[master/rhel7] kickstart user accounts should be locked by default (#1063554)
Vratislav Podzimek
vpodzime at redhat.com
Tue Feb 11 16:49:32 UTC 2014
On Tue, 2014-02-11 at 08:28 -0800, Brian C. Lane wrote:
> Commit 18a8f661635884e7861bc14f200455e470bebb0b changed createUser so
> that an account could be created with an empty password (see bug
> --password or --lock argument being created with no password, which is
> not what was intended.
>
> The impact was limited to local accounts, ssh blocks access to accounts
> with empty passwords by default. But another local user could access one
> of these accounts by using su.
>
> This patch fixes user creation so that when accounts are created from a
> kickstart and their password argument is blank (the default from
> pykickstart is "") it will switch it to None so that createUser will
> lock the passwordless account.
>
> Resolves: rhbz#1063554
> ---
> pyanaconda/kickstart.py | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
> index 2251b2a..43a8d61 100644
> --- a/pyanaconda/kickstart.py
> +++ b/pyanaconda/kickstart.py
> @@ -1400,6 +1400,12 @@ class User(commands.user.F12_User):
> for usr in self.userList:
> kwargs = usr.__dict__
> kwargs.update({"algo": algo, "root": ROOT_PATH})
> +
> + # If the user password came from a kickstart and it is blank we
> + # need to make sure the account is locked, not created with an
> + # empty password.
> + if ksdata.user.seen and kwargs.get("password", "") == "":
> + kwargs["password"] = None
> if not users.createUser(usr.name, **kwargs):
> log.error("User %s already exists, not creating." % usr.name)
Looks good to me.
--
Vratislav Podzimek
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
More information about the anaconda-patches
mailing list