#!/usr/bin/perl
# Copyright (c) 2017 Bruker BioSpin GmbH"";

use strict;
use warnings;
use English;
use Getopt::Long;
use File::Basename;
use Pod::Usage;
use Sys::Syslog qw(:standard :macros);

my $program = basename($0);

die "Only root may run $program\n" unless $EFFECTIVE_USER_ID == 0;

my $exitCode = 0;
####
# Supported options
my $help = 0;
my $man = 0;
my $syslog = 1;
my $verbose = 0;

GetOptions(
           'help|?' => \$help,
           'man'  => \$man,
           'verbose+'  => \$verbose,
           'syslog!'  => \$syslog
          ) || pod2usage(2);
pod2usage(1) if $help;
pod2usage(-exitstatus => 0, -verbose => 2) if $man;

openlog('bruker-setup', 'nofatal,pid', 'user') if $syslog;

###
# Some info about myself
###
my $Version = "1.0";
print "$program (Version $Version)\nCopyright (c) 2017 Bruker BioSpin GmbH\n" if $verbose;

###
# default file names
###
my $mokutil     = '/usr/bin/mokutil';
my $elrepokey   = '/etc/pki/elrepo/SECURE-BOOT-KEY-elrepo.org.der';

###
# Testing file and commands
###
unless (-x $mokutil) {
    syslog(LOG_ERR, "Aborting script $program, because mokutil command is missing.") if $syslog;
    print "Aborting script $program, because mokutil command is missing.\n" if $verbose;
    closelog if $syslog;
    exit 1;
}

unless (-e $elrepokey) {
    syslog(LOG_ERR, "Aborting script $program, because elrepo key is missing.") if $syslog;
    print "Aborting script $program, because elrepo key is missing.\n" if $verbose;
    closelog if $syslog;
    exit 2;
}

# Test Secure Boot Modus
my $securebootmode = `$mokutil --sb-state`;
chomp $securebootmode;
if($securebootmode eq "SecureBoot enabled") {
  # Test if elrepo key is enrolled
  my $enrolled= `$mokutil --test-key $elrepokey`;
  chomp $enrolled;
  if($enrolled eq "/etc/pki/elrepo/SECURE-BOOT-KEY-elrepo.org.der is already enrolled") {
    syslog(LOG_INFO, "ELRepo Uefi Secure Boot Key is already enrolled! Nothing to do! Disable Service.") if $syslog;
    print "ELRepo Uefi Secure Boot Key is already enrolled! Nothing to do!\nDisable Service.\n" if $verbose;
  } else {
    syslog(LOG_WARNING, "Secure Boot Mode is active, but ELRepo Key is not enrolled! Try to enroll key!") if $syslog;
    print "Secure Boot Mode is active, but ELRepo Key is not enrolled!\nTry to enroll key!\n" if $verbose;
    $exitCode = 3;
    my $result = `$mokutil --import $elrepokey --root-pw`;
    chomp $result;
    if ($result ne "") {
        syslog(LOG_ERR, "Import of key was not successful! See message: $result") if $syslog;
        print "Import of key was not successful! See message: $result" if $verbose;
        $exitCode = 4;
    }
  }
} else {
  syslog(LOG_INFO, "Secure Boot Mode is not active! Nothing to do!") if $syslog;
  print "Secure Boot Mode is not active! Nothing to do!\n" if $verbose;
}

closelog  if $syslog;

exit $exitCode;

__END__

=head1 NAME

check-secureboot-elrepo-key - Checks if the elrepo key is imported, if the system starts with secureboot

=head1 SYNOPSIS

check-secureboot-elrepo-key [options]

Options:

     -help            brief help message
     -man             prints the manual page
     -verbose         create verbose output

=head1 OPTIONS

=over 8

=item B<-help>

    Print a brief help message and exits.

=item B<-man>

    Prints the manual page and exits.


=item B<-verbose>

    Print additional debug information

=back


=head1 DESCRIPTION

This script checks the existens of the elrepo key, if the system is started with secureboot active.
The key must be imported to allow a change in the kernel modules,
which is necessary for the import of the nvidia kernel module.

=cut