post_install: setup /etc/shadow to be group-owned and readable by shadow

Signed-off-by: Kevin Morris <kevr@0cost.org>

2 files changed, 13 insertions, 1 deletions

diff --git a/PKGBUILD b/PKGBUILD
index cc0911006dfa..f23b71333cf4 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -28,6 +28,15 @@ pkgver() {
 
 package()
 {
+  mkdir -p "$pkgdir"/usr/lib/sysusers.d
+
+  # Add the shadow group, used for /etc/shadow read access to utilize
+  # PAM authentication.
+  echo 'g shadow - -' > "$pkgdir/usr/lib/sysusers.d/webvirt-api.conf"
+
+  # Add webvirt to the shadow group
+  echo 'm webvirt shadow' >> "$pkgdir/usr/lib/sysusers.d/webvirt-api.conf"
+
   cd "$pkgname"
 
   # Install application to /var/lib/webvirt_api
diff --git a/webvirt-api-git.install b/webvirt-api-git.install
index ecb7110a3bc7..31cf1a419227 100644
--- a/webvirt-api-git.install
+++ b/webvirt-api-git.install
@@ -11,6 +11,10 @@ post_install() {
   python manage.py collectstatic --noinput
   chown -R webvirt:webvirt "$dir"
 
+  # Set /etc/shadow permissions.
+  chown root:shadow /etc/shadow
+  chmod 640 /etc/shadow
+
   cat << EOF
 
 A UWSGI configuration is provided at /etc/uwsgi/webvirt_api.ini.
@@ -22,7 +26,6 @@ To start the API server:
 By default, the API is accessible at http://localhost:9080.
 
 EOF
-
 }
 
 post_upgrade() {