#!/bin/bash
# CIS Ubuntu 24.04 - 6.1.4.1 Ensure access to all logfiles has been configured.
# Adaptation simplifiee du script officiel CIS pour Ubuntu (retire les cas RHEL/SSSD/gdm
# non pertinents ici). Ne fait que RESTREINDRE les permissions, jamais les elargir.

set -u

fix_file() {
    local f="$1" perm_mask="$2" rperms="$3" auser="$4" agroup="$5"
    local mode user group
    read -r mode user group < <(stat -Lc '%#a %U %G' "$f" 2>/dev/null)
    [ -z "${mode:-}" ] && return
    if [ $(( mode & perm_mask )) -gt 0 ]; then
        chmod "$rperms" "$f"
    fi
    if [[ ! "$user" =~ ^($auser)$ ]]; then
        chown root "$f"
    fi
    if [[ ! "$group" =~ ^($agroup)$ ]]; then
        chgrp root "$f"
    fi
}

while IFS= read -r -d '' file; do
    base="$(basename "$file")"
    dir="$(dirname "$file")"
    case "$base" in
        lastlog|lastlog.*|wtmp|wtmp.*|wtmp-*|btmp|btmp.*|btmp-*)
            # group-write tolere : necessaire au bon fonctionnement de last/who/lastlog
            # (groupe utmp) — plus strict casserait ces commandes, ecart assume vs le
            # check SCA generique qui ne distingue pas ces fichiers.
            fix_file "$file" 0113 "ug-x,o-wx" "root" "root|utmp"
            ;;
        README)
            fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
            ;;
        *.journal|*.journal~)
            fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|systemd-journal"
            ;;
        *)
            if [[ "$dir" == *"/apt" ]]; then
                fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
            else
                fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root|syslog" "root|adm"
            fi
            ;;
    esac
done < <(find -L /var/log -type f \( -perm /0137 -o ! -user root -o ! -group root \) -print0 2>/dev/null)

echo "OK"