Vendor the command set the menu and shell depend on

2026-09-19 23:57:12 -04:00
parent 9501f2bb4d
commit c5434026a8
179 changed files with 12414 additions and 54 deletions
@@ -0,0 +1,148 @@
+#!/bin/bash
+
+# blob:summary=Set up FIDO2 authentication for sudo and polkit
+# blob:requires-sudo=true
+
+set -e
+set -o pipefail
+
+
+check_fido2_hardware() {
+  tokens=$(fido2-token -L 2>/dev/null)
+  if [[ -z $tokens ]]; then
+    echo -e "\e[31m\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well).\e[0m"
+    return 1
+  fi
+  return 0
+}
+
+setup_pam_config() {
+  # Configure sudo
+  if ! grep -q pam_u2f.so /etc/pam.d/sudo; then
+    echo "Configuring sudo for FIDO2 authentication..."
+    sudo sed -i '1i auth    sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo
+  fi
+
+  # Configure polkit
+  if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then
+    echo "Configuring polkit for FIDO2 authentication..."
+    sudo sed -i '1i auth      sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1
+  elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
+    echo "Creating polkit configuration with FIDO2 authentication..."
+    sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
+auth      sufficient pam_u2f.so cue authfile=/etc/fido2/fido2
+auth      required pam_unix.so
+
+account   required pam_unix.so
+password  required pam_unix.so
+session   required pam_unix.so
+EOF
+  fi
+}
+
+echo -e "\e[32mSetting up FIDO2 device for authentication.\n\e[0m"
+
+# Install required packages
+echo "Installing required packages..."
+blob-pkg-add libfido2 pam-u2f
+
+if ! check_fido2_hardware; then
+  exit 1
+fi
+
+# Create the pamu2fcfg file
+authdir=/etc/fido2
+authfile=/etc/fido2/fido2
+
+# install -d follows a symlink here and applies the mode and ownership to
+# whatever it points at, so the credential would be staged and published inside
+# the link target and that directory reopened to root:root 755. This is the
+# threat blob-remove-security-fido2 already names on its side.
+if [[ -L $authdir || ( -e $authdir && ! -d $authdir ) ]]; then
+  echo -e "\e[31m\n$authdir is not a FIDO2 configuration directory.\e[0m"
+  echo "Run blob-remove-security-fido2 first, then set FIDO2 up again."
+  exit 1
+fi
+
+# -f follows symlinks, so the already-registered check below reads a symlinked
+# authfile as a registration and leaves it in place, and is false for a
+# directory, so it tries to register over one. Only a regular file is a valid
+# pam_u2f authfile.
+if [[ -L $authfile || ( -e $authfile && ! -f $authfile ) ]]; then
+  echo -e "\e[31m\n$authfile is not a FIDO2 registration file.\e[0m"
+  echo "Run blob-remove-security-fido2 first, then set FIDO2 up again."
+  exit 1
+fi
+
+if [[ ! -f $authfile ]]; then
+  sudo install -d -m 755 -o root -g root "$authdir"
+  echo -e "\e[32m\nLet's setup your device by confirming on the device now.\e[0m"
+  echo -e "Touch your FIDO2 key when it lights up...\n"
+
+  # A unique sibling created by root cannot be replaced by another process
+  # running as this user. Stream pamu2fcfg into it instead of asking root to
+  # reopen a caller-owned path: an observed temporary name could otherwise be
+  # replaced with a symlink before the privileged copy. The final rename is
+  # atomic, and -T refuses a directory at the destination. Mode 644 keeps the
+  # root-owned global authfile readable when pam_u2f uses openasuser; only root
+  # can still rewrite it.
+  stage=""
+
+  # mktemp's output is an operand for four privileged commands below, one of
+  # them an rm. Take only the name this script asked for rather than whatever
+  # came back on stdout.
+  safe_stage_path() {
+    local candidate=$1
+    local prefix="$authfile.new."
+    local suffix
+
+    [[ $candidate == "$prefix"* ]] || return 1
+    suffix=${candidate#"$prefix"}
+    [[ $suffix =~ ^[[:alnum:]]{6}$ ]]
+  }
+
+  cleanup_stage() {
+    local status=$?
+
+    if safe_stage_path "$stage"; then
+      sudo rm -f -- "$stage" || true
+    fi
+
+    return "$status"
+  }
+
+  trap cleanup_stage EXIT
+  stage=$(sudo mktemp "$authfile.new.XXXXXX")
+
+  if ! safe_stage_path "$stage" || [[ ! -f $stage || -L $stage ]]; then
+    echo -e "\e[31m\nCould not create a safe staging file beside $authfile.\e[0m"
+    exit 1
+  fi
+
+  if pamu2fcfg | sudo tee "$stage" >/dev/null && [[ -s $stage ]]; then
+    sudo chmod 644 "$stage"
+    sudo mv -Tf "$stage" "$authfile"
+    stage=""
+    trap - EXIT
+    echo -e "\e[32mFIDO2 device registered successfully!\e[0m"
+  else
+    echo -e "\e[31m\nFIDO2 registration failed. Please try again.\e[0m"
+    exit 1
+  fi
+else
+  echo "FIDO2 device already registered."
+fi
+
+# Configure PAM
+setup_pam_config
+
+# Test with sudo
+echo -e "\nTesting FIDO2 authentication with sudo..."
+echo -e "Touch your FIDO2 key when prompted.\n"
+
+if sudo echo "FIDO2 authentication test successful"; then
+  echo -e "\e[32m\nPerfect! FIDO2 authentication is now configured.\e[0m"
+  echo "You can use your FIDO2 key for sudo and polkit authentication."
+else
+  echo -e "\e[31m\nVerification failed. You may want to check your configuration.\e[0m"
+fi