Ensure Scheduler Pod Specification File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Fix CISKubernetes 1.1.5:
# Ensure scheduler pod specification file permissions are 644 or more restrictive.
#
# Run on: every control plane node (with root privileges)
# Safe to re-run (idempotent).

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
TARGET_MODE="644"
CHANGED=0

echo "==> Checking kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
  echo "File not found: ${SCHEDULER_MANIFEST}"
  echo "Nothing to change on this node."
  exit 0
fi

# Get current mode as a 3-digit permission string (e.g. 644, 640, 600)
CURRENT_MODE="$(stat -c '%a' "${SCHEDULER_MANIFEST}")"

echo "Current permissions: ${CURRENT_MODE}"
echo "Target permissions : ${TARGET_MODE}"

# Normalize to 3 digits for comparison
pad3() {
  local v="$1"
  printf "%03d" "${v}"
}
CMODE="$(pad3 "${CURRENT_MODE}")"
TMODE="$(pad3 "${TARGET_MODE}")"

# Helper: check if mode is "more restrictive or equal" than 644.
# Logic:
#  - owner perms: any value 0–7 are acceptable (CIS only constrains group/other)
#  - group perms must be <= 4 (no write/execute)
#  - other perms must be <= 4 (no write/execute)
is_restrictive_enough() {
  local mode="$1"
  local o="${mode:0:1}"
  local g="${mode:1:1}"
  local t="${mode:2:1}"

  # group and other must not exceed 4
  if [ "${g}" -le 4 ] && [ "${t}" -le 4 ]; then
    return 0
  fi
  return 1
}

if is_restrictive_enough "${CMODE}"; then
  echo "Permissions are already ${CURRENT_MODE}, which is 644 or more restrictive. No change needed."
else
  echo "Permissions ${CURRENT_MODE} are too permissive. Setting to ${TARGET_MODE}..."
  chmod "${TARGET_MODE}" "${SCHEDULER_MANIFEST}"
  CHANGED=1
fi

echo "==> Verifying final permissions..."
FINAL_MODE="$(stat -c '%a' "${SCHEDULER_MANIFEST}")"
echo "Final permissions: ${FINAL_MODE}"

if ! is_restrictive_enough "$(pad3 "${FINAL_MODE}")"; then
  echo "ERROR: Permissions still too permissive after chmod. Investigation required."
  exit 1
fi

if [ "${CHANGED}" -eq 1 ]; then
  echo "Permissions successfully updated to ${FINAL_MODE}."
else
  echo "No changes were necessary; permissions remain compliant."
fi

# Re-run of the benchmark audit command for proof:
echo "==> Benchmark-style audit output:"
/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml; fi'