From 5beb52a4df006e0ac693883d4592b3cf0b399b4a Mon Sep 17 00:00:00 2001 From: xSmurf Date: Fri, 7 Jun 2019 23:36:57 -0400 Subject: [PATCH] Moving to sudo, and pwdfile with plymouth set screen for live and install modes. --- .../citadel-config/citadel-config.bb | 12 +++++-- .../files/citadel-setpassword.sh | 36 +++++++++++++++++++ .../citadel-config/files/sudo-citadel | 2 ++ .../files/systemd/citadel-setpassword.service | 14 ++++++++ .../images/citadel-rootfs-image.bb | 8 +++-- .../packagegroup-citadel-base.bb | 3 ++ .../recipes-support/libidn2/libidn2_2.0.5.bb | 29 +++++++++++++++ .../libpam-pwdfile/libpam-pwdfile_1.0.bb | 24 +++++++++++++ .../mkpasswd/mkpasswd_5.4.2.bb | 19 ++++++++++ .../pam/files/pam.d/common-auth | 20 +++++++++++ .../recipes-support/pam/libpam_%.bbappend | 3 ++ 11 files changed, 166 insertions(+), 4 deletions(-) create mode 100755 meta-citadel/recipes-citadel/citadel-config/files/citadel-setpassword.sh create mode 100644 meta-citadel/recipes-citadel/citadel-config/files/sudo-citadel create mode 100644 meta-citadel/recipes-citadel/citadel-config/files/systemd/citadel-setpassword.service create mode 100644 meta-citadel/recipes-support/libidn2/libidn2_2.0.5.bb create mode 100644 meta-citadel/recipes-support/libpam-pwdfile/libpam-pwdfile_1.0.bb create mode 100644 meta-citadel/recipes-support/mkpasswd/mkpasswd_5.4.2.bb create mode 100644 meta-citadel/recipes-support/pam/files/pam.d/common-auth create mode 100644 meta-citadel/recipes-support/pam/libpam_%.bbappend diff --git a/meta-citadel/recipes-citadel/citadel-config/citadel-config.bb b/meta-citadel/recipes-citadel/citadel-config/citadel-config.bb index b678db1..bf620dc 100644 --- a/meta-citadel/recipes-citadel/citadel-config/citadel-config.bb +++ b/meta-citadel/recipes-citadel/citadel-config/citadel-config.bb @@ -37,7 +37,9 @@ SRC_URI = "\ file://locale.conf \ file://environment.sh \ file://fstab \ + file://sudo-citadel \ file://citadel-ifconfig.sh \ + file://citadel-setpassword.sh \ file://00-storage-tmpfiles.conf \ file://NetworkManager.conf \ file://share/dot.bashrc \ @@ -48,6 +50,7 @@ SRC_URI = "\ file://systemd/zram-swap.service \ file://systemd/iptables.service \ file://systemd/session-switcher.service \ + file://systemd/citadel-setpassword.service \ file://skel/profile \ file://skel/bashrc \ file://skel/vimrc \ @@ -64,12 +67,12 @@ USERADD_PACKAGES = "${PN}" USERADD_PARAM_${PN} = "-m -u 1000 -s /bin/bash citadel" INHIBIT_PACKAGE_DEBUG_SPLIT = "1" -# for citadel-ifconfig.sh +# for citadel-ifconfig.sh citadel-setpassword.sh RDEPENDS_${PN} = "bash" inherit allarch systemd useradd -SYSTEMD_SERVICE_${PN} = "zram-swap.service watch-run-user.path iptables.service session-switcher.service" +SYSTEMD_SERVICE_${PN} = "zram-swap.service watch-run-user.path iptables.service session-switcher.service citadel-setpassword.service" do_install() { install -m 0755 -d ${D}/storage @@ -83,14 +86,17 @@ do_install() { install -m 0755 -d ${D}${sysconfdir}/NetworkManager install -m 0755 -d ${D}${sysconfdir}/polkit-1/rules.d install -m 0755 -d ${D}${sysconfdir}/modprobe.d + install -m 0755 -d ${D}${sysconfdir}/sudoers.d install -m 0755 -d ${D}${datadir}/iptables install -m 0755 -d ${D}${datadir}/factory/skel install -m 0700 -d ${D}${localstatedir}/lib/NetworkManager install -m 0700 -d ${D}${localstatedir}/lib/NetworkManager/system-connections + install -m 0755 -d ${D}${datadir}/citadel install -m 0644 ${WORKDIR}/locale.conf ${D}${sysconfdir}/locale.conf install -m 0644 ${WORKDIR}/environment.sh ${D}${sysconfdir}/profile.d/environment.sh install -m 0644 ${WORKDIR}/fstab ${D}${sysconfdir}/fstab + install -m 0440 ${WORKDIR}/sudo-citadel ${D}${sysconfdir}/sudoers.d/citadel install -m 0644 ${WORKDIR}/00-storage-tmpfiles.conf ${D}${sysconfdir}/tmpfiles.d install -m 0644 ${WORKDIR}/NetworkManager.conf ${D}${sysconfdir}/NetworkManager @@ -99,6 +105,7 @@ do_install() { install -m 644 ${WORKDIR}/systemd/iptables.service ${D}${systemd_system_unitdir} install -m 644 ${WORKDIR}/systemd/session-switcher.service ${D}${systemd_system_unitdir} + install -m 644 ${WORKDIR}/systemd/citadel-setpassword.service ${D}${systemd_system_unitdir} install -m 644 ${WORKDIR}/systemd/watch-run-user.path ${D}${systemd_system_unitdir} install -m 644 ${WORKDIR}/systemd/watch-run-user.service ${D}${systemd_system_unitdir} @@ -114,6 +121,7 @@ do_install() { install -m 0644 ${WORKDIR}/udev/citadel-network.rules ${D}${sysconfdir}/udev/rules.d/ install -m 0755 ${WORKDIR}/citadel-ifconfig.sh ${D}${libexecdir} + install -m 0754 ${WORKDIR}/citadel-setpassword.sh ${D}${libexecdir} install -m 0644 ${WORKDIR}/udev/pci-pm.rules ${D}${sysconfdir}/udev/rules.d/ install -m 0644 ${WORKDIR}/udev/scsi-alpm.rules ${D}${sysconfdir}/udev/rules.d/ diff --git a/meta-citadel/recipes-citadel/citadel-config/files/citadel-setpassword.sh b/meta-citadel/recipes-citadel/citadel-config/files/citadel-setpassword.sh new file mode 100755 index 0000000..1be7e40 --- /dev/null +++ b/meta-citadel/recipes-citadel/citadel-config/files/citadel-setpassword.sh @@ -0,0 +1,36 @@ +#!/bin/bash + +PF="/storage/citadel-state/passwd" +if [ -e "${PF}" ]; then + exit 0 +fi + +success= +for ((I = 0; I < 3; I++)); do + P1= + P2= + /usr/bin/plymouth display-message --text='Set new user password...' + /usr/bin/plymouth pause-progress + P1="$(/usr/bin/plymouth ask-for-password --prompt='Password')" + /usr/bin/plymouth unpause-progress + /usr/bin/plymouth pause-progress + P2="$(/usr/bin/plymouth ask-for-password --prompt='Confirm')" + + if [ -n "${P1}" -a "${P1}" == "${P2}" ]; then + /usr/bin/plymouth unpause-progress + success=true + break; + fi + /usr/bin/plymouth display-message --text='Passwords do not match, try again...' + /usr/bin/plymouth unpause-progress + sleep 3 +done +if [ -n "${success}" ]; then + crypt=$(echo -n "${P1}" | /usr/bin/mkpasswd -s -m sha-512) + echo "citadel:${crypt}" > ${PF} + chmod 444 "${PF}" + /usr/bin/plymouth display-message --text='Password set succesfully...' +else + /usr/bin/plymouth display-message --text='Failed to set password...' +fi +exit 0; diff --git a/meta-citadel/recipes-citadel/citadel-config/files/sudo-citadel b/meta-citadel/recipes-citadel/citadel-config/files/sudo-citadel new file mode 100644 index 0000000..16a0b1e --- /dev/null +++ b/meta-citadel/recipes-citadel/citadel-config/files/sudo-citadel @@ -0,0 +1,2 @@ +# Citadel sudo +citadel ALL=(ALL:ALL) ALL diff --git a/meta-citadel/recipes-citadel/citadel-config/files/systemd/citadel-setpassword.service b/meta-citadel/recipes-citadel/citadel-config/files/systemd/citadel-setpassword.service new file mode 100644 index 0000000..a37f57f --- /dev/null +++ b/meta-citadel/recipes-citadel/citadel-config/files/systemd/citadel-setpassword.service @@ -0,0 +1,14 @@ +[Unit] +Description=Citadel Set Password +After=storage.mount +Requires=storage.mount +Before=gdm.service + +[Service] +Type=oneshot +RemainAfterExit=no +ExecStart=/usr/libexec/citadel-setpassword.sh + +[Install] +WantedBy=multi-user.target +RequiredBy=graphical.target diff --git a/meta-citadel/recipes-citadel/images/citadel-rootfs-image.bb b/meta-citadel/recipes-citadel/images/citadel-rootfs-image.bb index 51d5869..4355050 100644 --- a/meta-citadel/recipes-citadel/images/citadel-rootfs-image.bb +++ b/meta-citadel/recipes-citadel/images/citadel-rootfs-image.bb @@ -4,7 +4,7 @@ LICENSE = "MIT" SYSTEMD_DEFAULT_TARGET = "graphical.target" -ROOTFS_POSTPROCESS_COMMAND += "set_citadel_user_password; symlink_lib64; setup_var; append_os_release;" +ROOTFS_POSTPROCESS_COMMAND += "set_disable_root_password; symlink_lib64; setup_var; append_os_release;" IMAGE_INSTALL += "\ packagegroup-citadel-base \ @@ -18,7 +18,7 @@ require citadel-image.inc inherit citadel-image set_blank_user_password() { - sed -i 's%^citadel:!:%citadel::%' ${IMAGE_ROOTFS}/etc/shadow + sed -i 's%^citadel::%citadel:!:%' ${IMAGE_ROOTFS}/etc/shadow } set_citadel_user_password() { @@ -26,6 +26,10 @@ set_citadel_user_password() { sed -i 's%^citadel:!:%citadel:aadg8rGtZzOY6:%' ${IMAGE_ROOTFS}/etc/shadow } +set_disable_root_password() { + sed -i 's%^root::%root:!:%' ${IMAGE_ROOTFS}/etc/shadow +} + setup_var() { install -m 0755 -d ${IMAGE_ROOTFS}/usr/share/factory/var install -m 0755 -d ${IMAGE_ROOTFS}/usr/share/factory/home diff --git a/meta-citadel/recipes-citadel/packagegroups/packagegroup-citadel-base.bb b/meta-citadel/recipes-citadel/packagegroups/packagegroup-citadel-base.bb index 3e6c69e..1238729 100644 --- a/meta-citadel/recipes-citadel/packagegroups/packagegroup-citadel-base.bb +++ b/meta-citadel/recipes-citadel/packagegroups/packagegroup-citadel-base.bb @@ -70,10 +70,13 @@ RDEPENDS_${PN} = "\ e2fsprogs-resize2fs \ dosfstools \ libpam \ + libpam-pwdfile \ + mkpasswd \ wireguard-tools \ resolvconf \ udisks2 \ efivar \ efibootmgr \ iw \ + sudo \ " diff --git a/meta-citadel/recipes-support/libidn2/libidn2_2.0.5.bb b/meta-citadel/recipes-support/libidn2/libidn2_2.0.5.bb new file mode 100644 index 0000000..2d81a4e --- /dev/null +++ b/meta-citadel/recipes-support/libidn2/libidn2_2.0.5.bb @@ -0,0 +1,29 @@ +SUMMARY = "Internationalized Domain Name support library" +DESCRIPTION = "Implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names (IDN) working group." +HOMEPAGE = "http://www.gnu.org/software/libidn/" +SECTION = "libs" +LICENSE = "(GPLv2+ | LGPLv3) & GPLv3+" +LIC_FILES_CHKSUM = "file://COPYING;md5=ab90e75ef97cc6318ce4f2fbda62fe4d \ + file://COPYING.LESSERv3;md5=e6a600fd5e1d9cbde2d983680233ad02 \ + file://COPYINGv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ + file://src/idn2.c;endline=16;md5=0283aec28e049f5bcaaeee52aa865874 \ + file://lib/idn2.h.in;endline=27;md5=c2cd28d3f87260f157f022eabb83714f" + +SRC_URI = "${GNU_MIRROR}/libidn/${BPN}-${PV}.tar.gz" + +SRC_URI[md5sum] = "eaf9a5b9d03b0cce3760f34b3124eb36" +SRC_URI[sha256sum] = "53f69170886f1fa6fa5b332439c7a77a7d22626a82ef17e2c1224858bb4ca2b8" + +DEPENDS = "virtual/libiconv libunistring" + +inherit pkgconfig autotools gettext texinfo gtk-doc lib_package + +EXTRA_OECONF += "--disable-rpath \ + --with-libunistring-prefix=${STAGING_EXECPREFIXDIR} \ + " + +LICENSE_${PN} = "(GPLv2+ | LGPLv3)" +LICENSE_${PN}-bin = "GPLv3+" + +BBCLASSEXTEND = "native nativesdk" + diff --git a/meta-citadel/recipes-support/libpam-pwdfile/libpam-pwdfile_1.0.bb b/meta-citadel/recipes-support/libpam-pwdfile/libpam-pwdfile_1.0.bb new file mode 100644 index 0000000..0fbccce --- /dev/null +++ b/meta-citadel/recipes-support/libpam-pwdfile/libpam-pwdfile_1.0.bb @@ -0,0 +1,24 @@ +SUMMARY = "PAM pwdfile library" +SECTION = "libs" + +LICENSE = "BSD" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/BSD-3-Clause;md5=550794465ba0ec5312d6919e203a55f9" + +SRC_URI = "https://github.com/tiwe-de/libpam-pwdfile/archive/v${PV}.tar.gz" +SRC_URI[md5sum] = "1546a57bfe50800175f7cbc88ade4a15" +SRC_URI[sha256sum] = "5b8db1397cff9cadfd1bb96f53c134b787ab0e6a0fbedb71040541d340313ba2" + +S = "${WORKDIR}/libpam-pwdfile-${PV}" + +DEPENDS = "libpam libxcrypt" +inherit lib_package pkgconfig + +FILES_${PN} += "${libdir}/security/pam_pwdfile.so" + +do_compile_class() { + oe_runmake CC_FOR_BUILD="${BUILD_CC}" PAM_LIB_DIR=${libdir}/security +} + +do_install() { + oe_runmake install DESTDIR=${D} PAM_LIB_DIR=${libdir}/security +} diff --git a/meta-citadel/recipes-support/mkpasswd/mkpasswd_5.4.2.bb b/meta-citadel/recipes-support/mkpasswd/mkpasswd_5.4.2.bb new file mode 100644 index 0000000..5e5b2f4 --- /dev/null +++ b/meta-citadel/recipes-support/mkpasswd/mkpasswd_5.4.2.bb @@ -0,0 +1,19 @@ +LICENSE = "GPLv2" +LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" + +SRC_URI = "http://ftp.debian.org/debian/pool/main/w/whois/whois_${PV}.tar.xz" +SRC_URI[md5sum] = "8bbf1105702b9a03445211f45bd53efe" +SRC_URI[sha256sum] = "eee33a3b3a56912fbf115a7dd24ed60314e2707a3ad6aa604ca2752c1ed01f57" +S = "${WORKDIR}/whois-${PV}" + +DEPENDS = "libxcrypt libidn2" +RDEPENDS_${PN} = "libxcrypt libidn2" +inherit pkgconfig gettext + +do_compile() { + oe_runmake CC_FOR_BUILD="${BUILD_CC}" BASEDIR=${D} +} + +do_install() { + oe_runmake install-mkpasswd DESTDIR=${D} BASEDIR=${D} +} diff --git a/meta-citadel/recipes-support/pam/files/pam.d/common-auth b/meta-citadel/recipes-support/pam/files/pam.d/common-auth new file mode 100644 index 0000000..ff89aef --- /dev/null +++ b/meta-citadel/recipes-support/pam/files/pam.d/common-auth @@ -0,0 +1,20 @@ +# +# /etc/pam.d/common-auth - authentication settings common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of the authentication modules that define +# the central authentication scheme for use on the system +# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the +# traditional Unix authentication mechanisms. + +# here are the per-package modules (the "Primary" block) +# citadel pwdfile support +auth [success=2 authinfo_unavail=reset new_authtok_reqd=ok ignore=ignore default=bad] pam_pwdfile.so pwdfile=/storage/citadel-state/passwd +auth [success=1 default=ignore] pam_unix.so nullok_secure +# here's the fallback if no module succeeds +auth requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +auth required pam_permit.so +# and here are more per-package modules (the "Additional" block) diff --git a/meta-citadel/recipes-support/pam/libpam_%.bbappend b/meta-citadel/recipes-support/pam/libpam_%.bbappend new file mode 100644 index 0000000..7592210 --- /dev/null +++ b/meta-citadel/recipes-support/pam/libpam_%.bbappend @@ -0,0 +1,3 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/files:" + +SRC_URI += "file://pam.d/common-auth"