-2
a=$(df -h | grep ^/dev | awk '{print $6}')

for i in $(find $a -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>='"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' -F auid!=4294967295 -k privileged" }' | grep -o privileged | uniq | wc -l ); do
   if [ "$i" != '1' ]; then
      echo "{\"privilegecmd_4111_audit\":\"FAILED\"}"
   else
      echo "{\"privilegecmd_4111_audit\":\"PASSED\"}"
   fi
done

for my input a is / and /boot, here what my doubt, in my /boot partition, i removed privileged after I run the shell script it get passed, I need every partition will be privileged means it should passed otherwise if any of the file is not in privileged, it should be in failed condition.

Anyone help to solve this.

Bruni
  • 11,099
lee
  • 1
  • 4

1 Answers1

0

A suggestion on how to design your loop instead.

#!/bin/bash

while read -r; do
   (($REPLY > 0)) 

   && echo "condition passed" 

   || echo "condition failed"
done < <( 

   find . -mindepth 1 -perm -644 -user bac0n -group bac0n -printf 1\n -o -printf 0\n 

)