smagick — replace ImageMagick's default open policy with the official secure policy

smagick

#!/usr/bin/env bash
# smagick — replace ImageMagick's default open policy with the official secure policy
# Compatible with Debian/Ubuntu and Fedora/RHEL-family systems
# Written by Grok (AI) upon request

set -euo pipefail

# ---------------------------------------------------------------------------
# Concise WHY story
# ---------------------------------------------------------------------------
cat <<'EOF'
ImageMagick is intentionally open by default...
https://imagemagick.org/security-policy/

SCOPE: Replace ImageMagick's default open policy with the secure one.
EOF
echo

# ---------------------------------------------------------------------------
# 1. Must run as root (auto-elevate with sudo when possible)
# ---------------------------------------------------------------------------
if [[ $EUID -ne 0 ]]; then
  if command -v sudo >/dev/null 2>&1; then
    echo "[*] Not root – re-executing with sudo..."
    exec sudo -- "$0" "$@"
  else
    echo "Error: must be run as root (or have sudo)." >&2
    exit 1
  fi
fi

# ---------------------------------------------------------------------------
# Helper: detect package manager / distro family
# ---------------------------------------------------------------------------
detect_pkg() {
  if command -v apt-get >/dev/null 2>&1; then
    echo "apt"
  elif command -v dnf >/dev/null 2>&1; then
    echo "dnf"
  elif command -v yum >/dev/null 2>&1; then
    echo "yum"
  else
    echo "unknown"
  fi
}

PKG=$(detect_pkg)

# ---------------------------------------------------------------------------
# 2. Ensure ImageMagick is installed (magick or identify present)
# ---------------------------------------------------------------------------
if ! command -v magick >/dev/null 2>&1 && ! command -v identify >/dev/null 2>&1; then
  echo "[*] ImageMagick not found – installing..."
  case "$PKG" in
    apt)
      apt-get update -qq
      apt-get install -y imagemagick
      ;;
    dnf)
      dnf install -y ImageMagick
      ;;
    yum)
      yum install -y ImageMagick
      ;;
    *)
      echo "Error: cannot detect package manager. Install ImageMagick manually." >&2
      exit 1
      ;;
  esac
fi

# Prefer the modern 'magick' binary; fall back to classic tools
MAGICK_CMD="magick"
if ! command -v magick >/dev/null 2>&1; then
  MAGICK_CMD="identify"
fi

# ---------------------------------------------------------------------------
# Locate the live policy.xml (handles ImageMagick-6 and -7)
# ---------------------------------------------------------------------------
POLICY_DIR=""
for d in /etc/ImageMagick-7 /etc/ImageMagick-6 /etc/ImageMagick; do
  if [[ -f "$d/policy.xml" ]]; then
    POLICY_DIR="$d"
    break
  fi
done

if [[ -z "$POLICY_DIR" ]]; then
  # Last-chance discovery
  POLICY_DIR=$(find /etc -type f -name policy.xml 2>/dev/null | head -1 | xargs dirname 2>/dev/null || true)
fi

if [[ -z "$POLICY_DIR" || ! -d "$POLICY_DIR" ]]; then
  echo "Error: could not locate ImageMagick policy.xml under /etc." >&2
  exit 1
fi

POLICY_FILE="$POLICY_DIR/policy.xml"
echo "[*] Using policy directory: $POLICY_DIR"

# ---------------------------------------------------------------------------
# 3. Backup the current (usually open) policy
# ---------------------------------------------------------------------------
if [[ -f "$POLICY_FILE" ]]; then
  BACKUP="${POLICY_FILE}.orig"
  if [[ -f "$BACKUP" ]]; then
    # Keep a timestamped copy as well
    BACKUP="${POLICY_FILE}.orig.$(date +%Y%m%d%H%M%S)"
  fi
  echo "[*] Backing up $POLICY_FILE → $BACKUP"
  cp -a "$POLICY_FILE" "$BACKUP"
else
  echo "[!] No existing policy.xml found – will create a new one."
fi

# ---------------------------------------------------------------------------
# 4. Download the official secure policy
# ---------------------------------------------------------------------------
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

SECURE_URL="https://imagemagick.org/source/policy-secure.xml"
SECURE_FILE="$TMPDIR/policy-secure.xml"

echo "[*] Downloading secure policy from $SECURE_URL"
if command -v curl >/dev/null 2>&1; then
  curl -fsSL -o "$SECURE_FILE" "$SECURE_URL"
elif command -v wget >/dev/null 2>&1; then
  wget -q -O "$SECURE_FILE" "$SECURE_URL"
else
  echo "Error: need curl or wget to download the policy." >&2
  exit 1
fi

# Basic sanity check
if ! grep -q '<policymap' "$SECURE_FILE"; then
  echo "Error: downloaded file does not look like a valid ImageMagick policy." >&2
  exit 1
fi

# ---------------------------------------------------------------------------
# 5. Install as the new default policy
# ---------------------------------------------------------------------------
echo "[*] Installing secure policy → $POLICY_FILE"
install -m 644 "$SECURE_FILE" "$POLICY_FILE"

# ---------------------------------------------------------------------------
# 6. Verify
# ---------------------------------------------------------------------------
echo
echo "[*] Verifying active policy:"
echo "----------------------------------------"
$MAGICK_CMD identify -list policy 2>/dev/null || $MAGICK_CMD -list policy
echo "----------------------------------------"
echo
echo "[+] Done. ImageMagick is now running under the official secure policy."
echo "    Original policy saved as: ${BACKUP:-none}"
echo "    Revert with:  mv ${BACKUP:-$POLICY_FILE.orig} $POLICY_FILE"