#!/usr/bin/perl
#
# bin/nfs-chk.saint
#
# Report file systems that are exported via portmap or that can be mounted
# by unpriviliged programs. World-mountable file systems are already taken
# care of by showmount.saint.
#
# version 1, Mon Mar 20 18:48:11 1995, last mod by wietse
#

$running_under_saint = 1;
require 'config/saint.cf';
require 'config/paths.pl';
require 'perl/misc.pl';
require 'perl/hostname.pl';
require 'perl/get_host.pl';
require 'perl/getfqdn.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";
$usage="Usage: $0 [-t timeout -u -v] target";
$opt_u = $untrusted_host;
&Getopts("t:uv") || die $usage;
$timeout = $short_timeout;

$target = $ARGV[0];
$flags = "-v" if defined($opt_v);
$timeout = $opt_t if defined($opt_t);
$untrusted_host = $opt_u;

$flags = "$flags -t $timeout" if defined($opt_t);

if ($#ARGV != 0) {
   if ($ARGV[1] !~ /FW/ && $ARGV[1] !~ /.PLUS/) {
      die $usage;
   }
}

#$service = &basename($0, ".saint");
# made service same as in showmount.saint to avoid duplicate facts, 6/00
$service="nfs";
$severity = "x";
$status = "a";
$service_output = "";

$| = 1;

open(NFS, "$NFS_CHK $flags $target |") || die "$0: cannot run nfs-chk";
while(<NFS>) {
	if (defined($opt_v)) {
	    print;
	}
	if (/exports (\S+) via portmapper/) {
		$severity= "uw";
		$trusted = "ANY\@ANY";
		$trustee = "$1\@$target";
		$service_output = "NFS export via portmapper";
		$text = "Exports $1 via portmapper";
		&saint_print();
	} elsif ($untrusted_host && /Mounted: (\S+) via mount daemon/) {
		$severity = "uw";
		$trusted = "root\@ANY";
		$trustee = "$1\@$target";
		$service_output = "unrestricted NFS export";
		$text = "Exports $1 to everyone";
		&saint_print();
	} elsif (/exports (\S+) to unprivileged/) {
		$this_host = &getfqdn(&hostname());
		$severity= "ur";
		$trusted = "ANY\@$this_host";
		$trustee = "$1\@$target";
		$service_output = "NFS export to unprivileged programs";
		$text = "Exports $1 to unprivileged programs";
		&saint_print();
	}
	# world-wide exports already taken care of in showmount.saint
}
