#! /bin/sh

set -e

# install app update on system restart (uptime lower than 5 min) and app update is downloaded in $APP_UPDATE_PATH
if [ `cut -d '.' -f1 /proc/uptime` -lt 300 -a -f "/var/opt/eset/efs/updated/app/efs.bin" ]; then
	/opt/eset/efs/lib/install_scripts/perform_app_update.sh && \
		systemctl stop efs 2>/dev/null || service efs stop 2>/dev/null
	exit
fi

KVERSION="$(uname -r)"
ARCH="$(uname -m)"
MOD_DIR="/lib/modules/$KVERSION/eset/efs"
KDIR="/lib/modules/$KVERSION/build"
MODULES="eset_rtp"
SECUREBOOT_ENABLED="$( (hexdump /sys/firmware/efi/efivars/SecureBoot-* 2>/dev/null || echo "0 0 0 0") | head -n 1 | cut -d" " -f 4)"
SYSTEMD_CAT="$(which systemd-cat 2>/dev/null || true)"

print_error() {
	errorstr="ESET Server Security Error: $1"

	if [ -n "$SYSTEMD_CAT" ]; then
		echo -n "$errorstr" | $SYSTEMD_CAT -t "efs" -p err
	else
		echo "$errorstr" 1>&2
	fi
}

print_secure_boot_alert() {
	print_error "Secure Boot requires signed kernel modules. Please run \"/opt/eset/efs/lib/install_scripts/sign_modules.sh\" to sign our modules."
}

n_found=0
for m in $MODULES; do
	m_path="$(modinfo -n "$m" 2>/dev/null || true)"
	if [ -n "$m_path" ]; then
		m_dir="$(dirname "$m_path")"
		if [ "$m_dir" != "$MOD_DIR" ]; then
			print_error "found another installation of $m module, exiting"
			exit
		fi

		# detect if module is really present
		if [ -f "$m_path" ]; then
			if [ "$SECUREBOOT_ENABLED" -eq "0001" ] && ! grep -q "~Module signature appended~" "$m_path" 2>/dev/null; then
				# found module is not signed
				print_secure_boot_alert
			fi
			n_found=$((n_found + 1))
		fi
	fi
done

if [ $n_found -eq "$(echo "$MODULES" | wc -w)" ]; then
	exit
fi

if [ ! -d "$MOD_DIR" ]; then
	mkdir -p "$MOD_DIR" || { print_error "cannot create modules directory: $MOD_DIR"; exit 1; }
fi

if [ ! -d "$KDIR" ]; then
	if [ -d "/usr/src/kernels/$KVERSION" ]; then
		KDIR="/usr/src/kernels/$KVERSION"
	elif [ -d "/usr/src/linux-obj/$ARCH/default" ]; then
		KDIR="/usr/src/linux-obj/$ARCH/default"
	elif [ -d "/usr/src/linux-$KVERSION-obj/$ARCH/default" ]; then
		KDIR="/usr/src/linux-$KVERSION-obj/$ARCH/default"
	elif [ -d "/lib/modules/$KVERSION/build" ]; then
		KDIR="/lib/modules/$KVERSION/build"
	else
		print_error "cannot find kernel sources directory for kernel version $KVERSION"
		print_error "please check if kernel-devel (or linux-headers) package version matches the current kernel version"
		exit
	fi
fi

( \
	# make -B does not work on Red Hat 6, so we need call "make clean" explicitly to remove old modules build (in the case of upgrade)
	cd "/var/opt/eset/efs/eventd" && \
	make clean >/dev/null && \
	KDIR="$KDIR" make modules >/dev/null && \
	for m in $MODULES; do
		cp $m/${m}.ko "$MOD_DIR"
		if [ "$SECUREBOOT_ENABLED" -eq "0001" ]; then
			print_secure_boot_alert
		fi
	done &&
	depmod \
) || print_error 'Error compiling on-access kernel modules'

( \
	cd "/var/opt/eset/efs/ewap" && \
	make clean >/dev/null && \
	KDIR="$KDIR" make modules >/dev/null && \
	cp eset_wap/eset_wap.ko "$MOD_DIR" && \
	depmod \
) || print_error 'Error compiling web-access kernel modules'

exit