Skip to content

Commit 2708538

Browse files
author
Andreas Poulsen
committed
Merge branch '61405_prevent_citizen_from_accessing_prompt_for_chrome_user' into 'master'
Prevent citizen from accessing prompt for chrome user See merge request os2borgerpc/os2borgerpc-scripts!380
2 parents 4383a36 + 8fdfc35 commit 2708538

File tree

2 files changed

+81
-13
lines changed

2 files changed

+81
-13
lines changed

os2borgerpc_kiosk/os2borgerpc_kiosk/chromium_autostart.sh

Lines changed: 64 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ CHROMIUM_SCRIPT='/usr/share/os2borgerpc/bin/start_chromium.sh'
2929
ROTATE_SCREEN_SCRIPT_PATH="/usr/share/os2borgerpc/bin/rotate_screen.sh"
3030
OLD_ROTATE_SCREEN_SCRIPT_PATH="/usr/local/bin/rotate_screen.sh"
3131
ENVIRONMENT_FILE="/etc/environment"
32+
AUTOLOGIN_SCRIPT="/usr/share/os2borgerpc/bin/autologin.sh"
33+
AUTOLOGIN_COUNTER="/etc/os2borgerpc/login_counter.txt"
34+
COUNTER_RESET_SERVICE="/etc/systemd/system/reset_login_counter.service"
35+
REBOOT_SCRIPT="/usr/share/os2borgerpc/bin/chromium_error_reboot.sh"
36+
MAXIMUM_CONSECUTIVE_AUTOLOGINS=3
3237

3338
if ! get_os2borgerpc_config os2_product | grep --quiet kiosk; then
3439
echo "Dette script er ikke designet til at blive anvendt på en regulær OS2borgerPC-maskine."
@@ -47,21 +52,70 @@ mkdir --parents /etc/systemd/system/[email protected]
4752

4853
# Note: The empty ExecStart is not insignificant!
4954
# By default the value is appended, so the empty line changes it to an override
55+
# We make agetty use our own login-program instead of /bin/login
56+
# so we can customize the behavior
5057
cat << EOF > /etc/systemd/system/[email protected]/override.conf
5158
[Service]
5259
ExecStart=
53-
ExecStart=-/sbin/agetty --noissue --autologin $CUSER %I $TERM
60+
ExecStart=-/sbin/agetty --noissue --login-program $AUTOLOGIN_SCRIPT --autologin $CUSER %I $TERM
5461
Type=idle
5562
EOF
5663

64+
# Create the autologin script
65+
66+
# Ensure that the folder exists
67+
mkdir --parents "$(dirname $AUTOLOGIN_SCRIPT)"
68+
69+
cat << EOF > $AUTOLOGIN_SCRIPT
70+
#! /usr/bin/env bash
71+
COUNTER=\$(cat $AUTOLOGIN_COUNTER)
72+
COUNTER=\$((COUNTER+1))
73+
echo \$COUNTER > $AUTOLOGIN_COUNTER
74+
if [ \$COUNTER -le $MAXIMUM_CONSECUTIVE_AUTOLOGINS ]; then
75+
if [ \$COUNTER -gt 1 ]; then
76+
# Sleep before autologin attempts other than the first
77+
sleep 10
78+
fi
79+
# Autologin as $CUSER
80+
/bin/login -f $CUSER
81+
else
82+
# Regular login prompt
83+
/bin/login
84+
fi
85+
EOF
86+
87+
# To maintain the functionality of the error reboot script
88+
if [ -f "$REBOOT_SCRIPT" ]; then
89+
sed --in-place --expression "\@else@{ n; n; s@/bin/login@$REBOOT_SCRIPT@ }" \
90+
--expression "s/Regular login prompt/Reboot the computer/" $AUTOLOGIN_SCRIPT
91+
fi
92+
93+
chmod 700 $AUTOLOGIN_SCRIPT
94+
95+
# Create login counter
96+
echo "0" > $AUTOLOGIN_COUNTER
97+
98+
# Create service to reset counter when
99+
# the computer is booted
100+
cat << EOF > $COUNTER_RESET_SERVICE
101+
[Unit]
102+
Description=Reset the autologin counter when the computer starts
103+
104+
[Service]
105+
Type=oneshot
106+
ExecStart=sh -c 'echo "0" > $AUTOLOGIN_COUNTER'
107+
108+
[Install]
109+
WantedBy=multi-user.target
110+
EOF
111+
112+
systemctl enable --now "$(basename $COUNTER_RESET_SERVICE)"
113+
57114
# Create script to rotate screen
58115

59116
# ...remove the rotate script from its previous location
60117
rm --force $OLD_ROTATE_SCREEN_SCRIPT_PATH
61118

62-
# Make the new folder
63-
mkdir --parents "$(dirname $ROTATE_SCREEN_SCRIPT_PATH)"
64-
65119
cat << EOF > $ROTATE_SCREEN_SCRIPT_PATH
66120
#!/usr/bin/env sh
67121
@@ -153,13 +207,12 @@ fi
153207

154208
# Start X upon login
155209
PROFILE="/home/$CUSER/.profile"
156-
if ! grep --quiet -- 'for i in' $PROFILE; then # Ensure idempotency
157-
# This first line cleans up after the previous version of the script
158-
sed --in-place "/startx/d" $PROFILE
210+
if ! grep --quiet -- 'exit' $PROFILE; then # Ensure idempotency
211+
# This first line cleans up after previous versions of the script
212+
sed --in-place --expression "/startx/d" --expression "/for i in/d" --expression "/sleep/d" \
213+
--expression "/done/d" --expression "/chromium_error_reboot/d" $PROFILE
159214
cat << EOF >> $PROFILE
160-
for i in 1 2 3; do
161-
startx
162-
sleep 10
163-
done
215+
startx
216+
exit
164217
EOF
165218
fi

os2borgerpc_kiosk/os2borgerpc_kiosk/chromium_error_reboot.sh

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ RESET_COUNTER_SERVICE="/etc/systemd/system/chromium_reboot_counter_reset.service
88
PROFILE="/home/chrome/.profile"
99
COUNTER_FILE="/home/chrome/reboot_counter.txt"
1010
MAXIMUM_CONSECUTIVE_REBOOTS=5
11+
AUTOLOGIN_SCRIPT="/usr/share/os2borgerpc/bin/autologin.sh"
1112

1213
ACTIVATE=$1
1314

@@ -20,25 +21,39 @@ mkdir --parents "$(dirname $REBOOT_SCRIPT)"
2021

2122
# Ensure idempotency
2223
sed --in-place --expression "/startx/d" --expression "/for i in/d" --expression "/sleep/d" \
23-
--expression "/done/d" --expression "/$(basename $REBOOT_SCRIPT)/d" $PROFILE
24+
--expression "/done/d" --expression "/exit/d" --expression "/$(basename $REBOOT_SCRIPT)/d" $PROFILE
2425

2526
if [ "$ACTIVATE" = "False" ]; then
2627
systemctl disable "$(basename $RESET_COUNTER_SERVICE)"
2728
rm --force $REBOOT_SCRIPT $RESET_COUNTER_SCRIPT $RESET_COUNTER_SERVICE $COUNTER_FILE
2829
echo "startx" >> $PROFILE
30+
if [ -f "$AUTOLOGIN_SCRIPT" ]; then
31+
echo "exit" >> $PROFILE
32+
sed --in-place --expression "s/Reboot the computer/Regular login prompt/" \
33+
--expression "s@$REBOOT_SCRIPT@/bin/login@" $AUTOLOGIN_SCRIPT
34+
fi
2935
exit 0
3036
fi
3137

3238
echo "0" > $COUNTER_FILE
3339
chmod 666 $COUNTER_FILE
3440

35-
cat <<EOF >> $PROFILE
41+
if [ -f "$AUTOLOGIN_SCRIPT" ]; then
42+
cat << EOF >> $PROFILE
43+
startx
44+
exit
45+
EOF
46+
sed --in-place --expression "\@else@{ n; n; s@/bin/login@$REBOOT_SCRIPT@ }" \
47+
--expression "s/Regular login prompt/Reboot the computer/" $AUTOLOGIN_SCRIPT
48+
else
49+
cat <<EOF >> $PROFILE
3650
for i in 1 2 3; do
3751
startx
3852
sleep 10
3953
done
4054
$REBOOT_SCRIPT
4155
EOF
56+
fi
4257

4358
cat <<EOF > $REBOOT_SCRIPT
4459
#! /usr/bin/env bash

0 commit comments

Comments
 (0)