Revision 2dcd42b7
b/image_creator/os_type/linux.py | ||
---|---|---|
44 | 44 |
self._uuid = dict() |
45 | 45 |
self._persistent = re.compile('/dev/[hsv]d[a-z][1-9]*') |
46 | 46 |
|
47 |
self.meta["USERS"] = " ".join(self._get_passworded_users()) |
|
48 |
|
|
49 |
# Delete the USERS metadata if empty |
|
50 |
if not len(self.meta['USERS']): |
|
51 |
self.out.warn("No passworded users found!") |
|
52 |
del self.meta['USERS'] |
|
53 |
|
|
54 |
def _get_passworded_users(self): |
|
55 |
users = [] |
|
56 |
regexp = re.compile('(\S+):((?:!\S+)|(?:[^!*]\S+)|):(?:\S*:){6}') |
|
57 |
|
|
58 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
59 |
match = regexp.match(line) |
|
60 |
if not match: |
|
61 |
continue |
|
62 |
|
|
63 |
user, passwd = match.groups() |
|
64 |
if len(passwd) > 0 and passwd[0] == '!': |
|
65 |
self.out.warn("Ignoring locked %s account." % user) |
|
66 |
else: |
|
67 |
users.append(user) |
|
68 |
|
|
69 |
return users |
|
70 |
|
|
47 | 71 |
def is_persistent(self, dev): |
48 | 72 |
return not self._persistent.match(dev) |
49 | 73 |
|
... | ... | |
56 | 80 |
self._uuid[dev] = uuid |
57 | 81 |
return uuid |
58 | 82 |
|
83 |
@sysprep(enabled=False) |
|
84 |
def remove_user_accounts(self, print_header=True): |
|
85 |
"""Remove all user accounts with id greater than 1000""" |
|
86 |
|
|
87 |
if print_header: |
|
88 |
self.out.output("Removing all user accounts with id greater than " |
|
89 |
"1000") |
|
90 |
|
|
91 |
if 'USERS' not in self.meta: |
|
92 |
return |
|
93 |
|
|
94 |
# Remove users from /etc/passwd |
|
95 |
passwd = [] |
|
96 |
removed_users = {} |
|
97 |
metadata_users = self.meta['USERS'].split() |
|
98 |
for line in self.g.cat('/etc/passwd').splitlines(): |
|
99 |
fields = line.split(':') |
|
100 |
if int(fields[2]) > 1000: |
|
101 |
removed_users[fields[0]] = fields |
|
102 |
# remove it from the USERS metadata too |
|
103 |
if fields[0] in metadata_users: |
|
104 |
metadata_users.remove(fields[0]) |
|
105 |
else: |
|
106 |
passwd.append(':'.join(fields)) |
|
107 |
|
|
108 |
self.meta['USERS'] = " ".join(metadata_users) |
|
109 |
|
|
110 |
# Delete the USERS metadata if empty |
|
111 |
if not len(self.meta['USERS']): |
|
112 |
del self.meta['USERS'] |
|
113 |
|
|
114 |
self.g.write('/etc/passwd', '\n'.join(passwd) + '\n') |
|
115 |
|
|
116 |
# Remove the corresponding /etc/shadow entries |
|
117 |
shadow = [] |
|
118 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
119 |
fields = line.split(':') |
|
120 |
if fields[0] not in removed_users: |
|
121 |
shadow.append(':'.join(fields)) |
|
122 |
|
|
123 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
124 |
|
|
125 |
# Remove the corresponding /etc/group entries |
|
126 |
group = [] |
|
127 |
for line in self.g.cat('/etc/group').splitlines(): |
|
128 |
fields = line.split(':') |
|
129 |
# Remove groups tha have the same name as the removed users |
|
130 |
if fields[0] not in removed_users: |
|
131 |
group.append(':'.join(fields)) |
|
132 |
|
|
133 |
self.g.write('/etc/group', '\n'.join(group) + '\n') |
|
134 |
|
|
135 |
# Remove home directories |
|
136 |
for home in [field[5] for field in removed_users.values()]: |
|
137 |
if self.g.is_dir(home) and home.startswith('/home/'): |
|
138 |
self.g.rm_rf(home) |
|
139 |
|
|
140 |
@sysprep() |
|
141 |
def cleanup_passwords(self, print_header=True): |
|
142 |
"""Remove all passwords and lock all user accounts""" |
|
143 |
|
|
144 |
if print_header: |
|
145 |
self.out.output("Cleaning up passwords & locking all user " |
|
146 |
"accounts") |
|
147 |
|
|
148 |
shadow = [] |
|
149 |
|
|
150 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
151 |
fields = line.split(':') |
|
152 |
if fields[1] not in ('*', '!'): |
|
153 |
fields[1] = '!' |
|
154 |
|
|
155 |
shadow.append(":".join(fields)) |
|
156 |
|
|
157 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
158 |
|
|
59 | 159 |
@sysprep() |
60 | 160 |
def fix_acpid(self, print_header=True): |
61 | 161 |
"""Replace acpid powerdown action scripts to immediately shutdown the |
b/image_creator/os_type/unix.py | ||
---|---|---|
39 | 39 |
class Unix(OSBase): |
40 | 40 |
"""OS class for Unix""" |
41 | 41 |
sensitive_userdata = [ |
42 |
'.history', |
|
42 | 43 |
'.bash_history', |
43 | 44 |
'.gnupg', |
44 | 45 |
'.ssh', |
... | ... | |
49 | 50 |
def __init__(self, rootdev, ghandler, output): |
50 | 51 |
super(Unix, self).__init__(rootdev, ghandler, output) |
51 | 52 |
|
52 |
self.meta["USERS"] = " ".join(self._get_passworded_users()) |
|
53 |
# Delete the USERS metadata if empty |
|
54 |
if not len(self.meta['USERS']): |
|
55 |
self.out.warn("No passworded users found!") |
|
56 |
del self.meta['USERS'] |
|
57 |
|
|
58 |
def _get_passworded_users(self): |
|
59 |
users = [] |
|
60 |
regexp = re.compile('(\S+):((?:!\S+)|(?:[^!*]\S+)|):(?:\S*:){6}') |
|
61 |
|
|
62 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
63 |
match = regexp.match(line) |
|
64 |
if not match: |
|
65 |
continue |
|
66 |
|
|
67 |
user, passwd = match.groups() |
|
68 |
if len(passwd) > 0 and passwd[0] == '!': |
|
69 |
self.out.warn("Ignoring locked %s account." % user) |
|
70 |
else: |
|
71 |
users.append(user) |
|
72 |
|
|
73 |
return users |
|
74 |
|
|
75 |
@sysprep(enabled=False) |
|
76 |
def remove_user_accounts(self, print_header=True): |
|
77 |
"""Remove all user accounts with id greater than 1000""" |
|
78 |
|
|
79 |
if print_header: |
|
80 |
self.out.output("Removing all user accounts with id greater than " |
|
81 |
"1000") |
|
82 |
|
|
83 |
if 'USERS' not in self.meta: |
|
84 |
return |
|
85 |
|
|
86 |
# Remove users from /etc/passwd |
|
87 |
passwd = [] |
|
88 |
removed_users = {} |
|
89 |
metadata_users = self.meta['USERS'].split() |
|
90 |
for line in self.g.cat('/etc/passwd').splitlines(): |
|
91 |
fields = line.split(':') |
|
92 |
if int(fields[2]) > 1000: |
|
93 |
removed_users[fields[0]] = fields |
|
94 |
# remove it from the USERS metadata too |
|
95 |
if fields[0] in metadata_users: |
|
96 |
metadata_users.remove(fields[0]) |
|
97 |
else: |
|
98 |
passwd.append(':'.join(fields)) |
|
99 |
|
|
100 |
self.meta['USERS'] = " ".join(metadata_users) |
|
101 |
|
|
102 |
# Delete the USERS metadata if empty |
|
103 |
if not len(self.meta['USERS']): |
|
104 |
del self.meta['USERS'] |
|
105 |
|
|
106 |
self.g.write('/etc/passwd', '\n'.join(passwd) + '\n') |
|
107 |
|
|
108 |
# Remove the corresponding /etc/shadow entries |
|
109 |
shadow = [] |
|
110 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
111 |
fields = line.split(':') |
|
112 |
if fields[0] not in removed_users: |
|
113 |
shadow.append(':'.join(fields)) |
|
114 |
|
|
115 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
116 |
|
|
117 |
# Remove the corresponding /etc/group entries |
|
118 |
group = [] |
|
119 |
for line in self.g.cat('/etc/group').splitlines(): |
|
120 |
fields = line.split(':') |
|
121 |
# Remove groups tha have the same name as the removed users |
|
122 |
if fields[0] not in removed_users: |
|
123 |
group.append(':'.join(fields)) |
|
124 |
|
|
125 |
self.g.write('/etc/group', '\n'.join(group) + '\n') |
|
126 |
|
|
127 |
# Remove home directories |
|
128 |
for home in [field[5] for field in removed_users.values()]: |
|
129 |
if self.g.is_dir(home) and home.startswith('/home/'): |
|
130 |
self.g.rm_rf(home) |
|
131 |
|
|
132 |
@sysprep() |
|
133 |
def cleanup_passwords(self, print_header=True): |
|
134 |
"""Remove all passwords and lock all user accounts""" |
|
135 |
|
|
136 |
if print_header: |
|
137 |
self.out.output("Cleaning up passwords & locking all user " |
|
138 |
"accounts") |
|
139 |
|
|
140 |
shadow = [] |
|
141 |
|
|
142 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
143 |
fields = line.split(':') |
|
144 |
if fields[1] not in ('*', '!'): |
|
145 |
fields[1] = '!' |
|
146 |
|
|
147 |
shadow.append(":".join(fields)) |
|
148 |
|
|
149 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
150 |
|
|
151 | 53 |
@sysprep() |
152 | 54 |
def cleanup_cache(self, print_header=True): |
153 | 55 |
"""Remove all regular files under /var/cache""" |
Also available in: Unified diff