[master/rhel7] kickstart user accounts should be locked by default (#1063554)

Vratislav Podzimek vpodzime at redhat.com
Tue Feb 11 16:49:32 UTC 2014


On Tue, 2014-02-11 at 08:28 -0800, Brian C. Lane wrote:
> Commit 18a8f661635884e7861bc14f200455e470bebb0b changed createUser so
> that an account could be created with an empty password (see bug
> --password or --lock argument being created with no password, which is
> not what was intended.
> 
> The impact was limited to local accounts, ssh blocks access to accounts
> with empty passwords by default. But another local user could access one
> of these accounts by using su.
> 
> This patch fixes user creation so that when accounts are created from a
> kickstart and their password argument is blank (the default from
> pykickstart is "") it will switch it to None so that createUser will
> lock the passwordless account.
> 
> Resolves: rhbz#1063554
> ---
>  pyanaconda/kickstart.py | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
> index 2251b2a..43a8d61 100644
> --- a/pyanaconda/kickstart.py
> +++ b/pyanaconda/kickstart.py
> @@ -1400,6 +1400,12 @@ class User(commands.user.F12_User):
>          for usr in self.userList:
>              kwargs = usr.__dict__
>              kwargs.update({"algo": algo, "root": ROOT_PATH})
> +
> +            # If the user password came from a kickstart and it is blank we
> +            # need to make sure the account is locked, not created with an
> +            # empty password.
> +            if ksdata.user.seen and kwargs.get("password", "") == "":
> +                kwargs["password"] = None
>              if not users.createUser(usr.name, **kwargs):
>                  log.error("User %s already exists, not creating." % usr.name)
Looks good to me.

-- 
Vratislav Podzimek

Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic



More information about the anaconda-patches mailing list