From 62d2e9832561d590fdcfbcab8bd03f5cb31fd5d1 Mon Sep 17 00:00:00 2001
From: Vratislav Podzimek <vpodzime@redhat.com>
Date: Wed, 25 May 2016 08:53:17 +0200
Subject: [PATCH 05/13] Enforce the minimal root password length

With Anaconda supporting the pwpolicy command putting restrictions on (among the
other things) root password minimal length we can actually enforce the policy
given in the SCAP content in interactive installations.

Resolves: rhbz#1238281
---
 org_fedora_oscap/rule_handling.py | 50 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 6 deletions(-)

diff --git a/org_fedora_oscap/rule_handling.py b/org_fedora_oscap/rule_handling.py
index 6a67e8a..a7bed22 100644
--- a/org_fedora_oscap/rule_handling.py
+++ b/org_fedora_oscap/rule_handling.py
@@ -26,6 +26,8 @@ Module with various classes for handling pre-installation rules.
 import optparse
 import shlex
 
+from pyanaconda.pwpolicy import F22_PwPolicyData
+
 from org_fedora_oscap import common
 from org_fedora_oscap.common import OSCAPaddonError, RuleMessage
 
@@ -35,6 +37,9 @@ __all__ = ["RuleData"]
 import gettext
 _ = lambda x: gettext.ldgettext("oscap-anaconda-addon", x)
 
+import logging
+log = logging.getLogger("anaconda")
+
 # TODO: use set instead of list for mount options?
 def parse_csv(option, opt_str, value, parser):
     for item in value.split(","):
@@ -392,6 +397,9 @@ class PasswdRules(RuleHandler):
         """Constructor initializing attributes."""
 
         self._minlen = 0
+        self._created_policy = False
+        self._orig_minlen = None
+        self._orig_strict = None
 
     def __str__(self):
         """Standard method useful for debugging and testing."""
@@ -414,25 +422,55 @@ class PasswdRules(RuleHandler):
             # no password restrictions, nothing to be done here
             return []
 
+        ret = []
         if not ksdata.rootpw.password:
             # root password was not set
 
-            # password length enforcement is not suported in the Anaconda yet
             msg = _("make sure to create password with minimal length of %d "
-                    "characters" % self._minlen)
-            return [RuleMessage(common.MESSAGE_TYPE_WARNING, msg)]
+                    "characters") % self._minlen
+            ret = [RuleMessage(common.MESSAGE_TYPE_WARNING, msg)]
         else:
             # root password set
             if ksdata.rootpw.isCrypted:
                 msg = _("cannot check root password length (password is crypted)")
+                log.warning("cannot check root password length (password is crypted)")
                 return [RuleMessage(common.MESSAGE_TYPE_WARNING, msg)]
             elif len(ksdata.rootpw.password) < self._minlen:
                 # too short
                 msg = _("root password is too short, a longer one with at "
-                        "least %d characters is required" % self._minlen)
-                return [RuleMessage(common.MESSAGE_TYPE_FATAL, msg)]
+                        "least %d characters is required") % self._minlen
+                ret = [RuleMessage(common.MESSAGE_TYPE_FATAL, msg)]
             else:
-                return []
+                ret = []
+
+        # set the policy in any case (so that a weaker password is not entered)
+        pw_policy = ksdata.anaconda.pwpolicy.get_policy("root")
+        if pw_policy is None:
+            pw_policy = F22_PwPolicyData()
+            ksdata.anaconda.pwpolicy.policyList.append(pw_policy)
+            self._created_policy = True
+
+        self._orig_minlen = pw_policy.minlen
+        self._orig_strict = pw_policy.strict
+        pw_policy.minlen = self._minlen
+        pw_policy.strict = True
+
+        return ret
+
+    def revert_changes(self, ksdata, storage):
+        """:see: RuleHander.revert_changes"""
+
+        pw_policy = ksdata.anaconda.pwpolicy.get_policy("root")
+        if self._created_policy:
+            ksdata.anaconda.pwpolicy.policyList.remove(pw_policy)
+            self._created_policy = False
+        else:
+            if self._orig_minlen is not None:
+                pw_policy.minlen = self._orig_minlen
+                self._orig_minlen = None
+            if self._orig_strict is not None:
+                pw_policy.strict = self._orig_strict
+                self._orig_strict = None
 
 class PackageRules(RuleHandler):
     """Simple class holding data from the rules affecting installed packages."""
-- 
2.5.5