Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
master
core-agent-linux/passwordless-root/Makefile

26 lines
1010 B
Makefile
Raw Permalink Normal View History

Split items in `misc` directory by topic
2019-10-21 00:57:19 +02:00
SYSCONFDIR ?= /etc
SUDOERSDIR = $(SYSCONFDIR)/sudoers.d
POLKIT1DIR = $(SYSCONFDIR)/polkit-1
Override PAM config for su in RPM package In Red Hat based distributions, there is no pam-configs like mechanism (authselect seems too heavy and is not configured by default), so instead, we replace the PAM file. Enable su for users in the qubes group, same as in the Debian package.
2020-05-07 15:29:26 +02:00
PAMDIR = $(SYSCONFDIR)/pam.d
PAMCONFIGSDIR = /usr/share/pam-configs/
Split items in `misc` directory by topic
2019-10-21 00:57:19 +02:00
Override PAM config for su in RPM package In Red Hat based distributions, there is no pam-configs like mechanism (authselect seems too heavy and is not configured by default), so instead, we replace the PAM file. Enable su for users in the qubes group, same as in the Debian package.
2020-05-07 15:29:26 +02:00
.PHONY: install install-debian install-rh
Split items in `misc` directory by topic
2019-10-21 00:57:19 +02:00
install:
install -d -m 0750 $(DESTDIR)$(SUDOERSDIR)
sudo isn’t always built with SELinux support Red Hat- and Debian- derived distributions support SELinux, and so their sudo packages are built with SELinux support. However, other distributions (notably Arch) build sudo without SELinux. Such sudo builds will fail to parse the `ROLE=unconfined_r TYPE=unconfined_t` string added in 0fac1aa45c677d82b413d429dae37f51ad1d67f4. They *can* parse `role=unconfined_r, type=unconfined_t` in `Defaults`, but that causes problems on some Fedora 33 systems if SELinux is turned off and the root account is locked. To solve both of these problems at once, we install a different `/etc/sudoers.d/qubes` file depending on the distribution. As a heuristic, we use the presents of `/etc/redhat-release` or `/etc/debian_version`. If either is present, sudo probably supports SELinux, and we should include the corresponding entries. If both are missing, then we shouldn’t risk it. The `qubes.sudoers` file in the git repository includes the full file (with SELinux); we use `sed` to strip the SELinux portion when needed.
2021-01-11 10:23:38 +01:00
if [ -f /etc/redhat-release ] || [ -f /etc/debian_version ]; then \
exec install -D -m 0440 qubes.sudoers $(DESTDIR)$(SUDOERSDIR)/qubes; \
else \
sed -E '/^[^#]/s/\<(ROLE|TYPE)=[A-Za-z0-9_]+[[:space:]]+//g' qubes.sudoers | \
install -D -m 0440 /dev/stdin $(DESTDIR)$(SUDOERSDIR)/qubes; \
fi
Split items in `misc` directory by topic
2019-10-21 00:57:19 +02:00
install -D -m 0644 polkit-1-qubes-allow-all.pkla $(DESTDIR)$(POLKIT1DIR)/localauthority/50-local.d/qubes-allow-all.pkla
install -d -m 0750 $(DESTDIR)$(POLKIT1DIR)/rules.d
install -D -m 0644 polkit-1-qubes-allow-all.rules $(DESTDIR)$(POLKIT1DIR)/rules.d/00-qubes-allow-all.rules
Override PAM config for su in RPM package In Red Hat based distributions, there is no pam-configs like mechanism (authselect seems too heavy and is not configured by default), so instead, we replace the PAM file. Enable su for users in the qubes group, same as in the Debian package.
2020-05-07 15:29:26 +02:00
install-rh:
install -D -m 0644 pam.d_su.qubes $(DESTDIR)$(PAMDIR)/su.qubes
install-debian:
install -D -m 0644 pam-configs_su.qubes $(DESTDIR)$(PAMCONFIGSDIR)/su.qubes
Reference in New Issue Copy Permalink