nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-08-26 12:46:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: Fix issue with Plinth locked out from sudo

Browse Source 
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
This commit is contained in:
Sunil Mohan Adapa 2018-05-08 10:00:35 +05:30 committed by James Valleroy
parent fded8e57ec
commit daeec0528b
No known key found for this signature in database
GPG Key ID: 77C0C75E7B650808
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
debian/postinst vendored
View File

@ -5,6 +5,12 @@ set -e
daemonuser=plinth daemonuser=plinth
daemongroup=plinth daemongroup=plinth
# Due to a change in sudo, now it runs PAM modules even on password-less
# invocations. This leads to plinth not being able to run root privileges. This
# is because of our own restrictions in /etc/security/access.conf. Since Plinth
# is locked out after upgrade, we need to do this in postinst.
sed -ie 's+-:ALL EXCEPT root fbx (admin) (sudo):ALL+-:ALL EXCEPT root fbx plinth (admin) (sudo):ALL+' /etc/security/access.conf
case "$1" in case "$1" in
configure) configure)
addgroup --system --quiet plinth addgroup --system --quiet plinth

8
plinth/modules/security/__init__.py
View File

@ -23,7 +23,7 @@ from django.utils.translation import ugettext_lazy as _
from plinth import actions from plinth import actions
from plinth.menu import main_menu from plinth.menu import main_menu
version = 3 version = 4
is_essential = True is_essential = True
@ -50,7 +50,11 @@ def init():
def setup(helper, old_version=None): def setup(helper, old_version=None):
"""Install the required packages""" """Install the required packages"""
helper.install(managed_packages) helper.install(managed_packages)
setup_fail2ban() if not old_version:
setup_fail2ban()
if get_restricted_access_enabled():
set_restricted_access(True)
def setup_fail2ban(): def setup_fail2ban():