Ubuntu update status script

commentary / documentation / rambling

<?php  // update history at bottom

header('Location: ./up_commentary.html');
exit(0);

new UbuntuUpdateStatus();

class UbuntuUpdateStatus { // the rest of the file is in the class

const version		    = '2017/06/08 12:54am EDT';
const plus		    = -300;

const HTgetKey		    = 'key'; // such as http://example.com/?key=example
const initHTgetSecret	    = 'example';

const bin		    = '/usr/local/bin/ubu_get_up';
const sessStorage	    = 'ubups.txt';
const binSecretStorage	    = 'binsecstore.txt';

const scriptUser	    = 'www-data';

const cookieLife	    = 32000000; // set cookie life to a little over a year, in seconds

const Cfile = 'updates.c';

function setInitTimeLimit() {
    
    $ts  = strtotime(self::version) + self::plus;
    $str = date('Y-m-d g:ia T', $ts);
    $this->initNewSessionsBefore = $str;
}

function __construct() {
    self::setInitTimeLimit();
    self::setStorage();
   
    $sessr = self::getSessions();

    if (php_sapi_name() === 'cli') {
	self::compile();
    	self::refreshSessionFile($sessr['sesso'], true);
    }
    
    if  (php_sapi_name() === 'cli') {
	echo('OK - install' . "\n");
	exit(0);
    }
    
    $first = self::validOrDie($sessr);
    self::doScriptAndOutput($first);
}

private function setStorage() {
    
    if (getenv('KWYNN_201704_LOCAL') === 'Kwynn_rcvd_2014') $base = '/tmp/ubuwsess/';
    if (getenv('KWYNN_ID_201701'   ) === 'aws-nano-1'	  ) $base = '/home/' . get_current_user() . '/sess/';

    if (!isset($base)) die('no - 301');
    
    $this->storagePath = $base . self::sessStorage;
    
    if (php_sapi_name() === 'cli' && file_exists($this->storagePath)) unlink($this->storagePath) || die('cannot delete storage');
    
    $this->basePath = $base;
    $this->binSecretPath = $base . self::binSecretStorage;
    
    if (php_sapi_name() === 'cli') self::createStorage();
}

private function createStorage() {
    $dir = dirname($this->storagePath);
    if (!file_exists($dir)) self::exec(0, 0, 'mkdir ' . $dir );
    self::exec(0, 0, 'chmod 770 ' . $dir);
    self::exec(0, 0, 'chown ' . get_current_user() . ':' . self::scriptUser . ' ' . $dir);
    self::exec(0, 0, "touch " . $this->storagePath);
    self::exec(0, 0, "touch " . $this->binSecretPath);
    self::exec(0, 0, 'chown ' . get_current_user() . ':' . self::scriptUser . ' ' . $dir);
    self::exec(0, 0, 'chown ' . get_current_user() . ':' . self::scriptUser . ' ' . $this->storagePath);    
    self::exec(0, 0, 'chown ' . get_current_user() . ':' . self::scriptUser . ' ' . $this->binSecretPath);  
    self::exec(0, 0, 'chmod 660 ' . $this->storagePath);
    self::exec(0, 0, 'chmod 640 ' . $this->binSecretPath);
    
    if (!isset($this->binSecret)) {
	self::genBinSecret();
	file_put_contents($this->binSecretPath, $this->binSecret . "\n") || die('cannot write bin secret');
    }
}

private function exec($subc, $ctest = false, $whole = '') {
    $outa = array();
    $cmd = "sudo $subc " . self::bin . ' ' . ($ctest ? $this->binSecret : '');
    if ($whole) $cmd = $whole;
    $cmd .= ' 2>&1';
    $out = exec($cmd, $outa, $ret);
    $outs = implode("\n", $outa) . "\n";
    if (($outa && !$ctest) || $ret !== 0) { echo("command $cmd failed\n"); echo $outs; exit(1);   }
    if ($ctest === '+') self::getValidCOutputOrDie($outs);
    if ($ctest === '-') self::passTestOrDie($outs);
}

private function passTestOrDie($text) {
    if (trim($text) === 'sudo: unable to execute ' . self::bin . ': Permission denied') return;
    die('no - 7');
}


private function getValidCOutputOrDie($cout) {
    preg_match('/(\d+) packages can be updated\.\s*(\d+) updates are security updates\./', $cout, $matches);
    if (!isset($matches[2])) die('no - 6');
    $reto = new stdClass();
    $reto->security = $matches[2] > 0;
    $reto->std	    = $matches[1] > 0;
    
    if (strpos($cout, '*** System restart required ***') !== false) $reto->reboot = true;
    else $reto->reboot = false;
    
    return $reto;
}

private function putSecretInC() {
    
    $tempx  = tempnam($this->basePath, 'temp_');
    if (!$tempx) die('cannot create temp file');
    $tempc = $tempx . '.c';
    rename($tempx, $tempc) || die('cannot rename temp file');
    $this->Ctp = $tempc;
     
    $corig = file_get_contents(self::Cfile);
    if (!$corig) die('cannot read C file');
    
    self::popValidBinSecretOrDie();
    
    if (strpos($corig, $this->binSecret) !== false) return;
    
    $new  = str_replace('KWYNN_CHANGE_ME', $this->binSecret, $corig, $count);
    if ($count !== 1) die('cannot find secret in C file');
    file_put_contents($this->Ctp, $new) || die('could not write C file');
}

private function compile() {
    
    $p = self::bin;

    self::putSecretInC();
    self::exec('gcc ' . $this->Ctp . ' -o ');
    unlink($this->Ctp) || die('cannot delete temp C file');

    self::exec('chown root:' . self::scriptUser);
    self::exec('chmod 710');
    self::exec('chmod ug+s');
    self::exec('-u ' . self::scriptUser, '+');
    self::exec('-u man  '   , '-');

}

private function validHTkeyOrDie($sessr) {
    if (!isset($_REQUEST[self::HTgetKey])) die('no - 201');
    if (time() < strtotime($sessr->newSessionsBefore) && $_REQUEST[self::HTgetKey] === $sessr->newHTgetSecret) return;
    die('no - 204');
}

private function validOrDie($sessr) {
    
    $sd = false;
    if (	!$sessr['valid'] 
	    &&	time() < strtotime($sessr['sesso']->newSessionsBefore)
	) 
    {
	self::validHTKeyOrDie($sessr['sesso']);
	$sd = self::putNewSession($sessr['sesso']);
    } else if (!$sessr['valid']) die('no - 4');
    
    return $sd;
}

private function getJSON() {
    $con = file_get_contents($this->storagePath);
    $con = str_replace("\n", '', $con);
    return $con;
}

private function genBinSecret() {
    $secret = bin2hex(openssl_random_pseudo_bytes(16, $strong));
    if ($strong !== true) die('random not crypto strong');
    $this->binSecret = $secret;

}

private function getSessions() {

    $validUser = false;

    $sessj = file_exists($this->storagePath) ? self::getJSON() : false; // json version
    $sesso = json_decode($sessj); // session object
    
    if (!isset($sesso->sessions)) {
	$sesso = new stdClass();
	$sesso->sessions = array();
	self::refreshSessionFile($sesso);
    }
    else {
	session_set_cookie_params(self::cookieLife);
	session_start();
	foreach($sesso->sessions as $item) 
	    if ($item->sid === session_id()) { $validUser = true; break; }
    }

    
    return array('sesso' => $sesso, 'valid' => $validUser);
}

private function putNewSession($sesso) {

    if (!session_id()) session_start();

    $i = count($sesso->sessions);	   
    $sesso->sessions[$i]['ip'   ] = $_SERVER['REMOTE_ADDR'];
    $sesso->sessions[$i]['date' ] = date('Y-m-d H:i:s');
    $sesso->sessions[$i]['agent'] = $_SERVER['HTTP_USER_AGENT'];
    $sesso->sessions[$i]['sid'  ] = session_id();
    $sesso->sessions[$i]['seq'  ] = $i;

    self::refreshSessionFile($sesso);
        
    return $sesso->sessions[$i];
}

private function refreshSessionFile($sesso, $delete = false) {
    if (!isset($sesso->newSessionsBefore) || $delete) $sesso->newSessionsBefore = $this->initNewSessionsBefore;
    if (!isset($sesso->initHTgetSecret)   || $delete) $sesso->newHTgetSecret    = self::initHTgetSecret;
    
    self::putSession3(json_encode($sesso));   
}

private function putSession3($json) {
    $json  = str_replace('{', "\n{", $json);
    $json  = str_replace(',', ",\n", $json);
    $json  = str_replace('[', "\n[\n", $json);
    $json  = str_replace('],',"\n\n],\n", $json);
    $json .= "\n";
    $json = ltrim($json);

    $res = file_put_contents($this->storagePath, $json) || die('cannot write session file');
}

private function firstOutput($sd) {
    if (!$sd) return;
    // echo("\n" . $sd['ip'] . "\n" . $sd['date'] . "\n" . $sd['agent'] . "\n");
    echo("\n$sd[seq]") . ' - new session sequence';
}

private function popValidBinSecretOrDie() {
    
    if (!isset($this->binSecret)) {
	file_exists($this->binSecretPath) || die('cannot find secret file');
	$secret = trim(file_get_contents($this->binSecretPath));
    }
    else $secret = $this->binSecret;
        
    if (strlen($secret) !== 32) die('invalid bin secret');
    
    $this->binSecret = $secret;
}

private function doScriptAndOutput($first) {
    
    self::popValidBinSecretOrDie();
    $txt = shell_exec(self::bin . ' ' . $this->binSecret);
    $res = self::getValidCOutputOrDie($txt);

    header('Content-Type: text/plain');

    if (!$res->security && !$res->std && !$res->reboot) echo "N\n";
    else {
	if ($res->security) echo("Y ***\n");
	else {
	    echo ("N\n");
	    if ($res->std) echo("Y\n");
	    else	       echo("N\n");
	}
    
	if ($res->reboot) echo("Y (r) ***\n");
	else echo("N\n");
    }
    
    echo("\n" . date('g:i:s')) . "\n";
    
    self::firstOutput($first);
} // end func
} // end class

// 12:53am - newline after date
// 2017/06/08 12:41am - adding reboot to the simple "N"
// 2017/06/07 11:58pm EDT - 2nd web version; adding reboot / restart feature

json_example.txt

{"sessions":
[

{"ip":"127.0.0.1",
"date":"2017-06-05 05:03:40",
"agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,
 like Gecko) Chrome\/58.0.3029.110 Safari\/537.36",
"sid":"g78ag0ee7015afjsuosmpi9qi4",
"seq":0},

{"ip":"127.0.0.1",
"date":"2017-06-05 05:04:43",
"agent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko\/20100101 Firefox\/53.0",
"sid":"osrpk3rb26njk5ikvuj386ek90",
"seq":1}

],

"newSessionsBefore":"2017-06-05 5:15am EDT",
"newHTgetSecret":"example"}

updates.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

void main(int argc, char *argv[])
{
	char *version = "2017/06/04 1:35am EDT";
	char *secret1 = "KWYNN_CHANGE_ME";

	if (argc < 2) exit(1);

        if (strcmp((char *)argv[1], secret1) != 0) exit(2);

	char *validUser = "www-data";
	int validSize = sizeof(validUser) + 1;
	char buf[validSize];

	FILE *who = popen("whoami", "r");

	fgets(buf, validSize, who);
	pclose(who);

	if (strcmp(buf, validUser) != 0) exit(3);

	setreuid(geteuid(), getuid());
	system("/etc/update-motd.d/90-updates-available");
        system("/etc/update-motd.d/98-reboot-required");   // Kwynn 2017/06/07 11:39pm EDT
	printf("\n%s - C version\n", version);
}

updates.sh

# I retired this script between 6/2 and 6/4, but this was my 
# original build / test script that was merged into the 
# PHP file

SECRET=kdkdwe
MYSP="/tmp/web_getupstat"

gcc updates.c -o         $MYSP
sudo chown root:www-data $MYSP
sudo chmod 710  	 $MYSP
sudo chmod ug+s 	 $MYSP
ls -l			 $MYSP
sudo -u www-data	 $MYSP $SECRET
sudo -u pulse   	 $MYSP $SECRET

Script History

June 6 5:25am - creating show.php
June 1 5:07am - working towards posting a non-executing / example copy to the web (update.php)
May 18, 2017 4:02am EDT - first noted (date-commented) draft of update.php

Contents:

updates.php

json_example.txt

updates.c

updates.sh

Script History