debos: rootfs: fix password reset requirement

Existing code arranges to set up an initial well-known password but with
a requirement to reset it on first login.

This wasn't working because the well-known password was being set after
expiring the "old" password, meaning that it was being treated as having
been reset immediately.

Instead, ensure to expire the password _after_ setting it.

Fixes: #69
Signed-off-by: Robie Basak <[email protected]>

Author: basak-qcom

ci/qemu_test.py

@@ -60,3 +60,23 @@ def vm():
         # If this blocks then we have a problem. Better to hang than build up
         # excess qemu processes that won't die.
         child.wait()
+
+
+def test_password_reset_required(vm):
+    """On first login, there should be a mandatory reset password flow"""
+    # https://github.com/qualcomm-linux/qcom-deb-images/issues/69
+
+    # This takes a minute or two on a ThinkPad T14s Gen 6 Snapdragon
+    vm.expect_exact("debian login:", timeout=240)
+
+    vm.send("debian\r\n")
+    vm.expect_exact("Password:")
+    vm.send("debian\r\n")
+    vm.expect_exact("You are required to change your password immediately")
+    vm.expect_exact("Current password:")
+    vm.send("debian\r\n")
+    vm.expect_exact("New password:")
+    vm.send("new password\r\n")
+    vm.expect_exact("Retype new password:")
+    vm.send("new password\r\n")
+    vm.expect_exact("debian@debian:~$")

debos-recipes/qualcomm-linux-debian-rootfs.yaml

@@ -119,9 +119,10 @@ actions:
       # session has not updated ACLs to the device nodes
       useradd --create-home --shell /bin/bash --user-group \
           --groups adm,audio,render,sudo,users,video debian
-      # password must be changed on first login; set it to "debian"
-      chage --lastday 0 debian
+      # set password to "debian"
       echo debian:debian | chpasswd
+      # password must be changed on first login
+      chage --lastday 0 debian
       # add to sudoers
       mkdir -v --mode 755 --parents /etc/sudoers.d
       # subshell to override umask