Blame - yocto-poky/meta/classes/useradd-staticids.bbclass - mdmillerii/openbmc

Patrick Williams

c124f4f

2015-09-15 14:41:29 -0500

[diff] [blame]

1

# In order to support a deterministic set of 'dynamic' users/groups,

2

# we need a function to reformat the params based on a static file

3

def update_useradd_static_config(d):

import argparse

import re

class myArgumentParser( argparse.ArgumentParser ):

8

def _print_message(self, message, file=None):

9

bb.warn("%s - %s: %s" % (d.getVar('PN', True), pkg, message))

10

11

# This should never be called...

12

def exit(self, status=0, message=None):

13

message = message or ("%s - %s: useradd.bbclass: Argument parsing exited" % (d.getVar('PN', True), pkg))

14

error(message)

15

16

def error(self, message):

17

raise bb.build.FuncFailed(message)

18

19

# We parse and rewrite the useradd components

20

def rewrite_useradd(params):

21

# The following comes from --help on useradd from shadow

22

parser = myArgumentParser(prog='useradd')

23

parser.add_argument("-b", "--base-dir", metavar="BASE_DIR", help="base directory for the home directory of the new account")

24

parser.add_argument("-c", "--comment", metavar="COMMENT", help="GECOS field of the new account")

25

parser.add_argument("-d", "--home-dir", metavar="HOME_DIR", help="home directory of the new account")

26

parser.add_argument("-D", "--defaults", help="print or change default useradd configuration", action="store_true")

27

parser.add_argument("-e", "--expiredate", metavar="EXPIRE_DATE", help="expiration date of the new account")

28

parser.add_argument("-f", "--inactive", metavar="INACTIVE", help="password inactivity period of the new account")

29

parser.add_argument("-g", "--gid", metavar="GROUP", help="name or ID of the primary group of the new account")

30

parser.add_argument("-G", "--groups", metavar="GROUPS", help="list of supplementary groups of the new account")

31

parser.add_argument("-k", "--skel", metavar="SKEL_DIR", help="use this alternative skeleton directory")

32

parser.add_argument("-K", "--key", metavar="KEY=VALUE", help="override /etc/login.defs defaults")

33

parser.add_argument("-l", "--no-log-init", help="do not add the user to the lastlog and faillog databases", action="store_true")

34

parser.add_argument("-m", "--create-home", help="create the user's home directory", action="store_true")

35

parser.add_argument("-M", "--no-create-home", help="do not create the user's home directory", action="store_true")

36

parser.add_argument("-N", "--no-user-group", help="do not create a group with the same name as the user", action="store_true")

37

parser.add_argument("-o", "--non-unique", help="allow to create users with duplicate (non-unique UID)", action="store_true")

38

parser.add_argument("-p", "--password", metavar="PASSWORD", help="encrypted password of the new account")

39

parser.add_argument("-R", "--root", metavar="CHROOT_DIR", help="directory to chroot into")

40

parser.add_argument("-r", "--system", help="create a system account", action="store_true")

41

parser.add_argument("-s", "--shell", metavar="SHELL", help="login shell of the new account")

42

parser.add_argument("-u", "--uid", metavar="UID", help="user ID of the new account")

43

parser.add_argument("-U", "--user-group", help="create a group with the same name as the user", action="store_true")

44

parser.add_argument("LOGIN", help="Login name of the new user")

45

46

# Return a list of configuration files based on either the default

47

# files/passwd or the contents of USERADD_UID_TABLES

48

# paths are resulved via BBPATH

49

def get_passwd_list(d):

50

str = ""

51

bbpath = d.getVar('BBPATH', True)

52

passwd_tables = d.getVar('USERADD_UID_TABLES', True)

53

if not passwd_tables:

54

passwd_tables = 'files/passwd'

55

for conf_file in passwd_tables.split():

56

str += " %s" % bb.utils.which(bbpath, conf_file)

return str

newparams = []

for param in re.split('''[ \t]*;[ \t]*(?=(?:[^'"]|'[^']*'|"[^"]*")*$)''', params):

61

param = param.strip()

if not param:

continue

try:

uaargs = parser.parse_args(re.split('''[ \t]*(?=(?:[^'"]|'[^']*'|"[^"]*")*$)''', param))

66

except:

67

raise bb.build.FuncFailed("%s: Unable to parse arguments for USERADD_PARAM_%s: '%s'" % (d.getVar('PN', True), pkg, param))

68

69

# files/passwd or the contents of USERADD_UID_TABLES

70

# Use the standard passwd layout:

71

# username:password:user_id:group_id:comment:home_directory:login_shell

72

# (we want to process in reverse order, as 'last found' in the list wins)

73

#

74

# If a field is left blank, the original value will be used. The 'username'

75

# field is required.

76

#

77

# Note: we ignore the password field, as including even the hashed password

78

# in the useradd command may introduce a security hole. It's assumed that

79

# all new users get the default ('*' which prevents login) until the user is

80

# specifically configured by the system admin.

81

for conf in get_passwd_list(d).split()[::-1]:

82

if os.path.exists(conf):

83

f = open(conf, "r")

84

for line in f:

85

if line.startswith('#'):

86

continue

87

field = line.rstrip().split(":")

88

if field[0] == uaargs.LOGIN:

89

if uaargs.uid and field[2] and (uaargs.uid != field[2]):

90

bb.warn("%s: Changing username %s's uid from (%s) to (%s), verify configuration files!" % (d.getVar('PN', True), uaargs.LOGIN, uaargs.uid, field[2]))

91

uaargs.uid = [field[2], uaargs.uid][not field[2]]

92

93

# Determine the possible groupname

94

# Unless the group name (or gid) is specified, we assume that the LOGIN is the groupname

95

#

96

# By default the system has creation of the matching groups enabled

97

# So if the implicit username-group creation is on, then the implicit groupname (LOGIN)

98

# is used, and we disable the user_group option.

99

#

100

uaargs.groupname = [uaargs.gid, uaargs.LOGIN][not uaargs.gid or uaargs.user_group]

101

uaargs.groupid = [uaargs.gid, uaargs.groupname][not uaargs.gid]

102

uaargs.groupid = [field[3], uaargs.groupid][not field[3]]

103

104

if not uaargs.gid or uaargs.gid != uaargs.groupid:

105

if (uaargs.groupid and uaargs.groupid.isdigit()) and (uaargs.groupname and uaargs.groupname.isdigit()) and (uaargs.groupid != uaargs.groupname):

106

# We want to add a group, but we don't know it's name... so we can't add the group...

107

# We have to assume the group has previously been added or we'll fail on the adduser...

108

# Note: specifying the actual gid is very rare in OE, usually the group name is specified.

109

bb.warn("%s: Changing gid for login %s from (%s) to (%s), verify configuration files!" % (d.getVar('PN', True), uaargs.LOGIN, uaargs.groupname, uaargs.gid))

110

elif (uaargs.groupid and not uaargs.groupid.isdigit()) and uaargs.groupid == uaargs.groupname:

111

# We don't have a number, so we have to add a name

112

bb.debug(1, "Adding group %s!" % (uaargs.groupname))

113

uaargs.gid = uaargs.groupid

114

uaargs.user_group = False

115

groupadd = d.getVar("GROUPADD_PARAM_%s" % pkg, True)

116

newgroup = "%s %s" % (['', ' --system'][uaargs.system], uaargs.groupname)

117

if groupadd:

118

d.setVar("GROUPADD_PARAM_%s" % pkg, "%s ; %s" % (groupadd, newgroup))

119

else:

120

d.setVar("GROUPADD_PARAM_%s" % pkg, newgroup)

121

elif uaargs.groupname and (uaargs.groupid and uaargs.groupid.isdigit()):

122

# We have a group name and a group number to assign it to

123

bb.debug(1, "Adding group %s gid (%s)!" % (uaargs.groupname, uaargs.groupid))

124

uaargs.gid = uaargs.groupid

125

uaargs.user_group = False

126

groupadd = d.getVar("GROUPADD_PARAM_%s" % pkg, True)

127

newgroup = "-g %s %s" % (uaargs.gid, uaargs.groupname)

128

if groupadd:

129

d.setVar("GROUPADD_PARAM_%s" % pkg, "%s ; %s" % (groupadd, newgroup))

130

else:

131

d.setVar("GROUPADD_PARAM_%s" % pkg, newgroup)

132

133

uaargs.comment = ["'%s'" % field[4], uaargs.comment][not field[4]]

134

uaargs.home_dir = [field[5], uaargs.home_dir][not field[5]]

135

uaargs.shell = [field[6], uaargs.shell][not field[6]]

136

break

137

138

# Should be an error if a specific option is set...

139

if d.getVar('USERADD_ERROR_DYNAMIC', True) == '1' and not ((uaargs.uid and uaargs.uid.isdigit()) and uaargs.gid):

140

#bb.error("Skipping recipe %s, package %s which adds username %s does not have a static uid defined." % (d.getVar('PN', True), pkg, uaargs.LOGIN))

141

raise bb.build.FuncFailed("%s - %s: Username %s does not have a static uid defined." % (d.getVar('PN', True), pkg, uaargs.LOGIN))

142

143

# Reconstruct the args...

144

newparam = ['', ' --defaults'][uaargs.defaults]

145

newparam += ['', ' --base-dir %s' % uaargs.base_dir][uaargs.base_dir != None]

146

newparam += ['', ' --comment %s' % uaargs.comment][uaargs.comment != None]

147

newparam += ['', ' --home-dir %s' % uaargs.home_dir][uaargs.home_dir != None]

148

newparam += ['', ' --expiredata %s' % uaargs.expiredate][uaargs.expiredate != None]

149

newparam += ['', ' --inactive %s' % uaargs.inactive][uaargs.inactive != None]

150

newparam += ['', ' --gid %s' % uaargs.gid][uaargs.gid != None]

151

newparam += ['', ' --groups %s' % uaargs.groups][uaargs.groups != None]

152

newparam += ['', ' --skel %s' % uaargs.skel][uaargs.skel != None]

153

newparam += ['', ' --key %s' % uaargs.key][uaargs.key != None]

154

newparam += ['', ' --no-log-init'][uaargs.no_log_init]

155

newparam += ['', ' --create-home'][uaargs.create_home]

156

newparam += ['', ' --no-create-home'][uaargs.no_create_home]

157

newparam += ['', ' --no-user-group'][uaargs.no_user_group]

158

newparam += ['', ' --non-unique'][uaargs.non_unique]

159

newparam += ['', ' --password %s' % uaargs.password][uaargs.password != None]

160

newparam += ['', ' --root %s' % uaargs.root][uaargs.root != None]

161

newparam += ['', ' --system'][uaargs.system]

162

newparam += ['', ' --shell %s' % uaargs.shell][uaargs.shell != None]

163

newparam += ['', ' --uid %s' % uaargs.uid][uaargs.uid != None]

164

newparam += ['', ' --user-group'][uaargs.user_group]

165

newparam += ' %s' % uaargs.LOGIN

166

167

newparams.append(newparam)

168

169

return " ;".join(newparams).strip()

170

171

# We parse and rewrite the groupadd components

172

def rewrite_groupadd(params):

173

# The following comes from --help on groupadd from shadow

174

parser = myArgumentParser(prog='groupadd')

175

parser.add_argument("-f", "--force", help="exit successfully if the group already exists, and cancel -g if the GID is already used", action="store_true")

176

parser.add_argument("-g", "--gid", metavar="GID", help="use GID for the new group")

177

parser.add_argument("-K", "--key", metavar="KEY=VALUE", help="override /etc/login.defs defaults")

178

parser.add_argument("-o", "--non-unique", help="allow to create groups with duplicate (non-unique) GID", action="store_true")

179

parser.add_argument("-p", "--password", metavar="PASSWORD", help="use this encrypted password for the new group")

180

parser.add_argument("-R", "--root", metavar="CHROOT_DIR", help="directory to chroot into")

181

parser.add_argument("-r", "--system", help="create a system account", action="store_true")

182

parser.add_argument("GROUP", help="Group name of the new group")

183

184

# Return a list of configuration files based on either the default

185

# files/group or the contents of USERADD_GID_TABLES

186

# paths are resulved via BBPATH

187

def get_group_list(d):

188

str = ""

189

bbpath = d.getVar('BBPATH', True)

190

group_tables = d.getVar('USERADD_GID_TABLES', True)

191

if not group_tables:

192

group_tables = 'files/group'

193

for conf_file in group_tables.split():

194

str += " %s" % bb.utils.which(bbpath, conf_file)

return str

newparams = []

for param in re.split('''[ \t]*;[ \t]*(?=(?:[^'"]|'[^']*'|"[^"]*")*$)''', params):

199

param = param.strip()

if not param:

continue

try:

# If we're processing multiple lines, we could have left over values here...

204

gaargs = parser.parse_args(re.split('''[ \t]*(?=(?:[^'"]|'[^']*'|"[^"]*")*$)''', param))

205

except:

206

raise bb.build.FuncFailed("%s: Unable to parse arguments for GROUPADD_PARAM_%s: '%s'" % (d.getVar('PN', True), pkg, param))

207

208

# Need to iterate over layers and open the right file(s)

209

# Use the standard group layout:

210

# groupname:password:group_id:group_members

211

#

212

# If a field is left blank, the original value will be used. The 'groupname' field

213

# is required.

214

#

215

# Note: similar to the passwd file, the 'password' filed is ignored

216

# Note: group_members is ignored, group members must be configured with the GROUPMEMS_PARAM

217

for conf in get_group_list(d).split()[::-1]:

218

if os.path.exists(conf):

219

f = open(conf, "r")

220

for line in f:

221

if line.startswith('#'):

222

continue

223

field = line.rstrip().split(":")

224

if field[0] == gaargs.GROUP and field[2]:

225

if gaargs.gid and (gaargs.gid != field[2]):

226

bb.warn("%s: Changing groupname %s's gid from (%s) to (%s), verify configuration files!" % (d.getVar('PN', True), gaargs.GROUP, gaargs.gid, field[2]))

227

gaargs.gid = field[2]

228

break

229

230

if d.getVar('USERADD_ERROR_DYNAMIC', True) == '1' and not (gaargs.gid and gaargs.gid.isdigit()):

231

#bb.error("Skipping recipe %s, package %s which adds groupname %s does not have a static gid defined." % (d.getVar('PN', True), pkg, gaargs.GROUP))

232

raise bb.build.FuncFailed("%s - %s: Groupname %s does not have a static gid defined." % (d.getVar('PN', True), pkg, gaargs.GROUP))

233

234

# Reconstruct the args...

235

newparam = ['', ' --force'][gaargs.force]

236

newparam += ['', ' --gid %s' % gaargs.gid][gaargs.gid != None]

237

newparam += ['', ' --key %s' % gaargs.key][gaargs.key != None]

238

newparam += ['', ' --non-unique'][gaargs.non_unique]

239

newparam += ['', ' --password %s' % gaargs.password][gaargs.password != None]

240

newparam += ['', ' --root %s' % gaargs.root][gaargs.root != None]

241

newparam += ['', ' --system'][gaargs.system]

242

newparam += ' %s' % gaargs.GROUP

243

244

newparams.append(newparam)

245

246

return " ;".join(newparams).strip()

247

248

# Load and process the users and groups, rewriting the adduser/addgroup params

249

useradd_packages = d.getVar('USERADD_PACKAGES', True)

250

251

for pkg in useradd_packages.split():

252

# Groupmems doesn't have anything we might want to change, so simply validating

253

# is a bit of a waste -- only process useradd/groupadd

254

useradd_param = d.getVar('USERADD_PARAM_%s' % pkg, True)

255

if useradd_param:

256

#bb.warn("Before: 'USERADD_PARAM_%s' - '%s'" % (pkg, useradd_param))

257

d.setVar('USERADD_PARAM_%s' % pkg, rewrite_useradd(useradd_param))

258

#bb.warn("After: 'USERADD_PARAM_%s' - '%s'" % (pkg, d.getVar('USERADD_PARAM_%s' % pkg, True)))

259

260

groupadd_param = d.getVar('GROUPADD_PARAM_%s' % pkg, True)

261

if groupadd_param:

262

#bb.warn("Before: 'GROUPADD_PARAM_%s' - '%s'" % (pkg, groupadd_param))

263

d.setVar('GROUPADD_PARAM_%s' % pkg, rewrite_groupadd(groupadd_param))

264

#bb.warn("After: 'GROUPADD_PARAM_%s' - '%s'" % (pkg, d.getVar('GROUPADD_PARAM_%s' % pkg, True)))

python __anonymous() {

269

if not bb.data.inherits_class('nativesdk', d) \

270

and not bb.data.inherits_class('native', d):

271

try:

272

update_useradd_static_config(d)

273

except bb.build.FuncFailed as f:

274

bb.debug(1, "Skipping recipe %s: %s" % (d.getVar('PN', True), f))

275

raise bb.parse.SkipPackage(f)

276

}