16803: Tweak permission setting on created files/dirs

[arvados.git] / services / login-sync / bin / arvados-login-sync

diff --git a/services/login-sync/bin/arvados-login-sync b/services/login-sync/bin/arvados-login-sync
index e00495c04db7db621ba0bf377cbe62072b82feba..aee911cfc43fca5806e700a40437f2641d63abe8 100755 (executable)
--- a/services/login-sync/bin/arvados-login-sync
+++ b/services/login-sync/bin/arvados-login-sync
@@ -36,7 +36,7 @@ begin
 
   logins = arv.virtual_machine.logins(:uuid => vm_uuid)[:items]
   logins = [] if logins.nil?
-  logins = logins.reject { |l| l[:username].nil? or l[:hostname].nil? or l[:public_key].nil? or l[:virtual_machine_uuid] != vm_uuid }
+  logins = logins.reject { |l| l[:username].nil? or l[:hostname].nil? or l[:virtual_machine_uuid] != vm_uuid }
 
   # No system users
   uid_min = 1000
@@ -79,13 +79,15 @@ begin
   logins.each do |l|
     keys[l[:username]] = Array.new() if not keys.has_key?(l[:username])
     key = l[:public_key]
-    # Handle putty-style ssh public keys
-    key.sub!(/^(Comment: "r[^\n]*\n)(.*)$/m,'ssh-rsa \2 \1')
-    key.sub!(/^(Comment: "d[^\n]*\n)(.*)$/m,'ssh-dss \2 \1')
-    key.gsub!(/\n/,'')
-    key.strip
-
-    keys[l[:username]].push(key) if not keys[l[:username]].include?(key)
+    if !key.nil?
+      # Handle putty-style ssh public keys
+      key.sub!(/^(Comment: "r[^\n]*\n)(.*)$/m,'ssh-rsa \2 \1')
+      key.sub!(/^(Comment: "d[^\n]*\n)(.*)$/m,'ssh-dss \2 \1')
+      key.gsub!(/\n/,'')
+      key.strip
+
+      keys[l[:username]].push(key) if not keys[l[:username]].include?(key)
+    end
   end
 
   seen = Hash.new()
@@ -119,8 +121,8 @@ begin
       end
     end
 
-    @homedir = pwnam[l[:username]].dir
-    userdotssh = File.join(@homedir, ".ssh")
+    homedir = pwnam[l[:username]].dir
+    userdotssh = File.join(homedir, ".ssh")
     Dir.mkdir(userdotssh) if !File.exist?(userdotssh)
 
     newkeys = "###\n###\n" + keys[l[:username]].join("\n") + "\n###\n###\n"
@@ -148,10 +150,39 @@ begin
       f.write(newkeys)
       f.close()
     end
+
+    userdotconfig = File.join(homedir, ".config")
+    if !File.exist?(userdotconfig)
+      Dir.mkdir(userdotconfig)
+    end
+
+    configarvados = File.join(userdotconfig, "arvados")
+    Dir.mkdir(configarvados) if !File.exist?(configarvados)
+
+    tokenfile = File.join(configarvados, "settings.conf")
+
+    begin
+      if !File.exist?(tokenfile)
+        user_token = arv.api_client_authorization.create(api_client_authorization: {owner_uuid: l[:user_uuid], api_client_id: 0})
+        f = File.new(tokenfile, 'w')
+        f.write("ARVADOS_API_HOST=#{ENV['ARVADOS_API_HOST']}\n")
+        f.write("ARVADOS_API_TOKEN=v2/#{user_token[:uuid]}/#{user_token[:api_token]}\n")
+        f.close()
+      end
+    rescue => e
+      STDERR.puts "Error setting token for #{l[:username]}: #{e}"
+    end
+
     FileUtils.chown_R(l[:username], nil, userdotssh)
+    FileUtils.chown_R(l[:username], nil, userdotconfig)
     File.chmod(0700, userdotssh)
-    File.chmod(0750, @homedir)
+    File.chmod(0700, userdotconfig)
+    File.chmod(0700, configarvados)
+    File.chmod(0750, homedir)
     File.chmod(0600, keysfile)
+    if File.exist?(tokenfile)
+      File.chmod(0600, tokenfile)
+    end
   end
 
   devnull.close