Merge pull request #222 from himmelblau-idm/stable-0.6.x_deb_packaging

Stable 0.6.x Debian packaging fixes

Cargo.toml

@@ -16,7 +16,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.6.3"
+version = "0.6.4"
 authors = [
     "David Mulder <[email protected]>"
 ]
@@ -76,7 +76,7 @@ tracing-forest = "^0.1.6"
 rusqlite = "^0.32.0"
 hashbrown = { version = "0.14.0", features = ["serde", "inline-more", "ahash"] }
 lru = "^0.12.3"
-kanidm_lib_crypto = { path = "./src/crypto", version = "0.6.3" }
+kanidm_lib_crypto = { path = "./src/crypto", version = "0.6.4" }
 kanidm_utils_users = { path = "./src/users" }
 walkdir = "2"
 csv = "1.2.2"

Makefile

@@ -30,6 +30,7 @@ install-ubuntu:
 	install -m 0644 ./src/config/himmelblau.conf.example /etc/himmelblau/himmelblau.conf
 	install -m 0755 ./target/release/libnss_himmelblau.so /usr/lib/x86_64-linux-gnu/libnss_himmelblau.so.2
 	install -m 0755 ./target/release/libpam_himmelblau.so /usr/lib/x86_64-linux-gnu/pam_himmelblau.so
+	install -m 0644 ./platform/debian/pam-config /usr/share/pam-configs/himmelblau
 	install -m 0755 ./target/release/himmelblaud /usr/sbin
 	install -m 0755 ./target/release/himmelblaud_tasks /usr/sbin
 	install -m 0755 ./target/release/aad-tool /usr/bin

platform/debian/apparmor.unix-chkpwd.local

@@ -0,0 +1,5 @@
+/etc/himmelblau/himmelblau.conf r,
+capability dac_read_search,
+capability dac_override,
+/var/cache/private/himmelblaud/himmelblau.conf r,
+/run/himmelblaud/socket rw,

platform/debian/himmelblau_sshd.conf

@@ -0,0 +1 @@
+KbdInteractiveAuthentication yes

platform/debian/pam-config

@@ -0,0 +1,12 @@
+Name: Azure authentication
+Default: yes
+Priority: 192
+Auth-Type: Primary
+Auth:
+	[success=end default=ignore]    pam_himmelblau.so ignore_unknown_user use_first_pass
+Account-Type: Primary
+Account:
+	[success=end default=ignore]    pam_himmelblau.so ignore_unknown_user
+Session-Type: Additional
+Session:
+	optional	pam_himmelblau.so

platform/debian/scripts/postinst

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+
+# Define the patch content using cat command
+UNIX_CHKPWD_PATCH=$(cat << 'EOF'
+--- /etc/apparmor.d/unix-chkpwd	2024-10-07 13:41:33.143303700 -0600
++++ /etc/apparmor.d/unix-chkpwd	2024-10-07 13:36:55.740827834 -0600
+@@ -11,7 +11,7 @@
+ 
+ include <tunables/global>
+ 
+-profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd {
++profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(attach_disconnected) {
+   include <abstractions/base>
+   include <abstractions/nameservice>
+ 
+EOF
+)
+
+# Check if the file /etc/apparmor.d/unix-chkpwd exists
+if [[ -f /etc/apparmor.d/unix-chkpwd ]]; then
+	# Apply the patch using the patch command
+	echo "$UNIX_CHKPWD_PATCH" | patch --fuzz 2 --silent --forward -p0 /etc/apparmor.d/unix-chkpwd
+
+	# Reload the AppArmor profile to apply the changes
+	sudo apparmor_parser -r /etc/apparmor.d/unix-chkpwd
+fi

platform/debian/scripts/postrm

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+
+# Define the patch content using cat command
+UNIX_CHKPWD_PATCH=$(cat << 'EOF'
+--- /etc/apparmor.d/unix-chkpwd 2024-10-07 13:41:33.143303700 -0600
++++ /etc/apparmor.d/unix-chkpwd 2024-10-07 13:36:55.740827834 -0600
+@@ -11,7 +11,7 @@
+ 
+ include <tunables/global>
+ 
+-profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd {
++profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(attach_disconnected) {
+   include <abstractions/base>
+   include <abstractions/nameservice>
+ 
+EOF
+)
+
+# Check if the file /etc/apparmor.d/unix-chkpwd exists
+if [[ -f /etc/apparmor.d/unix-chkpwd ]]; then
+	# Reverse the patch using the patch command
+	echo "$UNIX_CHKPWD_PATCH" | patch --fuzz 2 --silent --reverse -p0 /etc/apparmor.d/unix-chkpwd
+
+	# Reload the AppArmor profile to apply the changes
+	sudo apparmor_parser -r /etc/apparmor.d/unix-chkpwd
+fi

src/pam/Cargo.toml

@@ -28,4 +28,8 @@ name = "pam-himmelblau"
 maintainer = "David Mulder <[email protected]>"
 assets = [
   ["target/release/libpam_himmelblau.so", "usr/lib/x86_64-linux-gnu/security/pam_himmelblau.so", "755"],
+  ["../../platform/debian/pam-config", "usr/share/pam-configs/himmelblau", "644"],
+  ["../../platform/debian/apparmor.unix-chkpwd.local", "etc/apparmor.d/local/unix-chkpwd", "644"],
+  ["../../platform/debian/himmelblau_sshd.conf", "/etc/ssh/sshd_config.d/himmelblau.conf", "644"],
 ]
+maintainer-scripts = "../../platform/debian/scripts"