Update so-yara-update

salt/common/tools/sbin/so-yara-update

@@ -1,4 +1,21 @@
 #!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+clone_dir="/tmp"
 output_dir="/opt/so/saltstack/default/salt/strelka/rules"
 #mkdir -p $output_dir
 repos="$output_dir/repos.txt"
@@ -19,13 +36,14 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
     [ -d $repo_name ] && rm -rf $repo_name
 
     # Clone repo and make appropriate directories for rules
-    git clone $repo
+
-    echo "Analyzing rules from $repo_name..."
+    git clone $repo $clone_dir/$repo_name
+    echo "Analyzing rules from $clone_dir/$repo_name..."
     mkdir -p $output_dir/$repo_name
-    [ -f $repo_name/LICENSE ] && cp $repo_name/LICENSE $output_dir/$repo_name
+    [ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
 
     # Copy over rules
-    for i in $(find $repo_name -name "*.yar*"); do
+    for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
       rule_name=$(echo $i | awk -F '/' '{print $NF}')
       repo_sum=$(sha256sum $i | awk '{print $1}')
 
@@ -50,17 +68,17 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
         fi
       fi;
     done
-
+    
     # Check to see if we have any old rules that need to be removed
     for i in $(find $output_dir/$repo_name -name "*.yar*" | awk -F '/' '{print $NF}'); do
-      is_repo_rule=$(find $repo_name -name "$i" | wc -l)
+      is_repo_rule=$(find $clone_dir/$repo_name -name "$i" | wc -l)
       if [ $is_repo_rule -eq 0 ]; then
         echo "Could not find $i in source $repo_name repo...removing from $output_dir/$repo_name..."
         rm $output_dir/$repo_name/$i
         ((deletecounter++))
       fi
     done
-    #rm -rf $repo_name
+    rm -rf $clone_dir/$repo_name
   done < $repos
 
   echo "Done!"