#
# Checks out $fstab for nosuid and nodev mounts.  These are often good
#   to use, since most filesystems do not need suid files, or devices
#   on them.  They give an added layer of protection against scripts
#   that use holes to write a suid shell.
#

&pcheck($fstab);

#
# @acceptable is a set of directories that is ok to have mounted suid
#  or with devices.  These are, by default, the root and usr directories.
#
@acceptable = ("/","/usr");
$tmp = 0;

if (open (FSTAB, $fstab)) {

	while (<FSTAB>) {
		next if (/^#/);
		($source, $mpoint, $mtype, $args) = split(/\s+/);

		if ($mpoint eq "/tmp") { $tmp = 1; }

		if (!($args =~ /nosuid/)) {
			if (!(grep(/$mpoint/,@acceptable))) { 
				&needsuid($source);
			}
		}

		if (!($args =~ /nodev/)) {
			if (!(grep(/$mpoint/,@acceptable))) {
				&needdev($source);
			}
		}
	}
} else {
	&report("\nERROR:  Cannot open $fstab\n");
	&error;
	exit;
}

if (! $mpoint) {
	&report("WARNING: /tmp was not found in the fstab.  This means that\n",
	"\t/tmp is probably part of /usr.  If this is the case, \n",
	"\tthere is no way to mount it nosuid and nodev.  This \n",
	"\tleaves the machine open to attempts to gain suid shells.\n");
	$warn = 1;
}

if ($fail) {
	&failed;
} elsif ($warn) {
	&warn;
} else {
	&passed;
}

exit 0;

#############################################################################
#
# ERROR/WARNING/INFO Messages
#

sub needsuid {
	$source = shift(@_);

	&report("WARNING: $mpoint ($source) is not mounted nosuid.\n",
		"\tIf it is not necessary for the filesystem to be suid,\n",
		"\tplease add a nosuid option.\n");
	$warn = 1;
}

sub needdev {
	$source = shift(@_);

	&report("WARNING: $mpoint ($source) is not mounted nodev.\n",
		"\tIf it is not necessary for the filesystem to have devices,\n",
		"\tplease add a nodev option.\n");
	$warn = 1;
}

