#!/bin/bash

NAGIOS_OK=0
NAGIOS_ERROR=2

PAKITI_RESULT="pakiti_results"

if [ -f "$PAKITI_RESULT" ]; then
    cve=$(echo $0 | sed 's/.*check_//')
    grep -q "$cve" "$PAKITI_RESULT" 2>/dev/null
    if [ $? -eq 1 ]; then
        echo "No $cve vulnerability found, skipping the mitigation check"
        exit $NAGIOS_OK
    fi
fi

# Check if kvm_amd and kvm_intel modules are blocked (mitigation for CVE-2026-53359)
if grep -q -r -E "^blacklist kvm_amd|^install kvm_amd" /etc/modprobe.d && ! lsmod | grep -q kvm_amd; then
    if grep -q -r -E "^blacklist kvm_intel|^install kvm_intel" /etc/modprobe.d && ! lsmod | grep -q kvm_intel; then
        echo "Modules kvm_amd and kvm_intel are blocked, mitigation applied"
        exit $NAGIOS_OK
    fi
fi

echo "No known mitigation of CVE-2026-53359 detected"
exit $NAGIOS_ERROR
