#-----------------------------------------------------------------------------
#
# Check for suid scripts and apps (and check them against out lists)
#

&pcheck("SUID/SGID files");
open(LIST, "$api{'whereami'}/suid.$os{'version'}");
while ($_ = <LIST>) {
  chop;
  if (/^\s*$/ || /^\s*#/) { next; } ## skip blank lines and comments
  $suid{$_} = 1;
  }
close(LIST);

$findcmd = "$find / ! -type d ! -type l -local \\( -perm -02000 -o -perm -04000 \\) -print |";
open(FIND, $findcmd);

while ($_ = <FIND>) {
  chop;
  if ((!$suid{$_}) &&
      (substr($_, 0, 20) ne '/var/inst/patchbase/') &&
      (substr($_, 0, 24) ne '/usr/var/inst/patchbase/')) {
    push(@suid, $_);
    }
  }
close(FIND);

if (defined @suid) {
  &report("WARNING: The following files are SUID/SGID but are not listed:\n");
  
  &report('  ' . join("\n  ", @suid) . "\n");
  &report("\n  Remember that this *DOES NOT* mean they are a security threat, they\n");
  &report("  are just not in my list.  Please *DO NOT* chmod -s these files simply\n");
  &report("  because they are listed here.  If you find one that is part of the\n");
  &report("  system and not in the list, please inform <nate\@vis.colostate.edu>\n");
  &report("  about it.\n\n");
  &warn;
  }
else {
  &report("INFO:  No unexpected SUID/SGID files were found.\n");
  &passed;
  }

exit 0;
