#!/bin/bash

NAGIOS_OK=0
NAGIOS_WARNING=1
NAGIOS_ERROR=2
NAGIOS_UNKNOWN=3

PAKITI_RESULT="pakiti_results"

if [ -f "$PAKITI_RESULT" ]; then
    cve=$(echo $0 | sed 's/.*check_//')
    grep -q "$cve" "$PAKITI_RESULT" 2>/dev/null
    if [ $? -eq 1 ]; then
        echo "No $cve vulnerability found, skipping the mitigation check"
        exit $NAGIOS_OK
    fi
fi

pkexec=$(which pkexec)

if [ -z "$pkexec" ]; then
    echo "pkexec not found in PATH, probably not installed"
    exit $NAGIOS_OK
fi

if [ ! -x "$pkexec" ]; then
    echo "pkexec not executable"
    exit $NAGIOS_OK
fi

bit=$(stat -L -c "%A" "$pkexec" | cut -c4)
if [ "$bit" != "s" ]; then
    echo "pkexec doesn't have the suid bit set"
    exit $NAGIOS_OK
fi

echo "No mitigation found for CVE-2021-4034, pkexec seems vulnerable"
exit $NAGIOS_ERROR
