-2
a=$(df -h | grep ^/dev | awk '{print $6}')

for i in $(find $a -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>='"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' -F auid!=4294967295 -k privileged" }' | grep -o privileged | uniq | wc -l ); do
   if [ "$i" != '1' ]; then
      echo "{\"privilegecmd_4111_audit\":\"FAILED\"}"
   else
      echo "{\"privilegecmd_4111_audit\":\"PASSED\"}"
   fi
done

for my input a is / and /boot, here what my doubt, in my /boot partition, i removed privileged after I run the shell script it get passed, I need every partition will be privileged means it should passed otherwise if any of the file is not in privileged, it should be in failed condition.

Anyone help to solve this.

Bruni
  • 10,542
lee
  • 1
  • The answer to your question: make the user privileged. See for instance https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands – Rinzwind Sep 23 '21 at 09:34

1 Answers1

0

A suggestion on how to design your loop instead.

#!/bin/bash

while read -r; do
   (($REPLY > 0)) 

   && echo "condition passed" 

   || echo "condition failed"
done < <( 

   find . -mindepth 1 -perm -644 -user bac0n -group bac0n -printf 1\n -o -printf 0\n 

)