shawn/op-pedal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set pipedal_d shell to /usr/sbin/nologin

Browse Source
This commit is contained in:
Robin Davies
2024-10-12 19:22:51 -04:00
parent b05f31aa8e
commit b9c3ad2367
11 changed files with 105 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ConfigMain.cpp
+35 -2
View File
@@ -44,6 +44,9 @@
#include <grp.h>
#include "ofstream_synced.hpp"
#include <pwd.h>
#include <unistd.h>
#define P2PD_DISABLED
#if JACK_HOST
@@ -88,6 +91,29 @@ namespace fs = std::filesystem;
#define REMOVE_OLD_SERVICE 0 // Grandfathering: whether to remove the old shutdown service (now pipedaladmind)
#define OLD_SHUTDOWN_SERVICE "pipedalshutdownd"
void changeUserShell(const char* username, const char* newShell) {
struct passwd* pw;
struct passwd p;
char buf[1024];
pw = getpwnam(username);
if (pw == nullptr) {
throw std::runtime_error("User not found");
}
if (strcmp(pw->pw_shell,newShell) == 0) {
return;
}
std::string args = SS("/usr/sbin/usermod -s " << newShell << " " << username);
if (silentSysExec(args.c_str()) != EXIT_SUCCESS)
{
cout << "Failed to set shell for " << username << endl;
}
}
fs::path GetServiceFileName(const std::string &serviceName)
{
return fs::path(SERVICE_PATH) / (serviceName + ".service");
@@ -926,7 +952,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
try
{
// apply policy changes we dropped into the polkit configuration files (allows pipedal_d to use NetworkManager dbus apis).
silentSysExec(SYSTEMCTL_BIN " restart polkit");
silentSysExec(SYSTEMCTL_BIN " restart polkit.service");
DeployVarConfig();
@@ -994,7 +1020,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
if (!userExists(SERVICE_ACCOUNT_NAME))
{
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -s /usr/sbin/nologin -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
{
// throw std::runtime_error("Failed to create service account.");
}
@@ -1007,6 +1033,13 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
// add to netdev group
sysExec(USERMOD_BIN " -a -G " NETDEV_GROUP_NAME " " SERVICE_ACCOUNT_NAME);
try {
changeUserShell(SERVICE_ACCOUNT_NAME, "/usr/sbin/nologon");
} catch (const std::exception&e)
{
cout << "Error: Can't set user shell for pipedal_d. " << e.what() << std::endl;
}
// create and configure /var directory.
fs::path varDirectory("/var/pipedal");