tinymacaudit.sh

#!/bin/bash
# macOS ships Bash 3.2; do not introduce Bash 4-only features.
set -u
set -o pipefail
export PATH=/usr/bin:/bin:/usr/sbin:/sbin
export LC_ALL=C
umask 077
SCRIPT_DIR="$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
for module in colors util vendor health launchd helpers loginitems backgrounditems extensions browser profiles cron report backup restore ui; do
    source "$SCRIPT_DIR/lib/$module.sh"
done
main() {
    case "${1:---help}" in
        --help|-h) printf 'TinyMacAudit 0.0.1\nUsage: ./tinymacaudit.sh [scan|review|restore] [--output DIRECTORY] [--login-items]\nLogin item inspection may request macOS Automation permission.\n'; return ;;
        --version) echo '0.0.1'; return ;;
        scan|review|restore) local action="$1"; shift ;;
        *) echo 'Unknown command. Use --help.' >&2; return 2 ;;
    esac
    [[ $(uname -s) == Darwin ]] || { echo 'macOS required.' >&2; return 1; }
    [[ $EUID != 0 ]] || { echo 'Run as your normal user, without sudo.' >&2; return 1; }
    local output='' login=no
    while (($#)); do
        case "$1" in
            --output) [[ $# -ge 2 ]] || return 2; output="$2"; shift 2 ;;
            --login-items) login=yes; shift ;;
            *) echo 'Unknown option.' >&2; return 2 ;;
        esac
    done
    if [[ $action == restore ]]; then restore_menu; return; fi
    WORK=$(mktemp -d "${TMPDIR:-/tmp}/tinymacaudit.XXXXXXXX") || return 1
    readonly WORK
    trap 'cleanup_work' EXIT
    COUNT=0
    scan_launchd
    scan_helpers
    scan_loginitems "$login"
    scan_backgrounditems
    scan_extensions
    scan_browser
    scan_profiles
    scan_cron
    summary
    if [[ -n $output ]]; then write_reports "$output" || return 1; fi
    if [[ $action == review ]]; then review_items; fi
}
main "$@"