# SPDX-License-Identifier: GPL-3.0-or-later
"""new_suid — a SUID/SGID binary that wasn't in the baseline.

A new setuid binary is a privilege-escalation persistence trick; one in a
world-writable dir (``/tmp``, ``/home`` …) is almost never legitimate, so it is
escalated to CRITICAL. The filesystem walk is expensive, so the daemon only
populates ``state.suid_binaries`` on its slow scan cadence — when it's absent
this detector is a no-op.
"""
from __future__ import annotations

from collections.abc import Iterator

from ..alert import Alert, Severity
from ..config import Config
from ..system import SystemState


def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
    if state.suid_binaries is None or state.suid_baseline is None:
        return
    for path in state.suid_binaries:
        if path in state.suid_baseline:
            continue
        hot = any(
            path.startswith(d.rstrip("/") + "/") for d in cfg.suid_hot_dirs
        )
        yield Alert(
            severity=Severity.CRITICAL if hot else Severity.HIGH,
            signature="new_suid",
            key=f"suid:{path}",
            detail=(
                ("SUID/SGID binary in writable dir: " if hot
                 else "new SUID/SGID binary: ") + path
            ),
        )