From 20697db3ee5d227176c4d31e6c96454a64f47797 Mon Sep 17 00:00:00 2001
From: Patrick Schleizer <adrelanos@riseup.net>
Date: Tue, 31 Dec 2019 02:53:02 -0500
Subject: [PATCH] improve console lockdown info output

---
 usr/lib/security-misc/pam_tally2-info | 51 ++++++++++++++++-----------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/usr/lib/security-misc/pam_tally2-info b/usr/lib/security-misc/pam_tally2-info
index 8b6ae52..4bcbdf6 100755
--- a/usr/lib/security-misc/pam_tally2-info
+++ b/usr/lib/security-misc/pam_tally2-info
@@ -5,28 +5,37 @@
 
 grep_result="$(grep "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)"
 
-if ! echo "$grep_result" | grep -q "#" ; then
-   ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592
+## Check if grep matched something.
+if [ ! "$grep_result" = "" ]; then
+   ## Yes, grep matched.
 
-   if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then
-      console_allowed=true
-   fi
-   if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then
-      console_allowed=true
-   fi
-   if [ ! "$console_allowed" = "true" ]; then
-      echo "$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console'" >&2
-      echo "$0: To unlock, run the following command as superuser:" >&2
-      echo "$0: (If you still have a sudo/root shell somewhere.)" >&2
-      echo "" >&2
-      echo "addgroup $PAM_USER console" >&2
-      echo "" >&2
-      echo "$0: However, possibly unlock procedure is required." >&2
-      echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2
-      echo "$0: See also:" >&2
-      echo "https://www.whonix.org/wiki/root#console" >&2
-      echo "" >&2
-      exit 0
+   ## Check if not out commented.
+   if ! echo "$grep_result" | grep -q "#" ; then
+      ## Not out commented indeed.
+
+      ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592
+
+      if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then
+         console_allowed=true
+      fi
+      if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then
+         console_allowed=true
+      fi
+
+      if [ ! "$console_allowed" = "true" ]; then
+         echo "$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console'" >&2
+         echo "$0: To unlock, run the following command as superuser:" >&2
+         echo "$0: (If you still have a sudo/root shell somewhere.)" >&2
+         echo "" >&2
+         echo "addgroup $PAM_USER console" >&2
+         echo "" >&2
+         echo "$0: However, possibly unlock procedure is required." >&2
+         echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2
+         echo "$0: See also:" >&2
+         echo "https://www.whonix.org/wiki/root#console" >&2
+         echo "" >&2
+         exit 0
+      fi
    fi
 fi