Merge pull request #27 from pagienge/main

Updates to sudo-impl.sh and related

Author: malachma

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "alar"
-version = "1.3.2"
+version = "1.3.3"
 authors = ["malachma <malachma@microsoft.com>", "pagienge <pagienge@microsoft.com>"]
 edition = "2021"
 license = "MIT OR Apache-2.0"

Changelog.md

@@ -6,6 +6,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 1.3.3 (2025-12-15)
+Enhanced 'sudo' action to include more checks
+  - rev sudo-impl.sh to 1.1.0
+    - add sudo setuid check
+    - add /etc check 
+Updated helpers.sh
+  - rev helpers.sh to 1.2.0 
+    - adding OS detection, first used in sudo-impl.sh
+    - refactor the check functions into a check and fix functions so perms/owners can check w/o fixing
+
 ## 1.3.2 (2025-12-12)
   - Minimal refactoring of the code.
   - Add 'partx' support as replacement for sgdisk on RHEL 10

src/action_implementation/helpers.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/bash
 # -----------------------------------------------------------------------------
-# Version: 1.1.0
+# Version: 1.2.0
 # Released: 2025-10-31
+# Latest update: 2025-12-16
 # Author: Azure Support
 #
 # Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16,6 +17,77 @@
 # timestamp
 TIMESTAMP=`date +%Y%m%dT%H%M%S`
 
+# this will be infinitely useful
+source /etc/os-release
+
+# Do OS detection for use in other functions
+function detect_osfam() {
+  # Normalize to lowercase
+  local id like_str
+  id="$(printf '%s' "${ID:-}" | tr '[:upper:]' '[:lower:]')"
+  like_str="$(printf '%s' "${ID_LIKE:-}" | tr '[:upper:]' '[:lower:]')"
+
+  # Default
+  OSFAM="unknown"
+
+  # Helper: prefer 'fedora' over other RHEL derivatives if both appear
+  _prefer_fedora_like() {
+    # Takes a space-separated list; echoes the chosen token if matched.
+    local tokens="$1"
+    # First, explicit fedora
+    for t in $tokens; do
+      [[ "$t" == "fedora" ]] && { echo "fedora"; return; }
+    done
+    # Then other RHEL-family tokens
+    for t in $tokens; do
+      case "$t" in
+        rhel|centos|rocky|almalinux|ol|amzn)
+          echo "fedora"; return
+          ;;
+      esac
+    done
+    # No match
+    echo ""
+  }
+
+  # Pass 1: exact ID
+  case "$id" in
+    # Treat all these as fedora lineage
+    rhel|fedora|centos|rocky|almalinux|ol|amzn)
+      OSFAM="fedora"
+      ;;
+    ubuntu|debian)
+      OSFAM="debian"
+      ;;
+    sles|suse|opensuse*)
+      OSFAM="suse"
+      ;;
+    *)
+      ;;
+  esac
+
+  # Pass 2: scan ID_LIKE with fedora preference (handles multi-token)
+  if [[ "$OSFAM" == "unknown" && -n "$like_str" ]]; then
+    local chosen
+    chosen="$(_prefer_fedora_like "$like_str")"
+    if [[ -n "$chosen" ]]; then
+      OSFAM="$chosen"
+    else
+      # Fall back to other families
+      for like in $like_str; do
+        case "$like" in
+          debian|ubuntu) OSFAM="debian"; break ;;
+          suse|sles|opensuse*) OSFAM="suse"; break ;;
+        esac
+      done
+    fi
+  fi
+
+  export $OSFAM
+}
+# call the function above to set the OSFAM variable for use elsewhere
+detect_osfam
+
 function backup() {
   # Create a backup of a file.
   # Args:
@@ -64,108 +136,208 @@ function backup() {
   fi
 }
 
-function checkPerm() {
-  # Validate permissions, including special bits.
-  # Args: $1 = file to validate perms
-  #       $2 = octal representation of desired permissions (may include special
-  #            bits)
+## TODO: Test these 4 functions standalone and in the sudo script
 
-  file="$1"
-  desired="$2"
+# -------------------------------------------
+# CHECK: validate current perms vs desired
+# Return codes:
+#   0 -> match
+#   1 -> mismatch (fixable)
+#   2 -> check error (do not fix)
+# -------------------------------------------
+function checkPerm() {
+  # Args: $1 = file path, $2 = desired octal (3 or 4 digits; may include special bits)
+  local file="$1"
+  local desired="$2"
+  local actual newperm
 
   if [[ -z "$file" || -z "$desired" ]]; then
     echo "Usage: checkPerm <file> <desired-octal-perms>"
-    return 1
+    return 2
   fi
 
   if [[ ! -e "$file" ]]; then
     echo "Error: File does not exist: $file"
-    return 1
+    return 2
+  fi
+
+  # Basic octal validation (3–4 digits)
+  if [[ ! "$desired" =~ ^[0-7]{3,4}$ ]]; then
+    echo "Error: Desired permissions must be 3 or 4 octal digits (e.g., 644, 0755, 4755)."
+    return 2
   fi
 
   # Get current permissions in full 4-digit octal form (includes special bits)
   actual=$(stat -c "%a" "$file")
+
   # Pad to 4 digits for consistent comparison (e.g., 755 -> 0755)
-  # there is an edge case not being handled in 'actual' output of stat - if the
+  # There is an edge case not being handled in 'actual' output of stat - if the
   # 3-digit perms of the actual file start with 0 from 'stat' it will break the
-  # check because it looks like 0x to bash.  This is sufficiently edge to not 
+  # check because it looks like 0x to bash. This is sufficiently edge to not
   # handle it, and also 0XX perms would be basically broken for most real-world
-  # uses, so lets keep the implied force change in that scenario
+  # uses, so let's keep the implied force change in that scenario.
   actual=$(printf "%04d" "$actual")
   desired=$(printf "%04s" "$desired")
 
   if [[ "$actual" == "$desired" ]]; then
     echo "OK: $file already has permissions $actual"
+    return 0
   else
-    echo "WARN: $file has permissions $actual, fixing to $desired"
-    if chmod "$desired" "$file"; then
-      newperm=$(stat -c "%a" "$file")
-      printf -v newperm "%04d" "$newperm"
-      echo "FIXED: $file now has permissions $newperm"
-    else
-      echo "ERR: Unable to fix permissions on $file"
-      return 1
-    fi
+    echo "MISMATCH: $file has permissions $actual; desired $desired"
+    return 1
   fi
 }
 
-function checkOwner() {
-  # Validate file ownership
-  # Args:
-  #   $1 = file to validate
-  #   $2 = desired owner or owner:group
-  #   $3 = optional group (ignored if $2 includes :)
-  #
-  # Examples:
-  #   checkOwner /etc/sudoers root root
-  #   checkOwner /etc/sudoers root:root
+# -------------------------------------------
+# FIX: apply chmod if check reports mismatch
+# Behavior:
+#   - Calls checkPerm and relays its status.
+#   - If checkPerm returns 1 (mismatch), attempts chmod.
+#   - On success, echoes FIXED and returns 0.
+#   - On failure, echoes ERR and returns 1.
+#   - If checkPerm returns 2 (error), propagates 2 (no fix attempt).
+# -------------------------------------------
+fixPerm() {
+  local file="$1"
+  local desired="$2"
+
+  # Run check and capture status
+  checkPerm "$file" "$desired"
+  local rc=$?
 
+  case "$rc" in
+    0)
+      echo "NOOP: Permissions already correct; no change applied."
+      return 0
+      ;;
+    1)
+      # Re-normalize desired to 4 digits before chmod
+      desired=$(printf "%04s" "$desired")
+      echo "FIX: Applying chmod $desired to $file ..."
+      if chmod "$desired" "$file"; then
+        local newperm
+        newperm=$(stat -c "%a" "$file")
+        printf -v newperm "%04d" "$newperm"
+        echo "FIXED: $file now has permissions $newperm"
+        return 0
+      else
+        echo "ERR: Unable to fix permissions on $file"
+        return 1
+      fi
+      ;;
+    2)
+      # Usage / file-not-found / invalid desired perms
+      echo "ABORT: Check failed; fix not attempted."
+      return 2
+      ;;
+    *)
+      echo "ERR: Unexpected checkPerm status: $rc"
+      return 1
+      ;;
+  esac
+}
+
+# -------------------------------------------
+# CHECK: validate current owner/group vs desired
+# Return codes:
+#   0 -> match
+#   1 -> mismatch (fixable)
+#   2 -> check error (do not fix)
+# -------------------------------------------
+checkOwner() {
   local file="$1"
   local owner_group="$2"
-  local desired_owner desired_group
+  local opt_group="$3"
+  local desired_owner desired_group actual_owner actual_group
 
   # Validate args
   if [[ -z "$file" || -z "$owner_group" ]]; then
     echo "Usage: checkOwner <file> <owner[:group]> [group]"
-    return 1
+    return 2
+  fi
+
+  # File must exist
+  if [[ ! -e "$file" ]]; then
+    echo "WARN: File not found: $file"
+    return 2
   fi
 
-  # Parse user/group input
+  # Parse owner[:group]
   if [[ "$owner_group" == *:* ]]; then
     desired_owner="${owner_group%%:*}"
     desired_group="${owner_group##*:}"
   else
     desired_owner="$owner_group"
-    desired_group="$3"
+    desired_group="$opt_group"
   fi
 
-  # Sanity check
+  # Validate parsed values
   if [[ -z "$desired_owner" || -z "$desired_group" ]]; then
     echo "Usage: checkOwner <file> <owner[:group]> [group]"
-    return 1
-  fi
-
-  # Verify file exists
-  if [[ ! -e "$file" ]]; then
-    echo "WARN: File not found: $file"
-    return 1
+    return 2
   fi
 
-  # Get current owner and group
-  local actual_owner actual_group
+  # Get actual ownership
   actual_owner=$(stat -c "%U" "$file")
   actual_group=$(stat -c "%G" "$file")
 
-  # Compare and fix if needed
+  # Compare
   if [[ "$actual_owner" == "$desired_owner" && "$actual_group" == "$desired_group" ]]; then
     echo "OK: $file owner:group OK ($actual_owner:$actual_group)"
+    return 0
   else
-    echo "WARN: $file has $actual_owner:$actual_group, fixing to $desired_owner:$desired_group"
-    if chown "$desired_owner:$desired_group" "$file"; then
-      echo "FIXED: $file now owned by $(stat -c "%U:%G" "$file")"
-    else
-      echo "ERR: Failed to change ownership of $file"
-      return 1
-    fi
+    echo "MISMATCH: $file has $actual_owner:$actual_group, desired $desired_owner:$desired_group"
+    return 1
   fi
+}
+
+# -------------------------------------------
+# FIX: apply chown if checkOwner reports mismatch
+#   - If checkOwner returns 1 → try fix
+#   - If checkOwner returns 0 → do nothing
+#   - If checkOwner returns 2 → abort
+# -------------------------------------------
+fixOwner() {
+  local file="$1"
+  local owner_group="$2"
+  local opt_group="$3"
+
+  # Run check
+  checkOwner "$file" "$owner_group" "$opt_group"
+  local rc=$?
+
+  case "$rc" in
+    0)
+      echo "NOOP: Ownership already correct; no change applied."
+      return 0
+      ;;
+    1)
+      # Determine owner:group again (same parsing logic)
+      local desired_owner desired_group
+      if [[ "$owner_group" == *:* ]]; then
+        desired_owner="${owner_group%%:*}"
+        desired_group="${owner_group##*:}"
+      else
+        desired_owner="$owner_group"
+        desired_group="$opt_group"
+      fi
+
+      echo "FIX: Applying chown $desired_owner:$desired_group to $file ..."
+      if chown "$desired_owner:$desired_group" "$file"; then
+        echo "FIXED: $file now owned by $(stat -c "%U:%G" "$file")"
+        return 0
+      else
+        echo "ERR: Failed to change ownership of $file"
+        return 1
+      fi
+      ;;
+    2)
+      echo "ABORT: Check failed; fix not attempted."
+      return 2
+      ;;
+    *)
+      echo "ERR: Unexpected checkOwner status: $rc"
+      return 1
+      ;;
+  esac
 }