Sovran_SystemsOS/app/sovran_systemsos_web/system_password.py

"""system_password.py -- the one place that knows about the 'free' (and root) password.

Rules
  * /etc/shadow is the ONLY source of truth for authentication: Hub login == GDM login.
  * /var/lib/secrets/free-password (0600 root) is a DISPLAY copy for the Hub's credentials
    view. Only set_free_password() writes it, and it is verified against /etc/shadow before
    it is shown, so the Hub can never show a stale password.
  * Legacy / unknown-password machines go through the *migration* flow the onboarding already
    has: generate a new diceware password, show it, and apply it on acknowledgement. Until
    then the old password keeps working everywhere (shadow is untouched).
  * No keyring code anywhere: the GNOME login keyring is decoupled from the login password
    (blank-password keyring, pam_gnome_keyring off), so nothing has to be wiped or re-keyed.

Needs libxcrypt. On NixOS the Hub service gets:  environment.LIBCRYPT = "${pkgs.libxcrypt}/lib/libcrypt.so.1"
"""
from __future__ import annotations

import ctypes
import ctypes.util
import hmac
import os
import secrets
import subprocess
import threading
from typing import Callable

USER = "free"
SECRETS_DIR = "/var/lib/secrets"
DISPLAY_FILE = f"{SECRETS_DIR}/free-password"
ROOT_DISPLAY_FILE = f"{SECRETS_DIR}/root-password"
MIGRATION_FILE = f"{SECRETS_DIR}/free-password-migration-newpass"   # same path the onboarding UI already uses
LIVE_ISO_MARKER = "/iso"   # NixOS live media mounts the image here; never start a migration there

_lock = threading.Lock()   # crypt() returns a static buffer; serialise calls
_libcrypt = None


# ── low level ──────────────────────────────────────────────────────────────

def _crypt():
    global _libcrypt
    if _libcrypt is None:
        path = os.environ.get("LIBCRYPT") or ctypes.util.find_library("crypt") or "libcrypt.so.1"
        lib = ctypes.CDLL(path)
        lib.crypt.restype = ctypes.c_char_p
        lib.crypt.argtypes = [ctypes.c_char_p, ctypes.c_char_p]
        _libcrypt = lib
    return _libcrypt


def shadow_hash(user: str = USER) -> str | None:
    """Password hash from /etc/shadow, or None if the account has none / is locked."""
    try:
        with open("/etc/shadow", encoding="utf-8") as f:
            for line in f:
                fields = line.rstrip("\n").split(":")
                if fields[0] == user:
                    h = fields[1]
                    return h if h and h[0] not in "!*" else None
    except OSError:
        return None
    return None


def verify_system_password(password: str, user: str = USER) -> bool:
    """True iff `password` is the account's current login password
    (yescrypt, sha512crypt, ... whatever chpasswd produced)."""
    h = shadow_hash(user)
    if not h or not password:
        return False
    with _lock:
        out = _crypt().crypt(password.encode(), h.encode())
    return out is not None and hmac.compare_digest(out, h.encode())


def _write_secret(path: str, value: str) -> None:
    os.makedirs(SECRETS_DIR, mode=0o700, exist_ok=True)
    tmp = path + ".tmp"
    with open(os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w", encoding="utf-8") as f:
        f.write(value + "\n")
    os.replace(tmp, path)


def _read_secret(path: str) -> str | None:
    try:
        with open(path, encoding="utf-8") as f:
            v = f.read().rstrip("\n")
        return v or None
    except OSError:
        return None


def _chpasswd(user: str, password: str) -> None:
    import shutil
    bin_ = shutil.which("chpasswd") or "/run/current-system/sw/bin/chpasswd"
    subprocess.run([bin_], input=f"{user}:{password}\n", text=True, check=True, capture_output=True)


# ── the single writers ─────────────────────────────────────────────────────

def set_free_password(new_password: str) -> None:
    """System password first, then the display copy. Used by: change-password, reset,
    migration acknowledgement, the CLI."""
    if not new_password:
        raise ValueError("empty password")
    _chpasswd(USER, new_password)
    _write_secret(DISPLAY_FILE, new_password)


def set_root_password(new_password: str) -> None:
    """Same contract for root (the credentials view lists it too)."""
    if not new_password:
        raise ValueError("empty password")
    _chpasswd("root", new_password)
    _write_secret(ROOT_DISPLAY_FILE, new_password)


# ── what the Hub shows ─────────────────────────────────────────────────────

def read_display_password() -> str | None:
    """The 'free' password to SHOW -- only if it really is the current one."""
    pw = _read_secret(DISPLAY_FILE)
    return pw if pw and verify_system_password(pw) else None


def read_root_display_password() -> str | None:
    pw = _read_secret(ROOT_DISPLAY_FILE)
    if not pw or ":" in pw:          # ':' = scrypt hash written by older reset code -> not showable
        return None
    return pw if verify_system_password(pw, "root") else None


def _display_state(path: str) -> str:
    """"missing" | "legacy" | "present" -- "present" only means a plaintext copy
    exists; it can still be stale (use read_display_password() to check that)."""
    pw = _read_secret(path)
    if pw is None:
        return "missing"
    return "legacy" if ":" in pw else "present"


# ── migration flow (legacy machines) ────────────────────────────────────────

def migration_pending() -> str | None:
    """The generated password awaiting acknowledgement, if any."""
    return _read_secret(MIGRATION_FILE)


def ensure_migration_pending(generate: Callable[[], str]) -> bool:
    """Legacy detection. Call it where onboarding status is computed.

    Condition: the account HAS a password (so this is not the first boot) but the Hub
    has NO display copy of it at all (file missing or still the old hash format).
    Then generate a new password once and park it for the onboarding "migration
    password" step. Nothing is applied until the user acknowledges, so the old
    password keeps working at GDM and in the Hub. Returns True when a migration is
    pending (caller re-opens onboarding).

    A copy that exists but merely fails to verify (password changed in GNOME
    Settings, `passwd`, or the pre-upgrade Hub) is DRIFT, not a legacy install:
    it never triggers a migration and never changes any password -- it is healed
    automatically at the next login via record_known_password(pw, only_if_stale=True).

    Never fires on the live ISO (/iso) or while shadow is still locked."""
    if os.path.exists(LIVE_ISO_MARKER):
        return False
    if migration_pending():
        return True
    if shadow_hash() is None:
        return False
    if _display_state(DISPLAY_FILE) == "present":
        return False            # copy exists: current, or just stale (drift)
    _write_secret(MIGRATION_FILE, generate())
    return True


def acknowledge_migration() -> bool:
    """User has written the new password down: make it real, then clear the pending file."""
    pw = migration_pending()
    if not pw:
        return False
    set_free_password(pw)
    os.remove(MIGRATION_FILE)
    return True


def record_known_password(password: str, only_if_stale: bool = False) -> bool:
    """"Keep my current password" (migration step): if the user types the correct
    current password, store it as the display copy and cancel the migration.

    only_if_stale=True is the login-handler heal: write ONLY when an existing
    plaintext copy is stale, never create a missing one (a missing copy is the
    legacy case and belongs to the migration flow)."""
    if not verify_system_password(password):
        return False
    if only_if_stale and _display_state(DISPLAY_FILE) != "present":
        return False
    if _read_secret(DISPLAY_FILE) != password:
        _write_secret(DISPLAY_FILE, password)
    try:
        os.remove(MIGRATION_FILE)
    except FileNotFoundError:
        pass
    return True


def generate_diceware_password(words: list[str] | None = None, n: int = 4) -> str:
    """word-word-word-word-NN, same shape the installer/reset produce (CSPRNG)."""
    words = words or ("apple barn brook cabin cedar cloud coral crane delta eagle ember fern field "
                      "flame flora flint frost grove haven hedge holly heron jade juniper kelp larch "
                      "lemon lilac linden loch lotus maple marsh meadow mist mossy mount oak ocean "
                      "olive petal pine pixel plum pond prism quartz raven ridge river robin rocky "
                      "rose rowan sage sand sierra silver slate snow solar spark spruce stone storm "
                      "summit swift thorn tide timber torch trout vale vault vine walnut wave willow "
                      "wren amber aspen birch blaze bloom bluff coast copper crest dune elder fjord "
                      "forge glade glen glow gulf").split()
    return "-".join(secrets.choice(words) for _ in range(n)) + f"-{secrets.randbelow(100):02d}"


if __name__ == "__main__":   # tiny CLI for credentials.nix:  echo NEW | system_password.py set-free
    import sys
    cmd = sys.argv[1] if len(sys.argv) > 1 else ""
    if cmd in ("set-free", "set-root"):
        pw = sys.stdin.readline().rstrip("\n")
        (set_free_password if cmd == "set-free" else set_root_password)(pw)
        print("ok")
    elif cmd == "verify":
        sys.exit(0 if verify_system_password(sys.stdin.readline().rstrip("\n")) else 1)
    else:
        print("usage: system_password.py set-free|set-root|verify  (password on stdin)", file=sys.stderr)
        sys.exit(2)