Programming-Contests/lockdown.yml

- name: Lockdown (AI completion, USB devices, network settings, printers, clock at login)
  hosts: all
  become: yes
  tasks:
    # IntelliJ IDEA and PyCharm ship local AI models for code completion
    # (Full Line), which work without any network. The models and the local
    # inference server are removed. The plugin code stays, because other
    # parts of PyCharm depend on it.
    - name: Find the local AI completion models of the JetBrains IDEs
      find:
        paths: [/opt/intellij-idea/plugins/fullLine, /opt/pycharm/plugins/fullLine]
        patterns: ["full-line-model-*", "full-line-native-server-*"]
      register: fullline

    - name: Remove them
      file:
        path: "{{ item.path }}"
        state: absent
      loop: "{{ fullline.files }}"
      loop_control:
        label: "{{ item.path }}"

    - name: Check that no model is left
      shell: find /opt -xdev \( -name 'full-line-model-*' -o -name 'full-line-native-server-*' -o -iname '*.gguf' \) | head -5
      register: models_left
      changed_when: false
      failed_when: models_left.stdout | length > 0

    # udisks lets the desktop user mount USB sticks without a password
    - name: Refuse USB disks and disk images to the teams (polkit)
      copy:
        src: files/lockdown/10-acpc-no-removable-media.rules
        dest: /etc/polkit-1/rules.d/10-acpc-no-removable-media.rules
        mode: '0644'

    - name: Refuse direct access to phones and cameras (MTP, PTP)
      copy:
        src: files/lockdown/72-acpc-no-phone-access.rules
        dest: /etc/udev/rules.d/72-acpc-no-phone-access.rules
        mode: '0644'

    # USBGuard: the devices present at boot (the stick itself, keyboard, mouse)
    # are allowed, any device plugged in later is rejected. This also stops
    # a device that types prepared code while posing as a keyboard.
    # An administrator allows a replacement keyboard with
    # "sudo usbguard list-devices" and "sudo usbguard allow-device ID".
    - name: Install USBGuard
      apt:
        name: usbguard
        state: present

    - name: Allow the devices present at boot
      lineinfile:
        path: /etc/usbguard/usbguard-daemon.conf
        regexp: '^PresentDevicePolicy='
        line: PresentDevicePolicy=allow

    - name: Reject the devices plugged in later
      lineinfile:
        path: /etc/usbguard/usbguard-daemon.conf
        regexp: '^ImplicitPolicyTarget='
        line: ImplicitPolicyTarget=reject

    # No rule list: it would describe the devices of the build machine
    - name: Empty rule list
      copy:
        dest: /etc/usbguard/rules.conf
        content: ""
        mode: '0600'

    - name: Enable USBGuard
      systemd:
        name: usbguard.service
        enabled: yes

    - name: Refuse network changes to the teams (polkit)
      copy:
        src: files/lockdown/10-acpc-no-network-changes.rules
        dest: /etc/polkit-1/rules.d/10-acpc-no-network-changes.rules
        mode: '0644'

    # chrony steps the clock a few seconds after boot. Without this, the
    # desktop could start with the clock of the machine and show it for a
    # while.
    - name: Wait for the clock before the desktop starts
      copy:
        src: files/lockdown/wait-for-time.service
        dest: /etc/systemd/system/wait-for-time.service
        mode: '0644'

    - name: Enable it
      systemd:
        name: wait-for-time.service
        enabled: yes
        daemon_reload: yes

    # A restart would let USBGuard accept a device plugged in before it, so the
    # teams may not restart, power off or suspend the machine
    - name: Refuse restart, power off and suspend to the teams (polkit)
      copy:
        src: files/lockdown/10-acpc-no-power-actions.rules
        dest: /etc/polkit-1/rules.d/10-acpc-no-power-actions.rules
        mode: '0644'

    - name: No restart with Ctrl+Alt+Del
      systemd:
        name: ctrl-alt-del.target
        masked: yes

    - name: No SysRq key combinations
      copy:
        src: files/lockdown/90-acpc-sysrq.conf
        dest: /etc/sysctl.d/90-acpc-sysrq.conf
        mode: '0644'

    - name: Power, reboot and suspend keys do nothing
      block:
        - file:
            path: /etc/systemd/logind.conf.d
            state: directory
            mode: '0755'
        - copy:
            src: files/lockdown/90-acpc-keys.conf
            dest: /etc/systemd/logind.conf.d/90-acpc-keys.conf
            mode: '0644'

    # The image must not change during maintenance with the firewall off:
    # an upgrade could change the versions of the compilers (Kattis)
    - name: No automatic package updates
      systemd:
        name: "{{ item }}"
        enabled: no
        masked: yes
      loop:
        - apt-daily.timer
        - apt-daily-upgrade.timer
        - unattended-upgrades.service

    # The lpadmin group administers the printers and can write in
    # /usr/share/ppd/custom. Printing does not need it.
    - name: Remove team from the lpadmin group
      command: gpasswd -d team lpadmin
      register: lpadmin
      changed_when: lpadmin.rc == 0
      failed_when: false

    # Root only: the administrator runs it with sudo from the icpc account
    - name: Install the command that turns the restrictions off and on
      copy:
        src: files/lockdown/contest-restrictions
        dest: /usr/local/sbin/contest-restrictions
        mode: '0700'

    # Runs as root, so the team account cannot stop it
    - name: Show a red banner on the screen while a restriction is off
      copy:
        src: "files/lockdown/{{ item.src }}"
        dest: "{{ item.dest }}"
        mode: "{{ item.mode }}"
      loop:
        - { src: contest-restrictions-warning, dest: /usr/local/sbin/contest-restrictions-warning, mode: '0700' }
        - { src: contest-restrictions-warning.service, dest: /etc/systemd/system/contest-restrictions-warning.service, mode: '0644' }

    - name: Enable the banner service
      systemd:
        name: contest-restrictions-warning.service
        enabled: yes
        daemon_reload: yes

    - name: Create the folder of the restrictions turned off (root only)
      file:
        path: "{{ item }}"
        state: directory
        mode: '0700'
      loop:
        - /etc/contest-restrictions
        - /etc/contest-restrictions/disabled

    - name: Install the reset script of the team account
      copy:
        src: files/lockdown/reset_team_home.sh
        dest: /reset_team_home.sh
        mode: '0500'