#!/bin/sh
# Run in an already authorized host inspection session, not inside an app pod.
# Prints metadata only. Does not change sysctls, load BPF or read Secret values.
show_file() {
  printf '\nFILE %s\n' "$1"
  if [ -r "$1" ]; then
    cat "$1" || printf 'UNKNOWN: read failed\n'
  else
    printf 'UNKNOWN: unavailable or not readable\n'
  fi
}
date -u '+UTC %Y-%m-%dT%H:%M:%SZ'
hostname
uname -r
show_file /proc/sys/kernel/random/boot_id
show_file /proc/cmdline
show_file /sys/fs/selinux/enforce
show_file /sys/kernel/security/lsm
show_file /sys/kernel/security/lockdown
for key in kernel.yama.ptrace_scope kernel.unprivileged_bpf_disabled \
  kernel.perf_event_paranoid kernel.kptr_restrict kernel.dmesg_restrict \
  kernel.randomize_va_space fs.suid_dumpable; do
  printf '\nSYSCTL %s\n' "$key"
  sysctl "$key" || printf 'UNKNOWN: sysctl failed\n'
done
for f in /sys/devices/system/cpu/vulnerabilities/*; do
  [ -e "$f" ] || continue
  show_file "$f"
done