#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — SUID / SUID BINARY EXPOSURE PROOF
#
# Purpose: Enumerates SUID/SGID binaries on the local filesystem (find with
#          strict limits) to prove potential privilege-escalation surface.
#          Pure local inventory — no execution of any binary.
#
# Safety: Bounded find (maxdepth, specific paths, timeout). Never runs binaries.
#
# Generated by Vigil safe-poc-generator (Phase 1, template A).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
ROOT=${1:-/}

echo '{
  "validator": "suid-binary-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "root": "'"$ROOT"'",
  "suidBinaries": ['

# Bounded, safe find (no exec, limited depth on /)
SUIDS=$(find "$ROOT" -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null | head -30 | sed 's/"/\\"/g' || true)

FIRST=1
while IFS= read -r line; do
  [ -z "$line" ] && continue
  if [ $FIRST -eq 0 ]; then echo -n ','; fi
  echo -n '"'"$line"'"'
  FIRST=0
done <<< "$SUIDS"

echo '],
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "SUID/SGID binary list captured locally for operator triage. Cross-reference with known vulns."
}'
exit 0