#!/bin/bash

set -eu

SCRIPT_DIR=$(dirname $(realpath $0))
source ${SCRIPT_DIR}/helper

MULTIARCH="$(dpkg-architecture -qDEB_HOST_MULTIARCH)"

declare -a binaries=(
    /usr/bin/mozc_emacs_helper
    /usr/lib/${MULTIARCH}/fcitx5/fcitx5-mozc.so
    /usr/lib/${MULTIARCH}/uim/plugin/libuim-mozc.so
    /usr/lib/ibus-mozc/ibus-engine-mozc
    /usr/lib/mozc/libinit_mozc_renderer.so
    /usr/lib/mozc/librenderer_client.so
    /usr/lib/mozc/librenderer_server.so
    /usr/lib/mozc/libtable_layout.so
    /usr/lib/mozc/libwindow_util.so
    /usr/lib/mozc/mozc_server
    /usr/lib/mozc/mozc_tool
)

info "Checking whether no missing symbols"
for binary in "${binaries[@]}"; do
  if ldd -r ${binary} >/dev/null; then
      pass "No missing symbols for ${binary}"
  else
      fail "Missing symbols for ${binary}"
  fi
done

declare -a targets=(
    "Stack protected: yes"
    "Fortify Source functions: yes"
    "Read-only relocations: yes"
    "Immediate binding: yes"
)

info "Checking hardening ..."
options="--nobranchprotection --nocfprotection"
hardening-check ${options} ${binary} | tee hardening.log
for binary in "${binaries[@]}"; do
    for target in "${targets[@]}"; do
        info "Checking whether '${target}' with ${binary}"
        if grep "${target}" hardening.log >/dev/null; then
            pass "${target}: ${binary}"
        else
            fail "Missing ${target}: ${binary}"
        fi
    done
done
rm -f hardening.log
