[PATCH v3 4/8] meta/classes: add image-account-extension class

[claudius.heine.ext@siemens.com]

From: Claudius Heine <ch@denx.de>

This class allows to configure user and group accounts of the image.

Groups or users that should be configured/created are added into the
`GROUPS` or `USERS` variable.

The configuration itself is then added to each groups or users
`GROUP_<groupname>` or `USER_<username>` flags.

The flags available for groups are `gid` and `flags`. The `flags`
variable contains some additional options for the group. With this patch
only `system` is supported for groups, allowing to create groups with
`groupadd` with the `--system` parameter.

The flags available for users are `password`, `expire`, `inactive`,
`uid`, `gid`, `comment`, `home`, `shell`, `groups` and `flags`. The
additional flags for users are `no-create-home`, `create-home`, `system`
and `allow-empty-password`.

Signed-off-by: Claudius Heine <ch@denx.de>
---
 meta/classes/image-account-extension.bbclass | 257 +++++++++++++++++++
 meta/classes/image.bbclass                   |   1 +
 2 files changed, 258 insertions(+)
 create mode 100644 meta/classes/image-account-extension.bbclass

diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass
new file mode 100644
index 0000000..22754da
--- /dev/null
+++ b/meta/classes/image-account-extension.bbclass
@@ -0,0 +1,257 @@
+# This software is a part of ISAR.
+# Copyright (C) Siemens AG, 2019
+#
+# SPDX-License-Identifier: MIT
+#
+# This class extends the image.bbclass for creating user accounts and groups.
+
+USERS ??= ""
+
+#USERS += "root"
+#USER_root[password] = "" # Encrypted password
+#USER_root[expire] = ""
+#USER_root[inactive] = ""
+#USER_root[uid] = ""
+#USER_root[gid] = "" # If first character is a number: gid, otherwise groupname
+#USER_root[comment] = "The ultimate root user"
+#USER_root[home] = "/home/root"
+#USER_root[shell] = "/bin/sh"
+#USER_root[groups] = "audio video"
+#USER_root[flags] = "no-create-home create-home system allow-empty-password"
+
+GROUPS ??= ""
+
+#GROUPS += "root"
+#GROUP_root[gid] = ""
+#GROUP_root[flags] = "system"
+
+def gen_accounts_array(d, listname, entryname, flags, verb_flags=None):
+    from itertools import chain
+
+    entries = (d.getVar(listname, True) or "").split()
+    return " ".join(
+        ":".join(
+            chain(
+                (entry,),
+                (
+                    (",".join(
+                        (
+                            d.getVarFlag(entryname + "_" + entry, flag, True) or ""
+                        ).split()
+                    ) if flag not in (verb_flags or []) else (
+                        d.getVarFlag(entryname + "_" + entry, flag, True) or ""
+                    )).replace(":","=")
+                    for flag in flags
+                ),
+            )
+        )
+        for entry in entries
+    )
+
+# List of space separated entries, where each entry has the format:
+# username:encryptedpassword:expiredate:inactivenumber:userid:groupid:comment:homedir:shell:group1,group2:flag1,flag2
+IMAGE_ACCOUNTS_USERS =+ "${@gen_accounts_array(d, 'USERS', 'USER', ['password',  'expire', 'inactive', 'uid', 'gid', 'comment', 'home', 'shell', 'groups', 'flags'], ['password', 'comment', 'home', 'shell'])}"
+
+# List of space separated entries, where each entry has the format:
+# groupname:groupid:flag1,flag2
+IMAGE_ACCOUNTS_GROUPS =+ "${@gen_accounts_array(d, 'GROUPS', 'GROUP', ['gid', 'flags'])}"
+
+ROOTFS_CONFIGURE_COMMAND += "image_configure_accounts"
+image_configure_accounts[weight] = "3"
+image_configure_accounts() {
+    # Create groups
+    # Add space to the end of the list:
+    list='${@" ".join(d.getVar('IMAGE_ACCOUNTS_GROUPS', True).split())} '
+    while true; do
+        # Pop first group entry:
+        list_rest="${list#*:*:* }"
+        entry="${list%%${list_rest}}"
+        list="${list_rest}"
+
+        if [ -z "${entry}" ]; then
+            break
+        fi
+
+        # Add colon to the end of the entry and remove trailing space:
+        entry="${entry% }:"
+
+        # Decode entries:
+        name="${entry%%:*}"
+        entry="${entry#${name}:}"
+
+        gid="${entry%%:*}"
+        entry="${entry#${gid}:}"
+
+        flags="${entry%%:*}"
+        entry="${entry#${flags}:}"
+
+        flags=",${flags}," # Needed for searching for substrings
+
+        # Check if user already exists:
+        if grep -q "^${name}:" '${ROOTFSDIR}/etc/group'; then
+            exists="y"
+        else
+            exists="n"
+        fi
+
+        # Create arguments:
+        set -- # clear arguments
+
+        if [ -n "$gid" ]; then
+            set -- "$@" --gid "$gid"
+        fi
+
+        if [ "n" = "$exists" ]; then
+            if [ "${flags}" != "${flags%*,system,*}" ]; then
+                set -- "$@" --system
+            fi
+        fi
+
+        # Create or modify groups:
+        if [ "y" = "$exists" ]; then
+            if [ -z "$@" ]; then
+                echo "Do not execute groupmod (no changes)."
+            else
+                echo "Execute groupmod with \"$@\" for \"$name\""
+                sudo -E chroot '${ROOTFSDIR}' \
+                    /usr/sbin/groupmod "$@" "$name"
+            fi
+        else
+            echo "Execute groupadd with \"$@\" for \"$name\""
+            sudo -E chroot '${ROOTFSDIR}' \
+                /usr/sbin/groupadd "$@" "$name"
+        fi
+    done
+
+    # Create users
+    list='${@" ".join(d.getVar('IMAGE_ACCOUNTS_USERS', True).split())} '
+    while true; do
+        # Pop first user entry:
+        list_rest="${list#*:*:*:*:*:*:*:*:*:*:* }"
+        entry="${list%%${list_rest}}"
+        list="${list_rest}"
+
+        if [ -z "${entry}" ]; then
+            break
+        fi
+
+        # Add colon to the end of the entry and remove trailing space:
+        entry="${entry% }:"
+
+        # Decode entries:
+        name="${entry%%:*}"
+        entry="${entry#${name}:}"
+
+        password="${entry%%:*}"
+        entry="${entry#${password}:}"
+
+        expire="${entry%%:*}"
+        entry="${entry#${expire}:}"
+
+        inactive="${entry%%:*}"
+        entry="${entry#${inactive}:}"
+
+        uid="${entry%%:*}"
+        entry="${entry#${uid}:}"
+
+        gid="${entry%%:*}"
+        entry="${entry#${gid}:}"
+
+        comment="${entry%%:*}"
+        entry="${entry#${comment}:}"
+
+        home="${entry%%:*}"
+        entry="${entry#${home}:}"
+
+        shell="${entry%%:*}"
+        entry="${entry#${shell}:}"
+
+        groups="${entry%%:*}"
+        entry="${entry#${groups}:}"
+
+        flags="${entry%%:*}"
+        entry="${entry#${flags}:}"
+
+        flags=",${flags}," # Needed for searching for substrings
+
+        # Check if user already exists:
+        if grep -q "^${name}:" '${ROOTFSDIR}/etc/passwd'; then
+            exists="y"
+        else
+            exists="n"
+        fi
+
+        # Create arguments:
+        set -- # clear arguments
+
+        if [ -n "$expire" ]; then
+            set -- "$@" --expiredate "$expire"
+        fi
+
+        if [ -n "$inactive" ]; then
+            set -- "$@" --inactive "$inactive"
+        fi
+
+        if [ -n "$uid" ]; then
+            set -- "$@" --uid "$uid"
+        fi
+
+        if [ -n "$gid" ]; then
+            set -- "$@" --gid "$gid"
+        fi
+
+        if [ -n "$comment" ]; then
+            set -- "$@" --comment "$comment"
+        fi
+
+        if [ -n "$home" ]; then
+            if [ "y" = "$exists" ]; then
+                set -- "$@" --home "$home" --move-home
+            else
+                set -- "$@" --home-dir "$home"
+            fi
+        fi
+
+        if [ -n "$shell" ]; then
+            set -- "$@" --shell "$shell"
+        fi
+
+        if [ -n "$groups" ]; then
+            set -- "$@" --groups "$groups"
+        fi
+
+        if [ "n" = "$exists" ]; then
+            if [ "${flags}" != "${flags%*,system,*}" ]; then
+                set -- "$@" --system
+            fi
+            if [ "${flags}" != "${flags%*,no-create-home,*}" ]; then
+                set -- "$@" --no-create-home
+            else
+                if [ "${flags}" != "${flags%*,create-home,*}" ]; then
+                    set -- "$@" --create-home
+                fi
+            fi
+        fi
+
+        # Create or modify users:
+        if [ "y" = "$exists" ]; then
+            if [ -z "$@" ]; then
+                echo "Do not execute usermod (no changes)."
+            else
+                echo "Execute usermod with \"$@\" for \"$name\""
+                sudo -E chroot '${ROOTFSDIR}' \
+                    /usr/sbin/usermod "$@" "$name"
+            fi
+        else
+            echo "Execute useradd with \"$@\" for \"$name\""
+            sudo -E chroot '${ROOTFSDIR}' \
+                /usr/sbin/useradd "$@" "$name"
+        fi
+
+        # Set password:
+        if [ -n "$password" -o "${flags}" != "${flags%*,allow-empty-password,*}" ]; then
+            printf '%s:%s' "$name" "$password" | sudo chroot '${ROOTFSDIR}' \
+                /usr/sbin/chpasswd -e
+        fi
+    done
+}
diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
index dce6638..ef7983b 100644
--- a/meta/classes/image.bbclass
+++ b/meta/classes/image.bbclass
@@ -61,6 +61,7 @@ inherit image-cache-extension
 inherit image-tools-extension
 inherit image-postproc-extension
 inherit image-locales-extension
+inherit image-account-extension
 
 # Extra space for rootfs in MB
 ROOTFS_EXTRA ?= "64"
-- 
2.20.1