40f4781 Add "is pkg used" check — HardenedBSD-pkg

modified scripts/periodic/400.status-pkg

@@ -15,15 +15,20 @@ case "$weekly_status_pkg_enable" in

 	echo ''
 	echo 'Checking for out of date packages:'
 	rc=$(${pkgcmd} version -v ${pkg_version_index} |
 	    sed -n -e '/up-to-date/d' \
 	    -e 's/^\([^[:space:]]*\)[[:space:]]*[<>=!?][[:space:]]*\(.*\)$/\1 \2/p' |
 	    tee /dev/stderr |
 	    wc -l)
 	[ $rc -gt 1 ] && rc=1
 	;;
     *)
 	rc=0
 	if ${pkgcmd} -N >/dev/null 2>&1 ; then
 	    echo 'status-pkg is enabled but pkg is not used'
 	    rc=2
 	else
 		rc=$(${pkgcmd} version -v ${pkg_version_index} |
 			sed -n -e '/up-to-date/d' \
 			-e 's/^\([^[:space:]]*\)[[:space:]]*[<>=!?][[:space:]]*\(.*\)$/\1 \2/p' |
 			tee /dev/stderr |
 			wc -l)
 		[ $rc -gt 1 ] && rc=1
 		;;
 		*)
 		rc=0
 	fi
 	;;
 esac

modified scripts/periodic/410.pkg-audit

@@ -55,21 +55,27 @@ case "${daily_status_security_pkgaudit_enable:-YES}" in

 		echo
                 echo "Checking for packages with security vulnerabilities:"
 		then=`stat -f '%m' "${auditfile}" 2> /dev/null` || rc=3
 		now=`date +%s` || rc=3
 		# Add 10 minutes of padding since the check is in seconds.
 		if [ $rc -ne 0 -o \
 			$(( 86400 \* "${daily_status_security_pkgaudit_expiry:-2}" )) \
 			-le $(( ${now} - ${then} + 600 )) ]; then
 			${pkgcmd} audit -Fq || {
 			  rc=$?; [ $rc -lt 3 ] && rc=3
 			}
 		if ${pkgcmd} -N >/dev/null 2>&1 ; then
 			echo 'pkg-audit is enabled but pkg is not used'
 			rc=2
 		else
 			echo -n "Database fetched: ";
 			date -r "${then}" || rc=3
 			${pkgcmd} audit || {
 			  rc=$?; [ $rc -lt 3 ] && rc=3
 			}
 			then=`stat -f '%m' "${auditfile}" 2> /dev/null` || rc=3
 			now=`date +%s` || rc=3
 			# Add 10 minutes of padding since the check is in seconds.
 			if [ $rc -ne 0 -o \
 				$(( 86400 \* "${daily_status_security_pkgaudit_expiry:-2}" )) \
 				-le $(( ${now} - ${then} + 600 )) ]; then
 				${pkgcmd} audit -Fq || {
 				  rc=$?; [ $rc -lt 3 ] && rc=3
 				}
 			else
 				echo -n "Database fetched: ";
 				date -r "${then}" || rc=3
 				${pkgcmd} audit || {
 				  rc=$?; [ $rc -lt 3 ] && rc=3
 				}
 			fi
 		fi
 		;;
 esac

modified scripts/periodic/411.pkg-backup

@@ -21,26 +21,31 @@ case "${daily_backup_pkgng_enable:-YES}" in

 	bak_file="${bak}/pkgng.db"
 	pkgcmd=/usr/local/sbin/pkg
 	if [ ! -d "$bak" ]
 	then
 	    install -d -o root -g wheel -m 750 $bak || {
 		echo '$daily_backup_pkgng_enable is enabled but' \
 		    "$daily_backup_pkgng_dbdir doesn't exist" ;
 		exit 2 ; }
 	fi
 	echo ''
 	echo 'Backing up pkgng database:'
 	if [ -e "${bak_file}.txz" ]; then
 	    unlink "${bak_file}.txz.2"
 	    mv "${bak_file}.txz" "${bak_file}.txz.2"
 	fi
 	if ${pkgcmd} backup -d ${bak_file} 2>/dev/null; then
 	    rc=0
 	else
 	    rc=3
 	if ${pkgcmd} -N >/dev/null 2>&1 ; then
 	    echo 'pkg-backup is enabled but pkg is not used'
 	    rc=2
  	else
 		if [ ! -d "$bak" ]
 		then
 			install -d -o root -g wheel -m 750 $bak || {
 			echo '$daily_backup_pkgng_enable is enabled but' \
 				"$daily_backup_pkgng_dbdir doesn't exist" ;
 			exit 2 ; }
 		fi
 		echo ''
 		echo 'Backing up pkgng database:'
 		if [ -e "${bak_file}.txz" ]; then
 			unlink "${bak_file}.txz.2"
 			mv "${bak_file}.txz" "${bak_file}.txz.2"
 		fi
 		if ${pkgcmd} backup -d ${bak_file} 2>/dev/null; then
 			rc=0
 		else
 			rc=3
 		fi
 	fi
 esac

modified scripts/periodic/460.chkpkgsum

@@ -16,10 +16,16 @@ case "${daily_status_security_chkpkgsum_enable}" in

 	echo ''
 	echo 'Checking for packages with mismatched checksums:'
 	n=$(${pkgcmd} check -sa 2>&1 |
 	sed -e 's/ checksum mismatch for//' |
 	tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 	if ${pkgcmd} -N >/dev/null 2>&1 ; then
 	    echo 'chkpkgsum is enabled but pkg is not used'
 	    rc=2
 	else
 		n=$(${pkgcmd} check -sa 2>&1 |
 		sed -e 's/ checksum mismatch for//' |
 		tee /dev/stderr | wc -l)
 		[ $n -gt 0 ] && rc=1 || rc=0
 	fi
 	;;
     *)
 	rc=0

modified scripts/periodic/490.status-pkg-changes

@@ -14,6 +14,7 @@ case "$daily_status_pkg_changes_enable" in

 	echo ''
 	echo 'Changes in installed packages:'
 	if ${pkgcmd} -N >/dev/null 2>&1 ; then
 	    echo 'status-pkg-changes is enabled but pkg is not used'
 	    rc=2