#!/bin/bash
#
# mdatp     Startup script for the wdavdaemon
#
# chkconfig: 35 60 20
# description: MDATP is a complete endpoint security solution by Microsoft.
# processname: wdavdaemon
#
### BEGIN INIT INFO
# Provides: wdavdaemon
# Required-Start: $network $local_fs
# Required-Stop: $network $local_fs
# Default-Stop: 0 1 2 6
# Default-Start: 3 5
# Short-Description: Starts daemon of Microsoft Defender Advanced Threat Protection for Endpoints
# Description:  MDATP is a complete endpoint security solution.
#               It delivers preventative protection, post-breach
#               detection, automated investigation, and response.
### END INIT INFO

# Source function library.
# shellcheck source=/dev/null
. /etc/rc.d/init.d/functions

SERVICENAME="wdavdaemon"
INITNAME="mdatp"
WORKING_DIRECTORY="/opt/microsoft/mdatp/sbin"
MDATP_LIBS_DIR="/opt/microsoft/mdatp/lib"
DAEMON="$WORKING_DIRECTORY/$SERVICENAME"
LOCK="/var/lock/subsys/$INITNAME"
PIDFILE="/var/run/$INITNAME.pid"

KERNEL_VERSION=$(uname -r)
TALPA_DIR="/lib/modules/$KERNEL_VERSION/talpa"
TALPA_MODULES=(talpa_syscallhook talpa_syscallhookprobe talpa_syscall talpa_vcdevice talpa_vfshook talpa_pedconnector talpa_pedevice talpa_core talpa_linux)

RETVAL=0

check() {
    # Check that we're a privileged user
    [ "$(id -u)" = 0 ] || exit 4

    # Check if the daemon is executable
    test -x "$DAEMON" || chmod +x "$DAEMON"
}

checkpid() {
    pidofproc -p $PIDFILE $SERVICENAME
    RETVAL=$?
    ## $RETVAL=0 indicates that the daemon is already running.
    return $RETVAL
}

start() {
    # Sanity check for root user
    check

    # Only one instance of daemon should be running at any give time
    checkpid
    CHECKPID_SUCCESS=$?

    # Check if it is already running. If not, then start the daemon
    if [ -f "$LOCK" ] || [ $CHECKPID_SUCCESS -eq 0 ]; then
        echo "Process is already running or did not stop gracefully earlier. Run \"service $INITNAME restart\" to restart the daemon."
        RETVAL=2
    else
        MODULE_DIR="/opt/microsoft/mdatp/talpa/rhel6.10/$KERNEL_VERSION"
        if [ -d "$MODULE_DIR" ]; then
            mkdir -p "$TALPA_DIR"

            echo -n "Loading talpa: "
            for module in "${TALPA_MODULES[@]}"
            do
                ln -sf "$MODULE_DIR/${module}.ko" "$TALPA_DIR/${module}.ko"
            done

            depmod -a
            for module in "${TALPA_MODULES[@]}"
            do
                echo "Loading $module:"
                logger MDATP: Loading TALPA "$module"
                
                modprobe "$module"
                RETVAL=$?
                if [ $RETVAL -eq 0 ]; then
                    success
                else
                    failure
                    logger MDATP: Failed to load "$module"
                    return $RETVAL
                fi
                echo;
            done
            
            # Enable filesystem even reception
            echo "enable" > /proc/sys/talpa/interceptors/VFSHookInterceptor/status
        else
            logger MDATP: No TALPA modules build For "$KERNEL_VERSION"
        fi

        export LD_LIBRARY_PATH="$MDATP_LIBS_DIR"

        echo -n $"Starting daemon: "
        logger MDATP: Starting $DAEMON

        cd "$WORKING_DIRECTORY" || exit 3
        daemon --pidfile="$PIDFILE" "$DAEMON"
        RETVAL=$?

        [ $RETVAL -eq 0 ] && touch $LOCK
        echo

        ##Creating pidfile
        pidof $DAEMON > $PIDFILE
    fi

    return $RETVAL
}

stop() {
    # Sanity check for root user
    check

    echo -n $"Stopping daemon: "
    logger MDATP: Stopping "$DAEMON"

    echo "disable" > /proc/sys/talpa/interceptors/VFSHookInterceptor/status

    killproc "$DAEMON" 2>/dev/null
    RETVAL=$?

    [ $RETVAL -eq 0 ] || killall "$DAEMON" 2>/dev/null
    rm -f "$LOCK" "$PIDFILE"

    for module in "${TALPA_MODULES[@]}"
    do
        modprobe -r "$module" 2>/dev/null
    done

    rm -rf "$TALPA_DIR"

    return $RETVAL
}

restart() {
    stop
    start
}

reload() {
    restart
}

case "$1" in
start)
    start
    ;;
stop)
    stop
    ;;
reload)
    reload
    ;;
restart)
    restart
    ;;
status)
    status -p "$PIDFILE" $INITNAME
    RETVAL=$?
    ;;
*)
    echo "Usage: $0 {start|stop|status|restart|reload}"
    RETVAL=2
esac

exit $RETVAL

