C///

\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5�\D6?\BD�\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2� \00$\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4�\E9\F2�\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// #!/bin/bash PKG_INTEGRITY_VERSION="1.0.2" # imunify-check-pkg-integrity: verify imunify* package file integrity # via rpm -V / dpkg -V. Outputs results to stdout. # # Deployed to (both RPM and DEB, spec overrides _prefix): # /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integrity # Package: imunify-core # # This script is also sourced by imunify-force-update.sh for shared functions # (filter_verify_noise, filter_whitelisted_files, INTEGRITY_WHITELIST_FILES, etc.). # set -euo pipefail is only applied when run directly, not when sourced. DEBIAN_VERSION_FILE="${DEBIAN_VERSION_FILE:-/etc/debian_version}" # Files always reported as modified on a healthy system. # On RPM most of these are %config and already filtered by filter_verify_noise; # on Debian they are NOT marked as conffiles, so we whitelist explicitly. # Uses substring matching (grep -v -F). INTEGRITY_WHITELIST_FILES=( "imunify360.config.defaults.example" # imunify-ui-*-cpanel: triggerin runs sed to patch IMUNIFY_PACKAGE in config.js "imunify/assets/js/config.js" # imunify360-php-i360: postinst copies .ini/.so per PHP version from templates "/i360.ini" "/i360.so" # i360-php-opts: module.ini modified during config (conffile on RPM, not on DEB) "i360-php-opts/module.ini" # imunify360-ossec-server: postinst sed-patches analysisd.stats_maxdiff "internal_options.conf" # imunify360-webshield-bundle: service updates these at runtime (conffile on RPM, not on DEB) "imunify360-webshield/common-proxies.conf" "imunify360-webshield/country_ips.conf" "imunify360-webshield/whitelisted-domains.conf" # imunify360-webshield-bundle: postinst awk-merges wscheck.conf on DEB. # DEF-41475 registers it as a conffile going forward; this whitelist line # keeps hosts on older bundles quiet until the new .deb rolls out. "imunify360-webshield/wscheck.conf" ) detect_pkg_manager() { if [ -f "$DEBIAN_VERSION_FILE" ]; then echo "dpkg" elif command -v rpm >/dev/null 2>&1; then echo "rpm" else echo "unknown" fi } check_dpkg_verify_supported() { # Inspect help text instead of `dpkg -V ` exit code: the latter goes # non-zero when the probe package has any modified files, falsely marking # -V as unsupported. Pure bash to avoid SIGPIPE under set -o pipefail. local help help=$(dpkg --help 2>&1) || return 1 [[ $help == *--verify* || $help == *" -V"* ]] } # Filter rpm -V / dpkg -V output to keep only lines indicating real corruption. # # Both tools use a 9-char flag string + optional type flag + path. # rpm: SM5DLUGTP [c|d|g|l|r| ] /path dpkg: ??5?????? [c| ] /path # rpm also emits: missing /path # # Excluded: # - config files (type 'c') and ghost files (type 'g') # - .pyc files (Python bytecode cache, regenerated at import) # - metadata-only changes (no S or 5 flag - just mode/group/time drift) # Kept: # - 'missing' lines for non-pyc files # - lines with S (size, pos 1) or 5 (digest, pos 3) change filter_verify_noise() { grep -v -E '^.{9} +[cg] ' \ | grep -v '\.pyc$' \ | grep -E '^(S|..5|[?][?]5|missing)' \ || true } filter_whitelisted_files() { local input input=$(cat) if [[ ${#INTEGRITY_WHITELIST_FILES[@]} -eq 0 ]]; then echo "$input" return fi local pattern="" for entry in "${INTEGRITY_WHITELIST_FILES[@]}"; do if [[ -n "$pattern" ]]; then pattern+=$'\n' fi pattern+="$entry" done echo "$input" | grep -v -F "$pattern" || true } list_packages_rpm() { rpm -qa 'imunify*' 2>/dev/null | sort } list_packages_dpkg() { dpkg-query -W -f '${Status} ${Package}\n' 'imunify*' 2>/dev/null \ | sed -n 's/.* installed $.*$/\1/p' \ | sort } verify_package_rpm() { local pkg="$1" local raw_output="" raw_output=$(rpm -V "$pkg" 2>&1) || raw_output="${raw_output}" local filtered="" filtered=$(echo "$raw_output" | filter_verify_noise | filter_whitelisted_files) if [[ -n "$filtered" ]]; then echo "$filtered" return 1 fi return 0 } verify_package_dpkg() { local pkg="$1" local raw_output="" raw_output=$(dpkg -V "$pkg" 2>&1) || raw_output="${raw_output}" local filtered="" filtered=$(echo "$raw_output" | filter_verify_noise | filter_whitelisted_files) if [[ -n "$filtered"