Restrict Access to All Key Files

BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
files=$(find $BH $RUN -type f 2>/dev/null | xargs -r grep -l secret 2>/dev/null | sort -u)
[ -n "$files" ] || { echo compliant; exit 0; }
bad=$(for f in $files; do find "$f" \( \! \( $U \) -o \! \( $G \) -o -perm /022 \) -print; done)
[ -z "$bad" ] && echo compliant || { echo 'key files with wrong owner/group or group/other write:'; printf '%s\n' "$bad"; }

tmaegis scan --target bind