~ubuntu-core-dev/user-setup/ubuntu

#! /bin/sh

set -e

. /usr/share/debconf/confmodule

if [ "$1" ]; then

	export LANG=C # avoid locale errors from perl

	ROOT="$1"

	chroot=chroot

	log='log-output -t user-setup'

else

	ROOT=

	chroot=

	log=

fi

. /usr/lib/user-setup/functions.sh

# Set a password, via chpasswd.

# Use a heredoc rather than echo, to avoid the password

# showing in the process table. (However, this is normally

# only called when first installing the system, when root has no

# password at all, so that should be an unnecessary precaution).

#

# Pass in four arguments: the user, the password, 'true' if the

# password has been pre-crypted (by preseeding), and a 'true' if

# the home directory is encrypted

setpassword () {

	local USER PASSWD PAM_SET_PWD

	USER="$1"

	PASSWD="$2"

	local VERSION=$($chroot $ROOT dpkg-query -W -f '${Version}\n' passwd)

	PAM_SET_PWD=false

	if $chroot $ROOT dpkg --compare-versions "$VERSION" ge "1:4.1.4-1"; then

		# support for versions with PAM support (Squeeze)

		PAM_SET_PWD=true

		if [ "$3" = true ]; then

			$chroot $ROOT usermod --password=$PASSWD $USER

		else

			$chroot $ROOT chpasswd <<EOF

$USER:$PASSWD

EOF

		fi

	else

		# compatibility support for versions without PAM support (Lenny)

		local OPTS

		if [ "$3" = true ]; then

			OPTS=-e

		else

			OPTS=-m

		fi

		$chroot $ROOT chpasswd $OPTS <<EOF

$USER:$PASSWD

EOF

	fi

	# If the password was set using PAM, pam_ecryptfs will handle the initial

	# passphrase wrapping.  Otherwise, we need this hack...

	if [ "$4" = true ] && [ "$PAM_SET_PWD" = false ]; then

		local UNWRAPPED_PASSPHRASE_FILE WRAPPED_PASSPHRASE_FILE MOUNT_PASSPHRASE

		UNWRAPPED_PASSPHRASE_FILE=/dev/shm/.ecryptfs-$USER

		if [ -e "$UNWRAPPED_PASSPHRASE_FILE" ]; then

			WRAPPED_PASSPHRASE_FILE=/home/$USER/.ecryptfs/wrapped-passphrase

			MOUNT_PASSPHRASE=$($chroot $ROOT cat $UNWRAPPED_PASSPHRASE_FILE)

			$chroot $ROOT ecryptfs-wrap-passphrase $WRAPPED_PASSPHRASE_FILE - <<EOF

$MOUNT_PASSPHRASE

$PASSWD

EOF

			$chroot $ROOT rm -f $UNWRAPPED_PASSPHRASE_FILE

			$chroot $ROOT chown $USER:$USER $WRAPPED_PASSPHRASE_FILE

		else

			echo "$UNWRAPPED_PASSPHRASE_FILE does not exist, but should!" >&2

			db_input critical user-setup/encrypt-home-failed || true

			db_go || true

		fi

	fi

}

# Enable/disable shadow passwords.

db_get passwd/shadow

if [ "$RET" = true ]; then

	$log $chroot $ROOT shadowconfig on

else

	$log $chroot $ROOT shadowconfig off

fi

if ! root_password; then

	# Was the root password preseeded encrypted?

	if db_get passwd/root-password-crypted && [ "$RET" ]; then

		# The root password was preseeded encrypted.

		ROOT_PW="$RET"

		PRECRYPTED=true

	else

		db_get passwd/root-password

		ROOT_PW="$RET"

		PRECRYPTED=false

	fi

	# Clear the root password from the database, and set the password.

	db_set passwd/root-password-crypted ''

	db_set passwd/root-password ''

	db_set passwd/root-password-again ''

	if [ "$ROOT_PW" ]; then

		setpassword root "$ROOT_PW" "$PRECRYPTED"

	fi

	ROOT_PW=

else

	# Just in case, clear any preseeded root password from the database

	# anyway.

	db_set passwd/root-password-crypted ''

	db_set passwd/root-password ''

	db_set passwd/root-password-again ''

fi

db_get passwd/make-user

if [ "$RET" = true ] && ! is_system_user; then

	if db_get passwd/user-password-crypted && [ "$RET" ]; then

		USER_PW="$RET"

		USER_PW_CRYPTED=true

	else

		db_get passwd/user-password

		USER_PW="$RET"

		USER_PW_CRYPTED=false

	fi

	if db_get passwd/user-uid && [ "$RET" ]; then

		if [ -x $ROOT/usr/sbin/adduser ]; then

			UIDOPT="--uid $RET"

		else

			UIDOPT="-u $RET"

		fi

	else

		UIDOPT=

	fi

	ENCRYPT_HOME="false"

	ENCRYPT_HOME_OPT=

	if [ "$OVERRIDE_ALREADY_ENCRYPTED_SWAP" ]; then

		ENCRYPT_HOME="true"

		ENCRYPT_HOME_OPT="--encrypt-home"

	elif db_get user-setup/encrypt-home && [ "$RET" = true ]; then

		ENCRYPT_HOME="true"

		ENCRYPT_HOME_OPT="--encrypt-home"

		if type anna-install >/dev/null 2>&1 && [ -d /lib/debian-installer ]; then

			ANNA_QUIET=1 DEBIAN_FRONTEND=none $log anna-install crypto-modules || true

			depmod -a >/dev/null 2>&1 || true

		fi

		for module in aes cbc ecb; do

			modprobe -q "$module" || true

		done

		apt-install ecryptfs-utils 2>/dev/null

		apt-install cryptsetup 2>/dev/null

		umountproc=false

		umountsys=false

		umountdev=false

		if [ ! -e $ROOT/proc/cmdline ]; then

			$log $chroot $ROOT mount -t proc proc /proc

			umountproc=:

		fi

		if [ ! -e $ROOT/sys/block ]; then

			# We need /sys for devtmpfs to create block devices.

			$log $chroot $ROOT mount -t sysfs sysfs /sys

			umountsys=:

		fi

		if [ "$(stat -c %d "$ROOT/dev")" -eq "$(stat -c %d "$ROOT/")" ]; then

			mount --bind /dev $ROOT/dev

			umountdev=:

		else

			$log $chroot $ROOT udevadm settle

		fi

		if ! $log $chroot $ROOT ecryptfs-setup-swap -f -n; then

			echo "ecryptfs-setup-swap failed." >&2

			db_input critical user-setup/encrypt-home-failed || true

			db_go || true

			ENCRYPT_HOME="false"

			ENCRYPT_HOME_OPT=

		fi

		if $umountproc; then

			$log $chroot $ROOT umount /proc

		fi

		if $umountsys; then

			$log $chroot $ROOT umount /sys

		fi

		if $umountdev; then

			umount $ROOT/dev

		fi

	fi

	# Add the user to the database, using adduser in noninteractive

	# mode.

	db_get passwd/username

	USER="$RET"

	db_get passwd/user-fullname

	HOME_EXISTED=

	if [ -d "$ROOT/home/$USER" ]; then

		HOME_EXISTED=1

		# user-setup-ask shouldn't have allowed this, but for safety:

		ENCRYPT_HOME="false"

		ENCRYPT_HOME_OPT=

	fi

	umountsys=false

	if [ -n "$ENCRYPT_HOME_OPT" ]; then

		if [ ! -e $ROOT/sys/kernel ]; then

			$log $chroot $ROOT mount -t sysfs sysfs /sys

			umountsys=:

		fi

		mkdir -p $ROOT/dev/shm

		$log $chroot $ROOT mount -t tmpfs tmpfs /dev/shm

	fi

	if [ -x $ROOT/usr/sbin/adduser ]; then

		$log $chroot $ROOT adduser --disabled-password --gecos "$RET" $UIDOPT $ENCRYPT_HOME_OPT "$USER" >/dev/null || true

	else

		$log $chroot $ROOT useradd -c "$RET" -m "$USER" $UIDOPT >/dev/null || true

	fi

	# Clear the user password from the database.

	db_set passwd/user-password-crypted ''

	db_set passwd/user-password ''

	db_set passwd/user-password-again ''

	setpassword "$USER" "$USER_PW" "$USER_PW_CRYPTED" "$ENCRYPT_HOME"

	if [ -n "$ENCRYPT_HOME_OPT" ]; then

		if $umountsys; then

			$log $chroot $ROOT umount /sys

		fi

		$log $chroot $ROOT umount /dev/shm

	fi

	if [ "$HOME_EXISTED" ]; then

		# The user's home directory already existed before we called

		# adduser. This often means that a mount point under

		# /home/$USER was selected in (and thus created by) partman,

		# and the home directory may have ended up owned by root.

		$log $chroot $ROOT chown "$USER:$USER" "/home/$USER" >/dev/null || true

	fi

	if [ -n "$USER" ]; then

		for group in lpadmin sambashare; do

			$log $chroot $ROOT addgroup --system $group >/dev/null 2>&1 || true

		done

		if type archdetect >/dev/null 2>&1; then

			SUBARCH="$(archdetect)"

			case $SUBARCH in

				powerpc/ps3|powerpc/cell)

					$log $chroot $ROOT addgroup --system spu >/dev/null 2>&1 || true

					;;

			esac

		fi

		db_get passwd/user-default-groups

		for group in $RET; do

			$log $chroot $ROOT adduser "$USER" $group >/dev/null 2>&1 || true

		done

 		# Configure desktop auto-login if instructed by preseeding

 		db_get passwd/auto-login

 		if [ "$RET" = true ]; then

			db_get passwd/auto-login-backup

			BACKUP="${RET:+.$RET}"

			if [ -d "$ROOT/etc/gdm3" ]; then

				# Configure GDM autologin

				GDMCustomFile=$ROOT/etc/gdm3/custom.conf

				if [ -e "$GDMCustomFile" ] && [ "$BACKUP" ]; then

					cp "$GDMCustomFile" "${GDMCustomFile}$BACKUP"

				fi

				AutologinParameters="AutomaticLoginEnable=true\n\

AutomaticLogin=$USER\n"

				# Prevent from updating if parameters already present (persistent usb key)

				if ! `grep -qs "AutomaticLogin=$USER" $GDMCustomFile` ; then

					if [ -e "$GDMCustomFile" ]; then

						sed -i '/\(Automatic\)Login/d' $GDMCustomFile

					fi

					if ! `grep -qs '\[daemon\]' $GDMCustomFile` ; then

						echo '[daemon]' >> $GDMCustomFile

					fi

					sed -i "s/\[daemon\]/\[daemon\]\n$AutologinParameters/" $GDMCustomFile

				fi

			fi

			if $chroot $ROOT [ -f /etc/kde4/kdm/kdmrc ]; then

				# Configure KDM autologin

				$log $chroot $ROOT sed -i$BACKUP -r \

					-e "s/^#?AutoLoginEnable=.*\$/AutoLoginEnable=true/" \

					-e "s/^#?AutoLoginUser=.*\$/AutoLoginUser=$USER/" \

					-e "s/^#?AutoReLogin=.*\$/AutoReLogin=true/" \

					/etc/kde4/kdm/kdmrc

			fi

			if $chroot $ROOT [ -f /etc/lxdm/lxdm.conf ]; then

    				# Configure LXDM autologin with LXDE session

   				$log $chroot $ROOT sed -i$BACKUP -r \

        				-e "s/^# autologin=dgod/autologin=$USER/" \

        				-e "s/^# session/session/" \

        				/etc/lxdm/lxdm.conf

			fi

			if $chroot $ROOT [ -f /etc/xdg/lubuntu/lxdm/lxdm.conf ]; then

    				# Configure LXDM autologin with Lubuntu session

				$log $chroot $ROOT sed -i$BACKUP -r \

			        	-e "s/^# autologin=dgod/autologin=$USER/" \

			        	-e "s/^# session/session/" \

			        	-e "s/startlxde/startlubuntu/" \

			        	/etc/xdg/lubuntu/lxdm/lxdm.conf

			fi

			if $chroot $ROOT [ -f /usr/bin/sddm ]; then

				# Configure SDDM autologin with an appropiate session

				$log $chroot $ROOT /bin/sh -c "cat > /etc/sddm.conf" << EOF

[Autologin]

User=$USER

Session=PLACEHOLDER

EOF

				if $chroot $ROOT [ -f /usr/share/xsessions/plasma.desktop ]; then

					sed -i 's/PLACEHOLDER/plasma.desktop/' /etc/sddm.conf

				elif $chroot $ROOT [ -f /usr/share/xsessions/Lubuntu.desktop ]; then

					sed -i 's/PLACEHOLDER/Lubuntu.desktop/' /etc/sddm.conf

				elif $chroot $ROOT [ -f /usr/share/xsessions/lxqt.desktop ]; then

					sed -i 's/PLACEHOLDER/lxqt.desktop/' /etc/sddm.conf

				else #fallback if some other DE/WM is used

					SDDMSESSION=$(ls /usr/share/xsessions | head -1)

					sed -i "s/PLACEHOLDER/$SDDMSESSION/" sddm.conf

				fi

			fi

			if $chroot $ROOT [ -d /etc/lightdm ]; then

				# Configure LightDM autologin

				LightDMCustomFile=$ROOT/etc/lightdm/lightdm.conf

				AutologinParameters="autologin-guest=false\n\

autologin-user=$USER\n\

autologin-user-timeout=0"

				if ! grep -qs '^autologin-user' $LightDMCustomFile; then

					if ! grep -qs '^\[Seat:\*\]' $LightDMCustomFile; then

						echo '[Seat:*]' >> $LightDMCustomFile

					fi

					sed -i "s/\[Seat:\*\]/\[Seat:\*\]\n$AutologinParameters/" $LightDMCustomFile

				#oem config scenario

				else

					sed -i "s/^\(\(str  *\)\?autologin-user\)=.*$/\1=$USER/g;" $ROOT/etc/lightdm/lightdm.conf

				fi

			fi

		fi

	fi

	db_get passwd/root-login

	if [ "$RET" = false ] && [ -n "$USER" ]; then

		# Ensure sudo is installed, and set up the user to be able

		# to use it.

		if [ ! -e $ROOT/etc/sudoers ]; then

			# try to work in d-i and out; it's better to

			# use apt-install in d-i

			apt-install sudo 2>/dev/null || $log $chroot $ROOT apt-get -q -y install sudo || true

		fi

		if [ -e $ROOT/etc/sudoers ]; then

			# Test if we can add the user to the sudo group

			# (possible if sudo >= 1.7.2-2 is installed on the target system)

			# If we can, do it this way, otherwise add the user to sudoers

			# See #597239

			if ! $log $chroot $ROOT adduser "$USER" sudo >/dev/null 2>&1; then

				echo "$USER ALL=(ALL) ALL" >> $ROOT/etc/sudoers

			fi

		else

			# sudo failed to install, system won't be usable

			exit 1

		fi

		# Configure gksu to use sudo, via an alternative, if it's

		# installed and the alternative is registered.

		if $chroot $ROOT update-alternatives --display libgksu-gconf-defaults >/dev/null 2>&1; then

			$log $chroot $ROOT update-alternatives --set libgksu-gconf-defaults /usr/share/libgksu/debian/gconf-defaults.libgksu-sudo

			$log $chroot $ROOT update-gconf-defaults || true

		fi

		# Configure aptitude to use sudo.

		echo 'Aptitude::Get-Root-Command "sudo:/usr/bin/sudo";' > $ROOT/etc/apt/apt.conf.d/00aptitude

	else

		# Configure gksu to use su, via an alternative, if it's

		# installed and the alternative is registered.

		if $chroot $ROOT update-alternatives --display libgksu-gconf-defaults >/dev/null 2>&1; then

			$log $chroot $ROOT update-alternatives --set libgksu-gconf-defaults /usr/share/libgksu/debian/gconf-defaults.libgksu-su

			$log $chroot $ROOT update-gconf-defaults || true

		fi

	fi

	if [ -z "$OVERRIDE_ALREADY_ENCRYPTED_SWAP" ] && \

	   [ -n "$ENCRYPT_HOME_OPT" ] && [ -e $ROOT/etc/crypttab ]; then

		# Zero out all encrypted swap partitions.  It is assumed that

		# passwords are not used beyond this point in the install.

		# cryptswap0 /dev/sda5 /dev/urandom swap,cipher=aes-cbc-essiv:sha256

		# Ideally we would set up a new progress bar here, but we're

		# inside finish-install's and cdebconf doesn't support nested

		# progress bars.

		db_progress INFO user-setup/progress/wipe-swap

		while read name device source options; do

			if echo "$options" | grep -q "swap"; then

				if swapoff $device; then

					if [ ! -b $device ]; then

						ONE_MEG=$((1024*1024))

						size=$(($(stat -c %s ${device})/${ONE_MEG}))

						dd if=/dev/zero of=$device bs=${ONE_MEG} count=$size 2>/dev/null || true

					else

						dd if=/dev/zero of=$device bs=16M 2>/dev/null || true

					fi

				fi

			fi

		done < $ROOT/etc/crypttab

	fi

else

	# Just in case, clear any preseeded user password from the database

	# anyway.

	db_set passwd/user-password-crypted ''

	db_set passwd/user-password ''

	db_set passwd/user-password-again ''

fi

exit 0