Pull request for branch yem-package-create-user

GIT PULL New Yann E. MORIN 3 participants 9 messages Dec 30, 2012 – Jan 1, 2013 VFS

lore

Share & tools

lore

Yann E. MORIN

author

2012-12-30 23:26 UTC #0 lore raw

Hello All!

Here is a series that allows packages to create users.

Packages that install daemons may well want to run those daemons as non-root users to avoid security issues. Currently, there are two users of choice to run 'generic' daemons: root or daemon (although there are a few dedicated users to run a few services: mail, sshd, ftp...).

This series builds upon both the package infrastrucutre to define the user(s) a package may want to create, and the filesystem infrastructure to actually generate these users, and chown their ${HOME}s.

Documentation is updated accordingly.

Note: for now, users' passwords are md5-encrypted. Once the pending change to introduce alternative password-encryption schemes is applied, we can use that to encode users' passwords, too.

As a proof of concept, the package tvheadend has been updated to use a dedicated user to run its daemon as (call me stubborn! ;-] ).

The following changes since commit f1d44593a04ff3be981c8a3b01a502f0b18193ee:

docs/manual: small fixes and enhancements to adding generic packages (2012-12-30 22:39:13 +0100)

are available in the git repository at:
git://gitorious.org/buildroot/buildroot.git yem-package-create-user

Yann E. MORIN (3):
system/skeleton: add the shadow-group file
packages: add ability for packages to create users package/tvheadend: use a non-root user to run the daemon

 docs/manual/adding-packages-generic.txt |   16 ++-
 docs/manual/makedev-syntax.txt          |   65 ++++++
 fs/common.mk                            |    5 +-
 package/pkg-generic.mk                  |    1 +
 package/tvheadend/etc.default.tvheadend |    5 +-
 package/tvheadend/tvheadend.mk          |   10 +-
 support/scripts/mkusers                 |  341 +++++++++++++++++++++++++++++++
 system/skeleton/etc/gshadow             |   21 ++
 8 files changed, 456 insertions(+), 8 deletions(-)
 create mode 100755 support/scripts/mkusers
 create mode 100644 system/skeleton/etc/gshadow

Regards,
Yann E. MORIN

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Yann E. MORIN

author

2012-12-30 23:26 UTC #1 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

/etc/gshadow is to /etc/group what /etc/shadow is to /etc/passwd.

Signed-off-by "Yann E. MORIN" <[email protected]>

---
 system/skeleton/etc/gshadow |   21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)
 create mode 100644 system/skeleton/etc/gshadow

system/skeleton/etc/gshadow new file +21 -0

new file mode 100644
index 0000000..0af6dad
@@ -0,0 +1,21 @@
+root:*::
+daemon:*::
+bin:*::
+sys:*::
+adm:*::
+tty:*::
+disk:*::
+wheel:*::
+audio:*::
+www-data:*::
+utmp:*::
+staff:*::
+lock:*::
+haldaemon:*::
+dbus:*::
+netdev:*::
+ftp:*::
+nobody:*::
+nogroup:*::
+users:*::
+default:*::

Signature · 1 line

1.7.2.5

Thomas Petazzoni

2012-12-31 17:18 UTC #2 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

Dear Yann E. MORIN,

Quoted 1 line · Yann E. MORIN

/etc/gshadow is to /etc/group what /etc/shadow is to /etc/passwd.

Could you give some more details? I understand /etc/shadow as opposed to /etc/passwd, but I don't see the point of /etc/gshadow since groups don't have passwords.

Thomas

Signature · 4 lines

Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

Yann E. MORIN

author

2012-12-31 18:18 UTC #3 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

Thomas, All,

Quoted 6 lines · On Monday 31 December 2012 Thomas Petazzoni wrote:

Quoted 1 line · Yann E. MORIN
/etc/gshadow is to /etc/group what /etc/shadow is to /etc/passwd.
Could you give some more details? I understand /etc/shadow as opposed to /etc/passwd, but I don't see the point of /etc/gshadow since groups don't have passwords.

Wrong. Groups can have passwords. And users can change-group with:

    $ newgrp [-] groupname

If the user is a member of that group, or the group is paswrod-less, then no password is asked for, and the current group-id has changed (it is a bit like 'su', but to just change group)

If the user is not a member that group, and the group is not restricted (eg. password is not '*' and does not start with '!', then the user is asked to enter the group password.

See:

    group(5) gshadow(5) newgrp(1)

I hope that was enough to explain addition of gshadow. ;-)

Happy New Year!

Regards,
Yann E. MORIN.

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Thomas Petazzoni

2013-01-01 09:26 UTC #4 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

Dear Yann E. MORIN,

Happy New Year!

Quoted 8 lines · Yann E. MORIN

Wrong. Groups can have passwords. And users can change-group with:
    $ newgrp [-] groupname
If the user is a member of that group, or the group is paswrod-less, then no password is asked for, and the current group-id has changed (it is a bit like 'su', but to just change group)

Quoted 8 lines

If the user is not a member that group, and the group is not restricted (eg. password is not '*' and does not start with '!', then the user is asked to enter the group password.
See:
    group(5) gshadow(5) newgrp(1)
I hope that was enough to explain addition of gshadow. ;-)

Interesting, I didn't know about this.

The next question that comes up is: do we really need to support this in Buildroot?

Thomas

Signature · 4 lines

Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

Yann E. MORIN

author

2013-01-01 15:36 UTC #5 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

Thomas, All,

Quoted 2 lines · On Tuesday 01 January 2013 Thomas Petazzoni wrote:

Quoted 1 line · Yann E. MORIN
Wrong. Groups can have passwords. And users can change-group with:

[--SNIP--]

Quoted 2 lines

The next question that comes up is: do we really need to support this in Buildroot?

Well, I interpreted the abscence of that file as an oversight, that's why I thought of adding it.

Right, we probably do not need the change-group feature in buildroot. However, for the sake of consistency, I think it is good to have gshadow.

But I can very well live without it, sure.

Anyway... Happy New Year to all! :-)

Regards,
Yann E. MORIN.

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Peter Korsgaard

2013-01-01 21:08 UTC #6 lore raw

PATCH 1/3 system/skeleton: add the shadow-group file

Quoted 1 line

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:

Hi,

Quoted 2 lines

Quoted 2 lines
The next question that comes up is: do we really need to support this in Buildroot?

Yann> Well, I interpreted the abscence of that file as an oversight, Yann> that's why I thought of adding it.

Yann> Right, we probably do not need the change-group feature in Yann> buildroot. However, for the sake of consistency, I think it is Yann> good to have gshadow.

Yann> But I can very well live without it, sure.

Well, the fact that nobody has ever asked for it in the 11 years buildroot has existed and that Thomas (and me) didn't know about the file, makes me think that perhaps it isn't too important to support it in the default skeleton (you can certainly manually add it).

Yann> Anyway... Happy New Year to all! :-)

Thanks, same to you!

Signature · 1 line

Bye, Peter Korsgaard

Yann E. MORIN

author

2012-12-30 23:26 UTC #7 lore raw

PATCH 2/3 packages: add ability for packages to create users

In reply to Yann E. MORIN

Packages that install daemons may need those daemons to run as a non-root, or an otherwise non-system (eg. 'daemon'), user.

Add infrastructure for packages to create users, by declaring the FOO_USERS variable that conatin a makedev-syntax-like description of the user(s) to add.

Signed-off-by "Yann E. MORIN" <[email protected]>

---
 docs/manual/adding-packages-generic.txt |   16 ++-
 docs/manual/makedev-syntax.txt          |   65 ++++++
 fs/common.mk                            |    5 +-
 package/pkg-generic.mk                  |    1 +
 support/scripts/mkusers                 |  341 +++++++++++++++++++++++++++++++
 5 files changed, 425 insertions(+), 3 deletions(-)
 create mode 100755 support/scripts/mkusers

docs/manual/adding-packages-generic.txt +14 -2

index 0759d4f..1adf424 100644
@@ -50,7 +50,11 @@ system is based on hand-written Makefiles or shell scripts.
 34:	/bin/foo  f  4755  0  0	 -  -  -  -  -
 35: endef
 36:
-37: $(eval $(generic-package))
+37: define LIBFOO_USERS
+38: foo -1 libfoo -1 * - - - LibFoo daemon
+39: endef
+40
+41: $(eval $(generic-package))
 --------------------------------
 
 The Makefile begins on line 6 to 10 with metadata information: the

@@ -95,7 +99,10 @@ On line 29..31, we define a device-node file used by this package
 On line 33..35, we define the permissions to set to specific files
 installed by this package (+LIBFOO_PERMISSIONS+).
 
-Finally, on line 37, we call the +generic-package+ function, which
+On lines 37..39, we define a user that is used by this package (eg.
+to run a daemon as non-root).
+
+Finally, on line 41, we call the +generic-package+ function, which
 generates, according to the variables defined previously, all the
 Makefile code necessary to make your package working.

@@ -252,6 +259,11 @@ information is (assuming the package name is +libfoo+) :
   You can find some documentation for this syntax in the xref:makedev-syntax[].
   This variable is optional.
 
+* +LIBFOO_USERS+ lists the users to create for this package, if it installs
+  a daemon you want to run with a specific user. The syntax is similar in
+  spirit to the makedevs one, and is described in the xref:makeuser-syntax[].
+  This variable is optional.
+
 * +LIBFOO_LICENSE+ defines the license (or licenses) under which the package
   is released.
   This name will appear in the manifest file produced by +make legal-info+.

docs/manual/makedev-syntax.txt +65 -0

68 lines not on this page · raw message

fs/common.mk +4 -1

index b1512dd..b5a7950 100644
@@ -35,6 +35,7 @@ FAKEROOT_SCRIPT = $(BUILD_DIR)/_fakeroot.fs
 FULL_DEVICE_TABLE = $(BUILD_DIR)/_device_table.txt
 ROOTFS_DEVICE_TABLES = $(call qstrip,$(BR2_ROOTFS_DEVICE_TABLE)) \
 	$(call qstrip,$(BR2_ROOTFS_STATIC_DEVICE_TABLE))
+USERS_TABLE = $(BUILD_DIR)/_users_table.txt
 
 define ROOTFS_TARGET_INTERNAL

@@ -55,11 +56,13 @@ endif
 	printf '$(subst $(sep),\n,$(PACKAGES_PERMISSIONS_TABLE))' >> $(FULL_DEVICE_TABLE)
 	echo "$(HOST_DIR)/usr/bin/makedevs -d $(FULL_DEVICE_TABLE) $(TARGET_DIR)" >> $(FAKEROOT_SCRIPT)
 endif
+	printf '$(subst $(sep),\n,$(PACKAGES_USERS))' > $(USERS_TABLE)
+	$(TOPDIR)/support/scripts/mkusers $(USERS_TABLE) $(TARGET_DIR) >> $(FAKEROOT_SCRIPT)
 	echo "$(ROOTFS_$(2)_CMD)" >> $(FAKEROOT_SCRIPT)
 	chmod a+x $(FAKEROOT_SCRIPT)
 	$(HOST_DIR)/usr/bin/fakeroot -- $(FAKEROOT_SCRIPT)
 	cp support/misc/target-dir-warning.txt $(TARGET_DIR_WARNING_FILE)
-	- at rm -f $(FAKEROOT_SCRIPT) $(FULL_DEVICE_TABLE)
+	- at rm -f $(FAKEROOT_SCRIPT) $(FULL_DEVICE_TABLE) $(USERS_TABLE)
 	$(foreach hook,$(ROOTFS_$(2)_POST_GEN_HOOKS),$(call $(hook))$(sep))
 ifeq ($$(BR2_TARGET_ROOTFS_$(2)_GZIP),y)
 	gzip -9 -c $$@ > [email protected]

package/pkg-generic.mk +1 -0

index a570ad7..871544c 100644
@@ -510,6 +510,7 @@ ifeq ($$($$($(2)_KCONFIG_VAR)),y)
 TARGETS += $(1)
 PACKAGES_PERMISSIONS_TABLE += $$($(2)_PERMISSIONS)$$(sep)
 PACKAGES_DEVICES_TABLE += $$($(2)_DEVICES)$$(sep)
+PACKAGES_USERS += $$($(2)_USERS)$$(sep)
 
 ifeq ($$($(2)_SITE_METHOD),svn)
 DL_TOOLS_DEPENDENCIES += svn

support/scripts/mkusers new file +341 -0

341 lines not on this page · raw message

Signature · 1 line

1.7.2.5

Yann E. MORIN

author

2012-12-30 23:26 UTC #8 lore raw

PATCH 3/3 package/tvheadend: use a non-root user to run the daemon

In reply to Yann E. MORIN

Signed-off-by "Yann E. MORIN" <[email protected]>

---
 package/tvheadend/etc.default.tvheadend |    5 ++---
 package/tvheadend/tvheadend.mk          |   10 ++++++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

package/tvheadend/etc.default.tvheadend +2 -3

index c769055..253f832 100644
@@ -1,6 +1,5 @@
-# Once we have a real user, we'll use it
-TVH_USER=root
-TVH_GROUP=root
+TVH_USER=tvheadend
+TVH_GROUP=tvheadend
 #TVH_ADAPTERS=
 #TVH_HTTP_PORT=9981
 #TVH_HTSP_PORT=9982

package/tvheadend/tvheadend.mk +8 -2

index 5100781..f63b433 100644
@@ -26,9 +26,11 @@ TVHEADEND_DEPENDENCIES     += dvb-apps
 # To run tvheadend, we need:
 #  - a startup script, and its config file
 #  - a default DB with a tvheadend admin
+#  - a non-root user to run as
 define TVHEADEND_INSTALL_DB
-	$(INSTALL) -D package/tvheadend/accesscontrol.1     \
-	              $(TARGET_DIR)/root/.hts/tvheadend/accesscontrol/1
+	$(INSTALL) -D -m 0600 package/tvheadend/accesscontrol.1     \
+	              $(TARGET_DIR)/home/tvheadend/.hts/tvheadend/accesscontrol/1
+	chmod -R go-rwx $(TARGET_DIR)/home/tvheadend
 endef
 TVHEADEND_POST_INSTALL_TARGET_HOOKS  = TVHEADEND_INSTALL_DB

@@ -37,6 +39,10 @@ define TVHEADEND_INSTALL_INIT_SYSV
 	$(INSTALL) -D package/tvheadend/S99tvheadend          $(TARGET_DIR)/etc/init.d/S99tvheadend
 endef
 
+define TVHEADEND_USERS
+tvheadend -1 tvheadend -1 * /home/tvheadend - - TVHeadend daemon
+endef
+
 #----------------------------------------------------------------------------
 # tvheadend is not an autotools-based package, but it is possible to
 # call its ./configure script as if it were an autotools one.

Signature · 1 line

1.7.2.5