#!/bin/sh
#
# Script for adding and removing user from /etc/sudoers file used by sudo
# for bootstrapping perl soap framework 
# NOTES:
# This code assuming that user being added to sudo file has been already created

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin
export PATH

SUDOERS_PATH='/etc /usr/local/etc'
SUDOERS="sudoers"
# FIXME: XXX Add getting owner and perms from file before editing?
MKTEMP_TEMPLATE='/tmp/tmp.XXXXXX'
DEFAULT_MODE="440"
DEFAULT_OWNER="root:root"

#ALLOWED_BINS='perl '
SUDOERS_LOCK_POSTFIX=".lock"
SUDOERS_POSTFIX=' ALL=(root) NOPASSWD: ALL'

err() {
	echo "ERROR: $*" >&2
	exit 1
}

usage() {
	err  "Usage: $0 [-r|-a] username"
	exit 1
}

set_def_perms_on_file() {
	chmod ${DEFAULT_MODE} $1 || err "Can't chmod $1"

    chown ${DEFAULT_OWNER} $1 || err "Can't chown $1"
}


while getopts r:a: _option
do	case "$_option" in
	r)	username="$OPTARG"
		remove=1
	;;
	a)	username="$OPTARG"
		add=1
	;;
	[?])	err "Usage: $0 [-r|-a] username";;
	esac
done

# Sanity check for options

if [ -n "$remove" -a -n "$add" ]; then
	usage
elif [ -z "$remove" -a -z "$add" ]; then
	usage
elif [ -z "$username" ]; then
	usage
fi

# Check username for UNIX user name regex
if ! echo $username | grep "^[A-Za-z][A-Za-z0-9_\.\-]*\$*$" >/dev/null 2>&1; then
	err "Supplied username ($username) doesn't match regex"
fi

# Constructing sudoers line
#
#for _bin in ${ALLOWED_BINS}; do
#
#	_bin_path=`which $_bin`
#
#	if [ "$?" -ne 0 ]; then
#		err "Can't find $_bin executable in $PATH"
#	fi
#
#	SUDOERS_POSTFIX="${SUDOERS_POSTFIX} ${_bin_path},"
#done

# Adding this script (with full path) to allow user delete himself from sudoers
#home=`grep "^$username:" /etc/passwd | awk -F ':' '{print $6}'`
#
#if [ $? -ne 0 ]; then
#	err "Can't get home directory of user $username"
#fi
#
# Detecting our name
#pwd=`pwd`
#
#basename=`basename $0`
#
#basename=`echo ${basename} | sed -e 's/ .*//'`
#
#sudoers_entry="${SUDOERS_POSTFIX} ${home}/${basename}"
#
#sudoers_entry="$username ${sudoers_entry}"

sudoers_entry="$username ${SUDOERS_POSTFIX}"


# Searching sudoers file
for _dir in ${SUDOERS_PATH}; do
	if [ -f "$_dir/$SUDOERS" ]; then
		found_sudoers="$_dir/$SUDOERS"
		break
	fi
done

if [ -z "$found_sudoers" ]; then
	err "Can't find sudoers file"
# Checking if visudo doesn't support 'q' and 'c' flags
elif visudo -qc 2>&1 | grep 'usage' >/dev/null 2>&1; then
	break
elif ! visudo -qc > /dev/null 2>&1; then
	err "$found_sudoers has invalid syntax"
fi

# Sudoers lock file for simu access
sudoers_lock="${found_sudoers}${SUDOERS_LOCK_POSTFIX}"

# Escape '*' in sudoers line
_grep_sudoers_entry=`echo "${sudoers_entry}" | sed 's/\*/\\\*/g'`

while [ -f ${sudoers_lock} ]; do
	sleep 1
done   

trap "rm -f ${sudoers_lock}; exit $?" INT TERM EXIT

touch ${sudoers_lock} || err "Can't create lock file: ${sudoers_lock}"

DEFAULTS_OPTION="Defaults"

REQUIRE_TTY_OPTION="requiretty"

_default_tty_entry="${DEFAULTS_OPTION}   ${REQUIRE_TTY_OPTION}"
_veeam_tty_entry="#${_default_tty_entry} #Veeam Commented"

# Commenting if exists
if grep "^${DEFAULTS_OPTION}" ${found_sudoers} | grep "${REQUIRE_TTY_OPTION}$" >/dev/null 2>&1; then
	_tempfile=`mktemp -q  ${MKTEMP_TEMPLATE}` || \
    err "Can't create temporary file for disabling requretty option"

	sed -e "s/${DEFAULTS_OPTION}[ ]*${REQUIRE_TTY_OPTION}/${_veeam_tty_entry}/g" ${found_sudoers} > ${_tempfile} || \
	err "Can't write substituted sudoers to $_tempfile"
	
	mv $_tempfile $found_sudoers || err "Can't move $_tempfile to $found_sudoers"
	set_def_perms_on_file $found_sudoers
fi  
#Defaults    requiretty

if grep "$_grep_sudoers_entry" $found_sudoers >/dev/null 2>&1; then
	if [ -n "$remove"  ]; then 

		# Uncommenting if commented by us
		if grep "^${_veeam_tty_entry}" ${found_sudoers} >/dev/null 2>&1; then
			_tempfile=`mktemp -q  ${MKTEMP_TEMPLATE}` || \
			err "Can't create temporary file for disabling requretty option"

			sed -e "s/${_veeam_tty_entry}/${_default_tty_entry}/g" ${found_sudoers} > ${_tempfile} || \
			err "Can't write substituted sudoers to $_tempfile"

			mv $_tempfile $found_sudoers || err "Can't move $_tempfile to $found_sudoers"
			set_def_perms_on_file $found_sudoers
		fi

		_tempfile=`mktemp -q  ${MKTEMP_TEMPLATE}` || \
		 err "Can't create temporary file" 

		grep -v "$_grep_sudoers_entry" $found_sudoers > $_tempfile || \
		err "Can't write to $_tempfile"

		mv $_tempfile $found_sudoers || err "Can't move $_tempfile to $found_sudoers"
		set_def_perms_on_file $found_sudoers
	fi
else
	if [ -n "$add" ]; then
		# Commenting if exists
        if grep "^${DEFAULTS_OPTION}" ${found_sudoers} | grep "${REQUIRE_TTY_OPTION}" >/dev/null 2>&1; then
            _tempfile=`mktemp -q  ${MKTEMP_TEMPLATE}` || \
            err "Can't create temporary file for disabling requretty option"

            sed -e "s/${DEFAULTS_OPTION}[ ]*${REQUIRE_TTY_OPTION}/${_veeam_tty_entry}/g" ${found_sudoers} > ${_tempfile} || \
            err "Can't write substituted sudoers to $_tempfile"

            mv $_tempfile $found_sudoers || err "Can't move $_tempfile to $found_sudoers"
            set_def_perms_on_file $found_sudoers
        fi

		echo "${sudoers_entry}" >> $found_sudoers || err "Can't add entry to $found_sudoers"
	fi
fi 

rm -f ${sudoers_lock} || err "Can't remove lock file: ${sudoers_lock}"
trap - INT TERM EXIT

# Checking if visudo doesn't support 'q' and 'c' flags
if visudo -qc 2>&1 | grep 'usage' >/dev/null 2>&1 ; then
	break	
elif ! visudo -qc > /dev/null 2>&1; then
	err "Syntax of $found_sudoers is wrong"
fi
