Skip to content

Commit 32a4574

Browse files
mfxamfxa
committed
Add lockdown_usb from adminsite
1 parent e8ea9b1 commit 32a4574

File tree

4 files changed

+226
-32
lines changed

4 files changed

+226
-32
lines changed

‎chrome/chrome_start_maximized_kiosk.sh

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#! /usr/bin/env sh
2+
3+
# Chrome launch maximized or kiosk by default
4+
#
5+
# Arguments:
6+
# 1: 'false/falsk/no/nej' disables maximizing by default, anything else enables it.
7+
# 2: 'false/falsk/no/nej' disables kiosk by default, anything else enables it.
8+
#
9+
# Takes effect after logout / restart.
10+
#
11+
# Author: [email protected]
12+
13+
set -x
14+
15+
lower() {
16+
echo "$@" | tr '[:upper:]' '[:lower:]'
17+
}
18+
19+
MAXIMIZE="$(lower "$1")"
20+
KIOSK="$(lower "$2")"
21+
22+
USER=".skjult"
23+
DESKTOP_FILE_PATH=/usr/share/applications/google-chrome.desktop
24+
# In case they've also added Chrome to their desktop
25+
DESKTOP_FILE_PATH2=/home/$USER/Skrivebord/google-chrome.desktop
26+
27+
# MAXIMIZE
28+
if [ "$MAXIMIZE" != 'false' ] && [ "$MAXIMIZE" != 'falsk' ] && \
29+
[ "$MAXIMIZE" != 'no' ] && [ "$MAXIMIZE" != 'nej' ]; then
30+
# Don't add --start-maximized multiple times
31+
if ! grep -q -- '--start-maximized' $DESKTOP_FILE_PATH; then
32+
sed -i 's,\(Exec=/usr/bin/google-chrome-stable\)\(.*\),\1 --start-maximized\2,' $DESKTOP_FILE_PATH
33+
sed -i 's,\(Exec=/usr/bin/google-chrome-stable\)\(.*\),\1 --start-maximized\2,' $DESKTOP_FILE_PATH2
34+
fi
35+
else
36+
sed -i 's/ --start-maximized//g' $DESKTOP_FILE_PATH
37+
sed -i 's/ --start-maximized//g' $DESKTOP_FILE_PATH2
38+
true
39+
fi
40+
41+
# KIOSK
42+
if [ "$KIOSK" != 'false' ] && [ "$KIOSK" != 'falsk' ] && \
43+
[ "$KIOSK" != 'no' ] && [ "$KIOSK" != 'nej' ]; then
44+
# Don't add --kiosk multiple times
45+
if ! grep -q -- '--kiosk' $DESKTOP_FILE_PATH; then
46+
sed -i 's,\(Exec=/usr/bin/google-chrome-stable\)\(.*\),\1 --kiosk\2,' $DESKTOP_FILE_PATH
47+
sed -i 's,\(Exec=/usr/bin/google-chrome-stable\)\(.*\),\1 --kiosk\2,' $DESKTOP_FILE_PATH2
48+
fi
49+
else
50+
sed -i 's/ --kiosk//g' $DESKTOP_FILE_PATH
51+
sed -i 's/ --kiosk//g' $DESKTOP_FILE_PATH2
52+
true
53+
fi

‎custom/solrod/chrome_start_maximized.sh

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎scanner/hp-usb-scanner-setup2.sh

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#! /usr/bin/env sh
2+
3+
export DEBIAN_FRONTEND=noninteractive
4+
5+
# Install the dependencies to run the interactive script noninteractively
6+
apt-get update -y
7+
apt-get install -yf expect
8+
9+
SCRIPT_PATH=/tmp/hp-plugin-setup.sh
10+
11+
cat << EOF > $SCRIPT_PATH
12+
#!/usr/bin/expect -f
13+
14+
set timeout -1
15+
16+
spawn hp-plugin -i
17+
18+
expect "Do you wish to download and install the plug-in? (y=yes*, no=no, q=quit) ? \r"
19+
20+
send -- "\r"
21+
22+
expect "Enter option (d=download*, p=specify path, q=quit) ? \r"
23+
24+
send -- "\r"
25+
26+
expect "Do you accept the license terms for the plug-in (y=yes*, n=no, q=quit) ? \r"
27+
28+
send -- ""
29+
30+
expect eof
31+
EOF
32+
33+
# Fix permissions
34+
chmod +x $SCRIPT_PATH
35+
36+
# Run it
37+
/tmp/hp-plugin-setup.sh

‎system/lockdown_usb.sh

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
#!/bin/sh
2+
3+
#================================================================
4+
# HEADER
5+
#================================================================
6+
#% SYNOPSIS
7+
#+ lockdown_usb.sh [ENFORCE]
8+
#%
9+
#% DESCRIPTION
10+
#% This script installs a system service that shuts down and disables the
11+
#% user session whenever an action is detected on a USB port, and configures
12+
#% udev to forward all USB events to this service.
13+
#%
14+
#% Logins are disabled with the nologin(5) mechanism. By default, Ubuntu
15+
#% 20.04 clears this file whenever the system is restarted.
16+
#%
17+
#% It takes one optional parameter: whether or not to enforce this policy.
18+
#% If this parameter is missing, empty, "false", "falsk", "no" or "nej"
19+
#% (not case-sensitive), the policy will be removed; otherwise, it will be
20+
#% enforced.
21+
#%
22+
#================================================================
23+
#- IMPLEMENTATION
24+
#- version lockdown_usb.sh (magenta.dk) 1.0.0
25+
#- author Alexander Faithfull
26+
#- copyright Copyright 2021 Magenta ApS
27+
#- license GNU General Public License
28+
#- email [email protected]
29+
#-
30+
#================================================================
31+
# HISTORY
32+
# 2021/04/12 : af : Script created
33+
#
34+
#================================================================
35+
# END_OF_HEADER
36+
#================================================================
37+
38+
set -x
39+
40+
lower() {
41+
echo "$@" | tr '[:upper:]' '[:lower:]'
42+
}
43+
44+
activate="`lower "$1"`"
45+
46+
if [ "$activate" != "" \
47+
-a "$activate" != "false" -a "$activate" != "falsk" \
48+
-a "$activate" != "no" -a "$activate" != "nej" ]; then
49+
mkdir -p /usr/local/lib/os2borgerpc
50+
51+
cat <<"END" > /usr/local/lib/os2borgerpc/usb-monitor
52+
#!/usr/bin/env python3
53+
54+
from os import mkfifo, unlink
55+
from os.path import exists
56+
import subprocess
57+
58+
PIPE = "/var/lib/os2borgerpc/usb-event"
59+
60+
61+
def lockdown(message):
62+
"""Creates the /etc/nologin file with the specified message and shuts the
63+
user's session manager down, forcing a logout.
64+
65+
This function does nothing if /etc/nologin already exists."""
66+
if not exists("/etc/nologin"):
67+
with open("/etc/nologin", "wt") as fp:
68+
fp.write(message)
69+
subprocess.run(["su", "-c", "systemctl --user exit 1", "alec"])
70+
71+
72+
def main():
73+
# Make sure we always start with a fresh FIFO
74+
try:
75+
unlink(PIPE)
76+
except FileNotFoundError:
77+
pass
78+
79+
mkfifo(PIPE)
80+
try:
81+
while True:
82+
with open(PIPE, "rt") as fp:
83+
# Reading from a FIFO should block until the udev helper script
84+
# gives us a signal. Lock the system immediately when that
85+
# happens
86+
content = fp.read()
87+
lockdown("Systemet er låst -- kontakt venligst personalet")
88+
finally:
89+
unlink(PIPE)
90+
91+
92+
if __name__ == "__main__":
93+
main()
94+
END
95+
chmod 700 /usr/local/lib/os2borgerpc/usb-monitor
96+
97+
cat <<"END" > /etc/systemd/system/os2borgerpc-usb-monitor.service
98+
[Unit]
99+
Description=OS2borgerPC USB monitoring service
100+
101+
[Service]
102+
Type=simple
103+
ExecStart=/usr/local/lib/os2borgerpc/usb-monitor
104+
# It's important that we stop the Python process, stuck in a blocking read,
105+
# with SIGINT rather than SIGTERM so that its finaliser has a chance to run
106+
KillSignal=SIGINT
107+
108+
[Install]
109+
WantedBy=display-manager.service
110+
END
111+
systemctl enable --now os2borgerpc-usb-monitor.service
112+
113+
cat <<"END" > /usr/local/lib/os2borgerpc/on-usb-event
114+
#!/bin/sh
115+
116+
if [ -p "/var/lib/os2borgerpc/usb-event" ]; then
117+
# Use dd with oflag=nonblock to make sure that we don't append to the pipe
118+
# if the reader isn't yet running
119+
echo "$@" | dd oflag=nonblock \
120+
of=/var/lib/os2borgerpc/usb-event status=none
121+
fi
122+
END
123+
chmod 700 /usr/local/lib/os2borgerpc/on-usb-event
124+
125+
cat <<"END" > /etc/udev/rules.d/99-os2borgerpc-usb-event.rules
126+
SUBSYSTEM=="usb", TEST=="/var/lib/os2borgerpc/usb-event", RUN{program}="/usr/local/lib/os2borgerpc/on-usb-event '%E{ACTION}' '$sys$devpath'"
127+
END
128+
else
129+
systemctl disable --now os2borgerpc-usb-monitor.service
130+
rm -f /usr/local/lib/os2borgerpc/on-usb-event \
131+
/etc/udev/rules.d/99-os2borgerpc-usb-event.rules \
132+
/usr/local/lib/os2borgerpc/usb-monitor \
133+
/etc/systemd/system/os2borgerpc-usb-monitor.service
134+
fi
135+
136+
udevadm control -R

0 commit comments

Comments
 (0)