Rework the first-boot setup flow

Makefile

@@ -15,6 +15,7 @@ install_common:
 
 	install -p -Dm 0755 ready-set-service $(DESTDIR)$(PREFIX)/bin/ready-set-service
 	install -p -Dm 0755 ready-set-post.sh $(DESTDIR)$(DATADIR)/ready-set-service/ready-set-post.sh
+	install -p -Dm 0755 ready-set-start.sh $(DESTDIR)$(DATADIR)/ready-set-service/ready-set-start.sh
 	install -p -Dm 0755 weston.ini $(DESTDIR)$(DATADIR)/ready-set-service/weston.ini
 	install -p -Dm 0755 ready-set-service.service $(DESTDIR)$(UNITDIR)/ready-set-service.service
 	install -p -Dm 0755 setup.target $(DESTDIR)$(UNITDIR)/setup.target

ready-set-post.sh

 #!/bin/bash
-subst 's/ systemd\.unit=setup\.target//g' /etc/sysconfig/grub2
 
-rm /usr/share/wayland-sessions/weston.desktop
+set -euo pipefail
 
-systemctl start display-manager.service
+warn()
+{
+	printf 'ready-set-post.sh: warning: %s\n' "$*" >&2
+}
 
-update-grub
+find_regular_user()
+{
+	getent passwd | awk -F: '
+	$3 >= 1000 && $3 < 60000 && $6 ~ /^\/home\// && $7 !~ /(nologin|false|\/dev\/null)$/ {
+		print $1
+		found = 1
+	}
+	END {
+		exit found ? 0 : 1
+	}'
+}
 
-apt-get remove -y weston libweston ready-set ready-set-service
+get_generated_grub_config()
+{
+	local config="/boot/grub/grub.cfg"
+	local configured
+
+	configured="$(sed -rn "s|^[[:space:]]*GRUB_AUTOUPDATE_CFGNAME[[:space:]]*=[[:space:]]*['\"]?([^'\"#[:space:]]+)['\"]?.*|\\1|p" /etc/sysconfig/grub2 | tail -n 1)"
+	if [[ -n "$configured" ]]; then
+		config="$configured"
+	fi
+
+	printf '%s\n' "$config"
+}
+
+patch_generated_grub_config()
+{
+	local config="$1"
+
+	[[ -f "$config" ]] || return 0
+	grep -q -- 'systemd.unit=setup.target' "$config" || return 0
+
+	sed -ri "/^[[:space:]]*linux[[:space:]]/ {
+		s/[[:space:]]systemd\\.unit=setup\\.target([[:space:]]|$)/\\1/g
+	}" "$config"
+}
+
+# Mirror cleanup progress to tty1 so the user does not see a black screen.
+if [[ -w /dev/tty1 ]]; then
+	exec > >(tee /dev/tty1) 2>&1
+fi
+
+if ! find_regular_user >/dev/null; then
+	printf 'No regular user was created; cleanup skipped, ReadySet will be retried.\n'
+	exit 75
+fi
+
+printf 'Completing initial setup...\n'
+
+printf 'Removing setup boot option...\n'
+sed -ri "/^[[:space:]]*GRUB_CMDLINE_LINUX(_DEFAULT|_RECOVERY)?=/ {
+	s/(^|[=[:space:]'\"])systemd\\.unit=setup\\.target([[:space:]'\"]|$)/\\1\\2/g
+	s/[[:space:]]+/ /g
+	s/= /=/g
+	s/=' /='/g
+	s/ '/'/g
+	s/=\" /=\"/g
+	s/ \"/\"/g
+}" /etc/sysconfig/grub2
+
+printf 'Patching generated boot configuration...\n'
+generated_grub_config="$(get_generated_grub_config)"
+if [[ -f "$generated_grub_config" ]]; then
+	patch_generated_grub_config "$generated_grub_config"
+else
+	warn "generated GRUB config not found: $generated_grub_config"
+fi
+
+printf 'Removing Weston session entry...\n'
+rm -f /usr/share/wayland-sessions/weston.desktop || warn "failed to remove weston.desktop"
+
+printf 'Starting graphical session...\n'
+systemctl start graphical.target || warn "failed to start graphical.target"
+
+printf 'Removing setup packages...\n'
+apt-get remove -y weston libweston ready-set ready-set-service || warn "failed to remove setup packages"

ready-set-service

 #!/bin/bash
-dbus-run-session weston --shell=kiosk-shell.so --config=/usr/share/ready-set-service/weston.ini
+
+install -d -m 1777 /tmp/.X11-unix
+
+exec dbus-run-session weston --shell=kiosk-shell.so --config=/usr/share/ready-set-service/weston.ini

ready-set-service.service

@@ -7,17 +7,54 @@ Requires=multi-user.target
 [Service]
 Type=simple
 ExecStart=/usr/bin/ready-set-service
-ExecStop=/usr/share/ready-set-service/ready-set-post.sh
+ExecStopPost=+/usr/share/ready-set-service/ready-set-post.sh
 Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=15min
+RuntimeDirectory=ready-set-service
+RuntimeDirectoryMode=0700
+StateDirectory=ready-set
+WorkingDirectory=/var/lib/ready-set
+Environment=HOME=/var/lib/ready-set
 StandardInput=tty
 StandardOutput=journal
 StandardError=journal
+SyslogIdentifier=ready-set-service
 TTYPath=/dev/tty1
 TTYReset=yes
 TTYVHangup=yes
 TTYVTDisallocate=yes
-User=root
+User=ready-set
+Group=ready-set
+SupplementaryGroups=input
 PAMName=login
 
+# Security hardening
+NoNewPrivileges=no
+AmbientCapabilities=
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+SystemCallArchitectures=native
+RestrictNamespaces=yes
+RestrictRealtime=yes
+# Disable these two lines for a network-capable setup flow.
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+IPAddressDeny=any
+PrivateTmp=yes
+ReadOnlyPaths=/usr -/boot
+ReadWritePaths=/var/lib/ready-set /run/ready-set-service /run/user /etc
+InaccessiblePaths=/home /root
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=no
+ProtectHostname=no
+ProtectProc=invisible
+RemoveIPC=yes
+UMask=0077
+KeyringMode=private
+
 [Install]
 WantedBy=setup.target

ready-set-service.spec

 Name: ready-set-service
-Version: 0.0.2
+Version: 0.1.0
 Release: eter1
 
 Summary: Service for running ready-set
@@ -12,6 +12,14 @@ BuildArch: noarch
 Source: %name-%version.tar
 
 Requires: ready-set
+Requires: ready-set-plugin-welcome
+Requires: ready-set-plugin-language
+Requires: ready-set-plugin-user-passwdqc
+Requires: weston
+Requires: xorg-xwayland
+Requires: dbus
+Requires: libgio
+Requires: xkeyboard-config
 Conflicts: alterator-setup
 
 %description

ready-set-start.sh

 #!/bin/bash
-#/usr/bin/osk-wayland &
-/usr/libexec/ready-set && /usr/share/ready-set-service/ready-set-post.sh
+runtime_dir="${READY_SET_SERVICE_RUNTIME_DIR:-/run/ready-set-service}"
+config_file="${READY_SET_SERVICE_CONFIG_FILE:-${runtime_dir}/ready-set.conf}"
+ready_set_bin="${READY_SET_BIN:-/usr/libexec/ready-set}"
+steps="welcome,language,user-passwdqc"
+
+mkdir -p "$runtime_dir"
+
+cat > "$config_file" <<EOF
+[Application]
+fullscreen=true
+steps=${steps}
+# Welcome is display-only in ReadySet 0.6.2: applying it aborts.
+steps-no-apply=welcome
+
+[Context]
+user-with-root=true
+
+# ReadySet 0.6.2 ALT branch keys.
+no-password-security=true
+passwd-conf-path=/etc/passwdqc.conf
+
+# ReadySet main branch keys.
+user-no-password-security=true
+user-passwd-conf-path=/etc/passwdqc.conf
+EOF
+
+export GDK_BACKEND=x11
+exec "$ready_set_bin" --conf-file "$config_file"

weston.ini

 [core]
 shell=kiosk
+xwayland=true
+
+[shell]
+binding-modifier=ctrl
+
+[keyboard]
+keymap_rules=evdev
+keymap_model=pc105
+keymap_layout=us,ru
+keymap_variant=,
+keymap_options=grp:ctrl_space_toggle,grp:alt_space_toggle,grp:win_space_toggle,grp:alt_shift_toggle,grp:ctrl_shift_toggle,compose:menu
 
 [autolaunch]
-path=/usr/libexec/ready-set
+path=/usr/share/ready-set-service/ready-set-start.sh
 watch=true