Add alphagov/clamav module to Puppetfile

Adds the alphagov/clamav module to Puppetfile. We're eating our own dog food here.
Add `base::clamav` and `clamav` classes to Hiera

To use the `alphagov/clamav` package and the `base::clamav` class to control
configuration, we need to add it to Hiera as we're using Hiera as a
lightweight ENC in this instance.
Add /srv/infected directory

The /srv/infected directory is used by ClamAV to move infected files to in
7660f5d. This change ensures that the directory exists.
Add shell script to scan /srv/backup-data

This commit adds a shell script to scan the contents of /srv/backup-data, log
output to a specified .log file, and move infected data to /srv/infected
Add clamav.pp manifest to control ClamAV scanning

This commit adds a manifest (clamav.pp) to Puppet in order to control ClamAV.
The manifest itself does not directly run ClamAV, but rather it contains a cron
type to run a shell script at a random number of minutes (between 0 and 60) past
every hour.
Amend binary

@dcarley is correct; the binary was incorrect.
Move /srv/infected dir to clamav.pp; set require

Move /srv/infected directory to clamav.pp and set a require param on the File
type for the shell script.
Add logrotate support

The scan-backup-data.sh script logs output to a file in /var/log. By default,
this file will then be allowed to grow indefinitely. We should curtail this by
using logrotate.

This commit adds a logrotate configuration for `/var/log/clamav/clamdscan.log',
which:

- sets the log rotation to daily
- keeps the prior seven days of logs
- compresses stored logs with gzip
- delays compression until next rotation
- doesn't halt on error
- avoids log rotation if the file is empty
- creates a new file after rotation

It also ensures the file is present in the clamav.pp Puppet manifest.
Amends rotation intervals

The comments in this file are already well documented; they serve little purpose
in-line in the file, and add extra overhead if the commands are ever changed.

The rotation interval has been changed to weekly; we keep a year's worth (52
weeks) of logs before logrotate rotates them. This was done for security
purposes.
Amend clamscan program

In it's original form, this script used `clamdscan`, rather than `clamscan`.
During testing, however, it was realised that the script died as `clamdscan` was
unable to access `/srv/infected`.

By default, AppArmor restricts the behaviour of the clamdscan executable, and
investigation using `aa-status` showed that AppArmor was holding `clamdscan` in
enforce mode. I amended AppArmor to put `clamdscan` in to complain mode
(allowing the executable to run, and logging errors, rather than disallowing it
to run entirely). This then allowed `clamdscan` to run successfully.

However, a second issue then arose: `/srv/backup-data/lost+found` was
unaccessible. `clamdscan` doesn't support the --exclude switch, whereas `clamscan`
does. To that end, the command has been changed to support `clamscan`, thereby
allowing us to exclude `lost+found` as we do not particularly care about data
stored within that folder. Unfortunately, `clamdscan` did not like the use of
the `--exclude` switch.

`clamscan` and `clamdscan` have subtle differences, it seems. The former is
meant to be run as one-off and in cron jobs; the latter is daemonized. The
former also processes the virus definitions each time it runs; the latter does
not.

After it was realised that simply changing the command from `clamdscan` to
`clamscan` allowed us to use the `--exclude` switch, I then tested to see if the
AppArmor changes were still required. It turns out that they were not - using
`clamscan` over `clamdscan` was the overall fix to the issue, and the AppArmor
changes were reverted.
Merge pull request #19 from alphagov/add-clam

Add ClamAV