diff options
author | Christian Göttsche <cgzones@googlemail.com> | 2021-01-31 21:50:27 +0100 |
---|---|---|
committer | Jason Zaman <perfinion@gentoo.org> | 2021-02-06 12:54:11 -0800 |
commit | 16fa2fe4be80df6b61c0ecfa755ce7ad0ea9d358 (patch) | |
tree | da5a0387d956f6ebdfd4e8b3b7bce934134bdaa3 /support | |
parent | genhomedircon: misc pylint cleanup (diff) | |
download | hardened-refpolicy-16fa2fe4be80df6b61c0ecfa755ce7ad0ea9d358.tar.gz hardened-refpolicy-16fa2fe4be80df6b61c0ecfa755ce7ad0ea9d358.tar.bz2 hardened-refpolicy-16fa2fe4be80df6b61c0ecfa755ce7ad0ea9d358.zip |
genhomedircon: improve error messages for min uid search
Only grep if the files exist.
grep returns 1 on no match, check against 1 instead of 256.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
Diffstat (limited to 'support')
-rw-r--r-- | support/genhomedircon.py | 56 |
1 files changed, 29 insertions, 27 deletions
diff --git a/support/genhomedircon.py b/support/genhomedircon.py index e4475f5c7..2721bd7df 100644 --- a/support/genhomedircon.py +++ b/support/genhomedircon.py @@ -40,7 +40,7 @@ # are always "real" (including root, in the default configuration). # -import sys, pwd, getopt, re +import sys, pwd, getopt, re, os from subprocess import getstatusoutput EXCLUDE_LOGINS=["/sbin/nologin", "/bin/false"] @@ -71,32 +71,34 @@ def getStartingUID(): def getDefaultHomeDir(): ret = [] - rc=getstatusoutput("grep -h '^HOME' /etc/default/useradd") - if rc[0] == 0: - homedir = rc[1].split("=")[1] - homedir = homedir.split("#")[0] - homedir = homedir.strip() - if not homedir in ret: - ret.append(homedir) - else: - #rc[0] == 256 means the file was there, we read it, but the grep didn't match - if rc[0] != 256: - sys.stderr.write("%s\n" % rc[1]) - sys.stderr.write("You do not have access to /etc/default/useradd HOME=\n") - sys.stderr.flush() - rc=getstatusoutput("grep -h '^LU_HOMEDIRECTORY' /etc/libuser.conf") - if rc[0] == 0: - homedir = rc[1].split("=")[1] - homedir = homedir.split("#")[0] - homedir = homedir.strip() - if not homedir in ret: - ret.append(homedir) - else: - #rc[0] == 256 means the file was there, we read it, but the grep didn't match - if rc[0] != 256: - sys.stderr.write("%s\n" % rc[1]) - sys.stderr.write("You do not have access to /etc/libuser.conf LU_HOMEDIRECTORY=\n") - sys.stderr.flush() + if os.path.isfile('/etc/default/useradd'): + rc=getstatusoutput("grep -h '^HOME' /etc/default/useradd") + if rc[0] == 0: + homedir = rc[1].split("=")[1] + homedir = homedir.split("#")[0] + homedir = homedir.strip() + if not homedir in ret: + ret.append(homedir) + else: + #rc[0] == 1 means the file was there, we read it, but the grep didn't match + if rc[0] != 1: + sys.stderr.write("(%d): %s\n" % (rc[0], rc[1])) + sys.stderr.write("You do not have access to /etc/default/useradd HOME=\n") + sys.stderr.flush() + if os.path.isfile('/etc/libuser.conf'): + rc=getstatusoutput("grep -h '^LU_HOMEDIRECTORY' /etc/libuser.conf") + if rc[0] == 0: + homedir = rc[1].split("=")[1] + homedir = homedir.split("#")[0] + homedir = homedir.strip() + if not homedir in ret: + ret.append(homedir) + else: + #rc[0] == 1 means the file was there, we read it, but the grep didn't match + if rc[0] != 1: + sys.stderr.write("(%d): %s\n" % (rc[0], rc[1])) + sys.stderr.write("You do not have access to /etc/libuser.conf LU_HOMEDIRECTORY=\n") + sys.stderr.flush() if ret == []: ret.append("/home") return ret |