#!/usr/bin/env bash
set -euo pipefail

# Set HARRESI_ROOT_PREFIX when preparing an offline root filesystem.
ROOT_PREFIX="${HARRESI_ROOT_PREFIX:-}"
AUDIT_ROOT_REL="/var/log/harresi/audit"

root_path() {
  printf '%s%s\n' "$ROOT_PREFIX" "$1"
}

AUDIT_ROOT="$(root_path "$AUDIT_ROOT_REL")"
AUDITD_DIR="$AUDIT_ROOT/auditd"
SECURITY_DIR="$AUDIT_ROOT/security"
PRODUCT_DIR="$AUDIT_ROOT/product"
AIDE_DIR="$AUDIT_ROOT/aide"

install -d -m 0755 -o root -g root "$AUDIT_ROOT"
install -d -m 0700 -o root -g root "$AUDITD_DIR"
install -d -m 0755 -o root -g root "$SECURITY_DIR"
install -d -m 1777 -o root -g root "$SECURITY_DIR/tmux-status"
install -d -m 0750 -o root -g root "$PRODUCT_DIR"
install -d -m 0755 -o root -g root "$AIDE_DIR"

ensure_file() {
  local mode="$1" path="$2"
  [[ -e "$path" ]] || install -m "$mode" -o root -g root /dev/null "$path"
  chown root:root "$path"
  chmod "$mode" "$path"
}

ensure_file 0600 "$AUDITD_DIR/audit.log"
ensure_file 0640 "$SECURITY_DIR/audit-security.log"
ensure_file 0640 "$PRODUCT_DIR/audit-product.log"
ensure_file 0640 "$PRODUCT_DIR/ids-ips-events.log"
ensure_file 0644 "$AIDE_DIR/aide.log"
ensure_file 0644 "$AIDE_DIR/aide_history.log"

AUDITD_CONF="$(root_path /etc/audit/auditd.conf)"
if [[ -f "$AUDITD_CONF" ]]; then
  set_auditd_option() {
    local key="$1" value="$2"
    if grep -Eq "^[[:space:]]*${key}[[:space:]]*=" "$AUDITD_CONF"; then
      sed -i -E "s#^[[:space:]]*${key}[[:space:]]*=.*#${key} = ${value}#" "$AUDITD_CONF"
    else
      printf '\n%s = %s\n' "$key" "$value" >> "$AUDITD_CONF"
    fi
  }

  set_auditd_option log_file "$AUDIT_ROOT_REL/auditd/audit.log"
  set_auditd_option log_group root
  set_auditd_option flush DATA
  set_auditd_option max_log_file_action ROTATE
  set_auditd_option num_logs 5
else
  printf '[WARN] auditd.conf not found; auditd storage path was not configured: %s\n' "$AUDITD_CONF" >&2
fi
