harden

#
# License
#
# GNU Affero General Public License Version 3.0, https://www.gnu.org/licenses/agpl-3.0.en.html
#


usage(){

cat <<EOF
$0 [-x] -d <dynamically linked> -f <files and dirs> -r <files to remove> -u user <files to chown to user> -c <chmod to be world writable>" 
      -x Activates debugging
      -d Files are considered dynamically linked
         All library dependencies are resolved using ldd and necessary file are included
      -f Files and directories to include. Don't forget the license files
      -r Files to be removed before copying, especially log files
      -u User:Group files should be chowned to, access right will be set to rw for the user
      -c chmod go+rw to all the files in this section

      The container needs a usable version of sh, ldd, sed, rm and uniq
      
      License is GNU Affero General Public License Version 3.0, https://www.gnu.org/licenses/agpl-3.0.en.html
EOF

}

create_dir(){
  HARDEN=/tmp/harden
  mkdir -p $HARDEN

  for i in $*
  do
    DIR=$HARDEN/$(dirname $i)
   
    mkdir -p "$DIR"
    [ -d $HARDEN/"$i" ] || cp -a "$i" $HARDEN/$i 
    
 done
}

next_section(){
  [ $# -gt 0 ] && [ `echo $1 | head -c 1` != '-' ] && return 0
  return 1
}

ldd_filter(){
  sed 's+\t*++' |\
  sed 's+.*=>\ ++' |\
  sed 's+\ .*$++'
}

link_filter(){
  for f in $(find "$1")
  do
    echo $f
    if [ -L $f ] 
      then
        LINK=$(readlink $f) 
        if [ `echo $LINK | head -c 1` = '/' ]
        then
          echo $LINK
        else
          echo $(dirname $f)/$(readlink $f)
        fi
     fi
   done
}


extract(){

  while [ $# -ne 0 ]
  do	  
    case $1 in
    -x) # enable debugging

      set -x 
      shift
      ;;

    -d)     # dynamically linked executables
    
      shift
      while next_section $*
      do
        for f in $(ldd "$1" | ldd_filter) $1
        do
          link_filter $f
        done
        shift
      done
      ;;

    -f) # files and links
    
      shift
      while next_section $*
      do
        link_filter $1
        shift
      done
      ;;

    -r) # files to remove
      shift
      while next_section $*
      do
        rm $1
        shift
      done
      ;;

    -u)  # change owner and grant access    
      shift
      OWNER=$1
      shift
      while next_section $*
      do
        chown $OWNER $1
        chmod -R +rw $1
        shift
      done
      ;;

   -c) # make world writeable
      shift
      while next_section $*
      do
        chmod -R go+rw $1
        shift
      done
      ;;

    *) # error, show usage 
    
      usage
      exit 1
      ;;
    esac
  done  | uniq | sed 's+^/++'
}


create_dir $(extract $*)