Fixing audio permissions (server side) and simplify management of VM #6
@ -17,3 +17,8 @@
|
|||||||
- include: firefoxcert.yml
|
- include: firefoxcert.yml
|
||||||
tags:
|
tags:
|
||||||
- firefox
|
- firefox
|
||||||
|
|
||||||
|
- include: paperms.yml
|
||||||
|
tags:
|
||||||
|
- preseed
|
||||||
|
- paperms
|
||||||
|
25
roles/preseed/tasks/paperms.yml
Normal file
25
roles/preseed/tasks/paperms.yml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
# Installing fixes final fixes for PulseAudio permissions.
|
||||||
|
|
||||||
|
- name: Creating paperms subdir inside ks/preseed share
|
||||||
|
file:
|
||||||
|
path: /var/lib/nethserver/ibay/ks/paperms
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: locals
|
||||||
|
mode: 0755
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Deploy template files for paperms
|
||||||
|
template:
|
||||||
|
src: "paperms/{{ item }}"
|
||||||
|
dest: "/var/lib/nethserver/ibay/ks/paperms/{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: locals
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- updategrp.py
|
||||||
|
- paperms.sh
|
||||||
|
- cronjob
|
||||||
|
- logrotate
|
||||||
|
become: yes
|
@ -74,6 +74,5 @@
|
|||||||
- postseed-client.sh
|
- postseed-client.sh
|
||||||
- postseed-docenti.sh
|
- postseed-docenti.sh
|
||||||
- postseed-aula.sh
|
- postseed-aula.sh
|
||||||
- pulseaudio-perms.sh
|
|
||||||
- checksum.fact
|
- checksum.fact
|
||||||
become: yes
|
become: yes
|
||||||
|
1
roles/preseed/templates/paperms/cronjob
Normal file
1
roles/preseed/templates/paperms/cronjob
Normal file
@ -0,0 +1 @@
|
|||||||
|
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/paperms.sh >> /var/log/paperms.log 2>&1
|
7
roles/preseed/templates/paperms/logrotate
Normal file
7
roles/preseed/templates/paperms/logrotate
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
/var/log/paperms.log {
|
||||||
|
rotate 7
|
||||||
|
daily
|
||||||
|
compress
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
}
|
34
roles/preseed/templates/paperms/paperms.sh
Normal file
34
roles/preseed/templates/paperms/paperms.sh
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Fixing base variables
|
||||||
|
basedir=/var/lib/{{ ansible_local.domain.domainfull }}
|
||||||
|
|
||||||
|
# Making sure destination folder exists.
|
||||||
|
/usr/bin/install -d -o root -g users ${basedir}/bin
|
||||||
|
|
||||||
|
# Update this script itself
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh -O ${basedir}/bin/paperms.sh
|
||||||
|
/bin/chown root:users ${basedir}/bin/paperms.sh
|
||||||
|
/bin/chmod a+x ${basedir}/bin/paperms.sh
|
||||||
|
|
||||||
|
# Updating cronjob
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/cronjob -O /etc/cron.d/paperms
|
||||||
|
/bin/chown root:root /etc/cron.d/paperms
|
||||||
|
/bin/chmod 0644 /etc/cron.d/paperms
|
||||||
|
|
||||||
|
# Removing old versions of the cronjob
|
||||||
|
rm -f /etc/cron.d/pulseaudio-perms
|
||||||
|
|
||||||
|
# Updating logrotate
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/logrotate -O /etc/logrotate.d/paperms
|
||||||
|
/bin/chown root:root /etc/logrotate.d/paperms
|
||||||
|
/bin/chmod 0644 /etc/logrotate.d/paperms
|
||||||
|
|
||||||
|
# Updating updategrp.py
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/updategrp.py -O ${basedir}/bin/updategrp.py
|
||||||
|
/bin/chown root:users ${basedir}/bin/updategrp.py
|
||||||
|
/bin/chmod a+x ${basedir}/bin/updategrp.py
|
||||||
|
|
||||||
|
# Main part: run updategrp.py
|
||||||
|
/usr/bin/wbinfo -t && /usr/bin/python2 ${basedir}/bin/updategrp.py "domain users" "pulse" || echo "Not in domain."
|
||||||
|
/usr/bin/wbinfo -t && /usr/bin/python2 ${basedir}/bin/updategrp.py "domain users" "pulse-access" || echo "Not in domain."
|
74
roles/preseed/templates/paperms/updategrp.py
Normal file
74
roles/preseed/templates/paperms/updategrp.py
Normal file
@ -0,0 +1,74 @@
|
|||||||
|
#!/usr/bin/env python2
|
||||||
|
|
||||||
|
from __future__ import print_function
|
||||||
|
import grp
|
||||||
|
import re
|
||||||
|
from subprocess import check_output
|
||||||
|
from sys import argv
|
||||||
|
|
||||||
|
class UpdateGrp:
|
||||||
|
|
||||||
|
def __init__(self, leftname = "domain users", rightname = "pulse"):
|
||||||
|
"""Confronts members of the LHS group with the members of the RHS group. LHS group defaults to "domain users"."""
|
||||||
|
self.leftname = leftname
|
||||||
|
self.rightname = rightname
|
||||||
|
self.leftmembers = grp.getgrnam(self.leftname)[3]
|
||||||
|
self.rightmembers = grp.getgrnam(self.rightname)[3]
|
||||||
|
|
||||||
|
# Since there is also a local user already created on the machine but
|
||||||
|
# it is not a domain user, we will add it to leftmembers
|
||||||
|
self.leftmembers.append("bglug")
|
||||||
|
|
||||||
|
self.to_add = list(set(self.leftmembers) - set(self.rightmembers))
|
||||||
|
self.to_remove = list(set(self.rightmembers) - set(self.leftmembers))
|
||||||
|
|
||||||
|
def update_rhs(self):
|
||||||
|
"""Updates the RHS group members to be equal to the LHS group members."""
|
||||||
|
# If RHS is a local group
|
||||||
|
with open('/etc/group', 'r') as group:
|
||||||
|
for grp in group.readlines():
|
||||||
|
if re.match("%s:" % self.rightname, grp):
|
||||||
|
# If to_add is not empty, add each element to group
|
||||||
|
if len(self.to_add) > 0:
|
||||||
|
for user in self.to_add:
|
||||||
|
print(check_output(["gpasswd", "-a", user, self.rightname]), end='')
|
||||||
|
|
||||||
|
# If to_remove is not empty, remove each element to group
|
||||||
|
if len(self.to_remove) > 0:
|
||||||
|
for user in self.to_remove:
|
||||||
|
print(check_output(["gpasswd", "-d", user, self.rightname]), end='')
|
||||||
|
|
||||||
|
def update_lhs(self):
|
||||||
|
"""Updates the LHS group members to be equal to the RHS group members."""
|
||||||
|
# If LHS is a local group
|
||||||
|
with open('/etc/group', 'r') as group:
|
||||||
|
for grp in group.readline():
|
||||||
|
if re.match("%s:" % self.leftname, grp):
|
||||||
|
# If to_remove is not empty, add each element to group
|
||||||
|
if len(self.to_remove) > 0:
|
||||||
|
for user in self.to_remove:
|
||||||
|
print(check_output(["gpasswd", "-a", user, self.leftname]), end='')
|
||||||
|
|
||||||
|
# If to_add is not empty, remove each element to group
|
||||||
|
if len(self.to_add) > 0:
|
||||||
|
for user in self.to_add:
|
||||||
|
print(check_output(["gpasswd", "-d", user, self.leftname]), end='')
|
||||||
|
|
||||||
|
|
||||||
|
def modprint(self):
|
||||||
|
"""Debug function to print only modifications."""
|
||||||
|
print("To add: ", end='')
|
||||||
|
print(self.to_add)
|
||||||
|
print("To remove: ", end='')
|
||||||
|
print(self.to_remove)
|
||||||
|
|
||||||
|
# When run interactively
|
||||||
|
if __name__ == '__main__':
|
||||||
|
# If the first argument is '--help' or '-h', or number of arguments less than 1 and more than 2, print help.
|
||||||
|
if len(argv) < 2 or len(argv) > 3 or argv[1] == '--help' or argv[1] == '-h':
|
||||||
|
print("Usage: %s <LHSgroup> <RHSgroup>" % argv[0])
|
||||||
|
print("Aligns RHS group members as LHS.")
|
||||||
|
|
||||||
|
else:
|
||||||
|
updgrp = UpdateGrp(argv[1], argv[2])
|
||||||
|
updgrp.update_rhs()
|
@ -1,27 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
domaingroup="domain users"
|
|
||||||
localgroups="pulse pulse-access"
|
|
||||||
|
|
||||||
baseusers="bglug"
|
|
||||||
domainusers="$(getent group "${domaingroup}" | awk 'BEGIN { FS = ":" } ; { print $4 }' | sed -e 's/,/ /g')"
|
|
||||||
|
|
||||||
users="${baseusers} ${domainusers}"
|
|
||||||
|
|
||||||
for group in ${localgroups}; do
|
|
||||||
actualusers=$(getent group '${group}' | awk 'BEGIN { FS = ":" }; { print $4 }' | sed -e 's/,/ /g')
|
|
||||||
|
|
||||||
# Removing users not in the group
|
|
||||||
for user in ${actualusers}; do
|
|
||||||
whuser=${user//[[:space:]]/}
|
|
||||||
echo "removing ${user}"
|
|
||||||
[[ "${users}" =~ "${whuser}" ]] || gpasswd -d "${whuser}" "${group}"
|
|
||||||
unset whuser
|
|
||||||
done
|
|
||||||
|
|
||||||
# Adding users to group
|
|
||||||
for user in ${users}; do
|
|
||||||
whuser=${user//[[:space:]]/}
|
|
||||||
[[ "${actualusers}" =~ "${whuser}" ]] || gpasswd -a "${whuser}" "${group}"
|
|
||||||
done
|
|
||||||
done
|
|
Loading…
x
Reference in New Issue
Block a user