#!/usr/local/bin/zsh

HBSDCONTROL="/usr/sbin/hbsdcontrol"

mprotect_programs=(	\
	/usr/local/share/signal-desktop/signal-desktop \
	/usr/local/bin/gpclient \
	/usr/local/lib/firefox/firefox \
	/usr/local/bin/python3.11 \
	/usr/local/bin/ykman-gui \
	/usr/local/share/chromium/chrome \
)

pageexec_programs=(	\
	/usr/local/share/signal-desktop/signal-desktop \
	/usr/local/bin/gpclient \
	/usr/local/lib/firefox/firefox \
	/usr/local/bin/python3.11 \
	/usr/local/bin/ykman-gui \
	/usr/local/share/chromium/chrome \
)

insecure_kmods=(	\
	/boot/kernel/lindebugfs.ko \
	/boot/modules/dmabuf.ko \
)

destdir=""
while getopts 'd:' o; do
	case "${o}" in
		d)
			destdir="${OPTARG:A}"
			;;
	esac
done

if [ ! -d "${destdir}/" ]; then
	echo "[-] Destination not found or not a directory: ${destdir}"
	exit 1
fi

for prog in ${pageexec_programs}; do
	file="${destdir}${prog}"
	if [ -e "${file}" ]; then
		echo "[*] disable pageexec for ${file}"
		${HBSDCONTROL} pax disable pageexec ${file}
	fi
done

for prog in ${mprotect_programs}; do
	file="${destdir}${prog}"
	if [ -e "${file}" ]; then
		echo "[*] disable mprotect for ${file}"
		${HBSDCONTROL} pax disable mprotect ${file}
	fi
done

for kmod in ${insecure_kmods}; do
	file="${destdir}${kmod}"
	if [ -e "${file}" ]; then
		echo "[*] disable insecure_kmod for ${file}"
		${HBSDCONTROL} pax disable insecure_kmod ${file}
	fi
done