#!/bin/bash
# Enterprise bind mount management script

set -euo pipefail

# Configuration
MOUNT_CONFIG="/etc/enterprise-mounts.conf"
AUDIT_LOG="/var/log/mount-operations.log"
LOCK_FILE="/var/run/mount-manager.lock"

# Logging function with structured output
log_operation() {
    local level="$1"
    local operation="$2"
    local details="$3"
    local timestamp=$(date -u +"%Y-%m-%dT%H:%M:%S.%3NZ")
    
    echo "{\"timestamp\":\"$timestamp\",\"level\":\"$level\",\"operation\":\"$operation\",\"details\":\"$details\",\"user\":\"$(whoami)\",\"pid\":$$}" >> "$AUDIT_LOG"
}

# Secure bind mount with validation
secure_bind_mount() {
    local source="$1"
    local target="$2"
    local options="${3:-}"
    local context="${4:-default}"
    
    # Input validation
    if [[ ! -d "$source" ]]; then
        log_operation "ERROR" "bind_mount" "Source directory does not exist: $source"
        return 1
    fi
    
    # Security checks
    if [[ "$source" == /* ]] && [[ "$target" == /* ]]; then
        # Absolute paths - check for potential security issues
        if [[ "$source" =~ ^/proc|^/sys|^/dev ]] && [[ "$context" != "system" ]]; then
            log_operation "ERROR" "bind_mount" "Attempted mount of sensitive system directory: $source"
            return 1
        fi
    fi
    
    # Create target directory if it doesn't exist
    mkdir -p "$(dirname "$target")"
    mkdir -p "$target"
    
    # Perform the bind mount with specified options
    local mount_cmd="mount --bind"
    [[ -n "$options" ]] && mount_cmd="$mount_cmd -o $options"
    
    if $mount_cmd "$source" "$target"; then
        log_operation "INFO" "bind_mount" "Successfully mounted $source to $target with options: $options"
        
        # Update mount registry
        echo "$source $target $options $context $(date -u +%s)" >> "/var/lib/enterprise-mounts/registry"
        
        return 0
    else
        log_operation "ERROR" "bind_mount" "Failed to mount $source to $target"
        return 1
    fi
}

# Advanced bind mount with namespace support
namespace_bind_mount() {
    local namespace="$1"
    local source="$2"
    local target="$3"
    local options="${4:-}"
    
    # Enter the specified namespace and perform the mount
    nsenter --mount="/proc/$(pgrep -f "$namespace")/ns/mnt" \
        bash -c "$(declare -f secure_bind_mount); secure_bind_mount '$source' '$target' '$options' 'namespace'"
}

# Recursive bind mount with selective inclusion
selective_rbind_mount() {
    local source="$1"
    local target="$2"
    local include_pattern="${3:-.*}"
    local exclude_pattern="${4:-^$}"
    
    log_operation "INFO" "selective_rbind" "Starting selective recursive bind mount from $source to $target"
    
    # Create base bind mount
    secure_bind_mount "$source" "$target" "bind" "selective"
    
    # Find and mount matching subdirectories
    while IFS= read -r -d '' subdir; do
        local rel_path="${subdir#$source/}"
        
        if [[ "$rel_path" =~ $include_pattern ]] && [[ ! "$rel_path" =~ $exclude_pattern ]]; then
            local target_subdir="$target/$rel_path"
            secure_bind_mount "$subdir" "$target_subdir" "bind" "selective"
        fi
    done < <(find "$source" -mindepth 1 -type d -print0)
}

# Enterprise mount verification
verify_mount_integrity() {
    local mount_point="$1"
    
    # Check if mount point exists and is actually mounted
    if ! mountpoint -q "$mount_point"; then
        log_operation "ERROR" "verify_mount" "Mount point not active: $mount_point"
        return 1
    fi
    
    # Verify mount source and target are in sync
    local source_inode=$(stat -c '%i' "$(findmnt -n -o SOURCE "$mount_point")")
    local target_inode=$(stat -c '%i' "$mount_point")
    
    if [[ "$source_inode" != "$target_inode" ]]; then
        log_operation "ERROR" "verify_mount" "Mount integrity failed: inode mismatch at $mount_point"
        return 1
    fi
    
    log_operation "INFO" "verify_mount" "Mount integrity verified for $mount_point"
    return 0
}

# Cleanup function for graceful unmounting
cleanup_enterprise_mounts() {
    local context="${1:-all}"
    
    log_operation "INFO" "cleanup" "Starting cleanup for context: $context"
    
    # Read mount registry and unmount in reverse order
    if [[ -f "/var/lib/enterprise-mounts/registry" ]]; then
        tac "/var/lib/enterprise-mounts/registry" | while read -r source target options mount_context timestamp; do
            if [[ "$context" == "all" ]] || [[ "$mount_context" == "$context" ]]; then
                if mountpoint -q "$target"; then
                    if umount "$target"; then
                        log_operation "INFO" "cleanup" "Successfully unmounted $target"
                    else
                        log_operation "ERROR" "cleanup" "Failed to unmount $target"
                    fi
                fi
            fi
        done
    fi
}

# Signal handlers for graceful cleanup
trap 'cleanup_enterprise_mounts all; exit 0' SIGTERM SIGINT

#!/bin/bash
# Advanced overlay filesystem management

# Overlay configuration structure
create_overlay_stack() {
    local overlay_name="$1"
    local base_dir="$2"
    local work_dir="/var/lib/overlays/$overlay_name/work"
    local upper_dir="/var/lib/overlays/$overlay_name/upper"
    local merged_dir="/var/lib/overlays/$overlay_name/merged"
    local lower_dirs=("${@:3}")
    
    # Create necessary directories
    mkdir -p "$work_dir" "$upper_dir" "$merged_dir"
    
    # Build lower directories string
    local lower_string=""
    for dir in "${lower_dirs[@]}"; do
        [[ -n "$lower_string" ]] && lower_string="$lower_string:"
        lower_string="$lower_string$dir"
    done
    
    # Mount overlay
    mount -t overlay overlay \
        -o "lowerdir=$lower_string,upperdir=$upper_dir,workdir=$work_dir" \
        "$merged_dir"
    
    # Set up metadata
    cat > "/var/lib/overlays/$overlay_name/metadata.json" <<EOF
{
    "name": "$overlay_name",
    "created": "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)",
    "base_dir": "$base_dir",
    "lower_dirs": $(printf '%s\n' "${lower_dirs[@]}" | jq -R . | jq -s .),
    "upper_dir": "$upper_dir",
    "work_dir": "$work_dir",
    "merged_dir": "$merged_dir",
    "mount_options": "lowerdir=$lower_string,upperdir=$upper_dir,workdir=$work_dir"
}
EOF
    
    log_operation "INFO" "overlay_create" "Created overlay stack: $overlay_name"
}

# Container-optimized overlay for enterprise container runtimes
create_container_overlay() {
    local container_id="$1"
    local base_image_layers=("${@:2}")
    
    local overlay_path="/var/lib/containers/overlay/$container_id"
    mkdir -p "$overlay_path"/{diff,work,merged}
    
    # Build layer stack from base image
    local lower_layers=""
    for layer in "${base_image_layers[@]}"; do
        [[ -n "$lower_layers" ]] && lower_layers="$lower_layers:"
        lower_layers="$lower_layers/var/lib/containers/storage/overlay/$layer/diff"
    done
    
    # Mount with container-specific options
    mount -t overlay overlay \
        -o "lowerdir=$lower_layers,upperdir=$overlay_path/diff,workdir=$overlay_path/work,index=off,userxattr" \
        "$overlay_path/merged"
    
    # Set up container metadata
    cat > "$overlay_path/metadata.json" <<EOF
{
    "container_id": "$container_id",
    "created": "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)",
    "base_layers": $(printf '%s\n' "${base_image_layers[@]}" | jq -R . | jq -s .),
    "overlay_path": "$overlay_path",
    "mount_options": "lowerdir=$lower_layers,upperdir=$overlay_path/diff,workdir=$overlay_path/work,index=off,userxattr"
}
EOF
}

# Development environment overlay with COW semantics
create_dev_overlay() {
    local project_name="$1"
    local source_dir="$2"
    local dev_overlay="/var/lib/dev-overlays/$project_name"
    
    mkdir -p "$dev_overlay"/{upper,work,merged}
    
    # Create development overlay
    mount -t overlay overlay \
        -o "lowerdir=$source_dir,upperdir=$dev_overlay/upper,workdir=$dev_overlay/work" \
        "$dev_overlay/merged"
    
    # Set up development-specific permissions and metadata
    chown -R "$(id -u):$(id -g)" "$dev_overlay/upper" "$dev_overlay/merged"
    
    cat > "$dev_overlay/dev-info.json" <<EOF
{
    "project": "$project_name",
    "source_dir": "$source_dir",
    "overlay_dir": "$dev_overlay",
    "created_by": "$(whoami)",
    "created_at": "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)",
    "git_branch": "$(cd "$source_dir" && git branch --show-current 2>/dev/null || echo 'unknown')",
    "git_commit": "$(cd "$source_dir" && git rev-parse HEAD 2>/dev/null || echo 'unknown')"
}
EOF
    
    echo "$dev_overlay/merged"
}

#!/bin/bash
# Enterprise storage integration patterns

# High-availability bind mount with failover
ha_bind_mount() {
    local logical_path="$1"
    local primary_storage="$2"
    local secondary_storage="$3"
    local mount_point="$4"
    
    # Check primary storage health
    if storage_health_check "$primary_storage"; then
        secure_bind_mount "$primary_storage/$logical_path" "$mount_point" "bind" "ha-primary"
        log_operation "INFO" "ha_mount" "Using primary storage for $logical_path"
    elif storage_health_check "$secondary_storage"; then
        secure_bind_mount "$secondary_storage/$logical_path" "$mount_point" "bind" "ha-secondary"
        log_operation "WARN" "ha_mount" "Failover to secondary storage for $logical_path"
        
        # Trigger alert for primary storage failure
        send_alert "storage_failover" "Primary storage failed for $logical_path, using secondary"
    else
        log_operation "ERROR" "ha_mount" "Both primary and secondary storage failed for $logical_path"
        return 1
    fi
}

# Storage health check function
storage_health_check() {
    local storage_path="$1"
    local timeout="${2:-5}"
    
    # Test read/write performance
    local test_file="$storage_path/.health_check_$(date +%s)"
    
    if timeout "$timeout" dd if=/dev/zero of="$test_file" bs=1M count=1 2>/dev/null; then
        if timeout "$timeout" dd if="$test_file" of=/dev/null bs=1M count=1 2>/dev/null; then
            rm -f "$test_file"
            return 0
        fi
    fi
    
    rm -f "$test_file" 2>/dev/null
    return 1
}

# Network-attached storage integration
nfs_bind_mount() {
    local nfs_server="$1"
    local nfs_export="$2"
    local local_cache="$3"
    local mount_point="$4"
    
    local nfs_mount="/mnt/nfs/$(echo "$nfs_server" | tr '.' '_')$nfs_export"
    mkdir -p "$nfs_mount" "$local_cache"
    
    # Mount NFS with enterprise options
    mount -t nfs4 \
        -o "rsize=1048576,wsize=1048576,hard,intr,timeo=600,retrans=2" \
        "$nfs_server:$nfs_export" "$nfs_mount"
    
    # Create cached overlay
    create_overlay_stack "nfs_cache_$(basename "$nfs_export")" \
        "$local_cache" "$nfs_mount" "$local_cache"
    
    # Bind mount the overlay
    secure_bind_mount "/var/lib/overlays/nfs_cache_$(basename "$nfs_export")/merged" \
        "$mount_point" "bind" "nfs"
}

#!/bin/bash
# Enterprise namespace management

# Create isolated environment with multiple namespaces
create_enterprise_namespace() {
    local env_name="$1"
    local isolation_level="${2:-full}"  # full, network, mount, user
    local config_file="${3:-/etc/enterprise-namespaces/$env_name.conf}"
    
    # Load environment configuration
    source "$config_file"
    
    local ns_dir="/var/lib/namespaces/$env_name"
    mkdir -p "$ns_dir"/{mnt,net,ipc,uts,pid,user}
    
    case "$isolation_level" in
        "full")
            unshare --mount --net --ipc --uts --pid --user --fork \
                bash -c "setup_full_isolation '$env_name' '$ns_dir'"
            ;;
        "network")
            unshare --net --fork \
                bash -c "setup_network_isolation '$env_name' '$ns_dir'"
            ;;
        "mount")
            unshare --mount --fork \
                bash -c "setup_mount_isolation '$env_name' '$ns_dir'"
            ;;
        *)
            log_operation "ERROR" "namespace_create" "Unknown isolation level: $isolation_level"
            return 1
            ;;
    esac
}

# Full isolation setup
setup_full_isolation() {
    local env_name="$1"
    local ns_dir="$2"
    
    # Mount namespace setup
    mount --make-rprivate /
    
    # Create new root filesystem
    local new_root="$ns_dir/rootfs"
    mkdir -p "$new_root"
    
    # Bind mount essential directories
    for dir in bin lib lib64 usr etc; do
        mkdir -p "$new_root/$dir"
        secure_bind_mount "/$dir" "$new_root/$dir" "ro,bind" "namespace"
    done
    
    # Create writable directories
    for dir in tmp var home proc sys dev; do
        mkdir -p "$new_root/$dir"
    done
    
    # Mount special filesystems
    mount -t proc proc "$new_root/proc"
    mount -t sysfs sysfs "$new_root/sys"
    mount -t devtmpfs devtmpfs "$new_root/dev"
    mount -t tmpfs tmpfs "$new_root/tmp"
    
    # Network namespace setup
    setup_namespace_networking "$env_name"
    
    # User namespace setup
    setup_namespace_users "$env_name"
    
    # Change root and start environment
    chroot "$new_root" /bin/bash -c "
        export PS1='[$env_name] \u@\h:\w\$ '
        cd /home
        exec /bin/bash
    "
}

# Network namespace configuration
setup_namespace_networking() {
    local env_name="$1"
    
    # Create veth pair
    local veth_host="veth-$env_name-host"
    local veth_ns="veth-$env_name-ns"
    
    ip link add "$veth_host" type veth peer name "$veth_ns"
    
    # Configure host side
    ip link set "$veth_host" up
    ip addr add "192.168.100.1/24" dev "$veth_host"
    
    # Configure namespace side
    ip link set "$veth_ns" netns self
    ip addr add "192.168.100.2/24" dev "$veth_ns"
    ip link set "$veth_ns" up
    ip link set lo up
    
    # Add default route
    ip route add default via "192.168.100.1"
    
    # Configure NAT on host (requires iptables setup)
    iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE
    iptables -A FORWARD -i "$veth_host" -j ACCEPT
    iptables -A FORWARD -o "$veth_host" -j ACCEPT
}

# User namespace configuration
setup_namespace_users() {
    local env_name="$1"
    local uid_map="${NS_UID_MAP:-1000 100000 65536}"
    local gid_map="${NS_GID_MAP:-1000 100000 65536}"
    
    # Set up UID/GID mappings
    echo "$uid_map" > /proc/self/uid_map
    echo "$gid_map" > /proc/self/gid_map
    
    # Create user-specific directories
    mkdir -p "/home/$NS_USER"
    chown "$NS_USER:$NS_GROUP" "/home/$NS_USER"
}

# Container runtime integration
integrate_container_runtime() {
    local container_runtime="${1:-containerd}"
    local namespace_name="$2"
    
    case "$container_runtime" in
        "containerd")
            # Configure containerd namespace
            ctr namespace create "$namespace_name"
            ctr --namespace "$namespace_name" images pull docker.io/library/alpine:latest
            ;;
        "docker")
            # Docker doesn't have built-in namespace support, use custom implementation
            setup_docker_namespace_integration "$namespace_name"
            ;;
        "podman")
            # Podman rootless integration
            podman system migrate
            podman namespace create "$namespace_name"
            ;;
    esac
}

# Namespace monitoring and management
monitor_namespaces() {
    local output_format="${1:-json}"
    
    case "$output_format" in
        "json")
            lsns -J -t mnt,net,ipc,uts,pid,user,time | jq '.namespaces[] | {
                type: .type,
                ns: .ns,
                pid: .pid,
                ppid: .ppid,
                command: .command,
                user: .user
            }'
            ;;
        "table")
            lsns -t mnt,net,ipc,uts,pid,user,time -o TYPE,NS,PID,PPID,COMMAND,USER
            ;;
        "prometheus")
            # Export metrics for Prometheus
            local metrics_file="/var/lib/node_exporter/textfile_collector/namespaces.prom"
            {
                echo "# HELP linux_namespaces_total Total number of Linux namespaces"
                echo "# TYPE linux_namespaces_total gauge"
                for ns_type in mnt net ipc uts pid user time; do
                    local count=$(lsns -t "$ns_type" -n | wc -l)
                    echo "linux_namespaces_total{type=\"$ns_type\"} $count"
                done
            } > "$metrics_file"
            ;;
    esac
}

#!/bin/bash
# Enterprise security framework for Linux systems

# Security audit and compliance checking
security_audit() {
    local audit_type="${1:-full}"
    local output_file="/var/log/security-audit-$(date +%Y%m%d-%H%M%S).json"
    
    # Initialize audit report
    cat > "$output_file" <<EOF
{
    "audit_timestamp": "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)",
    "audit_type": "$audit_type",
    "hostname": "$(hostname)",
    "kernel_version": "$(uname -r)",
    "findings": []
}
EOF
    
    case "$audit_type" in
        "filesystem")
            audit_filesystem_security >> "$output_file"
            ;;
        "mounts")
            audit_mount_security >> "$output_file"
            ;;
        "namespaces")
            audit_namespace_security >> "$output_file"
            ;;
        "full")
            audit_filesystem_security >> "$output_file"
            audit_mount_security >> "$output_file"
            audit_namespace_security >> "$output_file"
            audit_system_hardening >> "$output_file"
            ;;
    esac
    
    # Close JSON structure
    echo "}" >> "$output_file"
    echo "Security audit completed: $output_file"
}

# Filesystem security audit
audit_filesystem_security() {
    local findings=()
    
    # Check for world-writable files
    while IFS= read -r -d '' file; do
        findings+=("$(jq -n --arg file "$file" --arg severity "HIGH" \
            '{type: "world_writable_file", file: $file, severity: $severity, description: "File is world-writable"}')")
    done < <(find / -type f -perm -002 -not -path "/proc/*" -not -path "/sys/*" -print0 2>/dev/null)
    
    # Check for SUID/SGID files
    while IFS= read -r -d '' file; do
        findings+=("$(jq -n --arg file "$file" --arg severity "MEDIUM" \
            '{type: "suid_sgid_file", file: $file, severity: $severity, description: "File has SUID or SGID bit set"}')")
    done < <(find / \( -perm -4000 -o -perm -2000 \) -type f -not -path "/proc/*" -not -path "/sys/*" -print0 2>/dev/null)
    
    # Check for files without owner
    while IFS= read -r -d '' file; do
        findings+=("$(jq -n --arg file "$file" --arg severity "MEDIUM" \
            '{type: "no_owner_file", file: $file, severity: $severity, description: "File has no valid owner"}')")
    done < <(find / -nouser -o -nogroup -not -path "/proc/*" -not -path "/sys/*" -print0 2>/dev/null)
    
    # Output findings
    printf '%s\n' "${findings[@]}" | jq -s '.'
}

# Mount security audit
audit_mount_security() {
    local findings=()
    
    # Check for insecure mount options
    while read -r mount_info; do
        local device=$(echo "$mount_info" | awk '{print $1}')
        local mount_point=$(echo "$mount_info" | awk '{print $2}')
        local fs_type=$(echo "$mount_info" | awk '{print $3}')
        local options=$(echo "$mount_info" | awk '{print $4}')
        
        # Check for missing noexec on writable mounts
        if [[ "$options" == *"rw"* ]] && [[ "$options" != *"noexec"* ]] && [[ "$mount_point" =~ ^/(tmp|var/tmp|home) ]]; then
            findings+=("$(jq -n --arg device "$device" --arg mount_point "$mount_point" --arg severity "HIGH" \
                '{type: "missing_noexec", device: $device, mount_point: $mount_point, severity: $severity, description: "Writable mount lacks noexec option"}')")
        fi
        
        # Check for missing nosuid
        if [[ "$options" != *"nosuid"* ]] && [[ "$mount_point" =~ ^/(tmp|var/tmp|home) ]]; then
            findings+=("$(jq -n --arg device "$device" --arg mount_point "$mount_point" --arg severity "MEDIUM" \
                '{type: "missing_nosuid", device: $device, mount_point: $mount_point, severity: $severity, description: "Mount lacks nosuid option"}')")
        fi
        
        # Check for insecure NFS mounts
        if [[ "$fs_type" == "nfs"* ]] && [[ "$options" != *"sec="* ]]; then
            findings+=("$(jq -n --arg device "$device" --arg mount_point "$mount_point" --arg severity "HIGH" \
                '{type: "insecure_nfs", device: $device, mount_point: $mount_point, severity: $severity, description: "NFS mount without security options"}')")
        fi
    done < <(mount | grep -E "^/dev|^[0-9]")
    
    printf '%s\n' "${findings[@]}" | jq -s '.'
}

# Namespace security audit
audit_namespace_security() {
    local findings=()
    
    # Check for privileged containers/namespaces
    while read -r ns_info; do
        local ns_type=$(echo "$ns_info" | awk '{print $1}')
        local pid=$(echo "$ns_info" | awk '{print $3}')
        local command=$(echo "$ns_info" | awk '{print $6}')
        
        # Check if process is running as root in user namespace
        if [[ "$ns_type" == "user" ]]; then
            local proc_uid=$(stat -c %u "/proc/$pid" 2>/dev/null || echo "unknown")
            if [[ "$proc_uid" == "0" ]]; then
                findings+=("$(jq -n --arg pid "$pid" --arg command "$command" --arg severity "HIGH" \
                    '{type: "root_in_user_namespace", pid: $pid, command: $command, severity: $severity, description: "Process running as root in user namespace"}')")
            fi
        fi
        
        # Check for unconfined processes with network namespaces
        if [[ "$ns_type" == "net" ]] && [[ "$command" != *"systemd"* ]] && [[ "$command" != *"containerd"* ]]; then
            findings+=("$(jq -n --arg pid "$pid" --arg command "$command" --arg severity "MEDIUM" \
                '{type: "unconfined_network_namespace", pid: $pid, command: $command, severity: $severity, description: "Unconfined process with network namespace"}')")
        fi
    done < <(lsns -n -t user,net 2>/dev/null | tail -n +2)
    
    printf '%s\n' "${findings[@]}" | jq -s '.'
}

# System hardening compliance check
audit_system_hardening() {
    local findings=()
    
    # Check kernel parameters
    local hardening_params=(
        "kernel.dmesg_restrict:1"
        "kernel.kptr_restrict:2"
        "kernel.yama.ptrace_scope:1"
        "net.ipv4.ip_forward:0"
        "net.ipv4.conf.all.send_redirects:0"
        "net.ipv4.conf.all.accept_redirects:0"
        "net.ipv6.conf.all.accept_redirects:0"
    )
    
    for param in "${hardening_params[@]}"; do
        local key="${param%:*}"
        local expected="${param#*:}"
        local current=$(sysctl -n "$key" 2>/dev/null || echo "missing")
        
        if [[ "$current" != "$expected" ]]; then
            findings+=("$(jq -n --arg key "$key" --arg current "$current" --arg expected "$expected" --arg severity "MEDIUM" \
                '{type: "kernel_parameter_misconfigured", parameter: $key, current_value: $current, expected_value: $expected, severity: $severity, description: "Kernel parameter not set to hardened value"}')")
        fi
    done
    
    # Check SELinux/AppArmor status
    if command -v getenforce >/dev/null 2>&1; then
        local selinux_status=$(getenforce)
        if [[ "$selinux_status" != "Enforcing" ]]; then
            findings+=("$(jq -n --arg status "$selinux_status" --arg severity "HIGH" \
                '{type: "selinux_not_enforcing", status: $status, severity: $severity, description: "SELinux is not in enforcing mode"}')")
        fi
    elif command -v aa-status >/dev/null 2>&1; then
        local apparmor_status=$(aa-status --enabled && echo "enabled" || echo "disabled")
        if [[ "$apparmor_status" != "enabled" ]]; then
            findings+=("$(jq -n --arg status "$apparmor_status" --arg severity "HIGH" \
                '{type: "apparmor_disabled", status: $status, severity: $severity, description: "AppArmor is disabled"}')")
        fi
    fi
    
    printf '%s\n' "${findings[@]}" | jq -s '.'
}

# Implement security controls based on findings
implement_security_controls() {
    local audit_file="$1"
    local auto_fix="${2:-false}"
    
    # Parse audit findings
    local high_findings=$(jq -r '.findings[] | select(.severity == "HIGH") | .type' "$audit_file")
    local medium_findings=$(jq -r '.findings[] | select(.severity == "MEDIUM") | .type' "$audit_file")
    
    echo "Security findings summary:"
    echo "HIGH severity: $(echo "$high_findings" | wc -l)"
    echo "MEDIUM severity: $(echo "$medium_findings" | wc -l)"
    
    if [[ "$auto_fix" == "true" ]]; then
        # Automatically fix some issues
        while read -r finding; do
            case "$finding" in
                "kernel_parameter_misconfigured")
                    fix_kernel_parameters "$audit_file"
                    ;;
                "missing_noexec"|"missing_nosuid")
                    fix_mount_options "$audit_file"
                    ;;
                "world_writable_file")
                    fix_world_writable_files "$audit_file"
                    ;;
            esac
        done <<< "$medium_findings"
    fi
}

#!/bin/bash
# Compliance automation framework

# CIS Benchmark automation
cis_compliance_check() {
    local benchmark_version="${1:-ubuntu20.04}"
    local output_format="${2:-json}"
    
    local findings=()
    
    case "$benchmark_version" in
        "ubuntu20.04")
            # CIS Ubuntu 20.04 specific checks
            cis_ubuntu_2004_checks findings
            ;;
        "rhel8")
            # CIS RHEL 8 specific checks
            cis_rhel8_checks findings
            ;;
        *)
            log_operation "ERROR" "cis_check" "Unknown benchmark version: $benchmark_version"
            return 1
            ;;
    esac
    
    # Output results
    case "$output_format" in
        "json")
            printf '%s\n' "${findings[@]}" | jq -s '{
                benchmark: $benchmark_version,
                timestamp: now | strftime("%Y-%m-%dT%H:%M:%S.%3NZ"),
                findings: .
            }' --arg benchmark_version "$benchmark_version"
            ;;
        "csv")
            echo "control_id,title,status,severity,description"
            printf '%s\n' "${findings[@]}" | jq -r '[.control_id, .title, .status, .severity, .description] | @csv'
            ;;
    esac
}

# SOC 2 compliance automation
soc2_compliance_check() {
    local control_area="${1:-all}"  # all, security, availability, processing_integrity
    
    local findings=()
    
    case "$control_area" in
        "security"|"all")
            soc2_security_controls findings
            ;;
        "availability"|"all")
            soc2_availability_controls findings
            ;;
        "processing_integrity"|"all")
            soc2_processing_integrity_controls findings
            ;;
    esac
    
    # Generate compliance report
    printf '%s\n' "${findings[@]}" | jq -s '{
        control_area: $control_area,
        assessment_date: now | strftime("%Y-%m-%d"),
        findings: .,
        summary: {
            total_controls: length,
            compliant: map(select(.status == "COMPLIANT")) | length,
            non_compliant: map(select(.status == "NON_COMPLIANT")) | length,
            not_applicable: map(select(.status == "NOT_APPLICABLE")) | length
        }
    }' --arg control_area "$control_area"
}

# Automated remediation
automated_remediation() {
    local compliance_report="$1"
    local remediation_level="${2:-low_risk}"  # low_risk, medium_risk, high_risk
    
    # Extract non-compliant findings that can be auto-remediated
    local remediable_findings=$(jq -r '.findings[] | select(.status == "NON_COMPLIANT" and .auto_remediable == true)' "$compliance_report")
    
    while read -r finding; do
        local control_id=$(echo "$finding" | jq -r '.control_id')
        local remediation_script=$(echo "$finding" | jq -r '.remediation_script')
        local risk_level=$(echo "$finding" | jq -r '.risk_level')
        
        # Only execute if within allowed risk level
        if should_execute_remediation "$risk_level" "$remediation_level"; then
            log_operation "INFO" "remediation" "Executing automated remediation for control: $control_id"
            
            # Execute remediation with timeout and error handling
            if timeout 300 bash -c "$remediation_script"; then
                log_operation "INFO" "remediation" "Successfully remediated control: $control_id"
            else
                log_operation "ERROR" "remediation" "Failed to remediate control: $control_id"
            fi
        fi
    done <<< "$remediable_findings"
}

#!/bin/bash
# Advanced Linux system monitoring

# Filesystem monitoring with intelligent alerting
monitor_filesystem_health() {
    local config_file="${1:-/etc/filesystem-monitor.conf}"
    local alert_threshold_critical="${2:-90}"
    local alert_threshold_warning="${3:-80}"
    
    # Load configuration
    source "$config_file"
    
    # Monitor disk usage
    while read -r filesystem size used available percentage mount_point; do
        # Skip header and special filesystems
        [[ "$filesystem" == "Filesystem" ]] && continue
        [[ "$filesystem" =~ ^(tmpfs|devtmpfs|udev) ]] && continue
        
        local usage_percent=${percentage%\%}
        
        if (( usage_percent >= alert_threshold_critical )); then
            send_alert "filesystem_critical" "Filesystem $mount_point is $percentage full (critical threshold: $alert_threshold_critical%)"
            
            # Automatic cleanup for specific mount points
            case "$mount_point" in
                "/tmp"|"/var/tmp")
                    cleanup_temp_directories "$mount_point"
                    ;;
                "/var/log")
                    rotate_logs_emergency "$mount_point"
                    ;;
            esac
        elif (( usage_percent >= alert_threshold_warning )); then
            send_alert "filesystem_warning" "Filesystem $mount_point is $percentage full (warning threshold: $alert_threshold_warning%)"
        fi
        
        # Record metrics for time-series analysis
        record_metric "filesystem_usage_percent" "$usage_percent" "mount_point=$mount_point,filesystem=$filesystem"
        record_metric "filesystem_size_bytes" "${size%?}" "mount_point=$mount_point,filesystem=$filesystem"
        record_metric "filesystem_available_bytes" "${available%?}" "mount_point=$mount_point,filesystem=$filesystem"
        
    done < <(df -h)
}

# Mount point monitoring
monitor_mount_points() {
    local expected_mounts_file="${1:-/etc/expected-mounts.list}"
    
    # Check for missing expected mounts
    while read -r expected_mount; do
        [[ -z "$expected_mount" || "$expected_mount" =~ ^# ]] && continue
        
        if ! mountpoint -q "$expected_mount"; then
            send_alert "mount_missing" "Expected mount point $expected_mount is not mounted"
            
            # Attempt automatic remount if configured
            if [[ -f "/etc/auto-remount/$expected_mount.conf" ]]; then
                attempt_auto_remount "$expected_mount"
            fi
        fi
    done < "$expected_mounts_file"
    
    # Check for unexpected mounts
    while read -r mount_info; do
        local mount_point=$(echo "$mount_info" | awk '{print $2}')
        local filesystem_type=$(echo "$mount_info" | awk '{print $3}')
        
        # Skip system mounts
        [[ "$mount_point" =~ ^/(proc|sys|dev) ]] && continue
        [[ "$filesystem_type" =~ ^(proc|sysfs|devtmpfs|tmpfs) ]] && continue
        
        # Check if mount is expected
        if ! grep -q "^$mount_point$" "$expected_mounts_file"; then
            send_alert "mount_unexpected" "Unexpected mount point detected: $mount_point ($filesystem_type)"
        fi
    done < <(mount)
}

# Advanced namespace monitoring
monitor_namespaces() {
    local baseline_file="${1:-/var/lib/namespace-baselines/baseline.json}"
    
    # Get current namespace state
    local current_namespaces=$(lsns -J)
    
    # Compare with baseline if it exists
    if [[ -f "$baseline_file" ]]; then
        local baseline_namespaces=$(cat "$baseline_file")
        
        # Detect new namespaces
        local new_namespaces=$(jq -r --argjson baseline "$baseline_namespaces" '
            .namespaces[] as $current |
            if [$baseline.namespaces[] | select(.ns == $current.ns)] | length == 0 then
                $current
            else
                empty
            end
        ' <<< "$current_namespaces")
        
        # Alert on new namespaces
        while read -r namespace; do
            [[ -z "$namespace" ]] && continue
            local ns_type=$(echo "$namespace" | jq -r '.type')
            local ns_pid=$(echo "$namespace" | jq -r '.pid')
            local ns_command=$(echo "$namespace" | jq -r '.command')
            
            send_alert "namespace_created" "New $ns_type namespace created by PID $ns_pid ($ns_command)"
        done <<< "$new_namespaces"
    fi
    
    # Update baseline
    echo "$current_namespaces" > "$baseline_file"
    
    # Monitor namespace resource usage
    while read -r ns_info; do
        local ns_type=$(echo "$ns_info" | awk '{print $1}')
        local ns_pid=$(echo "$ns_info" | awk '{print $3}')
        
        # Get resource usage for namespace
        local cpu_usage=$(get_namespace_cpu_usage "$ns_pid")
        local memory_usage=$(get_namespace_memory_usage "$ns_pid")
        
        record_metric "namespace_cpu_usage_percent" "$cpu_usage" "type=$ns_type,pid=$ns_pid"
        record_metric "namespace_memory_usage_bytes" "$memory_usage" "type=$ns_type,pid=$ns_pid"
        
    done < <(lsns -n -t mnt,net,pid,user 2>/dev/null | tail -n +2)
}

# Performance monitoring and analysis
monitor_system_performance() {
    local interval="${1:-60}"
    local duration="${2:-3600}"
    
    local end_time=$(($(date +%s) + duration))
    
    while (( $(date +%s) < end_time )); do
        # CPU metrics
        local cpu_stats=$(top -bn1 | head -3 | tail -1)
        local cpu_user=$(echo "$cpu_stats" | awk '{print $2}' | sed 's/%us,//')
        local cpu_system=$(echo "$cpu_stats" | awk '{print $4}' | sed 's/%sy,//')
        local cpu_idle=$(echo "$cpu_stats" | awk '{print $8}' | sed 's/%id,//')
        
        record_metric "cpu_usage_percent" "$cpu_user" "type=user"
        record_metric "cpu_usage_percent" "$cpu_system" "type=system"
        record_metric "cpu_usage_percent" "$cpu_idle" "type=idle"
        
        # Memory metrics
        local memory_stats=$(free -b | grep "^Mem:")
        local memory_total=$(echo "$memory_stats" | awk '{print $2}')
        local memory_used=$(echo "$memory_stats" | awk '{print $3}')
        local memory_available=$(echo "$memory_stats" | awk '{print $7}')
        
        record_metric "memory_total_bytes" "$memory_total"
        record_metric "memory_used_bytes" "$memory_used"
        record_metric "memory_available_bytes" "$memory_available"
        
        # I/O metrics
        local io_stats=$(iostat -x 1 1 | tail -n +4 | head -n -1)
        while read -r io_line; do
            [[ -z "$io_line" ]] && continue
            local device=$(echo "$io_line" | awk '{print $1}')
            local read_iops=$(echo "$io_line" | awk '{print $4}')
            local write_iops=$(echo "$io_line" | awk '{print $5}')
            local util_percent=$(echo "$io_line" | awk '{print $10}')
            
            record_metric "disk_read_iops" "$read_iops" "device=$device"
            record_metric "disk_write_iops" "$write_iops" "device=$device"
            record_metric "disk_utilization_percent" "$util_percent" "device=$device"
        done <<< "$io_stats"
        
        sleep "$interval"
    done
}

# Intelligent alerting system
send_alert() {
    local alert_type="$1"
    local message="$2"
    local severity="${3:-warning}"
    local alert_channels="${4:-default}"
    
    local alert_payload=$(jq -n \
        --arg type "$alert_type" \
        --arg message "$message" \
        --arg severity "$severity" \
        --arg hostname "$(hostname)" \
        --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)" \
        '{
            type: $type,
            message: $message,
            severity: $severity,
            hostname: $hostname,
            timestamp: $timestamp
        }')
    
    # Log alert
    echo "$alert_payload" >> "/var/log/system-alerts.log"
    
    # Send to configured channels
    case "$alert_channels" in
        *"slack"*)
            send_slack_alert "$alert_payload"
            ;;
        *"email"*)
            send_email_alert "$alert_payload"
            ;;
        *"pagerduty"*)
            send_pagerduty_alert "$alert_payload"
            ;;
    esac
    
    # Update metrics
    record_metric "system_alerts_total" "1" "type=$alert_type,severity=$severity"
}

# Metrics recording
record_metric() {
    local metric_name="$1"
    local value="$2"
    local labels="${3:-}"
    local timestamp="${4:-$(date +%s)}"
    
    # Write to Prometheus node_exporter textfile collector
    local metrics_file="/var/lib/node_exporter/textfile_collector/custom_metrics.prom"
    
    # Ensure directory exists
    mkdir -p "$(dirname "$metrics_file")"
    
    # Append metric (simplified format)
    echo "${metric_name}{${labels}} ${value} ${timestamp}000" >> "$metrics_file"
}

#!/bin/bash
# Infrastructure automation framework

# Declarative system configuration
apply_system_configuration() {
    local config_file="$1"
    local dry_run="${2:-false}"
    
    # Parse YAML configuration
    local config=$(yq eval '.' "$config_file")
    
    # Apply filesystem configurations
    local filesystem_configs=$(echo "$config" | yq eval '.filesystems[]' -)
    while read -r fs_config; do
        [[ -z "$fs_config" ]] && continue
        apply_filesystem_config "$fs_config" "$dry_run"
    done <<< "$filesystem_configs"
    
    # Apply mount configurations
    local mount_configs=$(echo "$config" | yq eval '.mounts[]' -)
    while read -r mount_config; do
        [[ -z "$mount_config" ]] && continue
        apply_mount_config "$mount_config" "$dry_run"
    done <<< "$mount_configs"
    
    # Apply namespace configurations
    local namespace_configs=$(echo "$config" | yq eval '.namespaces[]' -)
    while read -r ns_config; do
        [[ -z "$ns_config" ]] && continue
        apply_namespace_config "$ns_config" "$dry_run"
    done <<< "$namespace_configs"
}

# Apply filesystem configuration
apply_filesystem_config() {
    local config="$1"
    local dry_run="$2"
    
    local path=$(echo "$config" | yq eval '.path' -)
    local owner=$(echo "$config" | yq eval '.owner' -)
    local group=$(echo "$config" | yq eval '.group' -)
    local mode=$(echo "$config" | yq eval '.mode' -)
    local type=$(echo "$config" | yq eval '.type' -)
    
    if [[ "$dry_run" == "true" ]]; then
        echo "Would configure filesystem: $path (owner: $owner, group: $group, mode: $mode, type: $type)"
        return
    fi
    
    case "$type" in
        "directory")
            mkdir -p "$path"
            ;;
        "file")
            touch "$path"
            ;;
        "symlink")
            local target=$(echo "$config" | yq eval '.target' -)
            ln -sf "$target" "$path"
            ;;
    esac
    
    # Set ownership and permissions
    [[ "$owner" != "null" ]] && chown "$owner" "$path"
    [[ "$group" != "null" ]] && chgrp "$group" "$path"
    [[ "$mode" != "null" ]] && chmod "$mode" "$path"
    
    log_operation "INFO" "filesystem_config" "Applied configuration for $path"
}

# Apply mount configuration
apply_mount_config() {
    local config="$1"
    local dry_run="$2"
    
    local source=$(echo "$config" | yq eval '.source' -)
    local target=$(echo "$config" | yq eval '.target' -)
    local type=$(echo "$config" | yq eval '.type' -)
    local options=$(echo "$config" | yq eval '.options' -)
    local state=$(echo "$config" | yq eval '.state' -)
    
    if [[ "$dry_run" == "true" ]]; then
        echo "Would $state mount: $source -> $target (type: $type, options: $options)"
        return
    fi
    
    case "$state" in
        "mounted")
            case "$type" in
                "bind")
                    secure_bind_mount "$source" "$target" "$options" "iac"
                    ;;
                "overlay")
                    local lower_dirs=$(echo "$config" | yq eval '.lower_dirs[]' - | tr '\n' ':' | sed 's/:$//')
                    local upper_dir=$(echo "$config" | yq eval '.upper_dir' -)
                    local work_dir=$(echo "$config" | yq eval '.work_dir' -)
                    
                    mkdir -p "$upper_dir" "$work_dir" "$target"
                    mount -t overlay overlay \
                        -o "lowerdir=$lower_dirs,upperdir=$upper_dir,workdir=$work_dir,$options" \
                        "$target"
                    ;;
                *)
                    mount -t "$type" -o "$options" "$source" "$target"
                    ;;
            esac
            ;;
        "unmounted")
            if mountpoint -q "$target"; then
                umount "$target"
            fi
            ;;
    esac
    
    log_operation "INFO" "mount_config" "Applied mount configuration: $source -> $target"
}

# Configuration drift detection
detect_configuration_drift() {
    local config_file="$1"
    local report_file="${2:-/var/log/config-drift-$(date +%Y%m%d-%H%M%S).json}"
    
    local drift_findings=()
    
    # Check filesystem configurations
    local filesystem_configs=$(yq eval '.filesystems[]' "$config_file")
    while read -r fs_config; do
        [[ -z "$fs_config" ]] && continue
        
        local path=$(echo "$fs_config" | yq eval '.path' -)
        local expected_owner=$(echo "$fs_config" | yq eval '.owner' -)
        local expected_group=$(echo "$fs_config" | yq eval '.group' -)
        local expected_mode=$(echo "$fs_config" | yq eval '.mode' -)
        
        if [[ -e "$path" ]]; then
            local actual_owner=$(stat -c '%U' "$path")
            local actual_group=$(stat -c '%G' "$path")
            local actual_mode=$(stat -c '%a' "$path")
            
            if [[ "$expected_owner" != "null" && "$actual_owner" != "$expected_owner" ]]; then
                drift_findings+=("$(jq -n --arg path "$path" --arg expected "$expected_owner" --arg actual "$actual_owner" \
                    '{type: "owner_drift", path: $path, expected: $expected, actual: $actual}')")
            fi
            
            if [[ "$expected_group" != "null" && "$actual_group" != "$expected_group" ]]; then
                drift_findings+=("$(jq -n --arg path "$path" --arg expected "$expected_group" --arg actual "$actual_group" \
                    '{type: "group_drift", path: $path, expected: $expected, actual: $actual}')")
            fi
            
            if [[ "$expected_mode" != "null" && "$actual_mode" != "$expected_mode" ]]; then
                drift_findings+=("$(jq -n --arg path "$path" --arg expected "$expected_mode" --arg actual "$actual_mode" \
                    '{type: "mode_drift", path: $path, expected: $expected, actual: $actual}')")
            fi
        else
            drift_findings+=("$(jq -n --arg path "$path" \
                '{type: "missing_path", path: $path}')")
        fi
    done <<< "$filesystem_configs"
    
    # Generate drift report
    printf '%s\n' "${drift_findings[@]}" | jq -s '{
        timestamp: now | strftime("%Y-%m-%dT%H:%M:%S.%3NZ"),
        config_file: $config_file,
        hostname: $hostname,
        drift_count: length,
        findings: .
    }' --arg config_file "$config_file" --arg hostname "$(hostname)" > "$report_file"
    
    echo "Configuration drift report: $report_file"
    return ${#drift_findings[@]}
}

# Automated remediation of configuration drift
remediate_configuration_drift() {
    local drift_report="$1"
    local auto_fix="${2:-false}"
    
    local findings=$(jq -r '.findings[]' "$drift_report")
    
    while read -r finding; do
        [[ -z "$finding" ]] && continue
        
        local type=$(echo "$finding" | jq -r '.type')
        local path=$(echo "$finding" | jq -r '.path')
        local expected=$(echo "$finding" | jq -r '.expected')
        
        if [[ "$auto_fix" == "true" ]]; then
            case "$type" in
                "owner_drift")
                    chown "$expected" "$path"
                    log_operation "INFO" "drift_remediation" "Fixed owner drift for $path"
                    ;;
                "group_drift")
                    chgrp "$expected" "$path"
                    log_operation "INFO" "drift_remediation" "Fixed group drift for $path"
                    ;;
                "mode_drift")
                    chmod "$expected" "$path"
                    log_operation "INFO" "drift_remediation" "Fixed mode drift for $path"
                    ;;
                "missing_path")
                    log_operation "WARN" "drift_remediation" "Cannot auto-fix missing path: $path"
                    ;;
            esac
        else
            echo "Would fix $type for $path (expected: $expected)"
        fi
    done <<< "$findings"
}

#!/bin/bash
# Advanced Linux troubleshooting toolkit

# System diagnostic collector
collect_system_diagnostics() {
    local issue_type="${1:-general}"
    local output_dir="/var/log/diagnostics/$(date +%Y%m%d-%H%M%S)-$issue_type"
    
    mkdir -p "$output_dir"
    
    # Basic system information
    {
        echo "=== System Information ==="
        uname -a
        echo
        echo "=== Distribution Information ==="
        cat /etc/os-release
        echo
        echo "=== Hardware Information ==="
        lscpu
        echo
        free -h
        echo
        lspci
        echo
        lsblk
    } > "$output_dir/system-info.txt"
    
    # Process and resource information
    {
        echo "=== Process Tree ==="
        ps auxf
        echo
        echo "=== Top Processes ==="
        top -bn1
        echo
        echo "=== Memory Usage ==="
        cat /proc/meminfo
        echo
        echo "=== Swap Usage ==="
        swapon -s
    } > "$output_dir/processes.txt"
    
    # Filesystem and mount information
    {
        echo "=== Filesystem Usage ==="
        df -h
        echo
        echo "=== Inode Usage ==="
        df -i
        echo
        echo "=== Mount Points ==="
        mount
        echo
        echo "=== Mount Namespace Information ==="
        lsns -t mnt
        echo
        echo "=== findmnt Output ==="
        findmnt -D
    } > "$output_dir/filesystem.txt"
    
    # Network information
    {
        echo "=== Network Interfaces ==="
        ip addr show
        echo
        echo "=== Routing Table ==="
        ip route show
        echo
        echo "=== Network Namespaces ==="
        lsns -t net
        echo
        echo "=== Active Connections ==="
        ss -tuln
    } > "$output_dir/network.txt"
    
    # Security information
    {
        echo "=== SELinux Status ==="
        getenforce 2>/dev/null || echo "SELinux not available"
        echo
        echo "=== AppArmor Status ==="
        aa-status 2>/dev/null || echo "AppArmor not available"
        echo
        echo "=== Kernel Security Parameters ==="
        sysctl kernel.dmesg_restrict kernel.kptr_restrict kernel.yama.ptrace_scope
    } > "$output_dir/security.txt"
    
    # Collect logs
    mkdir -p "$output_dir/logs"
    cp /var/log/messages "$output_dir/logs/" 2>/dev/null || true
    cp /var/log/syslog "$output_dir/logs/" 2>/dev/null || true
    cp /var/log/kern.log "$output_dir/logs/" 2>/dev/null || true
    journalctl --since "1 hour ago" > "$output_dir/logs/journal.log"
    
    # Issue-specific diagnostics
    case "$issue_type" in
        "mount")
            collect_mount_diagnostics "$output_dir"
            ;;
        "namespace")
            collect_namespace_diagnostics "$output_dir"
            ;;
        "performance")
            collect_performance_diagnostics "$output_dir"
            ;;
    esac
    
    # Create archive
    tar -czf "$output_dir.tar.gz" -C "$(dirname "$output_dir")" "$(basename "$output_dir")"
    echo "Diagnostics collected: $output_dir.tar.gz"
}

# Mount-specific diagnostics
collect_mount_diagnostics() {
    local output_dir="$1"
    
    {
        echo "=== Mount Audit ==="
        audit_mount_security
        echo
        echo "=== Bind Mount Registry ==="
        cat /var/lib/enterprise-mounts/registry 2>/dev/null || echo "No registry found"
        echo
        echo "=== Overlay Information ==="
        find /var/lib/overlays -name "metadata.json" -exec cat {} \; 2>/dev/null
        echo
        echo "=== Failed Mount Attempts ==="
        grep -i "mount.*failed" /var/log/messages /var/log/syslog 2>/dev/null | tail -20
    } > "$output_dir/mount-diagnostics.txt"
}

# Namespace-specific diagnostics
collect_namespace_diagnostics() {
    local output_dir="$1"
    
    {
        echo "=== All Namespaces ==="
        lsns
        echo
        echo "=== Namespace Hierarchy ==="
        lsns -t pid,mnt,net,user -o NS,TYPE,NPROCS,PID,PPID,COMMAND,USER
        echo
        echo "=== Namespace Audit ==="
        audit_namespace_security
        echo
        echo "=== Container Runtime Namespaces ==="
        if command -v crictl >/dev/null; then
            crictl ps
        fi
        if command -v docker >/dev/null; then
            docker ps --format "table {{.ID}}\t{{.Image}}\t{{.Status}}\t{{.Names}}"
        fi
    } > "$output_dir/namespace-diagnostics.txt"
}

# Performance-specific diagnostics
collect_performance_diagnostics() {
    local output_dir="$1"
    
    # CPU performance
    {
        echo "=== CPU Information ==="
        lscpu
        echo
        echo "=== CPU Frequency ==="
        cat /proc/cpuinfo | grep "cpu MHz"
        echo
        echo "=== Load Average History ==="
        uptime
        echo
        echo "=== Context Switches ==="
        grep "ctxt" /proc/stat
    } > "$output_dir/cpu-performance.txt"
    
    # Memory performance
    {
        echo "=== Memory Performance ==="
        cat /proc/meminfo
        echo
        echo "=== Memory Fragmentation ==="
        cat /proc/buddyinfo
        echo
        echo "=== Virtual Memory Statistics ==="
        cat /proc/vmstat
    } > "$output_dir/memory-performance.txt"
    
    # I/O performance
    {
        echo "=== I/O Statistics ==="
        iostat -x 1 3
        echo
        echo "=== Disk Statistics ==="
        cat /proc/diskstats
        echo
        echo "=== I/O Scheduler Information ==="
        for disk in /sys/block/*/queue/scheduler; do
            echo "$disk: $(cat "$disk")"
        done
    } > "$output_dir/io-performance.txt"
}

# Interactive troubleshooting assistant
troubleshooting_assistant() {
    local issue_description="$1"
    
    echo "Linux Troubleshooting Assistant"
    echo "==============================="
    echo
    echo "Issue: $issue_description"
    echo
    
    # Analyze issue type
    local issue_keywords=($(echo "$issue_description" | tr '[:upper:]' '[:lower:]' | tr -s '[:space:]' '\n'))
    
    for keyword in "${issue_keywords[@]}"; do
        case "$keyword" in
            "mount"|"unmount"|"bind")
                suggest_mount_troubleshooting
                ;;
            "namespace"|"container"|"isolation")
                suggest_namespace_troubleshooting
                ;;
            "performance"|"slow"|"cpu"|"memory")
                suggest_performance_troubleshooting
                ;;
            "permission"|"access"|"denied")
                suggest_permission_troubleshooting
                ;;
        esac
    done
    
    echo "Collecting relevant diagnostics..."
    collect_system_diagnostics "general"
}

# Mount troubleshooting suggestions
suggest_mount_troubleshooting() {
    echo "Mount/Filesystem Troubleshooting Steps:"
    echo "--------------------------------------"
    echo "1. Check mount status: mountpoint -q /path/to/mount"
    echo "2. Verify source exists: ls -la /source/path"
    echo "3. Check permissions: ls -ld /source/path /target/path"
    echo "4. Review mount options: findmnt /path/to/mount"
    echo "5. Check for conflicting mounts: lsof /path/to/mount"
    echo "6. Verify filesystem integrity: fsck -n /dev/device"
    echo "7. Check kernel messages: dmesg | grep -i mount"
    echo
}

# Namespace troubleshooting suggestions
suggest_namespace_troubleshooting() {
    echo "Namespace Troubleshooting Steps:"
    echo "-------------------------------"
    echo "1. List all namespaces: lsns"
    echo "2. Check namespace ownership: lsns -o NS,TYPE,NPROCS,PID,USER"
    echo "3. Examine process tree: ps auxf"
    echo "4. Check namespace permissions: ls -l /proc/PID/ns/"
    echo "5. Verify namespace isolation: unshare --help"
    echo "6. Check container runtime: crictl ps or docker ps"
    echo "7. Review security policies: aa-status or getenforce"
    echo
}

# Performance troubleshooting suggestions
suggest_performance_troubleshooting() {
    echo "Performance Troubleshooting Steps:"
    echo "----------------------------------"
    echo "1. Check load average: uptime"
    echo "2. Analyze CPU usage: top or htop"
    echo "3. Check memory usage: free -h"
    echo "4. Review I/O statistics: iostat -x 1"
    echo "5. Check for swapping: vmstat 1"
    echo "6. Analyze disk usage: df -h and du -sh /*"
    echo "7. Review network performance: iftop or ss -i"
    echo "8. Check for runaway processes: ps aux --sort=-%cpu"
    echo
}

# Permission troubleshooting suggestions
suggest_permission_troubleshooting() {
    echo "Permission Troubleshooting Steps:"
    echo "--------------------------------"
    echo "1. Check file permissions: ls -la /path/to/file"
    echo "2. Verify ownership: stat /path/to/file"
    echo "3. Check ACLs: getfacl /path/to/file"
    echo "4. Review SELinux context: ls -Z /path/to/file"
    echo "5. Check AppArmor profiles: aa-status"
    echo "6. Verify user/group membership: id username"
    echo "7. Test access: sudo -u username test -r /path/to/file"
    echo
}

# Linux Systems Administrator Career Progression
CAREER_LEVELS=(
    "Junior Systems Administrator"
    "Systems Administrator" 
    "Senior Systems Administrator"
    "Principal Systems Engineer"
    "Infrastructure Architect"
    "Distinguished Engineer"
)

# Site Reliability Engineer Track
SRE_SKILLS=(
    "Incident Response and Postmortem Analysis"
    "Service Level Objectives (SLO) Implementation"
    "Chaos Engineering and Resilience Testing"
    "Performance Engineering and Optimization"
    "Automation and Tool Development"
)

# Platform Engineering Track
PLATFORM_SKILLS=(
    "Kubernetes Operator Development"
    "CI/CD Pipeline Design and Implementation"
    "Developer Experience and Self-Service Platforms"
    "Multi-Cloud and Hybrid Infrastructure"
    "Security and Compliance Automation"
)

# Example: Contributing to Linux kernel or system tools
git clone https://github.com/torvalds/linux.git
# Focus areas: filesystem drivers, namespace improvements, security enhancements

# Contributing to system administration tools
git clone https://github.com/systemd/systemd.git
# Focus areas: service management, logging, networking

# Creating useful automation tools
create_automation_portfolio() {
    local portfolio_dir="$HOME/sysadmin-portfolio"
    mkdir -p "$portfolio_dir"/{scripts,configs,documentation}
    
    # System monitoring scripts
    cat > "$portfolio_dir/scripts/advanced-system-monitor.sh" <<'EOF'
#!/bin/bash
# Advanced system monitoring with intelligent alerting
# Demonstrates: bash scripting, system monitoring, alerting patterns
EOF
    
    # Infrastructure as code examples
    cat > "$portfolio_dir/configs/enterprise-server-config.yml" <<'EOF'
# Ansible playbook for enterprise server configuration
# Demonstrates: automation, configuration management, best practices
EOF
    
    # Technical documentation
    cat > "$portfolio_dir/documentation/troubleshooting-guide.md" <<'EOF'
# Enterprise Linux Troubleshooting Guide
# Demonstrates: technical writing, problem-solving methodologies
EOF
}