#!/bin/sh
set -eu
if [ "$#" -ne 1 ]; then
printf '%s\n' "usage: audit-static-base.sh ROOTFS" >&2
exit 2
fi
rootfs=$1
failed=0
count=0
while IFS= read -r executable; do
description=$(file "$executable")
case "$description" in
*ELF*)
count=$((count + 1))
if objdump -p "$executable" |
grep -Eq '^[[:space:]]*(INTERP|NEEDED)[[:space:]]'; then
printf '%s\n' "dynamic base executable: $executable" >&2
failed=1
fi
;;
esac
done <<EOF
$(find "$rootfs" -type f -perm -0100 -print | LC_ALL=C sort)
EOF
if [ "$count" -eq 0 ]; then
printf '%s\n' "no ELF executables found under $rootfs" >&2
exit 1
fi
if [ "$failed" -ne 0 ]; then
exit 1
fi
printf '%s\n' "static ELF audit passed: $count executables"