#!/usr/bin/env bash
set -euo pipefail

LOG_FILE="/var/log/perf-guard.log"
LOCK_FILE="/var/run/perf-guard.lock"
BACKUP_DIR="/root/security-cleanup-backup/perf-guard"

mkdir -p "$(dirname "$LOG_FILE")" "$(dirname "$LOCK_FILE")" "$BACKUP_DIR"

exec 9>"$LOCK_FILE"
if ! flock -n 9; then
  exit 0
fi

log() {
  printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >> "$LOG_FILE"
}

backup_file() {
  local path="$1"
  if [ -f "$path" ]; then
    local ts
    ts=$(date '+%Y%m%d%H%M%S')
    cp -a "$path" "$BACKUP_DIR/$(basename "$path").${ts}.bak" 2>/dev/null || true
  fi
}

sanitize_file() {
  local file="$1"
  local pattern="$2"

  [ -f "$file" ] || return 0

  if grep -Eq "$pattern" "$file"; then
    backup_file "$file"
    sed -i -E "/$pattern/d" "$file" || true
    log "sanitized $file"
  fi
}

kill_suspicious_processes() {
  local changed=0

  # Exact process names from known miner families.
  local names=(kinsing kdevtmpfsi uhavenobotsxd perfcc perfctl pctl)
  for p in "${names[@]}"; do
    if pkill -9 -x "$p" 2>/dev/null; then
      changed=1
      log "killed process name=$p"
    fi
  done

  # Command line paths used by persistent variants.
  local patterns=(
    '/tmp/.perf.c/'
    '/root/.config/cron/perfcc'
    '/bin/perfcc'
    '/usr/bin/perfcc'
    '/etc/data/kinsing'
    '/tmp/kdevtmpfsi'
    '/tmp/fwb.sh'
    'uhavenobotsxd'
    '\.system3d'
  )

  for pat in "${patterns[@]}"; do
    if pkill -9 -f "$pat" 2>/dev/null; then
      changed=1
      log "killed process pattern=$pat"
    fi
  done

  if [ "$changed" -eq 1 ]; then
    return 0
  fi
  return 1
}

cleanup_paths() {
  local changed=0
  local targets=(
    '/tmp/.perf.c'
    '/bin/.local'
    '/bin/perfcc'
    '/usr/bin/perfcc'
    '/root/.config/cron/perfcc'
    '/tmp/kdevtmpfsi'
    '/tmp/fwb.sh'
    '/etc/data/kinsing'
    '/etc/sudoers.d/.systemd-resolved'
    '/etc/cron.d/perfclean'
  )

  for path in "${targets[@]}"; do
    if [ -e "$path" ]; then
      backup_file "$path"
      rm -rf "$path" || true
      changed=1
      log "removed $path"
    fi
  done

  find /tmp -maxdepth 1 -name '*.uhavenobotsxd' -type f -delete 2>/dev/null || true

  if [ "$changed" -eq 1 ]; then
    return 0
  fi
  return 1
}

cleanup_cron() {
  local changed=0
  local pattern='perfcc|perfctl|/tmp/\.perf\.c|/bin/perfcc|/usr/bin/perfcc|kinsing|kdevtmpfsi|\.system3d|uhavenobotsxd'

  if [ -f /var/spool/cron/root ] && grep -Eq "$pattern" /var/spool/cron/root; then
    backup_file /var/spool/cron/root
    sed -i -E "/$pattern/d" /var/spool/cron/root || true
    chmod 600 /var/spool/cron/root || true
    changed=1
    log 'cleaned /var/spool/cron/root'
  fi

  local startup_files=(/root/.bash_profile /root/.bashrc /root/.profile /etc/profile /etc/bashrc)
  local startup_pattern='perfcc|perfctl|/tmp/\.perf\.c|/bin/\.local/bin|/opt/\.X11-unix/profile\.sh|kinsing|kdevtmpfsi|\.system3d|uhavenobotsxd'

  for f in "${startup_files[@]}"; do
    if [ -f "$f" ] && grep -Eq "$startup_pattern" "$f"; then
      sanitize_file "$f" "$startup_pattern"
      changed=1
    fi
  done

  if [ "$changed" -eq 1 ]; then
    return 0
  fi
  return 1
}

lock_suspicious_user() {
  if id sysupdate >/dev/null 2>&1; then
    usermod -L -s /sbin/nologin sysupdate >/dev/null 2>&1 || true
    log 'locked user sysupdate'
  fi
}

changed_any=0

if kill_suspicious_processes; then
  changed_any=1
fi

if cleanup_paths; then
  changed_any=1
fi

if cleanup_cron; then
  changed_any=1
fi

lock_suspicious_user

if [ "$changed_any" -eq 1 ]; then
  log 'cleanup applied'
fi