#!/bin/bash


#########################################
#Core framework functions...
#########################################

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"

export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"

export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"

export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"

source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"

for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
  source "$framework_include_file"
done

for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
  source "$project_include_file"
done


#########################################
# Core script code begins here
#########################################

# Sourced from

# https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html
# https://github.com/ComplianceAsCode/content
# https://github.com/ComplianceAsCode

#apparmor
#enforcing
#enabled in bootloader config

#aide

#auditd

#disable auto mounting
#disable usb storage


#motd
#remote login warning banner

#Ensure time sync is working
#systemd-timesync
#ntp
#chrony

#password complexity
#password expiration warning
#password expiration time
#password hashing algo

#fix grub perms

if [ "$IS_RASPI" = 0 ] ; then

chown root:root /boot/grub/grub.cfg 
chmod og-rwx /boot/grub/grub.cfg
chmod 0400 /boot/grub/grub.cfg

fi


#disable auto mounting
systemctl --now disable autofs  || true
apt-get -y --purge remove autofs || true

#disable usb storage
cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf

#banners

cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd

#Cron perms

if [ -f /etc/cron.deny ]; then
rm /etc/cron.deny || true
fi

touch /etc/cron.allow
chmod g-wx,o-rwx /etc/cron.allow
chown root:root /etc/cron.allow

chmod og-rwx /etc/crontab
chmod og-rwx /etc/cron.hourly/
chmod og-rwx /etc/cron.daily/
chmod og-rwx /etc/cron.weekly/
chmod og-rwx /etc/cron.monthly/
chown root:root /etc/cron.d/
chmod og-rwx /etc/cron.d/

# At perms

rm -f /etc/at.deny || true
touch /etc/at.allow
chmod g-wx,o-rwx /etc/at.allow
chown root:root /etc/at.allow