#
# Cookbook:: irrigate-orchard_base
# Recipe:: system_files_permissions
#
# Copyright: The Orchard
#
# Used data structure looks like:
#  files = [
#    {
#      'path' => '/etc/passwd',
#      owner' => 'root',
#      group' => 'root',
#      mode' => '0644',
#    },
#  ]

files = if platform_family?('rhel', 'amazon', 'debian')
          [
            {
              'path' => '/etc/passwd',
              'mode' => '0644',
            },
            {
              'path' => '/etc/shadow',
              'mode' => '0000',
            },
            {
              'path' => '/etc/group',
              'mode' => '0644',
            },
            {
              'path' => '/etc/gshadow',
              'mode' => '0000',
            },
            {
              'path' => '/etc/passwd-',
              'mode' => '0600',
            },
            {
              'path' => '/etc/shadow-',
              'mode' => '0000',
            },
            {
              'path' => '/etc/group-',
              'mode' => '0600',
            },
            {
              'path' => '/etc/gshadow-',
              'mode' => '0600',
            },
            {
              'path' => '/etc/rsyslog.conf',
              'mode' => '0640',
            },
          ]
        else
          []
        end

files.each do |item|
  file item['path'] do
    mode item['mode']
    owner 'root'
    group 'root'
  end
end

execute 'Enforce log file permissions' do
  command 'find /var/log -type f -exec chmod g-wx,o-rwx {} +'
  user 'root'
  action :run
  returns [0, 1]
end