EVOLUTION-NINJA

Edit File: kcare-scanner-interface

#!/usr/bin/env bash
# vi:syntax=sh

set -eo pipefail

progname=$(basename "$0")

sub_help(){
    echo "Usage: $progname <subcommand> [options]"
    echo ""
    echo "Subcommands:"
    echo "    init   [username ...]"
    echo "    disable"
    echo ""
    echo "For help with each subcommand run:"
    echo "$progname <subcommand> -h|--help"
    echo ""
}

subcommand=$1
KCARE_PROFILE='/etc/profile.d/kernelcare.sh'
KCARE_SUDOERS='/etc/sudoers.d/kernelcare'
TMP_SUDOERS="/root/kernelcare.sudoers.tmp"
KCARE_FALCON_OVERRIDE_DIR='/etc/systemd/system/falcon-sensor.service.d'
KCARE_FALCON_OVERRIDE="${KCARE_FALCON_OVERRIDE_DIR}/kcare-scanner-interface.conf"

function clean_env_file(){
    [ -f "$1" ] && sed -i '/kpatch_package/d' "$1" || :
}

function patch_env_file(){
    clean_env_file "$1"
    echo "$2${KCARE_PACKAGE_ENV}$3" >> "$1"
}

function patch_falcon(){
    # CrowdStrike Falcon's unit file declares no EnvironmentFile, so a
    # systemd drop-in is the only supported way to inject LD_PRELOAD.
    command -v systemctl >/dev/null 2>&1 || return 0
    systemctl cat falcon-sensor.service >/dev/null 2>&1 || return 0

mkdir -p "${KCARE_FALCON_OVERRIDE_DIR}"
    cat > "${KCARE_FALCON_OVERRIDE}" << FALCONOVERRIDE
# Managed by kcare-scanner-interface — do not edit manually
[Service]
Environment="${KCARE_PACKAGE_ENV}"
FALCONOVERRIDE
    chmod 0644 "${KCARE_FALCON_OVERRIDE}"
    systemctl daemon-reload >/dev/null 2>&1 || :
    echo "Restart falcon-sensor.service to apply: systemctl restart falcon-sensor.service"
}

function unpatch_falcon(){
    [ -f "${KCARE_FALCON_OVERRIDE}" ] || return 0
    rm -f "${KCARE_FALCON_OVERRIDE}"
    rmdir "${KCARE_FALCON_OVERRIDE_DIR}" 2>/dev/null || :
    command -v systemctl >/dev/null 2>&1 && systemctl daemon-reload >/dev/null 2>&1 || :
    echo "Restart falcon-sensor.service to drop the LD_PRELOAD wrapper: systemctl restart falcon-sensor.service"
}

function patch_agents(){
    # Patch environment of the Qualys agent
    patch_env_file "/etc/sysconfig/qualys-cloud-agent" 'export ' '.qualys'
    patch_env_file "/etc/default/qualys-cloud-agent" '' '.qualys'
    # Patch environment of the Nessus agent
    patch_env_file "/etc/sysconfig/nessusagent" '' ''
    # Patch environment of the CrowdStrike Falcon agent
    patch_falcon
}

function patch_bashrc(){
    BASHRC=$1
    SOURCE_LINE="test -f ${KCARE_PROFILE} && source ${KCARE_PROFILE} > /dev/null ||:"
    test -f "${BASHRC}" && sed -i "2 i${SOURCE_LINE}" "${BASHRC}" 2> /dev/null || :
}

function patch_user(){
    KCARE_SCANNER_USER=$1

# Setup scanner interface for one user defined in $KCARE_SCANNER_USER
    if [ "$KCARE_SCANNER_USER" == '*' ]; then
        cat >> ${KCARE_PROFILE} << PROFILECONTENT
export ${KCARE_PACKAGE_ENV}
PROFILECONTENT
    else
        # Ensure profile script always exits with code 0 to avoid breaking job execution
        cat >> ${KCARE_PROFILE} << PROFILECONTENT
[ \$(logname 2>/dev/null || echo \${SUDO_USER:-\$USER}) = ${KCARE_SCANNER_USER} ] && export ${KCARE_PACKAGE_ENV} || :
PROFILECONTENT
    fi

chmod 644 "${KCARE_PROFILE}"

rm -rf "${TMP_SUDOERS}"
    [ -f ${KCARE_SUDOERS} ] && cp ${KCARE_SUDOERS} ${TMP_SUDOERS}

# Patch environment for sudoers
    if [ -f /usr/sbin/visudo ]; then
        if [ "$KCARE_SCANNER_USER" == '*' ]; then
            echo "Defaults env_file=/usr/libexec/kcare/env" >> "${TMP_SUDOERS}"
        else
            echo "Defaults:$KCARE_SCANNER_USER env_file=/usr/libexec/kcare/env" >> "${TMP_SUDOERS}"
        fi
        /usr/sbin/visudo -cf ${TMP_SUDOERS} > /dev/null && cp ${TMP_SUDOERS} ${KCARE_SUDOERS} && chmod 0440 ${KCARE_SUDOERS}
    fi
}

sub_disable(){
  rm -f ${KCARE_PROFILE}
  rm -f ${KCARE_SUDOERS}

sed -i '/^SCANNER_USER=/d' /etc/sysconfig/kcare/kcare.conf || :
  sed -i "\,${KCARE_PROFILE},d" /etc/bash.bashrc 2> /dev/null || :
  sed -i "\,${KCARE_PROFILE},d" /etc/bashrc 2> /dev/null || :

clean_env_file /etc/sysconfig/qualys-cloud-agent
  clean_env_file /etc/default/qualys-cloud-agent
  clean_env_file /etc/sysconfig/nessusagent
  unpatch_falcon
}

sub_init(){

# Reset all before settings (re)applying
    echo 'Resetting.'
    sub_disable

KCARE_SCANNER_USERS=("$@")
    KCARE_PACKAGE_ENV='LD_PRELOAD=/usr/libexec/kcare/kpatch_package.so'

echo "${KCARE_PACKAGE_ENV}" > /usr/libexec/kcare/env

for KCARE_SCANNER_USER in "${KCARE_SCANNER_USERS[@]}"
    do
        if [ "$KCARE_SCANNER_USER" == 'any' ] || [ "$KCARE_SCANNER_USER" == 'root' ]; then
            if [ -z "$KCARE_SCANNER_USER_FORCE_ROOT" ]; then
                echo "Using 'any' or 'root' is strongly unrecommended."
                echo "Use 'KCARE_SCANNER_USER_FORCE_ROOT' environment variable to allow."
                exit 1
            fi
        fi

if [ "$KCARE_SCANNER_USER" == 'any' ] && ! id "$KCARE_SCANNER_USER" >/dev/null 2>&1; then
            echo Setting up a scanner-interface for all users
            patch_user '*'
        elif id "${KCARE_SCANNER_USER}" >/dev/null 2>&1; then
            echo Setting up a scanner-interface for "${KCARE_SCANNER_USER}"
            patch_user "${KCARE_SCANNER_USER}"
        elif [ "$KCARE_SCANNER_USER" == 'none' ] || [ -z "$KCARE_SCANNER_USER" ]; then
            echo "Setting up a scanner-interface for user is skipped. Use \`init <username>\` for user-based scanners."
        else
            echo "User $KCARE_SCANNER_USER does not exist"
            exit 2
        fi

done

# Config set
    echo "SCANNER_USER=${KCARE_SCANNER_USERS[*]}" >> /etc/sysconfig/kcare/kcare.conf

# Patch environment for noninterative shells
    patch_bashrc /etc/bash.bashrc
    patch_bashrc /etc/bashrc

echo Setting up scanner agents
    patch_agents
}

case $subcommand in
    "" | "-h" | "--help")
        sub_help
        ;;
    *)
        shift
        "sub_${subcommand}" "$@"
        if [ $? = 127 ]; then
            echo "Error: '$subcommand' is not a known subcommand." >&2
            echo "       Run '$progname --help' for a list of known subcommands." >&2
            exit 1
        fi
        ;;
esac

echo "Done."