security-misc-shared.preinst

#!/bin/bash

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
shopt -s inherit_errexit
shopt -s shift_verbose
export LC_ALL=C

## helper-scripts is a Pre-Depends.
source /usr/libexec/helper-scripts/pre.bsh
source /usr/libexec/helper-scripts/has.bsh
source /usr/libexec/helper-scripts/accountctl.sh

true "
#####################################################################
## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $*
#####################################################################
"

user_groups_modifications() {
   ## /usr/libexec/security-misc/hide-hardware-info
   addgroup --system sysfs
   addgroup --system cpuinfo

   ## /usr/lib/systemd/system/proc-hidepid.service
   addgroup --system proc

   ## Avoid 'debian/control' file 'Depends:' 'sudo'.
   ##
   ## Could use '/usr/libexec/helper-scripts/user_create.bsh' in preinst? Looks more complex. Avoided.
   ## group 'sudo' is not a system group.
   #addgroup --system sudo
   ## Function 'is_group' is complex. Hence, use '2>/dev/null || true'.
   addgroup sudo 2>/dev/null || true

   ## group 'sudo' membership required to use 'su'
   ## /usr/share/pam-configs/wheel-security-misc
   adduser root sudo

   ## Useful to create groups in preinst rather than postinst.
   ## Otherwise if a user saw an error message such as this:
   ##
   ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted.
   ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run:
   ## sudo adduser user console
   ##
   ## Then the user could not run 'sudo adduser user console' but also would
   ## have to create the groups himself.

   ## Related to Console Lockdown.
   ## /usr/share/pam-configs/console-lockdown-security-misc
   ## /etc/security/access-security-misc.conf
   addgroup --system console
   addgroup --system console-unrestricted
   ## This has no effect since by default this package also ships and an
   ## /etc/securetty configuration file that contains nothing but comments, i.e.
   ## an "empty" /etc/securetty.
   ## In case a system administrator edits /etc/securetty, there is no need to
   ## block for this to be still blocked by console lockdown. See also:
   ## https://www.kicksecure.com/wiki/Root#Root_Login
   adduser root console
}

output_skip_checks() {
   printf '%s\n' "security-misc-shared '${0}' INFO: Allow installation of security-misc-shared anyway." >&2
   printf '%s\n' "security-misc-shared '${0}' INFO: (technical reason: $*)" >&2
   printf '%s\n' "security-misc-shared '${0}' INFO: If this is a chroot this is probably OK." >&2
   printf '%s\n' "security-misc-shared '${0}' INFO: Otherwise you might not be able to login." >&2
}

sudo_users_check () {
   if has qubesdb-read; then
      ## Qubes users can use dom0 to get a root terminal emulator.
      ## For example:
      ## qvm-run -u root debian-10 xterm
      return 0
   fi

   if group_has_nonroot_member sudo; then
      return 0
   fi

   ## Prevent users from locking themselves out.
   ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
   printf '%s\n' "${0}: ERROR: No account is a member of group 'sudo'. Installation aborted." >&2
   printf '%s\n' "${0}: ERROR: You probably want to run:" >&2
   printf '%s\n' "${0}: NOTE: Replace account 'user' with your actual Linux user account name." >&2
   printf '%s\n' "" >&2
   printf '%s\n' "sudo adduser user sudo" >&2
   printf '%s\n' "sudo adduser user console" >&2
   printf '%s\n' "" >&2
   printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2
   printf '%s\n' "https://www.kicksecure.com/wiki/security-misc#install" >&2

   if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then
      output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'."
      return 0
   fi
   if test -f "/var/lib/security-misc/skip_install_check" \
      || [ "${dist_build_iso:-}" = "true" ] ; then
      output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)."
      return 0
   fi

   exit 200
}

console_users_check() {
   if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then
      return 0
   fi
   if test -f "/var/lib/security-misc/skip_install_check" \
      || [ "${dist_build_iso:-}" = "true" ] ; then
      return 0
   fi
   if has qubesdb-read; then
      ## Qubes users can use dom0 to get a root terminal emulator.
      ## For example:
      ## qvm-run -u root debian-10 xterm
      return 0
   fi

   ## Prevent users from locking themselves out.
   ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
   if group_has_nonroot_member console \
      || group_has_nonroot_member console-unrestricted; then
      return 0
   fi

   printf '%s\n' "${0}: ERROR: No account is a member of group 'console'. Installation aborted." >&2
   printf '%s\n' "${0}: ERROR: You probably want to run:" >&2
   printf '%s\n' "" >&2
   printf '%s\n' "sudo adduser user console" >&2
   printf '%s\n' "" >&2
   printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2
   printf '%s\n' "https://www.whonix.org/wiki/security-misc#install" >&2

   if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then
      output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'."
      return 0
   fi
   if test -f "/var/lib/security-misc/skip_install_check" \
      || [ "${dist_build_iso:-}" = "true" ] ; then
      output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)."
      return 0
   fi

   exit 201
}

legacy() {
   if [ -f "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" ]; then
      return 0
   fi

   local continue_yes user_to_be_created

   if [ -f "/usr/share/whonix/marker" ]; then
      continue_yes=true
   fi
   if [ -f "/usr/share/kicksecure/marker" ]; then
      continue_yes=true
   fi

   if [ ! "${continue_yes:-}" = "true" ]; then
      return 0
   fi

   if has qubesdb-read; then
      ## Qubes users can use dom0 to get a root terminal emulator.
      ## For example:
      ## qvm-run -u root debian-10 xterm
      return 0
   fi

   ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7

   user_to_be_created=user

   if ! id "${user_to_be_created}" &>/dev/null ; then
      true "INFO: Account '${user_to_be_created}' does not exist. Skipping adding account '${user_to_be_created}' to group 'console' and also skipping 'pam-auth-update --enable console-lockdown-security-misc'."
      return 0
   fi

   adduser "${user_to_be_created}" console

   pam-auth-update --enable console-lockdown-security-misc

   mkdir --parents "/var/lib/legacy/do_once"
   touch "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1"
}

user_groups_modifications
legacy

if [ "${1:-}" = "install" ] || [ "${1:-}" = "upgrade" ]; then
   sudo_users_check
   console_users_check
fi

true "INFO: debhelper beginning here."

#DEBHELPER#

true "INFO: Done with debhelper."

true "
#####################################################################
## INFO: END  : ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $*
#####################################################################
"

## Explicitly "exit 0", so eventually trapped errors can be ignored.
exit 0