;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2019 Danny Milosavljevic <dannym@scratchpost.org>
;;; Copyright © 2020 Robin Green <greenrd@greenrd.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu services auditd)
  #:use-module (gnu services)
  #:use-module (gnu services configuration)
  #:use-module (gnu services base)
  #:use-module (gnu services shepherd)
  #:use-module (gnu packages admin)
  #:use-module (guix records)
  #:use-module (guix gexp)
  #:use-module (guix packages)
  #:export (auditd-configuration
            auditd-service-type
            %default-auditd-configuration-directory))

(define auditd.conf
  (plain-file "auditd.conf" "log_file = /var/log/audit.log\nlog_format = \
ENRICHED\nfreq = 1\nspace_left = 5%\nspace_left_action = \
syslog\nadmin_space_left_action = ignore\ndisk_full_action = \
ignore\ndisk_error_action = syslog\n"))

(define %default-auditd-configuration-directory
  (computed-file "auditd"
                 #~(begin
                     (mkdir #$output)
                     (copy-file #$auditd.conf
                                (string-append #$output "/auditd.conf")))))

(define-record-type* <auditd-configuration>
  auditd-configuration make-auditd-configuration
  auditd-configuration?
  (audit                   auditd-configuration-audit                          ; file-like
                           (default audit))
  (configuration-directory auditd-configuration-configuration-directory))      ; file-like

(define (auditd-shepherd-service config)
  (let* ((audit (auditd-configuration-audit config))
         (configuration-directory (auditd-configuration-configuration-directory config)))
    (list (shepherd-service
           (documentation "Auditd allows you to audit file system accesses and process execution.")
           (provision '(auditd))
           (start #~(make-forkexec-constructor
                     (list (string-append #$audit "/sbin/auditd") "-c" #$configuration-directory)
                     #:pid-file "/var/run/auditd.pid"))
           (stop #~(make-kill-destructor))))))

(define auditd-service-type
  (service-type (name 'auditd)
                (description "Allows auditing file system accesses and process execution.")
                (extensions
                 (list
                  (service-extension shepherd-root-service-type
                                     auditd-shepherd-service)))
                (default-value
                  (auditd-configuration
                   (configuration-directory %default-auditd-configuration-directory)))))
arget' rather than the deprecated one.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-08-29 01:05:26 -0400'>2021-08-29</span></td><td><a href='/guix/commit/gnu/bootloader.scm?id=2ca982ff41270288913ad6b7d5d9e1cad87b06d9'>gnu: bootloader: Support multiple targets.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://issues.guix.gnu.org/40997&gt;.

* gnu/bootloader.scm (&lt;bootloader-configuration&gt;): New 'targets' field.
(%bootloader-configuration-target): New procedure.
(bootloader-configuration-target): Add deprecation warning.
(bootloader-configuration-targets): New procedure.
* guix/scripts/system.scm (install): Access targets via
bootloader-configuration-targets.
(perform-action)[bootloader-target]: Remove unused argument and update doc.
Access targets via bootloader-configuration-targets and fix indentation.
(process-action): Access targets via bootloader-configuration-targets.
Do not provide the unused BOOTLOADER-TARGET argument when applying
`perform-action'.
* guix/scripts/system/reconfigure.scm (install-bootloader-program): Rename
DEVICE argument to DEVICES.  Adjust doc and comment.  Apply `installer' and
`disk-installer' for every DEVICES.
(install-bootloader): Access targets via bootloader-configuration-targets and
rename variable from DEVICE to DEVICES.
* gnu/tests/install.scm: Adjust accordingly.
* tests/guix-system.sh: Likewise.
* gnu/tests/reconfigure.scm (run-install-bootloader-test): Adjust the DEVICES
argument so that it is a list.
* doc/guix.texi: Update doc.
</span></span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2020-11-17 16:03:03 +0100'>2020-11-17</span></td><td><a href='/guix/commit/gnu/bootloader.scm?id=ede4117f7f18e118003f2599f5c8e985dfbdf9a5'>gnu: bootloader: efi-bootloader-chain: Allow multiple HOOKS.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/bootloader.scm (efi-bootloader-profile): Allow multiple HOOKS.
(efi-bootloader-chain): Allow multiple HOOKS.

Signed-off-by: Danny Milosavljevic &lt;dannym@scratchpost.org&gt;
</span></span></td><td>Stefan</td></tr>
<tr><td><span title='2020-11-16 10:33:18 +0100'>2020-11-16</span></td><td><a href='/guix/commit/gnu/bootloader.scm?id=74eeb11daee906cb012f10b6bb3afd254f9ea5c2'>gnu: bootloader: Support chain loading to an EFI bootloader.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/bootloader.scm (efi-bootloader-profile): New function.
(efi-bootloader-chain): New function.

Signed-off-by: Danny Milosavljevic &lt;dannym@scratchpost.org&gt;
</span></span></td><td>Stefan</td></tr>
<tr><td><span title='2020-06-08 13:51:18 +0200'>2020-06-08</span></td><td><a href='/guix/commit/gnu/bootloader.scm?id=21acd8d6c11b85d06c82b168807b35cb7d2d0adf'>bootloader: Extend `&lt;menu-entry&gt;' for multiboot.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/bootloader.scm (&lt;menu-entry&gt;)[multiboot-kernel,multiboot-arguments,
multiboot-modules]: New fields.
[linux,initrd]: Add default value '#f'.
(menu-entry-&gt;sexp, sexp-&gt;menu-entry): Support multiboot entry.
* doc/guix.texi (Bootloader Configuration): Document them.
</span></span></td><td>Jan (janneke) Nieuwenhuizen</td></tr>
<tr><td><span title='2020-05-29 08:37:13 +0200'>2020-05-29</span></td><td><a href='/guix/commit/gnu/bootloader.scm?id=7feefb3b82186be382725ac2d6b7e9f8953e4a83'>bootloader: Add 'disk-image-installer'.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/bootloader.scm (&lt;bootloader&gt;)[disk-image-installer]: New field,
(bootloader-disk-image-installer): export it.
* gnu/bootloader/grub.scm (install-grub-disk-image): New procedure ...
(grub-bootloader): ... used as "disk-image-installer" here.
(grub-efi-bootloader): set "disk-image-installer" to #f.
* gnu/system/image.scm (root-partition?, find-root-partition): Move to
"Helpers" section.
(root-partition-index): New procedure.
(system-disk-image): Honor disk-image-installer, and
use it to install the bootloader directly on the disk-image, if supported.
</span></span></td><td>Mathieu Othacehe</td></tr>