diff --git a/TODO b/TODO index e209aa0..87d7252 100644 --- a/TODO +++ b/TODO @@ -1,2 +1,3 @@ -* Deian package +* Debian package * Ubuntu package +* Read header of ${DIGEST_FILE} \ No newline at end of file diff --git a/hashboot.sh b/hashboot.sh index 65e7bc0..2ea7925 100755 --- a/hashboot.sh +++ b/hashboot.sh @@ -18,31 +18,31 @@ BOOT_MOUNTED="" #Umount /boot if we mounted it, exit with given exit code function die { - if [ ! -z ${BOOT_MOUNTED} ] - then - umount /boot - fi + if [ ! -z ${BOOT_MOUNTED} ] + then + umount /boot + fi - exit ${1} + exit ${1} } function recover { - echo "Restoring files from backup... (type yes or no for each file)" + echo "Restoring files from backup... (type yes or no for each file)" - #For each failed file: ask if it should be recovered from backup - for file in $(cut -d: -f1 ${LOG_FILE}) - do - tar -xzpPvwf ${BACKUP_FILE} ${file} - [ $? != 0 ] && echo "Error restoring ${file} from backup, continuing" - done + #For each failed file: ask if it should be recovered from backup + for file in $(cut -d: -f1 ${LOG_FILE}) + do + tar -xzpPvwf ${BACKUP_FILE} ${file} + [ $? != 0 ] && echo "Error restoring ${file} from backup, continuing" + done } #If we're not root: exit if [ ${UID} -ne 0 ] then - echo "You have to be root" >&2 - die 4 + echo "You have to be root" >&2 + die 4 fi #Try different hashers, use the most secure @@ -56,73 +56,67 @@ test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot md5sum 2> /dev/null) #If we found no hasher: exit if [ -z ${HASHER} ] then - echo "No hash calculator found" >&2 - die 5 + echo "No hash calculator found" >&2 + die 5 fi #If /boot is in fstab but not mounted: mount, mark as mounted if grep -q '/boot.*noauto' /etc/fstab && ! grep -q /boot /etc/mtab then - mount /boot - BOOT_MOUNTED=1 + mount /boot + BOOT_MOUNTED=1 fi if [ "${1}" == "index" ] then - #Write header - echo "#hashboot ${VERSION} - Algorithm: $(basename ${HASHER})" > ${DIGEST_FILE} - #Write hashes of all regular files to ${DIGEST_FILE} - err=$(dd if=/dev/sda of=${MBR_TMP} bs=1M count=1 status=noxfer 2>&1) || die 8 >&2 - ${HASHER} ${MBR_TMP} > ${MBR_FILE} - find /boot -type f -exec ${HASHER} --binary {} >> ${DIGEST_FILE} + - if [ $? == 0 ] - then - echo "List of hashes written to ${DIGEST_FILE}" - else - echo "Error writing ${DIGEST_FILE}" >&2 - die 7 - fi - #Backup of good files - tar -czpPf ${BACKUP_FILE} /boot ${MBR_TMP} ${MBR_FILE} - if [ $? == 0 ] - then - echo "Backup written to ${BACKUP_FILE}" - else - echo "Error writing ${BACKUP_FILE}" >&2 - die 7 - fi + #Write header + echo "#hashboot ${VERSION} - Algorithm: $(basename ${HASHER})" > ${DIGEST_FILE} + #Write hashes of all regular files to ${DIGEST_FILE} + err=$(dd if=/dev/sda of=${MBR_TMP} bs=2M count=1 status=noxfer 2>&1) || die 8 + ${HASHER} ${MBR_TMP} > ${MBR_FILE} + find /boot -type f -exec ${HASHER} --binary {} >> ${DIGEST_FILE} + + if [ $? == 0 ] + then + echo "List of hashes written to ${DIGEST_FILE}" + else + echo "Error writing ${DIGEST_FILE}" >&2 + die 7 + fi + #Backup of good files + tar -czpPf ${BACKUP_FILE} /boot ${MBR_TMP} ${MBR_FILE} ${DIGEST_FILE} + if [ $? == 0 ] + then + echo "Backup written to ${BACKUP_FILE}" + else + echo "Error writing ${BACKUP_FILE}" >&2 + die 7 + fi elif [ "${1}" == "check" ] then COUNTER=0 - err=$(dd if=/dev/sda of=${MBR_TMP} bs=1M count=1 status=noxfer 2>&1) || die 8 >&2 - if $(${HASHER} --check --warn --quiet --strict ${MBR_FILE} > ${LOG_FILE}) - then - echo "MBR ok" - - else - echo " !! TIME TO PANIK: MBR WAS MODIFIED !!" + err=$(dd if=/dev/sda of=${MBR_TMP} bs=2M count=1 status=noxfer 2>&1) || die 8 + if $(${HASHER} --check --warn --quiet --strict ${MBR_FILE} > ${LOG_FILE}) + then + echo "MBR ok" + else + echo " !! TIME TO PANIK: MBR WAS MODIFIED !!" COUNTER=$((COUNTER + 1)) - - fi - if $(${HASHER} --check --warn --quiet --strict ${DIGEST_FILE} >> ${LOG_FILE}) - then - echo "/boot io" + fi + if $(${HASHER} --check --warn --quiet --strict ${DIGEST_FILE} >> ${LOG_FILE}) + then + echo "/boot ok" die 0 - - else - echo " !! TIME TO PANIK: AT LEAST 1 FILE WAS MODIFIED !!" + else + echo " !! TIME TO PANIK: AT LEAST 1 FILE WAS MODIFIED !!" COUNTER=$((COUNTER + 2)) die $COUNTER - - fi + fi elif [ "${1}" == "recover" ] then - recover + recover else - echo "Usage: ${0} index|check|recover" >&2 - die 6 + echo "Usage: ${0} index|check|recover" >&2 + die 6 fi die 0 - - diff --git a/initscript.openrc b/initscript.openrc index 45404c4..364cf70 100755 --- a/initscript.openrc +++ b/initscript.openrc @@ -15,7 +15,7 @@ start() which hashboot.sh > /dev/null || return 1 hashboot.sh check - if [ $? == 4 ] + if [ $? -gt 0 ] && [ $? -le 3 ] then echo -n "Recover files? [y/N] " read -r yesno diff --git a/initscript.sysv b/initscript.sysv index 0b4d2a5..1840a7f 100755 --- a/initscript.sysv +++ b/initscript.sysv @@ -19,7 +19,7 @@ case "$1" in log_daemon_msg "Checking integrity of files in /boot" hashboot.sh check - if [ $? == 4 ] + if [ $? -gt 0 ] && [ $? -le 3 ] then log_end_msg 4