From 1b36134d86d1a98ea1a9773c64d79a2ccda6bfc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20M=C3=BCller?= <schnitzeltony@gmail.com>
Date: Sat, 29 Sep 2018 11:38:20 +0200
Subject: [PATCH] Introduce a default unpriviledged user for X11/wayland
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Modernized version of what I had in meta-misc.

Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
---
 conf/distro/mortsgna.conf                     |  4 ++
 .../users/unpriv-user_1.2.bb                  | 40 +++++++++++++++++++
 .../packagegroups/packagegroup-image-base.bb  |  2 +-
 3 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 recipes-defaultconfig/users/unpriv-user_1.2.bb

diff --git a/conf/distro/mortsgna.conf b/conf/distro/mortsgna.conf
index 1480e25..bb93301 100644
--- a/conf/distro/mortsgna.conf
+++ b/conf/distro/mortsgna.conf
@@ -87,3 +87,7 @@ DISTRO_EXTRA_RRECOMMENDS += " \
 # workaround oe-core long lasting bulls.. 049f89155b1e80875aad6e53b21808b827c06915
 # make x11-base a valid IMAGE_FEATURES again
 IMAGE_FEATURES[validitems] += "x11-base"
+
+# For X11/Wayland images we install an unpriviledged user by default. If this
+# is not desired override DISTRO_GUI_USER
+DISTRO_GUI_USER ?= "unpriv-user"
diff --git a/recipes-defaultconfig/users/unpriv-user_1.2.bb b/recipes-defaultconfig/users/unpriv-user_1.2.bb
new file mode 100644
index 0000000..5bbd804
--- /dev/null
+++ b/recipes-defaultconfig/users/unpriv-user_1.2.bb
@@ -0,0 +1,40 @@
+DESCRIPTION = "This recipe adds a user 'morona' without password"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+inherit useradd
+
+USERNAME = "morona"
+# groups user shall be member of
+USERGROUPS = " \
+    audio \
+    video \
+    ${@bb.utils.contains('BBFILE_COLLECTIONS', 'openembedded-layer', 'datetime network', '', d)} \
+    \
+    systemd-journal \
+"
+
+# all those we are member of
+USER_DEPS ?= " \
+    systemd \
+    \
+    ${@bb.utils.contains('BBFILE_COLLECTIONS', 'openembedded-layer', 'polkit-group-rule-datetime polkit-group-rule-network', '', d)} \
+    \
+    ${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-qt5-extra', 'audio-tweaks', '', d)} \
+"
+
+DEPENDS += "${USER_DEPS}"
+RDEPENDS_${PN} = "${USER_DEPS} bash"
+
+USERADD_PACKAGES = "${PN}"
+
+USERADD_PARAM_${PN} = "-m -c Operator -d /home/${USERNAME} -s /bin/bash -k /etc/skel -g ${USERNAME} ${USERNAME}"
+
+GROUPADD_PARAM_${PN} = "${USERNAME}"
+
+pkg_postinst_ontarget_${PN}() {
+# empty password
+passwd -d ${USERNAME}
+}
+
+ALLOW_EMPTY_${PN} = "1"
diff --git a/recipes-image/packagegroups/packagegroup-image-base.bb b/recipes-image/packagegroups/packagegroup-image-base.bb
index 33e37a3..415cf66 100644
--- a/recipes-image/packagegroups/packagegroup-image-base.bb
+++ b/recipes-image/packagegroups/packagegroup-image-base.bb
@@ -12,7 +12,7 @@ RDEPENDS_${PN} = " \
     source-han-sans-jp-fonts \
     source-han-sans-tw-fonts \
     \
-    operator-user \
+    ${DISTRO_GUI_USER} \
     \
     gedit gtksourceview-classic-light \
     xarchiver \