Add activating zone environment script

Change-Id: I34897c95669cfae417f167a03040c7a531390e16
Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>

diff --git a/packaging/device-policy-manager.spec b/packaging/device-policy-manager.spec
index 1c5d6d4..1001f9a 100644 (file)
--- a/packaging/device-policy-manager.spec
+++ b/packaging/device-policy-manager.spec
@@ -199,4 +199,5 @@ PAM Plugin for zone policy in device policy manager and CLI tool
 %defattr(600,root,root,700)
 %attr(700,root,root) %{_libdir}/security/pam_*.so
 %attr(700,root,root) %{_sbindir}/nsattach
+%attr(700,root,root) %{_sbindir}/activate-zone
 %config /etc/pam.d/*

diff --git a/pam/CMakeLists.txt b/pam/CMakeLists.txt
index 12bb086..e92ab6c 100644 (file)
--- a/pam/CMakeLists.txt
+++ b/pam/CMakeLists.txt
@@ -67,3 +67,4 @@ INSTALL(TARGETS ${PAM_ZONE_NAME} DESTINATION ${LIB_INSTALL_DIR}/security)
 INSTALL(TARGETS ${PAM_ZONE_CLI_NAME} DESTINATION sbin)
 INSTALL(FILES pam.d/nsattach DESTINATION ${PAMD_INSTALL_DIR})
 INSTALL(FILES pam.d/systemd-user-zone DESTINATION ${PAMD_INSTALL_DIR})
+INSTALL(FILES cli/activate-zone DESTINATION sbin)

diff --git a/pam/cli/activate-zone b/pam/cli/activate-zone
new file mode 100755 (executable)
index 0000000..b474fe0
--- /dev/null
+++ b/pam/cli/activate-zone
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+usage() {
+        echo "Usage :"
+        echo "   Zone-enable        : $0 y" >&2
+        echo "   Zone-disable       : $0 n" >&2
+        echo "   Activation state   : $0 info" >&2
+        exit 1
+}
+
+nowstate()
+{
+    if [ -f /etc/pam.d/systemd-user.bak ]
+    then
+        echo "enabled"
+    else
+        echo "disabled"
+    fi
+}
+
+zoneenable()
+{
+    if [ `nowstate` = "enabled" ]
+    then
+        echo "Already zone-enabled";
+        exit 0
+    fi
+
+    /bin/mv /etc/pam.d/systemd-user /etc/pam.d/systemd-user.bak
+    /bin/cp /etc/pam.d/systemd-user-zone /etc/pam.d/systemd-user
+    /bin/sync
+}
+
+zonedisable()
+{
+    if [ `nowstate` = "disabled" ]
+    then
+        echo "Already zone-disabled";
+        exit 0
+    fi
+
+    /bin/mv /etc/pam.d/systemd-user.bak /etc/pam.d/systemd-user
+    /bin/sync
+}
+
+if [ $EUID -ne 0 ]; then
+   echo "Root permission is required." 1>&2
+   exit 1
+fi
+
+case "${1}" in
+"y"|"Y")
+        zoneenable ;;
+"n"|"N")
+        zonedisable ;;
+"i"|"info")
+        nowstate ;;
+*)
+        usage
+esac
+
+exit 0
+
+