shawn/op-pedal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set pipedal_d shell to /usr/sbin/nologin

Browse Source
This commit is contained in:
Robin Davies
2024-10-12 19:22:51 -04:00
parent b05f31aa8e
commit b9c3ad2367
11 changed files with 105 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/CMakeLists.txt
+17 -6
View File
@@ -5,6 +5,10 @@ set (CMAKE_INSTALL_PREFIX "/usr/")
set (USE_PCH 1)
set (ENABLE_BACKTRACE 1)
set (USE_SANITIZE true)
set(CXX_STANDARD 20)
include(FindPkgConfig)
@@ -96,9 +100,6 @@ endif()
set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED True)
set (USE_SANITIZE true)
if (!ENABLE_VST3)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Werror -Wno-psabi -DARCHITECTURE=${CPACK_SYSTEM_NAME}")
else()
@@ -119,10 +120,17 @@ if (CMAKE_BUILD_TYPE MATCHES Debug)
endif()
elseif(CMAKE_BUILD_TYPE MATCHES RelWithDebInfo)
message(STATUS "RelWithgDebInfo build")
#set (CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS} "" )
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DNDEBUG" )
else()
message(STATUS "Release build")
#set (CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS} "" )
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DNDEBUG" )
endif()
if (ENABLE_BACKTRACE)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -rdynamic")
if (${DEBIAN_ARCHITECTURE} MATCHES arm64)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -funwind-tables")
endif()
endif()
@@ -292,6 +300,9 @@ add_executable(pipedald
)
target_include_directories(pipedald PRIVATE ${PIPEDAL_INCLUDES})
target_compile_definitions(pipedald PRIVATE "ENABLE_BACKTRACE=${ENABLE_BACKTRACE}")
target_link_libraries(pipedald PRIVATE PiPedalCommon
${PIPEDAL_LIBS}
@@ -627,7 +638,7 @@ add_executable(pipedalconfig
)
target_link_libraries(pipedalconfig PRIVATE PiPedalCommon pthread atomic uuid stdc++fs
target_link_libraries(pipedalconfig PRIVATE PiPedalCommon pthread atomic uuid stdc++fs
)
add_executable(pipedal_latency_test
src/ConfigMain.cpp
+35 -2
View File
@@ -44,6 +44,9 @@
#include <grp.h>
#include "ofstream_synced.hpp"
#include <pwd.h>
#include <unistd.h>
#define P2PD_DISABLED
#if JACK_HOST
@@ -88,6 +91,29 @@ namespace fs = std::filesystem;
#define REMOVE_OLD_SERVICE 0 // Grandfathering: whether to remove the old shutdown service (now pipedaladmind)
#define OLD_SHUTDOWN_SERVICE "pipedalshutdownd"
void changeUserShell(const char* username, const char* newShell) {
struct passwd* pw;
struct passwd p;
char buf[1024];
pw = getpwnam(username);
if (pw == nullptr) {
throw std::runtime_error("User not found");
}
if (strcmp(pw->pw_shell,newShell) == 0) {
return;
}
std::string args = SS("/usr/sbin/usermod -s " << newShell << " " << username);
if (silentSysExec(args.c_str()) != EXIT_SUCCESS)
{
cout << "Failed to set shell for " << username << endl;
}
}
fs::path GetServiceFileName(const std::string &serviceName)
{
return fs::path(SERVICE_PATH) / (serviceName + ".service");
@@ -926,7 +952,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
try
{
// apply policy changes we dropped into the polkit configuration files (allows pipedal_d to use NetworkManager dbus apis).
silentSysExec(SYSTEMCTL_BIN " restart polkit");
silentSysExec(SYSTEMCTL_BIN " restart polkit.service");
DeployVarConfig();
@@ -994,7 +1020,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
if (!userExists(SERVICE_ACCOUNT_NAME))
{
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -s /usr/sbin/nologin -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
{
// throw std::runtime_error("Failed to create service account.");
}
@@ -1007,6 +1033,13 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
// add to netdev group
sysExec(USERMOD_BIN " -a -G " NETDEV_GROUP_NAME " " SERVICE_ACCOUNT_NAME);
try {
changeUserShell(SERVICE_ACCOUNT_NAME, "/usr/sbin/nologon");
} catch (const std::exception&e)
{
cout << "Error: Can't set user shell for pipedal_d. " << e.what() << std::endl;
}
// create and configure /var directory.
fs::path varDirectory("/var/pipedal");
src/SetWifiConfig.cpp
+10 -10
View File
@@ -544,9 +544,9 @@ p2p configuration:
dnsmaqsq.d/30-pipedal-p2p.conf:
interface=p2p-wlan0-0
dhcp-range=p2p-wlan0,173.24.0.3,172.23.0.127,1h
dhcp-range=p2p-wlan0,173.24.0.3,192.168.60.127,1h
domain=local
address=/pipedal.local/172.23.0.2
address=/pipedal.local/192.168.60.2
except-interface=eth0
except-interface=wlan0
@@ -556,8 +556,8 @@ except-interface=lo
dhcpcd.conf:
======
interface p2p-wlan0-0
static ip_address=172.24.0.1/16
domain_name_servers=172.24.0.1
static ip_address=192.168.60.1/16
domain_name_servers=192.168.60.1
Watch resolv.conf to make sure we don't lose DNS servers.
************************************************************************************/
@@ -672,8 +672,8 @@ static void ConfigDhcpcdForP2p()
// dhcpcd.conf:
// ======
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/24
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/24
// domain_name_server=192.168.60.1
int line = dhcpcd.GetLineThatStartsWith("hostname");
std::string hostNameLine;
@@ -691,8 +691,8 @@ static void ConfigDhcpcdForP2p()
{
line = dhcpcd.GetLineCount();
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/16 (trying int on .1.)
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/16 (trying int on .1.)
// domain_name_server=192.168.60.1
dhcpcd.InsertLine(line++, "interface p2p-wlan0-0");
dhcpcd.InsertLine(line++, " static ip_address=" P2P_INTERFACE_ADDR);
@@ -705,8 +705,8 @@ static void ConfigDhcpcdForP2p()
line = dhcpcd.GetLineCount();
}
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/16 (trying int on .1.)
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/16 (trying int on .1.)
// domain_name_server=192.168.60.1
dhcpcd.InsertLine(line++, SS("allowinterfaces p2p-" << GetWifiConfigWlanAddress() << "-*").c_str());
dhcpcd.InsertLine(line++, "static ip_address=" P2P_INTERFACE_ADDR);
src/main.cpp
+30 -2
View File
@@ -27,7 +27,7 @@
#include "ServiceConfiguration.hpp"
#include "AvahiService.hpp"
#include "WebServerConfig.hpp"
#include <execinfo.h>
#include "PiPedalSocket.hpp"
#include "PluginHost.hpp"
#include <boost/system/error_code.hpp>
@@ -87,11 +87,39 @@ static void AsanCheck()
exit(EXIT_FAILURE);
}
#if ENABLE_BACKTRACE
void segvHandler(int sig) {
void *array[10];
// Get void*'s for all entries on the stack
size_t size;
size = backtrace(array, 10);
// Print out all the frames to stderr
const char *message = "Error: SEGV signal received.\n";
write(STDERR_FILENO,message,strlen(message));
backtrace_symbols_fd(array+2, size-2, STDERR_FILENO);
_exit(EXIT_FAILURE);
}
static void EnableBacktrace()
{
signal(SIGSEGV, segvHandler);
}
#endif
int main(int argc, char *argv[])
{
#ifndef WIN32
umask(002); // newly created files in /var/pipedal get 775-ish permissions, which improves debugging/live-service interaction.
umask(002); // newly created files in /var/pipedal get 7cd75-ish permissions, which improves debugging/live-service interaction.
#endif
#if ENABLE_BACKTRACE
EnableBacktrace();
#endif
// Check command line arguments.