Revision 2dcd42b7 image_creator/os_type/linux.py
b/image_creator/os_type/linux.py | ||
---|---|---|
44 | 44 |
self._uuid = dict() |
45 | 45 |
self._persistent = re.compile('/dev/[hsv]d[a-z][1-9]*') |
46 | 46 |
|
47 |
self.meta["USERS"] = " ".join(self._get_passworded_users()) |
|
48 |
|
|
49 |
# Delete the USERS metadata if empty |
|
50 |
if not len(self.meta['USERS']): |
|
51 |
self.out.warn("No passworded users found!") |
|
52 |
del self.meta['USERS'] |
|
53 |
|
|
54 |
def _get_passworded_users(self): |
|
55 |
users = [] |
|
56 |
regexp = re.compile('(\S+):((?:!\S+)|(?:[^!*]\S+)|):(?:\S*:){6}') |
|
57 |
|
|
58 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
59 |
match = regexp.match(line) |
|
60 |
if not match: |
|
61 |
continue |
|
62 |
|
|
63 |
user, passwd = match.groups() |
|
64 |
if len(passwd) > 0 and passwd[0] == '!': |
|
65 |
self.out.warn("Ignoring locked %s account." % user) |
|
66 |
else: |
|
67 |
users.append(user) |
|
68 |
|
|
69 |
return users |
|
70 |
|
|
47 | 71 |
def is_persistent(self, dev): |
48 | 72 |
return not self._persistent.match(dev) |
49 | 73 |
|
... | ... | |
56 | 80 |
self._uuid[dev] = uuid |
57 | 81 |
return uuid |
58 | 82 |
|
83 |
@sysprep(enabled=False) |
|
84 |
def remove_user_accounts(self, print_header=True): |
|
85 |
"""Remove all user accounts with id greater than 1000""" |
|
86 |
|
|
87 |
if print_header: |
|
88 |
self.out.output("Removing all user accounts with id greater than " |
|
89 |
"1000") |
|
90 |
|
|
91 |
if 'USERS' not in self.meta: |
|
92 |
return |
|
93 |
|
|
94 |
# Remove users from /etc/passwd |
|
95 |
passwd = [] |
|
96 |
removed_users = {} |
|
97 |
metadata_users = self.meta['USERS'].split() |
|
98 |
for line in self.g.cat('/etc/passwd').splitlines(): |
|
99 |
fields = line.split(':') |
|
100 |
if int(fields[2]) > 1000: |
|
101 |
removed_users[fields[0]] = fields |
|
102 |
# remove it from the USERS metadata too |
|
103 |
if fields[0] in metadata_users: |
|
104 |
metadata_users.remove(fields[0]) |
|
105 |
else: |
|
106 |
passwd.append(':'.join(fields)) |
|
107 |
|
|
108 |
self.meta['USERS'] = " ".join(metadata_users) |
|
109 |
|
|
110 |
# Delete the USERS metadata if empty |
|
111 |
if not len(self.meta['USERS']): |
|
112 |
del self.meta['USERS'] |
|
113 |
|
|
114 |
self.g.write('/etc/passwd', '\n'.join(passwd) + '\n') |
|
115 |
|
|
116 |
# Remove the corresponding /etc/shadow entries |
|
117 |
shadow = [] |
|
118 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
119 |
fields = line.split(':') |
|
120 |
if fields[0] not in removed_users: |
|
121 |
shadow.append(':'.join(fields)) |
|
122 |
|
|
123 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
124 |
|
|
125 |
# Remove the corresponding /etc/group entries |
|
126 |
group = [] |
|
127 |
for line in self.g.cat('/etc/group').splitlines(): |
|
128 |
fields = line.split(':') |
|
129 |
# Remove groups tha have the same name as the removed users |
|
130 |
if fields[0] not in removed_users: |
|
131 |
group.append(':'.join(fields)) |
|
132 |
|
|
133 |
self.g.write('/etc/group', '\n'.join(group) + '\n') |
|
134 |
|
|
135 |
# Remove home directories |
|
136 |
for home in [field[5] for field in removed_users.values()]: |
|
137 |
if self.g.is_dir(home) and home.startswith('/home/'): |
|
138 |
self.g.rm_rf(home) |
|
139 |
|
|
140 |
@sysprep() |
|
141 |
def cleanup_passwords(self, print_header=True): |
|
142 |
"""Remove all passwords and lock all user accounts""" |
|
143 |
|
|
144 |
if print_header: |
|
145 |
self.out.output("Cleaning up passwords & locking all user " |
|
146 |
"accounts") |
|
147 |
|
|
148 |
shadow = [] |
|
149 |
|
|
150 |
for line in self.g.cat('/etc/shadow').splitlines(): |
|
151 |
fields = line.split(':') |
|
152 |
if fields[1] not in ('*', '!'): |
|
153 |
fields[1] = '!' |
|
154 |
|
|
155 |
shadow.append(":".join(fields)) |
|
156 |
|
|
157 |
self.g.write('/etc/shadow', "\n".join(shadow) + '\n') |
|
158 |
|
|
59 | 159 |
@sysprep() |
60 | 160 |
def fix_acpid(self, print_header=True): |
61 | 161 |
"""Replace acpid powerdown action scripts to immediately shutdown the |
Also available in: Unified diff