Skip to content
Snippets Groups Projects
Commit 2dcd42b7 authored by Nikos Skalkotos's avatar Nikos Skalkotos
Browse files

Move linux specific code from unix.py to linux.py

parent c78ac789
No related branches found
No related tags found
No related merge requests found
......@@ -44,6 +44,30 @@ class Linux(Unix):
self._uuid = dict()
self._persistent = re.compile('/dev/[hsv]d[a-z][1-9]*')
self.meta["USERS"] = " ".join(self._get_passworded_users())
# Delete the USERS metadata if empty
if not len(self.meta['USERS']):
self.out.warn("No passworded users found!")
del self.meta['USERS']
def _get_passworded_users(self):
users = []
regexp = re.compile('(\S+):((?:!\S+)|(?:[^!*]\S+)|):(?:\S*:){6}')
for line in self.g.cat('/etc/shadow').splitlines():
match = regexp.match(line)
if not match:
continue
user, passwd = match.groups()
if len(passwd) > 0 and passwd[0] == '!':
self.out.warn("Ignoring locked %s account." % user)
else:
users.append(user)
return users
def is_persistent(self, dev):
return not self._persistent.match(dev)
......@@ -56,6 +80,82 @@ class Linux(Unix):
self._uuid[dev] = uuid
return uuid
@sysprep(enabled=False)
def remove_user_accounts(self, print_header=True):
"""Remove all user accounts with id greater than 1000"""
if print_header:
self.out.output("Removing all user accounts with id greater than "
"1000")
if 'USERS' not in self.meta:
return
# Remove users from /etc/passwd
passwd = []
removed_users = {}
metadata_users = self.meta['USERS'].split()
for line in self.g.cat('/etc/passwd').splitlines():
fields = line.split(':')
if int(fields[2]) > 1000:
removed_users[fields[0]] = fields
# remove it from the USERS metadata too
if fields[0] in metadata_users:
metadata_users.remove(fields[0])
else:
passwd.append(':'.join(fields))
self.meta['USERS'] = " ".join(metadata_users)
# Delete the USERS metadata if empty
if not len(self.meta['USERS']):
del self.meta['USERS']
self.g.write('/etc/passwd', '\n'.join(passwd) + '\n')
# Remove the corresponding /etc/shadow entries
shadow = []
for line in self.g.cat('/etc/shadow').splitlines():
fields = line.split(':')
if fields[0] not in removed_users:
shadow.append(':'.join(fields))
self.g.write('/etc/shadow', "\n".join(shadow) + '\n')
# Remove the corresponding /etc/group entries
group = []
for line in self.g.cat('/etc/group').splitlines():
fields = line.split(':')
# Remove groups tha have the same name as the removed users
if fields[0] not in removed_users:
group.append(':'.join(fields))
self.g.write('/etc/group', '\n'.join(group) + '\n')
# Remove home directories
for home in [field[5] for field in removed_users.values()]:
if self.g.is_dir(home) and home.startswith('/home/'):
self.g.rm_rf(home)
@sysprep()
def cleanup_passwords(self, print_header=True):
"""Remove all passwords and lock all user accounts"""
if print_header:
self.out.output("Cleaning up passwords & locking all user "
"accounts")
shadow = []
for line in self.g.cat('/etc/shadow').splitlines():
fields = line.split(':')
if fields[1] not in ('*', '!'):
fields[1] = '!'
shadow.append(":".join(fields))
self.g.write('/etc/shadow', "\n".join(shadow) + '\n')
@sysprep()
def fix_acpid(self, print_header=True):
"""Replace acpid powerdown action scripts to immediately shutdown the
......
......@@ -39,6 +39,7 @@ from image_creator.os_type import OSBase, sysprep
class Unix(OSBase):
"""OS class for Unix"""
sensitive_userdata = [
'.history',
'.bash_history',
'.gnupg',
'.ssh',
......@@ -49,105 +50,6 @@ class Unix(OSBase):
def __init__(self, rootdev, ghandler, output):
super(Unix, self).__init__(rootdev, ghandler, output)
self.meta["USERS"] = " ".join(self._get_passworded_users())
# Delete the USERS metadata if empty
if not len(self.meta['USERS']):
self.out.warn("No passworded users found!")
del self.meta['USERS']
def _get_passworded_users(self):
users = []
regexp = re.compile('(\S+):((?:!\S+)|(?:[^!*]\S+)|):(?:\S*:){6}')
for line in self.g.cat('/etc/shadow').splitlines():
match = regexp.match(line)
if not match:
continue
user, passwd = match.groups()
if len(passwd) > 0 and passwd[0] == '!':
self.out.warn("Ignoring locked %s account." % user)
else:
users.append(user)
return users
@sysprep(enabled=False)
def remove_user_accounts(self, print_header=True):
"""Remove all user accounts with id greater than 1000"""
if print_header:
self.out.output("Removing all user accounts with id greater than "
"1000")
if 'USERS' not in self.meta:
return
# Remove users from /etc/passwd
passwd = []
removed_users = {}
metadata_users = self.meta['USERS'].split()
for line in self.g.cat('/etc/passwd').splitlines():
fields = line.split(':')
if int(fields[2]) > 1000:
removed_users[fields[0]] = fields
# remove it from the USERS metadata too
if fields[0] in metadata_users:
metadata_users.remove(fields[0])
else:
passwd.append(':'.join(fields))
self.meta['USERS'] = " ".join(metadata_users)
# Delete the USERS metadata if empty
if not len(self.meta['USERS']):
del self.meta['USERS']
self.g.write('/etc/passwd', '\n'.join(passwd) + '\n')
# Remove the corresponding /etc/shadow entries
shadow = []
for line in self.g.cat('/etc/shadow').splitlines():
fields = line.split(':')
if fields[0] not in removed_users:
shadow.append(':'.join(fields))
self.g.write('/etc/shadow', "\n".join(shadow) + '\n')
# Remove the corresponding /etc/group entries
group = []
for line in self.g.cat('/etc/group').splitlines():
fields = line.split(':')
# Remove groups tha have the same name as the removed users
if fields[0] not in removed_users:
group.append(':'.join(fields))
self.g.write('/etc/group', '\n'.join(group) + '\n')
# Remove home directories
for home in [field[5] for field in removed_users.values()]:
if self.g.is_dir(home) and home.startswith('/home/'):
self.g.rm_rf(home)
@sysprep()
def cleanup_passwords(self, print_header=True):
"""Remove all passwords and lock all user accounts"""
if print_header:
self.out.output("Cleaning up passwords & locking all user "
"accounts")
shadow = []
for line in self.g.cat('/etc/shadow').splitlines():
fields = line.split(':')
if fields[1] not in ('*', '!'):
fields[1] = '!'
shadow.append(":".join(fields))
self.g.write('/etc/shadow', "\n".join(shadow) + '\n')
@sysprep()
def cleanup_cache(self, print_header=True):
"""Remove all regular files under /var/cache"""
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment