stripsystem

#!/bin/bash

# ==============================
# 🔐 Combined RecoveryOS Kext Hardening Script
# Purpose:
# - Audit loaded and installed kexts
# - Detect foreign/unapproved kexts
# - Prompt user
# - Lock down all other volumes to prevent external kext injection
# ==============================

# -- CONFIG: Approved Recovery kexts only
WHITELIST=(
  "AppleAPFS.kext"
  "IOStorageFamily.kext"
  "IOHDIXController.kext"
  "AppleSMC.kext"
  "IOKit.kext"
  "IOHIDFamily.kext"
  "IOGraphicsFamily.kext"
  "AppleTopCase.kext"
  "AppleBacklight.kext"
  "AppleCLCD.kext"
  "AppleDisplay.kext"
  "AppleM1Framebuffer.kext"
  "IOAcceleratorFamily2.kext"
)

KEXT_DIRS=(/System/Library/Extensions /Library/Extensions)

# -- Check if a kext is whitelisted
is_whitelisted() {
  local name="$1"
  for wk in "${WHITELIST[@]}"; do
    [[ "$name" == "$wk" ]] && return 0
  done
  return 1
}

# -- Audit kexts on disk
echo "\n📦 Checking installed kexts in Recovery disk..."
FOUND_EXTRA=0
for dir in "${KEXT_DIRS[@]}"; do
  if [ -d "$dir" ]; then
    for kext in "$dir"/*.kext; do
      base=$(basename "$kext")
      if ! is_whitelisted "$base"; then
        echo "❌ Extra kext on disk: $base"
        FOUND_EXTRA=1
      else
        echo "✅ Approved: $base"
      fi
    done
  fi
done

# -- Audit loaded kexts in memory
echo "\n📡 Checking loaded kexts (RecoveryOS kernelcache)..."
if command -v kmutil &>/dev/null; then
  LOADED=$(kmutil showloaded | grep -vE '^Index|^$' | awk '{print $2}' | sort | uniq)
  for kext in $LOADED; do
    name=$(basename "$kext")
    if ! is_whitelisted "$name"; then
      echo "❌ Loaded unapproved: $name"
      FOUND_EXTRA=1
    else
      echo "✅ Loaded & approved: $name"
    fi
  done
else
  echo "❌ kmutil not found (unexpected in RecoveryOS)"
  FOUND_EXTRA=1
fi

# -- Prompt user
if [[ $FOUND_EXTRA -eq 0 ]]; then
  echo "\n✅ System clean. Only whitelisted kexts found."
else
  echo "\n⚠️  WARNING: Non-whitelisted kexts found in RecoveryOS."
fi

read -r -p "❓ Proceed to LOCK DOWN all other volumes to block external kext injection? (y/N): " RESP
if [[ "$RESP" =~ ^[Yy]$ ]]; then
  echo "\n🚫 Locking down /Volumes/* ..."

  # Step 1: Lock Extensions folders
  for vol in /Volumes/*; do
    [ -d "$vol" ] || continue
    if [ -d "$vol/Library/Extensions" ]; then
      chmod -R 000 "$vol/Library/Extensions" 2>/dev/null
      chflags -R uchg "$vol/Library/Extensions" 2>/dev/null
      echo "🔒 Locked: $vol/Library/Extensions"
    fi
  done

  # Step 2: Remove known kext tools from mounted OS volumes
  for vol in /Volumes/*; do
    rm -f "$vol"/sbin/kextload
    rm -f "$vol"/sbin/kextunload
    rm -f "$vol"/usr/bin/kmutil
    rm -f "$vol"/usr/sbin/kextcache
  done
  echo "🧹 Removed staging tools from mounted systems."

  # Step 3: Lock all detected .kexts across /Volumes/*
  echo "\n🔎 Searching for foreign .kext files..."
  find /Volumes/* -name "*.kext" -type d 2>/dev/null | while read -r k; do
    chmod -R 000 "$k"
    chflags -R uchg "$k"
    echo "🔐 Locked kext: $k"
  done

  echo "\n✅ External kext injection prevention complete. Recovery is now airgap-hardened."
else
  echo "\n🛑 Skipped lockdown. No changes made."
fi