#!/bin/bash
set -euo pipefail
shopt -s inherit_errexit

# shellcheck source=scripts/libcc
. /usr/lib/common-criteria/scripts/libcc

# The paranoid profile alone strips the setuid bit from sudo/su/pkexec.
# /etc/permissions.d/permissions-commoncriteria (installed by this package)
# overrides sudo/su specifically back to setuid, restricted to the trusted
# group - without it present, applying paranoid genuinely does remove every
# remote path to root. pkexec has no such override and stays fully stripped
# regardless - not something this package relies on.
PERMISSIONS_CC="/etc/permissions.d/permissions-commoncriteria"

check_71_config_permissions() {
	local sudo_perms
	if ! grep -q '^PERMISSION_SECURITY=.*paranoid' /etc/sysconfig/security 2>/dev/null; then
		echo "/etc/sysconfig/security PERMISSION_SECURITY is not set to paranoid"
		return 1
	fi
	sudo_perms=$(stat -c '%U:%G:%a' /usr/bin/sudo 2>/dev/null) || sudo_perms=""
	if [ "$sudo_perms" != "root:trusted:4710" ]; then
		echo "/usr/bin/sudo is '$sudo_perms', expected 'root:trusted:4710'"
		return 1
	fi
}

apply_71_config_permissions() {
	[ -f "$PERMISSIONS_CC" ] || {
		cc_echo "FAILED: $PERMISSIONS_CC missing - is this package installed correctly?"
		return 1
	}

	if check_71_config_permissions; then
		cc_echo "permissions already set to paranoid and applied"
		return 0
	fi

	sed -ie '/^PERMISSION_SECURITY=/s/\(secure\|easy\)/paranoid/' /etc/sysconfig/security
	chkstat --set --system

	check_71_config_permissions || {
		cc_echo "FAILED: permissions do not verify as paranoid after applying"
		return 1
	}
	cc_echo "permissions set to paranoid and applied"
}

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
	cc_start_logging
	trap 'cc_exit $?' ERR
	apply_71_config_permissions
	cc_exit 0
fi
