From 096b05751e68c8be08d7492285cb6a7c08a71866 Mon Sep 17 00:00:00 2001 From: "Kevin C. Wells" Date: Tue, 7 Aug 2018 13:34:59 -0700 Subject: [PATCH] Make clr user wheelnopw This commit removes the restriction of root nopw access to only the mixer and swupd binaries. The 'clr' user is now part of the wheelnopw group. Signed-off-by: Kevin C. Wells --- clr-sdk/Dockerfile | 4 +--- clr-sdk/clruser | 2 -- clr-sdk/setup.py | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) delete mode 100644 clr-sdk/clruser diff --git a/clr-sdk/Dockerfile b/clr-sdk/Dockerfile index 89a763d..42cd885 100644 --- a/clr-sdk/Dockerfile +++ b/clr-sdk/Dockerfile @@ -4,13 +4,11 @@ MAINTAINER kevin.c.wells@intel.com ARG swupd_args COPY setup.py /usr/bin/setup.py -COPY clruser /usr/share/defaults/sudo/sudoers.d/ # Update and add bundles RUN swupd update $swupd_args && \ swupd bundle-add os-clr-on-clr $swupd_args && \ - chmod 755 /usr/bin/setup.py && \ - chmod 440 /usr/share/defaults/sudo/sudoers.d/clruser + chmod 755 /usr/bin/setup.py ENTRYPOINT ["/usr/bin/setup.py"] diff --git a/clr-sdk/clruser b/clr-sdk/clruser deleted file mode 100644 index 655631a..0000000 --- a/clr-sdk/clruser +++ /dev/null @@ -1,2 +0,0 @@ -clr ALL=NOPASSWD:SETENV: /usr/bin/mixer, /usr/bin/swupd - diff --git a/clr-sdk/setup.py b/clr-sdk/setup.py index b768467..b2edf2f 100755 --- a/clr-sdk/setup.py +++ b/clr-sdk/setup.py @@ -57,7 +57,7 @@ try: cmd = "groupadd -o -g {} {}".format(gid,user) subprocess.run(cmd.split(),stdout=subprocess.PIPE,stderr=subprocess.STDOUT,check=True) # Note: adding user to mock group for access to running mock - cmd = "useradd -Nmo -g {} -G mock -u {} {}".format(gid,uid,user) + cmd = "useradd -Nmo -g {} -G mock,wheelnopw -u {} {}".format(gid,uid,user) subprocess.run(cmd.split(),stdout=subprocess.PIPE,stderr=subprocess.STDOUT,check=True) os.chown("/home/{}".format(user),uid,gid) except subprocess.SubprocessError: