First version

files/lockdown/reset_team_home.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Manual staff command for permanently erasing the team account's files.
+# Stops the desktop, deletes the home and team-owned files on the root
+# filesystem, then recreates the home. No backup or undo.
+# Never invoke from boot, login, a timer, cron, a playbook or automated tests.
+# Run only after explicit staff authorization and verified backups.
+# The --now argument is internal to the transient service after confirmation.
+set -u
+[ "$(id -u)" -eq 0 ] || { echo "Run this script as root (sudo)." >&2; exit 1; }
+if [ "${1:-}" != --now ]; then
+    echo "The files of the team account will be deleted on this machine."
+    read -rp "Type RESET to continue: " answer
+    [ "$answer" = RESET ] || { echo "Cancelled."; exit 1; }
+    # The reset ends the desktop session, and with it this terminal if the
+    # script was started from the desktop. It runs as a separate service.
+    systemd-run --unit=reset-team-home --collect --quiet "$(readlink -f "$0")" --now
+    echo "Reset started. The screen restarts in a few seconds."
+    exit 0
+fi
+
+systemctl stop lightdm
+loginctl terminate-user team 2>/dev/null
+sleep 2
+pkill -KILL -u team 2>/dev/null
+sleep 1
+for m in /home/team/.vscode/extensions /home/team/.vscode/extensions-root; do
+    umount "$m" 2>/dev/null
+done
+rm -rf --one-file-system /home/team
+find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -user team -print0 2>/dev/null \
+    | xargs -0 -r rm -rf --one-file-system
+mkdir /home/team
+cp -a /etc/skel/. /home/team/
+chown -R team:teams /home/team
+chmod 750 /home/team
+systemctl restart team-vscode-extensions.service
+systemctl start lightdm
+echo "The team account is clean."