diff --git a/meta-selftest/files/static-group b/meta-selftest/files/static-group index 6a9ece20a8..9ef91bbdca 100644 --- a/meta-selftest/files/static-group +++ b/meta-selftest/files/static-group @@ -20,12 +20,11 @@ pulse:x:520: bind:x:521: builder:x:522: weston-launch:x:524: -weston:x:525: wayland:x:526: render:x:527: sgx:x:528: ptest:x:529: -xuser:x:530: +user:x:530: seat:x:531: audio:x:532: empower:x:533: diff --git a/meta-selftest/files/static-passwd b/meta-selftest/files/static-passwd index 98017c8153..cddf095ff2 100644 --- a/meta-selftest/files/static-passwd +++ b/meta-selftest/files/static-passwd @@ -16,8 +16,7 @@ pulse:x:520:520::/:/bin/nologin bind:x:521:521::/:/bin/nologin builder:x:522:522::/:/bin/nologin _apt:x:523:523::/:/bin/nologin -weston:x:525:525::/:/bin/nologin ptest:x:529:529::/:/bin/nologin -xuser:x:530:530::/:/bin/nologin +user:x:530:530::/:/bin/nologin cmake-example:x:534:534::/var/lib/cmake-example:/bin/false meson-example:x:535:535::/var/lib/meson-example:/bin/false diff --git a/meta/classes-recipe/standard-user.bbclass b/meta/classes-recipe/standard-user.bbclass new file mode 100644 index 0000000000..ff931b8092 --- /dev/null +++ b/meta/classes-recipe/standard-user.bbclass @@ -0,0 +1,26 @@ +# +# Copyright OpenEmbedded Contributors +# +# SPDX-License-Identifier: MIT +# + +STANDARD_USER_PACKAGES ?= "${PN}" +REQUIRED_STANDARD_USER_GROUPS ?= "" + +python __anonymous() { + d.appendVar("DEPENDS", " standard-user-account") + + for pkg in d.getVar('STANDARD_USER_PACKAGES').split(): + d.appendVar("RDEPENDS:" + pkg, " standard-user-account") + + active_groups = set(d.getVar('STANDARD_USER_GROUPS').split()) + active_groups.update(d.getVar('STANDARD_USER_SYSTEM_GROUPS').split()) + required_groups = set(d.getVar('REQUIRED_STANDARD_USER_GROUPS').split()) + + if not required_groups.issubset(active_groups): + raise bb.parse.SkipRecipe( + "one of '%s' needs to be in STANDARD_USER_GROUPS or " + "STANDARD_USER_SYSTEM_GROUPS" + % ' '.join(required_groups) + ) +} diff --git a/meta/conf/distro/include/default-distrovars.inc b/meta/conf/distro/include/default-distrovars.inc index 69c6db589b..88c3bc38be 100644 --- a/meta/conf/distro/include/default-distrovars.inc +++ b/meta/conf/distro/include/default-distrovars.inc @@ -66,3 +66,15 @@ KERNEL_IMAGETYPES ??= "${KERNEL_IMAGETYPE}" # the variable to be empty. # Git example url: git://git.yoctoproject.org/yocto-firewall-test;protocol=git;rev=master;branch=master CONNECTIVITY_CHECK_URIS ?= "https://www.yoctoproject.org/connectivity.html" + +# The STANDARD_USER_NAME is the default underprivileged user account name. +# The STANDARD_USER_GROUPS is a space delimited list of user groups that account +# should belong to, and STANDARD_USER_SYSTEM_GROUPS is the same but for system +# groups. +# +# Please take note that not all tooling currently supports changing these +# variables. Scripts like sstate-sysroot-cruft.sh and reproducible builds expect +# these values to be the defaults listed below. +STANDARD_USER_NAME ??= "user" +STANDARD_USER_GROUPS ??= "" +STANDARD_USER_SYSTEM_GROUPS ??= "video render tty audio input shutdown disk wayland" diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc index 66902616f5..8d2a92f041 100644 --- a/meta/conf/distro/include/maintainers.inc +++ b/meta/conf/distro/include/maintainers.inc @@ -814,6 +814,7 @@ RECIPE_MAINTAINER:pn-spirv-tools = "Jose Quaresma " RECIPE_MAINTAINER:pn-sqlite3 = "Unassigned " RECIPE_MAINTAINER:pn-squashfs-tools = "Robert Yang " RECIPE_MAINTAINER:pn-ssh-pregen-hostkeys = "Richard Purdie " +RECIPE_MAINTAINER:pn-standard-user-account = "Unassigned " RECIPE_MAINTAINER:pn-startup-notification = "Unassigned " RECIPE_MAINTAINER:pn-strace = "Robert Yang " RECIPE_MAINTAINER:pn-stress-ng = "Unassigned " @@ -940,7 +941,6 @@ RECIPE_MAINTAINER:pn-xserver-xf86-config = "Unassigned - + diff --git a/meta/recipes-support/user-creation/standard-user-account_0.1.bb b/meta/recipes-support/user-creation/standard-user-account_0.1.bb new file mode 100644 index 0000000000..558f1c70da --- /dev/null +++ b/meta/recipes-support/user-creation/standard-user-account_0.1.bb @@ -0,0 +1,46 @@ +SUMMARY = "Creates a standard user account" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" + +SRC_URI = "file://system-user.conf" + +inherit allarch useradd + +S = "${UNPACKDIR}" + +do_configure[noexec] = "1" +do_compile[noexec] = "1" + +COMMON_ARGS = "--create-home --user-group" + +python __anonymous() { + common_args = d.getVar("COMMON_ARGS") or "" + user = d.getVar("STANDARD_USER_NAME") or "" + pn = d.getVar("PN") or "" + + unique_groups = sorted(set((d.getVar("STANDARD_USER_GROUPS") or "").split())) + unique_system_groups = sorted(set((d.getVar("STANDARD_USER_SYSTEM_GROUPS") or "").split())) + + if unique_groups or unique_system_groups: + joined_groups = ','.join(unique_groups + unique_system_groups) + d.setVar(f"USERADD_PARAM:{pn}", f"{common_args} --groups {joined_groups} {user}") + + # make sure all the groups exist + groupadd_str = "" + for group in unique_groups: + groupadd_str += f" {group} ;" + for group in unique_system_groups: + groupadd_str += f" --system {group} ;" + d.setVar(f"GROUPADD_PARAM:{pn}", f"{groupadd_str}") +} + +# default case, and a requirement to satisfy the parser check +USERADD_PACKAGES = "${PN}" +USERADD_PARAM:${PN} = "${COMMON_ARGS} ${STANDARD_USER_NAME}" + +do_install () { + install -D -m 0644 ${UNPACKDIR}/system-user.conf ${D}${datadir}/dbus-1/system.d/system-user.conf + sed -i -e 's|@STANDARD_USER_NAME@|${STANDARD_USER_NAME}|g' ${D}${datadir}/dbus-1/system.d/system-user.conf +} + +FILES:${PN} = "${datadir}/dbus-1/system.d/system-user.conf" diff --git a/meta/recipes-support/user-creation/xuser-account_0.1.bb b/meta/recipes-support/user-creation/xuser-account_0.1.bb deleted file mode 100644 index 04f506e7a3..0000000000 --- a/meta/recipes-support/user-creation/xuser-account_0.1.bb +++ /dev/null @@ -1,30 +0,0 @@ -SUMMARY = "Creates an 'xuser' account used for running X11" -LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" - -SRC_URI = "file://system-xuser.conf" - -inherit allarch useradd - -S = "${UNPACKDIR}" - -do_configure() { - : -} - -do_compile() { - : -} - -do_install() { - install -D -m 0644 ${UNPACKDIR}/system-xuser.conf ${D}${sysconfdir}/dbus-1/system.d/system-xuser.conf -} - -FILES:${PN} = "${sysconfdir}/dbus-1/system.d/system-xuser.conf" - -USERADD_PACKAGES = "${PN}" -USERADD_PARAM:${PN} = "--create-home \ - --groups video,tty,audio,input,shutdown,disk \ - --user-group xuser" - -ALLOW_EMPTY:${PN} = "1" diff --git a/scripts/sstate-sysroot-cruft.sh b/scripts/sstate-sysroot-cruft.sh index b2002badfb..5e1ae9c535 100755 --- a/scripts/sstate-sysroot-cruft.sh +++ b/scripts/sstate-sysroot-cruft.sh @@ -127,9 +127,9 @@ WHITELIST="${WHITELIST} \ # generated by useradd.bbclass WHITELIST="${WHITELIST} \ [^/]*/home \ - [^/]*/home/xuser \ - [^/]*/home/xuser/.bashrc \ - [^/]*/home/xuser/.profile \ + [^/]*/home/user \ + [^/]*/home/user/.bashrc \ + [^/]*/home/user/.profile \ [^/]*/home/builder \ [^/]*/home/builder/.bashrc \ [^/]*/home/builder/.profile \