Monitor integrità directory

#!/usr/bin/env bash
#
# filewatch.sh
# controllo integrità filesystem - Lomazzi Federico 2/7/2025
#
# uso:
#   ./filewatch.sh init /etc
#       crea la baseline iniziale
#
#   ./filewatch.sh check /etc
#       confronta lo stato attuale con la baseline
#
#   ./filewatch.sh update /etc
#       aggiorna la baseline allo stato attuale
#
# la baseline viene salvata in /var/tmp/filewatch
# usare preferibilmente come root per poter leggere tutti i file

set -u

MODE="${1:-}"
TARGET="${2:-}"

STATE_DIR="/var/tmp/filewatch"

if [ -z "$MODE" ] || [ -z "$TARGET" ]; then
    echo "uso: $0 {init|check|update} /directory"
    exit 1
fi

if [ ! -d "$TARGET" ]; then
    echo "errore: directory inesistente: $TARGET"
    exit 1
fi

TARGET="$(cd "$TARGET" 2>/dev/null && pwd -P)" || exit 1

mkdir -p "$STATE_DIR" || exit 1

ID="$(printf '%s' "$TARGET" | sha256sum | awk '{print $1}')"

BASELINE="$STATE_DIR/$ID.baseline"
CURRENT="$STATE_DIR/$ID.current"

generate_state()
{
    local OUT="$1"

    : > "$OUT"

    # il sort rende il confronto indipendente dall'ordine restituito da find
    find "$TARGET" -xdev -type f -print0 2>/dev/null |
    while IFS= read -r -d '' FILE; do

        HASH="$(sha256sum "$FILE" 2>/dev/null | awk '{print $1}')"

        [ -z "$HASH" ] && HASH="UNREADABLE"

        printf '%s|%s\n' "$HASH" "$FILE"

    done | sort -t'|' -k2 > "$OUT"
}

case "$MODE" in

    init)

        if [ -f "$BASELINE" ]; then
            echo "baseline già presente per: $TARGET"
            echo "usa '$0 update \"$TARGET\"' per sostituirla"
            exit 1
        fi

        echo "creazione baseline: $TARGET"

        generate_state "$BASELINE"

        COUNT="$(wc -l < "$BASELINE")"

        echo "baseline creata"
        echo "file registrati: $COUNT"
        echo "database: $BASELINE"
        ;;

    update)

        echo "aggiornamento baseline: $TARGET"

        generate_state "$CURRENT"

        mv "$CURRENT" "$BASELINE" || exit 1

        COUNT="$(wc -l < "$BASELINE")"

        echo "baseline aggiornata"
        echo "file registrati: $COUNT"
        ;;

    check)

        if [ ! -f "$BASELINE" ]; then
            echo "nessuna baseline presente per: $TARGET"
            echo "eseguire prima: $0 init \"$TARGET\""
            exit 1
        fi

        echo "controllo: $TARGET"

        generate_state "$CURRENT"

        declare -A OLD_HASH
        declare -A NEW_HASH

        while IFS='|' read -r HASH FILE; do
            OLD_HASH["$FILE"]="$HASH"
        done < "$BASELINE"

        while IFS='|' read -r HASH FILE; do
            NEW_HASH["$FILE"]="$HASH"
        done < "$CURRENT"

        CREATED=0
        DELETED=0
        MODIFIED=0

        echo

        for FILE in "${!NEW_HASH[@]}"; do

            if [ -z "${OLD_HASH[$FILE]+x}" ]; then

                echo "[NEW]      $FILE"
                CREATED=$((CREATED + 1))

            elif [ "${OLD_HASH[$FILE]}" != "${NEW_HASH[$FILE]}" ]; then

                echo "[MODIFIED] $FILE"
                MODIFIED=$((MODIFIED + 1))

            fi

        done

        for FILE in "${!OLD_HASH[@]}"; do

            if [ -z "${NEW_HASH[$FILE]+x}" ]; then
                echo "[DELETED]  $FILE"
                DELETED=$((DELETED + 1))
            fi

        done

        rm -f "$CURRENT"

        echo
        echo "nuovi:      $CREATED"
        echo "modificati: $MODIFIED"
        echo "eliminati:  $DELETED"

        if [ "$CREATED" -eq 0 ] &&
           [ "$MODIFIED" -eq 0 ] &&
           [ "$DELETED" -eq 0 ]; then

            echo
            echo "nessuna modifica rilevata"
            exit 0
        fi

        # exit code 2 permette di usarlo facilmente anche da cron o altri script
        exit 2
        ;;

    *)

        echo "modalità non valida: $MODE"
        echo "uso: $0 {init|check|update} /directory"
        exit 1
        ;;

esac

exit 0