6*81ea85a8SBrad Davis# Redistribution and use in source and binary forms, with or without
7*81ea85a8SBrad Davis# modification, are permitted provided that the following conditions
8*81ea85a8SBrad Davis# are met:
9*81ea85a8SBrad Davis# 1. Redistributions of source code must retain the above copyright
10*81ea85a8SBrad Davis#    notice, this list of conditions and the following disclaimer.
11*81ea85a8SBrad Davis# 2. Redistributions in binary form must reproduce the above copyright
12*81ea85a8SBrad Davis#    notice, this list of conditions and the following disclaimer in the
13*81ea85a8SBrad Davis#    documentation and/or other materials provided with the distribution.
14*81ea85a8SBrad Davis#
15*81ea85a8SBrad Davis# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16*81ea85a8SBrad Davis# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17*81ea85a8SBrad Davis# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18*81ea85a8SBrad Davis# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19*81ea85a8SBrad Davis# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20*81ea85a8SBrad Davis# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21*81ea85a8SBrad Davis# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22*81ea85a8SBrad Davis# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23*81ea85a8SBrad Davis# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24*81ea85a8SBrad Davis# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25*81ea85a8SBrad Davis# SUCH DAMAGE.
26*81ea85a8SBrad Davis#
27*81ea85a8SBrad Davis#
28*81ea85a8SBrad Davis
29*81ea85a8SBrad Davis# This is a library file, so we only try to do something when sourced.
30*81ea85a8SBrad Daviscase "$0" in
31*81ea85a8SBrad Davis*/security.functions) exit 0 ;;
32*81ea85a8SBrad Davisesac
33*81ea85a8SBrad Davis
34*81ea85a8SBrad Davis#
35*81ea85a8SBrad Davis# Show differences in the output of an audit command
36*81ea85a8SBrad Davis#
37*81ea85a8SBrad Davis
38*81ea85a8SBrad DavisLOG="${security_status_logdir}"
39*81ea85a8SBrad Davisrc=0
40*81ea85a8SBrad Davis
41*81ea85a8SBrad Davis# Usage: COMMAND | check_diff [new_only] LABEL - MSG
42*81ea85a8SBrad Davis#        COMMAND > TMPFILE; check_diff [new_only] LABEL TMPFILE MSG
43*81ea85a8SBrad Davis#   if $1 is new_only, show only the 'new' part of the diff.
44*81ea85a8SBrad Davis#   LABEL is the base name of the ${LOG}/${label}.{today,yesterday} files.
45*81ea85a8SBrad Davis
46*81ea85a8SBrad Davischeck_diff() {
47*81ea85a8SBrad Davis  unset IFS
48*81ea85a8SBrad Davis  rc=0
49*81ea85a8SBrad Davis  if [ "$1" = "new_only" ]; then
50*81ea85a8SBrad Davis    shift
51*81ea85a8SBrad Davis    filter="grep '^[>+][^+]'"
52*81ea85a8SBrad Davis  else
53*81ea85a8SBrad Davis    filter="cat"
54*81ea85a8SBrad Davis  fi
55*81ea85a8SBrad Davis  label="$1"; shift
56*81ea85a8SBrad Davis  tmpf="$1"; shift
57*81ea85a8SBrad Davis  msg="$1"; shift
58*81ea85a8SBrad Davis
59*81ea85a8SBrad Davis  if [ "${tmpf}" = "-" ]; then
60*81ea85a8SBrad Davis    tmpf=`mktemp -t security`
61*81ea85a8SBrad Davis    cat > ${tmpf}
62*81ea85a8SBrad Davis  fi
63*81ea85a8SBrad Davis
64*81ea85a8SBrad Davis  if [ ! -f ${LOG}/${label}.today ]; then
65*81ea85a8SBrad Davis    rc=1
66*81ea85a8SBrad Davis    echo ""
67*81ea85a8SBrad Davis    echo "No ${LOG}/${label}.today"
68*81ea85a8SBrad Davis    cp ${tmpf} ${LOG}/${label}.today || rc=3
69*81ea85a8SBrad Davis  fi
70*81ea85a8SBrad Davis
71*81ea85a8SBrad Davis  if ! cmp -s ${LOG}/${label}.today ${tmpf} >/dev/null; then
72*81ea85a8SBrad Davis    [ $rc -lt 1 ] && rc=1
73*81ea85a8SBrad Davis    echo ""
74*81ea85a8SBrad Davis    echo "${msg}"
75*81ea85a8SBrad Davis    diff ${security_status_diff_flags} ${LOG}/${label}.today \
76*81ea85a8SBrad Davis	${tmpf} | eval "${filter}"
77*81ea85a8SBrad Davis    mv ${LOG}/${label}.today ${LOG}/${label}.yesterday || rc=3
78*81ea85a8SBrad Davis    mv ${tmpf} ${LOG}/${label}.today || rc=3
79*81ea85a8SBrad Davis  fi
80*81ea85a8SBrad Davis
81*81ea85a8SBrad Davis  rm -f ${tmpf}
82*81ea85a8SBrad Davis  exit ${rc}
83*81ea85a8SBrad Davis}
84