include_recipe 'auditd::rules'

template '/etc/audit/auditd.conf' do
  source 'auditd.conf.erb'
  owner 'root'
  group 'root'
  mode '0640'
end

Chef::Resource::Template.include Ciscat::Auditd::HelperPrivilegedCommands
template '/etc/audit/rules.d/cis.rules' do
  source 'debian_audit.rules.erb'
  owner 'root'
  group 'root'
  mode '0640'
end

#####                         #####
# Emptying default rules snippet  #
####                           ####
file '/etc/audit/rules.d/audit.rules' do
  content ''
end

#####                           #####
# Idempotent command by definition. #
# Doesn't need a only_if wrapper.   #
####                             ####
execute 'Regenerate /etc/audit/audit.rules' do
  command '/usr/sbin/augenrules --load'
end

#######                                                            ########
#  Replaced by auditctl --reload <ruleset> as an option for restricted    #
#  auditctl restart possibility (Nobody is able to restart the service).  #
#####                                                                 #####
service 'auditd' do
  restart_command 'auditctl -R /etc/audit/audit.rules' if platform_family?('rhel', 'amazon', 'debian') && systemd?
  supports [:start, :stop, :restart, :reload, :status]
  action :restart
end

cron 'auditd_cleanup' do
  hour node['audit']['cleanup_routine']['hour']
  minute node['audit']['cleanup_routine']['minute']
  user 'root'
  command '/bin/find /var/log/audit -type f -mtime +0 -exec rm -rf {} \; > /dev/null 2>&1'
end