Blame SOURCES/0063-Add-friendly-grub2-password-config-tool-985962.patch

8631a2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
8631a2
From: Robert Marshall <rmarshall@redhat.com>
8631a2
Date: Thu, 25 Jun 2015 11:13:11 -0400
8631a2
Subject: [PATCH] Add friendly grub2 password config tool (#985962)
8631a2
8631a2
Provided a tool for users to reset the grub2 root user password
8631a2
without having to alter the grub.cfg. The hashed password now
8631a2
lives in a root-only-readable configuration file.
8631a2
8631a2
Resolves: rhbz#985962
8631a2
---
8631a2
 configure.ac             |   1 +
8631a2
 Makefile.util.def        |  13 +++++
8631a2
 .gitignore               |   2 +
8631a2
 util/grub-mkconfig.in    |   2 +
8631a2
 util/grub-setpassword.8  |  28 +++++++++++
8631a2
 util/grub-setpassword.in | 123 +++++++++++++++++++++++++++++++++++++++++++++++
8631a2
 util/grub.d/01_users.in  |  11 +++++
8631a2
 7 files changed, 180 insertions(+)
8631a2
 create mode 100644 util/grub-setpassword.8
8631a2
 create mode 100644 util/grub-setpassword.in
8631a2
 create mode 100644 util/grub.d/01_users.in
8631a2
8631a2
diff --git a/configure.ac b/configure.ac
f6e916
index 056df1cba..679f634ce 100644
8631a2
--- a/configure.ac
8631a2
+++ b/configure.ac
8631a2
@@ -65,6 +65,7 @@ grub_TRANSFORM([grub-mkrelpath])
8631a2
 grub_TRANSFORM([grub-mkrescue])
8631a2
 grub_TRANSFORM([grub-probe])
8631a2
 grub_TRANSFORM([grub-reboot])
8631a2
+grub_TRANSFORM([grub-setpassword])
8631a2
 grub_TRANSFORM([grub-rpm-sort])
8631a2
 grub_TRANSFORM([grub-script-check])
8631a2
 grub_TRANSFORM([grub-set-default])
8631a2
diff --git a/Makefile.util.def b/Makefile.util.def
f6e916
index 406d96861..fd91045bd 100644
8631a2
--- a/Makefile.util.def
8631a2
+++ b/Makefile.util.def
8631a2
@@ -440,6 +440,12 @@ script = {
8631a2
   installdir = grubconf;
8631a2
 };
8631a2
 
8631a2
+script = {
8631a2
+  name = '01_users';
8631a2
+  common = util/grub.d/01_users.in;
8631a2
+  installdir = grubconf;
8631a2
+};
8631a2
+
8631a2
 script = {
8631a2
   name = '10_windows';
8631a2
   common = util/grub.d/10_windows.in;
8631a2
@@ -722,6 +728,13 @@ script = {
8631a2
   installdir = sbin;
8631a2
 };
8631a2
 
8631a2
+script = {
8631a2
+  name = grub-setpassword;
8631a2
+  common = util/grub-setpassword.in;
8631a2
+  mansection = 8;
8631a2
+  installdir = sbin;
8631a2
+};
8631a2
+
8631a2
 script = {
8631a2
   name = grub-mkconfig_lib;
8631a2
   common = util/grub-mkconfig_lib.in;
8631a2
diff --git a/.gitignore b/.gitignore
f6e916
index fa2e5b609..5066689bc 100644
8631a2
--- a/.gitignore
8631a2
+++ b/.gitignore
8631a2
@@ -111,6 +111,8 @@ grub-*.tar.*
8631a2
 /grub*-script-check.1
8631a2
 /grub*-set-default
8631a2
 /grub*-set-default.8
8631a2
+/grub*-setsetpassword
8631a2
+/grub*-setsetpassword.8
8631a2
 /grub*-shell
8631a2
 /grub*-shell-tester
8631a2
 /grub*-sparc64-setup
8631a2
diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
f6e916
index f68d4925e..bdb9982ae 100644
8631a2
--- a/util/grub-mkconfig.in
8631a2
+++ b/util/grub-mkconfig.in
8631a2
@@ -282,6 +282,8 @@ for i in "${grub_mkconfig_dir}"/* ; do
8631a2
     *~) ;;
8631a2
     # emacsen autosave files. FIXME: support other editors
8631a2
     */\#*\#) ;;
8631a2
+    # rpm config files of yore.
8631a2
+    *.rpmsave|*.rpmnew|*.rpmorig) ;;
8631a2
     *)
8631a2
       if grub_file_is_not_garbage "$i" && test -x "$i" ; then
8631a2
         echo
8631a2
diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8
8631a2
new file mode 100644
f6e916
index 000000000..49200a848
8631a2
--- /dev/null
8631a2
+++ b/util/grub-setpassword.8
8631a2
@@ -0,0 +1,28 @@
8631a2
+.TH GRUB-SETPASSWORD 3 "Thu Jun 25 2015"
8631a2
+.SH NAME
8631a2
+\fBgrub-setpassword\fR \(em Generate the user.cfg file containing the hashed grub bootloader password.
8631a2
+
8631a2
+.SH SYNOPSIS
8631a2
+\fBgrub-setpassword\fR [OPTION]
8631a2
+
8631a2
+.SH DESCRIPTION
8631a2
+\fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user.
8631a2
+
8631a2
+The file has the format:
8631a2
+GRUB2_PASSWORD=<\fIhashed password\fR>.
8631a2
+
8631a2
+.SH OPTIONS
8631a2
+.TP
8631a2
+-h, --help
8631a2
+Display program usage and exit.
8631a2
+.TP
8631a2
+-v, --version
8631a2
+Display the current version.
8631a2
+.TP
8631a2
+-o, --output[=\fIDIRECTORY PATH\fR]
8631a2
+Choose the file path to which user.cfg will be written.
8631a2
+
8631a2
+.SH SEE ALSO
8631a2
+.BR "info grub"
8631a2
+
8631a2
+.BR "info grub2-mkpasswd-pbkdf2"
8631a2
diff --git a/util/grub-setpassword.in b/util/grub-setpassword.in
8631a2
new file mode 100644
f6e916
index 000000000..dd76f00fc
8631a2
--- /dev/null
8631a2
+++ b/util/grub-setpassword.in
8631a2
@@ -0,0 +1,123 @@
8631a2
+#!/bin/sh -e
8631a2
+
8631a2
+if [ -d /sys/firmware/efi/efivars/ ]; then
8631a2
+    grubdir=`echo "/@bootdirname@/efi/EFI/redhat/" | sed 's,//*,/,g'`
8631a2
+else
8631a2
+    grubdir=`echo "/@bootdirname@/@grubdirname@" | sed 's,//*,/,g'`
8631a2
+fi
8631a2
+
8631a2
+PACKAGE_VERSION="@PACKAGE_VERSION@"
8631a2
+PACKAGE_NAME="@PACKAGE_NAME@"
8631a2
+self=`basename $0`
8631a2
+bindir="@bindir@"
8631a2
+grub_mkpasswd="${bindir}/@grub_mkpasswd_pbkdf2@"
8631a2
+
8631a2
+# Usage: usage
8631a2
+# Print the usage.
8631a2
+usage () {
8631a2
+    cat <
8631a2
+Usage: $0 [OPTION] [SOURCE]
8631a2
+Run GRUB script in a Qemu instance.
8631a2
+
8631a2
+  -h, --help              print this message and exit
8631a2
+  -v, --version           print the version information and exit
8631a2
+  -o, --output_path       choose a custom output path for user.cfg
8631a2
+
8631a2
+$0 prompts the user to set a password on the grub bootloader. The password
8631a2
+is written to a file named user.cfg.
8631a2
+
8631a2
+Report bugs at https://bugzilla.redhat.com.
8631a2
+EOF
8631a2
+}
8631a2
+
8631a2
+argument () {
8631a2
+    opt=$1
8631a2
+    shift
8631a2
+
8631a2
+    if test $# -eq 0; then
8631a2
+        gettext_printf "%s: option requires an argument -- \`%s'\n" "$self" "$opt" 1>&2
8631a2
+        exit 1
8631a2
+    fi
8631a2
+    echo $1
8631a2
+}
8631a2
+
8631a2
+# Ensure that it's the root user running this script
8631a2
+if [ "${EUID}" -ne 0 ]; then
8631a2
+    echo "The grub bootloader password may only be set by root."
8631a2
+    usage
8631a2
+    exit 2
8631a2
+fi
8631a2
+
8631a2
+# Check the arguments.
8631a2
+while test $# -gt 0
8631a2
+do
8631a2
+    option=$1
8631a2
+    shift
8631a2
+
8631a2
+    case "$option" in
8631a2
+    -h | --help)
8631a2
+	usage
8631a2
+	exit 0 ;;
8631a2
+    -v | --version)
8631a2
+	echo "$self (${PACKAGE_NAME}) ${PACKAGE_VERSION}"
8631a2
+	exit 0 ;;
8631a2
+    -o | --output)
8631a2
+        OUTPUT_PATH=`argument $option "$@"`; shift ;;
8631a2
+    --output=*)
8631a2
+        OUTPUT_PATH=`echo "$option" | sed 's/--output=//'` ;;
8631a2
+    -o=*)
8631a2
+        OUTPUT_PATH=`echo "$option" | sed 's/-o=//'` ;;
8631a2
+    esac
8631a2
+done
8631a2
+
8631a2
+# set user input or default path for user.cfg file
8631a2
+if [ -z "${OUTPUT_PATH}" ]; then
8631a2
+    OUTPUT_PATH="${grubdir}"
8631a2
+fi
8631a2
+
8631a2
+if [ ! -d "${OUTPUT_PATH}" ]; then
8631a2
+    echo "${OUTPUT_PATH} does not exist."
8631a2
+    usage
8631a2
+    exit 2;
8631a2
+fi
8631a2
+
8631a2
+ttyopt=$(stty -g)
8631a2
+fixtty() {
8631a2
+      stty ${ttyopt}
8631a2
+}
8631a2
+
8631a2
+trap fixtty EXIT
8631a2
+stty -echo
8631a2
+
8631a2
+# prompt & confirm new grub2 root user password
8631a2
+echo -n "Enter password: "
8631a2
+read PASSWORD
8631a2
+echo
8631a2
+echo -n "Confirm password: "
8631a2
+read PASSWORD_CONFIRM
8631a2
+echo
8631a2
+stty ${ttyopt}
8631a2
+
8631a2
+getpass() {
8631a2
+    local P0
8631a2
+    local P1
8631a2
+    P0="$1" && shift
8631a2
+    P1="$1" && shift
8631a2
+
8631a2
+    ( echo ${P0} ; echo ${P1} ) | \
8631a2
+        ${grub_mkpasswd} | \
8631a2
+        grep -v '[eE]nter password:' | \
8631a2
+        sed -e "s/PBKDF2 hash of your password is //"
8631a2
+}
8631a2
+
8631a2
+MYPASS="$(getpass "${PASSWORD}" "${PASSWORD_CONFIRM}")"
8631a2
+if [ -z "${MYPASS}" ]; then
8631a2
+      echo "${self}: error: empty password" 1>&2
8631a2
+      exit 1
8631a2
+fi
8631a2
+
8631a2
+# on the ESP, these will fail to set the permissions, but it's okay because
8631a2
+# the directory is protected.
8631a2
+install -m 0600 /dev/null "${grubdir}/user.cfg" 2>/dev/null || :
8631a2
+chmod 0600 "${grubdir}/user.cfg" 2>/dev/null || :
8631a2
+echo "GRUB2_PASSWORD=${MYPASS}" > "${grubdir}/user.cfg"
8631a2
diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
8631a2
new file mode 100644
f6e916
index 000000000..db2f44bfb
8631a2
--- /dev/null
8631a2
+++ b/util/grub.d/01_users.in
8631a2
@@ -0,0 +1,11 @@
8631a2
+#!/bin/sh -e
8631a2
+cat << EOF
8631a2
+if [ -f \${prefix}/user.cfg ]; then
8631a2
+  source \${prefix}/user.cfg
8631a2
+  if [ -n "\${GRUB2_PASSWORD}" ]; then
8631a2
+    set superusers="root"
8631a2
+    export superusers
8631a2
+    password_pbkdf2 root \${GRUB2_PASSWORD}
8631a2
+  fi
8631a2
+fi
8631a2
+EOF