# Cookbook:: irrigate-orchard_base
# Recipe:: cron_security
#
# Copyright: The Orchard
#
# This recipe manages crond files and their permissions for all systems.
#
cron_files = %w(
  /etc/crontab
  /etc/cron.hourly
  /etc/cron.allow
  /etc/at.allow
  /etc/cron.daily
  /etc/cron.weekly
  /etc/cron.monthly
  /etc/cron.d
)

restricted_cron_files = %w(
  /etc/at.deny
  /etc/cron.deny
)

cron_files.each do |cron_file|
  directory cron_file do
    recursive true
    mode '0700'
    owner 'root'
    group 'root'
    path cron_file
    only_if { ::File.directory?(cron_file.to_s) }
  end

  file cron_file do
    mode '0600'
    owner 'root'
    group 'root'
    path cron_file
    not_if { ::File.directory?(cron_file.to_s) }
  end
end

restricted_cron_files.each do |restricted_file|
  file restricted_file do
    path restricted_file
    action :delete
  end
end