mustard/QubesOS-Scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

I hate regexes

Browse source
This commit is contained in:
mustard 2024-10-07 20:33:21 +02:00
parent 219b89e85f
commit 7c31b6a073
4 changed files with 63 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
amogus Normal file
View file

@ -0,0 +1,17 @@
# Generated by authselect
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.
account required pam_unix.so
password requisite pam_pwquality.so
password sufficient pam_unix.so yescrypt shadow nullok use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

6
sudo-dom0.sh
View file

@ -2,8 +2,10 @@ sudo authselect create-profile sudo-dom0-prompt --base-on=sssd --symlink-meta --
sudo mv /etc/authselect/custom/sudo-dom0-prompt/system-auth /etc/authselect/custom/sudo-dom0-prompt/system-auth.original_aside
sudo cp /etc/authselect/system-auth /etc/authselect/custom/sudo-dom0-prompt
sudo sed -i '/^auth/d' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sed -i '/^account/{0,/auth/s/^auth /&\n auth [success=1 default=ignore] pam_exec.so seteuid \ /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth \ /bin/grep -q ^1$/&\n auth requisite pam_deny.so\n auth required pam_permit.so\n\n/' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sudo sed -i '/^auth/d' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sed -i '/^account/ i auth [success=1 default=ignore] pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAAuth /bin/grep -q ^1$\nauth requisite pam_deny.so\nauth required pam_permit.so' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sudo authselect select custom/sudo-dom0-prompt
sudo sed -i '/^%qubes/s/.*/user ALL=(ALL) ALL/' /etc/sudoers.d/qubes

20
sus Normal file
View file

@ -0,0 +1,20 @@
# Generated by authselect
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.
auth [success=1 default=ignore] pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAAuth /bin/grep -q ^1$
auth requisite pam_deny.so
auth required pam_permit.so
account required pam_unix.so
password requisite pam_pwquality.so
password sufficient pam_unix.so yescrypt shadow nullok use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

22
test.txt Normal file
View file

@ -0,0 +1,22 @@
# Generated by authselect
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok
auth required pam_deny.so
account required pam_unix.so
password requisite pam_pwquality.so
password sufficient pam_unix.so yescrypt shadow nullok use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so