jcoffey-dev
96774aba35
log_inspect.sh discarded grep's stderr and ignored its exit status, so an unprivileged search over root-owned logs was indistinguishable from a search that genuinely found nothing. grep's three outcomes now mean three different things: matched, matched nothing, or could not read everything -- the last of which says so and exits non-zero. Confirmed grep returns 2 rather than 1 in that case, which is why the naive "status -eq 1" check would never have fired. service_manager.sh validates the action before dispatch and requires root for the five that change system state, leaving status and list open to anyone. $action is quoted at both call sites. rsync_magic.sh had --inplace on unconditionally. It writes straight into destination files instead of to a temporary and renaming, so an interrupted run leaves them partially overwritten -- the opposite of what a backup tool should guarantee. Now opt-in, with a warning when used. Its log lives under /var/log and every line pipes through tee, so under pipefail an unprivileged run died on the first line with a bare permission error; it now falls back to stdout rather than failing the sync over its own logging. --delete also confirms before running, since reversing the two arguments erases the backup. disk_cleanup.sh moves from `set -o pipefail` to full strict mode, with the two pipelines that legitimately return non-zero handled at their call sites rather than by leaving the script lax. Its "largest files" walk also gained -xdev, which it was missing while security_audit.sh next door already had it -- without it the walk descends /proc, /sys and every network mount. All fifteen scripts now run under set -euo pipefail.
74 lines
2.6 KiB
Bash
74 lines
2.6 KiB
Bash
#!/bin/bash
|
|
# log_inspect.sh - Search or tail system log files
|
|
#
|
|
# Copyright (C) 2025 LINUXexpert.org
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation, version 3 of the License.
|
|
#
|
|
# This program is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
# for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along
|
|
# with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# Usage: log_inspect.sh [search <pattern> | tail <logfile>]
|
|
# Description: Searches across /var/log for a pattern, or tails a specific log file.
|
|
#
|
|
# Most of /var/log is root-only. Run this with sudo, or results will be
|
|
# quietly partial -- see the note on the search branch.
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "${1:-}" = "search" ]; then
|
|
pattern="${2:-}"
|
|
if [ -z "$pattern" ]; then
|
|
echo "Usage: $0 search <pattern>"; exit 1
|
|
fi
|
|
echo "Searching for '$pattern' in /var/log..."
|
|
# 2>/dev/null hid permission errors, so an unprivileged run looked like
|
|
# "no matches" rather than "could not read most of /var/log". Say so
|
|
# explicitly instead. grep exits 1 on no match, which is not an error.
|
|
# grep distinguishes three outcomes and they mean different things
|
|
# here: 0 matched, 1 matched nothing, 2 could not read everything. The
|
|
# original discarded stderr and ignored the status, so an unprivileged
|
|
# run over root-owned logs was indistinguishable from a clean search.
|
|
status=0
|
|
grep -R -i --color=auto -- "$pattern" /var/log 2>/dev/null || status=$?
|
|
case "$status" in
|
|
0) ;;
|
|
1) echo "No matches found." ;;
|
|
*)
|
|
echo "Search was incomplete -- some files under /var/log could not be read." >&2
|
|
[ "$EUID" -ne 0 ] && echo "Re-run with sudo for a complete search." >&2
|
|
exit "$status"
|
|
;;
|
|
esac
|
|
exit 0
|
|
elif [ "${1:-}" = "tail" ]; then
|
|
logfile="${2:-}"
|
|
if [ -z "$logfile" ]; then
|
|
echo "Usage: $0 tail <log_file_path>"; exit 1
|
|
fi
|
|
if [ ! -f "$logfile" ]; then
|
|
echo "Log file '$logfile' not found."; exit 1
|
|
fi
|
|
echo "== Last 100 lines of $logfile =="
|
|
tail -n 100 "$logfile"
|
|
exit 0
|
|
else
|
|
# Default: tail the main system log (syslog or messages)
|
|
if [ -f /var/log/syslog ]; then
|
|
echo "== Last 50 lines of /var/log/syslog =="
|
|
tail -n 50 /var/log/syslog
|
|
elif [ -f /var/log/messages ]; then
|
|
echo "== Last 50 lines of /var/log/messages =="
|
|
tail -n 50 /var/log/messages
|
|
else
|
|
echo "No syslog or messages log found."
|
|
fi
|
|
fi
|