From a2e013674b028103a10de86e6abfaaabe230946e Mon Sep 17 00:00:00 2001 From: Emiliano Vavassori Date: Thu, 8 Nov 2018 22:09:45 +0100 Subject: [PATCH] Fix for PulseAudio permissions, server side. --- roles/preseed/tasks/main.yml | 5 ++ roles/preseed/tasks/paperms.yml | 25 +++++++ roles/preseed/tasks/preseed.yml | 1 - roles/preseed/templates/paperms/cronjob | 1 + roles/preseed/templates/paperms/logrotate | 7 ++ roles/preseed/templates/paperms/paperms.sh | 34 +++++++++ roles/preseed/templates/paperms/updategrp.py | 74 +++++++++++++++++++ .../templates/preseed/pulseaudio-perms.sh | 27 ------- 8 files changed, 146 insertions(+), 28 deletions(-) create mode 100644 roles/preseed/tasks/paperms.yml create mode 100644 roles/preseed/templates/paperms/cronjob create mode 100644 roles/preseed/templates/paperms/logrotate create mode 100644 roles/preseed/templates/paperms/paperms.sh create mode 100644 roles/preseed/templates/paperms/updategrp.py delete mode 100755 roles/preseed/templates/preseed/pulseaudio-perms.sh diff --git a/roles/preseed/tasks/main.yml b/roles/preseed/tasks/main.yml index 4f7b83b..7953c6a 100644 --- a/roles/preseed/tasks/main.yml +++ b/roles/preseed/tasks/main.yml @@ -17,3 +17,8 @@ - include: firefoxcert.yml tags: - firefox + +- include: paperms.yml + tags: + - preseed + - paperms diff --git a/roles/preseed/tasks/paperms.yml b/roles/preseed/tasks/paperms.yml new file mode 100644 index 0000000..ca05705 --- /dev/null +++ b/roles/preseed/tasks/paperms.yml @@ -0,0 +1,25 @@ +--- +# Installing fixes final fixes for PulseAudio permissions. + +- name: Creating paperms subdir inside ks/preseed share + file: + path: /var/lib/nethserver/ibay/ks/paperms + state: directory + owner: root + group: locals + mode: 0755 + become: yes + +- name: Deploy template files for paperms + template: + src: "paperms/{{ item }}" + dest: "/var/lib/nethserver/ibay/ks/paperms/{{ item }}" + owner: root + group: locals + mode: 0644 + with_items: + - updategrp.py + - paperms.sh + - cronjob + - logrotate + become: yes diff --git a/roles/preseed/tasks/preseed.yml b/roles/preseed/tasks/preseed.yml index 36a339e..e2a7182 100644 --- a/roles/preseed/tasks/preseed.yml +++ b/roles/preseed/tasks/preseed.yml @@ -74,6 +74,5 @@ - postseed-client.sh - postseed-docenti.sh - postseed-aula.sh - - pulseaudio-perms.sh - checksum.fact become: yes diff --git a/roles/preseed/templates/paperms/cronjob b/roles/preseed/templates/paperms/cronjob new file mode 100644 index 0000000..ab3d7a3 --- /dev/null +++ b/roles/preseed/templates/paperms/cronjob @@ -0,0 +1 @@ +@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/paperms.sh >> /var/log/paperms.log 2>&1 diff --git a/roles/preseed/templates/paperms/logrotate b/roles/preseed/templates/paperms/logrotate new file mode 100644 index 0000000..0aae171 --- /dev/null +++ b/roles/preseed/templates/paperms/logrotate @@ -0,0 +1,7 @@ +/var/log/paperms.log { + rotate 7 + daily + compress + missingok + notifempty +} diff --git a/roles/preseed/templates/paperms/paperms.sh b/roles/preseed/templates/paperms/paperms.sh new file mode 100644 index 0000000..a11e29d --- /dev/null +++ b/roles/preseed/templates/paperms/paperms.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +# Fixing base variables +basedir=/var/lib/{{ ansible_local.domain.domainfull }} + +# Making sure destination folder exists. +/usr/bin/install -d -o root -g users ${basedir}/bin + +# Update this script itself +/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh -O ${basedir}/bin/paperms.sh +/bin/chown root:users ${basedir}/bin/paperms.sh +/bin/chmod a+x ${basedir}/bin/paperms.sh + +# Updating cronjob +/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/cronjob -O /etc/cron.d/paperms +/bin/chown root:root /etc/cron.d/paperms +/bin/chmod 0644 /etc/cron.d/paperms + +# Removing old versions of the cronjob +rm -f /etc/cron.d/pulseaudio-perms + +# Updating logrotate +/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/logrotate -O /etc/logrotate.d/paperms +/bin/chown root:root /etc/logrotate.d/paperms +/bin/chmod 0644 /etc/logrotate.d/paperms + +# Updating updategrp.py +/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/updategrp.py -O ${basedir}/bin/updategrp.py +/bin/chown root:users ${basedir}/bin/updategrp.py +/bin/chmod a+x ${basedir}/bin/updategrp.py + +# Main part: run updategrp.py +/usr/bin/wbinfo -t && /usr/bin/python2 ${basedir}/bin/updategrp.py "domain users" "pulse" || echo "Not in domain." +/usr/bin/wbinfo -t && /usr/bin/python2 ${basedir}/bin/updategrp.py "domain users" "pulse-access" || echo "Not in domain." diff --git a/roles/preseed/templates/paperms/updategrp.py b/roles/preseed/templates/paperms/updategrp.py new file mode 100644 index 0000000..c26da98 --- /dev/null +++ b/roles/preseed/templates/paperms/updategrp.py @@ -0,0 +1,74 @@ +#!/usr/bin/env python2 + +from __future__ import print_function +import grp +import re +from subprocess import check_output +from sys import argv + +class UpdateGrp: + + def __init__(self, leftname = "domain users", rightname = "pulse"): + """Confronts members of the LHS group with the members of the RHS group. LHS group defaults to "domain users".""" + self.leftname = leftname + self.rightname = rightname + self.leftmembers = grp.getgrnam(self.leftname)[3] + self.rightmembers = grp.getgrnam(self.rightname)[3] + + # Since there is also a local user already created on the machine but + # it is not a domain user, we will add it to leftmembers + self.leftmembers.append("bglug") + + self.to_add = list(set(self.leftmembers) - set(self.rightmembers)) + self.to_remove = list(set(self.rightmembers) - set(self.leftmembers)) + + def update_rhs(self): + """Updates the RHS group members to be equal to the LHS group members.""" + # If RHS is a local group + with open('/etc/group', 'r') as group: + for grp in group.readlines(): + if re.match("%s:" % self.rightname, grp): + # If to_add is not empty, add each element to group + if len(self.to_add) > 0: + for user in self.to_add: + print(check_output(["gpasswd", "-a", user, self.rightname]), end='') + + # If to_remove is not empty, remove each element to group + if len(self.to_remove) > 0: + for user in self.to_remove: + print(check_output(["gpasswd", "-d", user, self.rightname]), end='') + + def update_lhs(self): + """Updates the LHS group members to be equal to the RHS group members.""" + # If LHS is a local group + with open('/etc/group', 'r') as group: + for grp in group.readline(): + if re.match("%s:" % self.leftname, grp): + # If to_remove is not empty, add each element to group + if len(self.to_remove) > 0: + for user in self.to_remove: + print(check_output(["gpasswd", "-a", user, self.leftname]), end='') + + # If to_add is not empty, remove each element to group + if len(self.to_add) > 0: + for user in self.to_add: + print(check_output(["gpasswd", "-d", user, self.leftname]), end='') + + + def modprint(self): + """Debug function to print only modifications.""" + print("To add: ", end='') + print(self.to_add) + print("To remove: ", end='') + print(self.to_remove) + +# When run interactively +if __name__ == '__main__': + # If the first argument is '--help' or '-h', or number of arguments less than 1 and more than 2, print help. + if len(argv) < 2 or len(argv) > 3 or argv[1] == '--help' or argv[1] == '-h': + print("Usage: %s " % argv[0]) + print("Aligns RHS group members as LHS.") + + else: + updgrp = UpdateGrp(argv[1], argv[2]) + updgrp.update_rhs() diff --git a/roles/preseed/templates/preseed/pulseaudio-perms.sh b/roles/preseed/templates/preseed/pulseaudio-perms.sh deleted file mode 100755 index 9025660..0000000 --- a/roles/preseed/templates/preseed/pulseaudio-perms.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash - -domaingroup="domain users" -localgroups="pulse pulse-access" - -baseusers="bglug" -domainusers="$(getent group "${domaingroup}" | awk 'BEGIN { FS = ":" } ; { print $4 }' | sed -e 's/,/ /g')" - -users="${baseusers} ${domainusers}" - -for group in ${localgroups}; do - actualusers=$(getent group '${group}' | awk 'BEGIN { FS = ":" }; { print $4 }' | sed -e 's/,/ /g') - - # Removing users not in the group - for user in ${actualusers}; do - whuser=${user//[[:space:]]/} - echo "removing ${user}" - [[ "${users}" =~ "${whuser}" ]] || gpasswd -d "${whuser}" "${group}" - unset whuser - done - - # Adding users to group - for user in ${users}; do - whuser=${user//[[:space:]]/} - [[ "${actualusers}" =~ "${whuser}" ]] || gpasswd -a "${whuser}" "${group}" - done -done