mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-01-28 08:03:36 +00:00
253540fb3d
Closes: #2276. Functionality all over the system keeps failing due this approach. The latest is changing hostname in ejabberd Mnesia database fails (#2276). Further, users connecting FreedomBox to a monitor can't use a GUI. Tests: - Without patches, enable restricted access. Apply patches and setup.py install. Security app is updated. Restricted access is disabled and /etc/security/access.d/{50freedombox.conf, 10freedombox-security.conf, 10freedombox-performance.conf} are removed. It is possible to login into non-admin account via SSH. - On a fresh install, the configuration files are not found. - Security page does not show 'restrict console logins' option. - Updating security app setting works. Message 'Configuration updated.' is shown. - First boot succeeds. Restrict console login is not enabled. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
30 lines
962 B
Python
30 lines
962 B
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""Helper for security configuration."""
|
|
|
|
import os
|
|
|
|
from plinth.actions import privileged
|
|
|
|
ACCESS_CONF_FILE = '/etc/security/access.d/50freedombox.conf'
|
|
ACCESS_CONF_FILE_OLD = '/etc/security/access.conf'
|
|
ACCESS_CONF_SNIPPET = '-:ALL EXCEPT root fbx plinth (admin) (sudo):ALL'
|
|
OLD_ACCESS_CONF_SNIPPET = '-:ALL EXCEPT root fbx (admin) (sudo):ALL'
|
|
ACCESS_CONF_SNIPPETS = [OLD_ACCESS_CONF_SNIPPET, ACCESS_CONF_SNIPPET]
|
|
|
|
|
|
@privileged
|
|
def disable_restricted_access():
|
|
"""Don't restrict console login to users in admin or sudo group."""
|
|
with open(ACCESS_CONF_FILE_OLD, 'r', encoding='utf-8') as conffile:
|
|
lines = conffile.readlines()
|
|
|
|
with open(ACCESS_CONF_FILE_OLD, 'w', encoding='utf-8') as conffile:
|
|
for line in lines:
|
|
if line.strip() not in ACCESS_CONF_SNIPPETS:
|
|
conffile.write(line)
|
|
|
|
try:
|
|
os.remove(ACCESS_CONF_FILE)
|
|
except OSError:
|
|
pass
|