#!/bin/bash

list_bad_setuid () {
  find / -xdev -type f -perm +4000 -print 2> /dev/null \
   | fgrep -xvf /dev/fd/3 3<<EOF
#for pyhesiodfs
/usr/bin/fusermount
#for athmode
/usr/bin/schroot
#for people hacking at their grplist
/usr/bin/newgrp
#network utilities
/usr/bin/mtr
/bin/ping6
/bin/ping
EOF
}

list_bad_setgid () {
  find / -xdev -type f -perm +2000 \
    -not -group mit -not -group games -print 2> /dev/null \
   | fgrep -xvf /dev/fd/3 3<<EOF
#for attachtab
/usr/bin/quota.debathena
/bin/attach
#for...locate
/usr/bin/mlocate
EOF
}

case "$1" in
  --list|""|--clean)
    found=""
    setuid="$(list_bad_setuid)"
    setgid="$(list_bad_setgid)"
    if [ -n "$setuid" ]; then
        echo "Unexpected setuid files:"
        ls -l $setuid
        echo
        found=1
    fi
    if [ -n "$setgid" ]; then
        echo "Unexpected setgid files:"
        ls -l $setgid
        echo
        found=1
    fi
    if [ -n "$found" ]; then
        if [ "$1" = --clean ]; then
            stat -c "%U %G %a %n" $setuid $setgid | \
                while read user group mode file; do
                dpkg-statoverride --update --add \
                    "$user" "$group" "${mode:${#mode}-3}" "$file"
            done
        else
            echo "Run $0 --clean to fix these."
        fi
    fi
  ;;

  *)
    echo "Huh?  Try --list or --clean." >&2
    exit 2
  ;;
esac
