Re: [Integrit-users] Script to roll back filesystem changes as reported by integrit?

[Ed L. C. <ec...@gm...>]

On 4/22/05, Antoine <abo...@ya...> wrote:
...
> So I'm looking for a script that can parse the changes
> output by integrit and revert the affected files to
> the last known good state. Maybe someone here had to
> write such a thing in the past or can point me in the
> right direction? A quick web search didn't yield
> anything.

It does sound like something that could be=20
scripted with a little sed.  I don't usually post
untested scripts, but this is just to convey a
general approach ...

while read line; do
  uid=3D"`echo $line | sed -n '/^changed:/s/u[(]\([^:][^:]*\):/p'`"
  test "$uid" || continue
  fnam=3D"`echo $line | sed -e 's!^changed: !!' -e 's!  *.*!!'`"
  chown $uid $fnam
done

Whitespace in filenames will break the script.

--=20
  Ed L. Cashin <ec...@no...>