Need to automate the manual task using shell script

# find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null -> To list out
the full path of setuid program

After run the above command I will get the path of the program

/usr/bin/wall
/usr/bin/chfn
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/newgrp
===================
So whatever the path it's coming,


I need to add the rule "grep path /etc/audit/audit.rules"
example : path /usr/bin/newgrp

echo "-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged" >> /etc/audit/audit.rules
echo "-a always,exit -F path=/usr/bin/write -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged" >> /etc/audit/audit.rules
echo "-a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged" >> /etc/audit/audit.rules
echo "-a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=500 -F
auid!=4294967295 -k privileged" >> /etc/audit/audit.rules

Please let me know is there anyway to automate the process without adding
manually using echo.

Thanks


1 Answer
1

Try this:

find / -xdev -type f -perm -4000 -o -perm -2000 | xargs -I {XXX} printf "'-a always,exit -F path='{XXX} ' -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged'n" >>/etc/audit/audit.rules


It pipes the find command which searches for set suid stuff to xargs which puts it's stuff from stdin (the stuff from find) in the corresponding place {XXX} in the printf.

Edit: took out usr/bin/

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.