#!/bin/bash

set -xeu -o pipefail

date
echo Delaying start for '<%= p("pre_start_delay") %>' seconds
sleep '<%= p("pre_start_delay") %>'
date

if ! grep -e '^-e 2$' /etc/audit/rules.d/audit.rules -q; then
  echo '
# Custom rules; added by auditd job (os-conf-release)
<% p("rules").each do |rule| %>
<%= rule %>
<% end %>
' >> /etc/audit/rules.d/audit.rules

  echo '
# Make audit rules immutable; added by auditd job (os-conf-release)
-e 2' >> /etc/audit/rules.d/audit.rules

  # If auditd has trouble coming up, (e.g. `ENOBUFS`), we try for 5 minutes
  # before giving up
  COUNT=0
  service auditd stop
  while ! service auditd status && [ $COUNT -lt 10 ]; do
    service auditd restart
    COUNT=$(( COUNT + 1 ))
    sleep 30
  done
  if [ $COUNT -ge 10 ]; then
    echo "Could not start auditd; tried $COUNT times. Check auditd logs"
    exit 1
  fi
fi
