mirror of
https://github.com/KDE/kde-linux.git
synced 2026-08-04 11:12:32 -04:00
cd69c73b24
Use rsync with --exclude instead of copying everything and then removing it. I was having problems copying resolv.conf because it was owned by "nobody".
43 lines
1.6 KiB
Bash
Executable File
43 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
|
|
# SPDX-FileCopyrightText: 2025 Harald Sitter <sitter@kde.org>
|
|
|
|
set -eux
|
|
|
|
# Move pam files to non-legacy location.
|
|
if [ -d /etc/pam.d ]; then
|
|
find /etc/pam.d -mindepth 1 -exec mv {} /usr/lib/pam.d \;
|
|
rmdir /etc/pam.d
|
|
fi
|
|
|
|
# Turn off 3-second lockout after failed password because it's super annoying
|
|
sed -i "s/try_first_pass nullok/try_first_pass nullok nodelay/g" /usr/lib/pam.d/system-auth
|
|
echo "auth optional pam_faildelay.so delay=0" >> /usr/lib/pam.d/system-auth
|
|
|
|
# Increase number of failed password attempts before lockout because it's way too harsh
|
|
echo "# Default of 3 is way too harsh" >> /etc/security/faillock.conf
|
|
echo "deny = 12" >> /etc/security/faillock.conf
|
|
|
|
# Make double sure we don't seed random pam.d files from factory etc!
|
|
# https://invent.kde.org/kde-linux/kde-linux/-/issues/165
|
|
rm --recursive --force /usr/share/factory/etc/pam.d
|
|
|
|
# Copy all of etc into factory dir for tmpfiles.d (see tmpfiles.d docs).
|
|
# Exclude the content that we absolutely do not want because it is machine/installation dependent.
|
|
[ -d /usr/share/factory ] || mkdir /usr/share/factory
|
|
cd /etc
|
|
rsync --archive --update \
|
|
--exclude='.pwd.lock' \
|
|
--exclude='passwd*' \
|
|
--exclude='shadow*' \
|
|
--exclude='gshadow*' \
|
|
--exclude='group*' \
|
|
--exclude='localtime' \
|
|
--exclude='machine-id' \
|
|
--exclude='crypttab' \
|
|
--exclude='resolv.conf' \
|
|
--exclude='vconsole.conf' \
|
|
--exclude='hostname' \
|
|
--exclude='locale.conf' \
|
|
/etc/ /usr/share/factory/etc/
|