First version

lockdown.yml

@@ -0,0 +1,183 @@
+- name: Lockdown (AI completion, USB devices, network settings, printers, clock at login)
+  hosts: all
+  become: yes
+  tasks:
+    # IntelliJ IDEA and PyCharm ship local AI models for code completion
+    # (Full Line), which work without any network. The models and the local
+    # inference server are removed. The plugin code stays, because other
+    # parts of PyCharm depend on it.
+    - name: Find the local AI completion models of the JetBrains IDEs
+      find:
+        paths: [/opt/intellij-idea/plugins/fullLine, /opt/pycharm/plugins/fullLine]
+        patterns: ["full-line-model-*", "full-line-native-server-*"]
+      register: fullline
+
+    - name: Remove them
+      file:
+        path: "{{ item.path }}"
+        state: absent
+      loop: "{{ fullline.files }}"
+      loop_control:
+        label: "{{ item.path }}"
+
+    - name: Check that no model is left
+      shell: find /opt -xdev \( -name 'full-line-model-*' -o -name 'full-line-native-server-*' -o -iname '*.gguf' \) | head -5
+      register: models_left
+      changed_when: false
+      failed_when: models_left.stdout | length > 0
+
+    # udisks lets the desktop user mount USB sticks without a password
+    - name: Refuse USB disks and disk images to the teams (polkit)
+      copy:
+        src: files/lockdown/10-acpc-no-removable-media.rules
+        dest: /etc/polkit-1/rules.d/10-acpc-no-removable-media.rules
+        mode: '0644'
+
+    - name: Refuse direct access to phones and cameras (MTP, PTP)
+      copy:
+        src: files/lockdown/72-acpc-no-phone-access.rules
+        dest: /etc/udev/rules.d/72-acpc-no-phone-access.rules
+        mode: '0644'
+
+    # USBGuard: the devices present at boot (the stick itself, keyboard, mouse)
+    # are allowed, any device plugged in later is rejected. This also stops
+    # a device that types prepared code while posing as a keyboard.
+    # An administrator allows a replacement keyboard with
+    # "sudo usbguard list-devices" and "sudo usbguard allow-device ID".
+    - name: Install USBGuard
+      apt:
+        name: usbguard
+        state: present
+
+    - name: Allow the devices present at boot
+      lineinfile:
+        path: /etc/usbguard/usbguard-daemon.conf
+        regexp: '^PresentDevicePolicy='
+        line: PresentDevicePolicy=allow
+
+    - name: Reject the devices plugged in later
+      lineinfile:
+        path: /etc/usbguard/usbguard-daemon.conf
+        regexp: '^ImplicitPolicyTarget='
+        line: ImplicitPolicyTarget=reject
+
+    # No rule list: it would describe the devices of the build machine
+    - name: Empty rule list
+      copy:
+        dest: /etc/usbguard/rules.conf
+        content: ""
+        mode: '0600'
+
+    - name: Enable USBGuard
+      systemd:
+        name: usbguard.service
+        enabled: yes
+
+    - name: Refuse network changes to the teams (polkit)
+      copy:
+        src: files/lockdown/10-acpc-no-network-changes.rules
+        dest: /etc/polkit-1/rules.d/10-acpc-no-network-changes.rules
+        mode: '0644'
+
+    # chrony steps the clock a few seconds after boot. Without this, the
+    # desktop could start with the clock of the machine and show it for a
+    # while.
+    - name: Wait for the clock before the desktop starts
+      copy:
+        src: files/lockdown/wait-for-time.service
+        dest: /etc/systemd/system/wait-for-time.service
+        mode: '0644'
+
+    - name: Enable it
+      systemd:
+        name: wait-for-time.service
+        enabled: yes
+        daemon_reload: yes
+
+    # A restart would let USBGuard accept a device plugged in before it, so the
+    # teams may not restart, power off or suspend the machine
+    - name: Refuse restart, power off and suspend to the teams (polkit)
+      copy:
+        src: files/lockdown/10-acpc-no-power-actions.rules
+        dest: /etc/polkit-1/rules.d/10-acpc-no-power-actions.rules
+        mode: '0644'
+
+    - name: No restart with Ctrl+Alt+Del
+      systemd:
+        name: ctrl-alt-del.target
+        masked: yes
+
+    - name: No SysRq key combinations
+      copy:
+        src: files/lockdown/90-acpc-sysrq.conf
+        dest: /etc/sysctl.d/90-acpc-sysrq.conf
+        mode: '0644'
+
+    - name: Power, reboot and suspend keys do nothing
+      block:
+        - file:
+            path: /etc/systemd/logind.conf.d
+            state: directory
+            mode: '0755'
+        - copy:
+            src: files/lockdown/90-acpc-keys.conf
+            dest: /etc/systemd/logind.conf.d/90-acpc-keys.conf
+            mode: '0644'
+
+    # The image must not change during maintenance with the firewall off:
+    # an upgrade could change the versions of the compilers (Kattis)
+    - name: No automatic package updates
+      systemd:
+        name: "{{ item }}"
+        enabled: no
+        masked: yes
+      loop:
+        - apt-daily.timer
+        - apt-daily-upgrade.timer
+        - unattended-upgrades.service
+
+    # The lpadmin group administers the printers and can write in
+    # /usr/share/ppd/custom. Printing does not need it.
+    - name: Remove team from the lpadmin group
+      command: gpasswd -d team lpadmin
+      register: lpadmin
+      changed_when: lpadmin.rc == 0
+      failed_when: false
+
+    # Root only: the administrator runs it with sudo from the icpc account
+    - name: Install the command that turns the restrictions off and on
+      copy:
+        src: files/lockdown/contest-restrictions
+        dest: /usr/local/sbin/contest-restrictions
+        mode: '0700'
+
+    # Runs as root, so the team account cannot stop it
+    - name: Show a red banner on the screen while a restriction is off
+      copy:
+        src: "files/lockdown/{{ item.src }}"
+        dest: "{{ item.dest }}"
+        mode: "{{ item.mode }}"
+      loop:
+        - { src: contest-restrictions-warning, dest: /usr/local/sbin/contest-restrictions-warning, mode: '0700' }
+        - { src: contest-restrictions-warning.service, dest: /etc/systemd/system/contest-restrictions-warning.service, mode: '0644' }
+
+    - name: Enable the banner service
+      systemd:
+        name: contest-restrictions-warning.service
+        enabled: yes
+        daemon_reload: yes
+
+    - name: Create the folder of the restrictions turned off (root only)
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0700'
+      loop:
+        - /etc/contest-restrictions
+        - /etc/contest-restrictions/disabled
+
+    - name: Install the reset script of the team account
+      copy:
+        src: files/lockdown/reset_team_home.sh
+        dest: /reset_team_home.sh
+        mode: '0500'