#!/bin/bash
#Nifty: Run yara scan with our ruleset on dir in param 1

curl -s https://nifty.sh/lib/universal/niftylib.sh > /tmp/lib.nifty.sh
. /tmp/lib.nifty.sh
rm -f /tmp/lib.nifty.sh

# Requirements
require_root
require_64bit

OS="$(detect_os)"
case "$OS" in
  alma8|alma9|centos7) ;;
  *) err "This script does not support $OS"; exit 1 ;;
esac


SCANDIR=$1

if [ ! -d "$SCANDIR" ]; then
  echo "Scandir $SCANDIR does not exist"
  exit 1
fi

if [ ! -f "/usr/bin/yara" ]; then
  echo -n "Yara is not installed. Install now? [y/n] "
  read a
  res=`echo $a | tr '[:upper:]' '[:lower:]'`
  if [ "$res" = "y" ]; then

    if [ ! -f "/etc/yum.repos.d/epel.repo" ]; then
      echo -n "EPEL repo missing. Install now? [y/n] "
      read b
      eres=`echo $b | tr '[:upper:]' '[:lower:]'`
      if [ "$eres" = "y" ]; then
        yum install -y epel-release
      else
        echo "Okay. Exiting"
        exit 1
      fi
    fi

    yum install yara -y

  else
    echo "Okay. Exiting"
    exit 1
  fi

fi

curl -s https://mirror.dk.team.blue/internal/yara-sigs/surftown.yar > /tmp/yara_rules.yar
echo "Starting yara ... "
yara -r /tmp/yara_rules.yar $SCANDIR
rm -f /tmp/yara_rules.yar
