pc-unlocker/app/pc_unlocker.py

#!/usr/bin/env python3
"""PC-Unlocker -- grafisches Offline-Recovery fuer lokale Konten.

Legitimer Einsatz: Zuruecksetzen von Passwoertern auf Maschinen, zu denen man
physischen Zugang und die Berechtigung hat (eigener Rechner, verwaltete
Firmen-PCs, Konten ausgeschiedener Mitarbeiter). Verschluesselte Datentraeger
(BitLocker/LUKS) bleiben geschuetzt -- dieses Tool kann sie nicht umgehen.

Benoetigt root und ein X-Display (laeuft im Live-System automatisch).
"""

from __future__ import annotations

import os
import shutil
import subprocess
import sys
import threading
import tkinter as tk
from tkinter import messagebox, simpledialog, ttk

from puk import __version__, disks, linux, windows


class App(tk.Tk):
    def __init__(self) -> None:
        super().__init__()
        self.title(f"PC-Unlocker {__version__}")
        self.geometry("820x600")
        self.minsize(720, 520)

        self.parts: list[disks.Partition] = []
        self.current: disks.Partition | None = None

        self._build_ui()
        self.protocol("WM_DELETE_WINDOW", self._on_close)
        self.after(200, self.refresh_disks)

    # ---------------------------------------------------------------- UI
    def _build_ui(self) -> None:
        pad = dict(padx=8, pady=4)

        bar = ttk.Frame(self)
        bar.pack(fill="x", **pad)
        ttk.Button(bar, text="Datentraeger neu einlesen",
                   command=self.refresh_disks).pack(side="left")
        ttk.Button(bar, text="Oeffnen / Mounten",
                   command=self.open_selected).pack(side="left", padx=6)
        ttk.Button(bar, text="Aushaengen",
                   command=self.close_selected).pack(side="left")
        ttk.Button(bar, text="NTFS reparieren (Dirty-Bit)",
                   command=self.clean_selected).pack(side="left", padx=6)

        body = ttk.Panedwindow(self, orient="horizontal")
        body.pack(fill="both", expand=True, **pad)

        left = ttk.Labelframe(body, text="Partitionen")
        self.disk_list = tk.Listbox(left, exportselection=False)
        self.disk_list.pack(fill="both", expand=True, padx=4, pady=4)
        self.disk_list.bind("<<ListboxSelect>>", lambda e: None)
        body.add(left, weight=1)

        right = ttk.Labelframe(body, text="Benutzerkonten")
        self.user_list = tk.Listbox(right, exportselection=False)
        self.user_list.pack(fill="both", expand=True, padx=4, pady=4)
        body.add(right, weight=1)

        act = ttk.Frame(self)
        act.pack(fill="x", **pad)
        self.btn_blank = ttk.Button(act, text="Passwort leeren (blank)",
                                    command=self.do_blank, state="disabled")
        self.btn_set = ttk.Button(act, text="Neues Passwort setzen",
                                  command=self.do_set, state="disabled")
        self.btn_unlock = ttk.Button(act, text="Konto entsperren",
                                     command=self.do_unlock, state="disabled")
        self.btn_admin = ttk.Button(act, text="Zu Admin machen (Windows)",
                                    command=self.do_admin, state="disabled")
        for b in (self.btn_blank, self.btn_set, self.btn_unlock, self.btn_admin):
            b.pack(side="left", padx=4)

        logf = ttk.Labelframe(self, text="Protokoll")
        logf.pack(fill="both", expand=False, **pad)
        self.log = tk.Text(logf, height=8, state="disabled", wrap="word")
        self.log.pack(fill="both", expand=True, padx=4, pady=4)

        power = ttk.Frame(self)
        power.pack(fill="x", **pad)
        ttk.Button(power, text="Herunterfahren",
                   command=self.do_shutdown).pack(side="right", padx=4)
        ttk.Button(power, text="Neustarten",
                   command=self.do_reboot).pack(side="right", padx=4)
        ttk.Button(power, text="Beenden",
                   command=self._on_close).pack(side="right", padx=4)

        self._log("PC-Unlocker gestartet. Datentraeger auswaehlen und mounten.")

    def _log(self, msg: str) -> None:
        self.log.configure(state="normal")
        self.log.insert("end", msg + "\n")
        self.log.see("end")
        self.log.configure(state="disabled")

    # ------------------------------------------------------------- Disks
    def refresh_disks(self) -> None:
        disks.unmount_all(self.parts)
        self.current = None
        self.user_list.delete(0, "end")
        self._set_actions(linux_os=False, windows_os=False)
        try:
            self.parts = disks.list_partitions()
        except Exception as exc:  # noqa: BLE001
            messagebox.showerror("Fehler", f"lsblk fehlgeschlagen:\n{exc}")
            return
        self.disk_list.delete(0, "end")
        for p in self.parts:
            self.disk_list.insert("end", p.display)
        self._log(f"{len(self.parts)} Partition(en) gefunden.")

    def _selected_part(self) -> disks.Partition | None:
        sel = self.disk_list.curselection()
        if not sel:
            return None
        return self.parts[sel[0]]

    def open_selected(self) -> None:
        p = self._selected_part()
        if not p:
            messagebox.showinfo("Hinweis", "Bitte eine Partition auswaehlen.")
            return
        try:
            mp = disks.mount(p)
        except disks.DirtyVolume as exc:
            self._log(f"NTFS unsauber: {exc}")
            if not messagebox.askyesno(
                    "NTFS unsauber (Dirty-Bit)",
                    f"{p.path} wurde nicht ordnungsgemaess ausgehaengt "
                    "(Dirty-Bit / Windows Fast-Startup).\n\n"
                    "Dirty-Bit jetzt bereinigen (ntfsfix) und erneut "
                    "schreibend mounten?"):
                return
            if not self._fix_and_mount(p):
                return
            mp = p.our_mount
        except Exception as exc:  # noqa: BLE001
            messagebox.showerror("Mount fehlgeschlagen", str(exc))
            return
        self.current = p
        self.disk_list.delete(self.disk_list.curselection()[0])
        self.disk_list.insert(self.parts.index(p), p.display)
        self._log(f"Gemountet: {p.path} -> {mp}  (OS: {p.os_kind or 'unbekannt'})")
        self._load_users()

    def _fix_and_mount(self, p: disks.Partition) -> bool:
        """ntfsfix ausfuehren und anschliessend erzwungen RW mounten."""
        try:
            out = disks.fix_ntfs(p)
            self._log("ntfsfix: " + (out.splitlines()[-1] if out else "ok"))
            disks.mount(p, force=True)
            self._log(f"Nach Reparatur schreibend gemountet: {p.path} -> {p.our_mount}")
            return True
        except Exception as exc:  # noqa: BLE001
            messagebox.showerror("Reparatur fehlgeschlagen", str(exc))
            return False

    def clean_selected(self) -> None:
        """NTFS-Dirty-Bit einer ausgewaehlten (ausgehaengten) Partition bereinigen."""
        p = self._selected_part()
        if not p:
            messagebox.showinfo("Hinweis", "Bitte eine Partition auswaehlen.")
            return
        if p.fstype != "ntfs":
            messagebox.showinfo("Hinweis", "Nur fuer NTFS-Partitionen noetig.")
            return
        if p.our_mount:
            disks.unmount(p)
            self._log(f"Fuer Reparatur ausgehaengt: {p.path}")
        if not messagebox.askyesno(
                "NTFS reparieren",
                f"Dirty-Bit auf {p.path} loeschen (ntfsfix)?"):
            return
        try:
            out = disks.fix_ntfs(p)
            self._log("ntfsfix: " + (out or "ok"))
            messagebox.showinfo("Fertig",
                                "Dirty-Bit bereinigt. Partition kann nun "
                                "schreibend gemountet werden.")
        except Exception as exc:  # noqa: BLE001
            messagebox.showerror("Reparatur fehlgeschlagen", str(exc))
        self.refresh_disks()

    def close_selected(self) -> None:
        p = self._selected_part()
        if p:
            disks.unmount(p)
            self._log(f"Ausgehaengt: {p.path}")
            if self.current is p:
                self.current = None
                self.user_list.delete(0, "end")
                self._set_actions(linux_os=False, windows_os=False)
            self.refresh_disks()

    # ------------------------------------------------------------- Users
    def _load_users(self) -> None:
        self.user_list.delete(0, "end")
        p = self.current
        if not p:
            return
        try:
            if p.os_kind == "linux":
                self._users = linux.list_users(p.our_mount)
                self._set_actions(linux_os=True, windows_os=False)
            elif p.os_kind == "windows":
                self._users = windows.list_users(p.our_mount)
                self._set_actions(linux_os=False, windows_os=True)
            else:
                self._users = []
                self._set_actions(linux_os=False, windows_os=False)
                self._log("Kein unterstuetztes OS auf dieser Partition erkannt.")
                return
        except Exception as exc:  # noqa: BLE001
            messagebox.showerror("Fehler beim Lesen der Benutzer", str(exc))
            return
        for u in self._users:
            self.user_list.insert("end", u.display)
        self._log(f"{len(self._users)} Benutzerkonto(en) gelesen.")

    def _set_actions(self, linux_os: bool, windows_os: bool) -> None:
        self.btn_blank.configure(state="normal" if (linux_os or windows_os) else "disabled")
        self.btn_unlock.configure(state="normal" if (linux_os or windows_os) else "disabled")
        self.btn_set.configure(state="normal" if linux_os else "disabled")
        self.btn_admin.configure(state="normal" if windows_os else "disabled")

    def _selected_user(self):
        sel = self.user_list.curselection()
        if not sel:
            messagebox.showinfo("Hinweis", "Bitte ein Benutzerkonto auswaehlen.")
            return None
        return self._users[sel[0]]

    # ----------------------------------------------------------- Actions
    def _run(self, fn, ok_msg: str) -> None:
        """Aktion ausfuehren, UI-Thread sauber halten, danach Benutzer neu laden."""
        def worker():
            try:
                fn()
                self.after(0, lambda: self._log("OK: " + ok_msg))
            except Exception as exc:  # noqa: BLE001
                self.after(0, lambda: messagebox.showerror("Fehler", str(exc)))
            finally:
                self.after(0, self._load_users)
        threading.Thread(target=worker, daemon=True).start()

    def do_blank(self) -> None:
        u = self._selected_user()
        if not u or not self.current:
            return
        if not messagebox.askyesno(
                "Bestaetigen",
                f"Passwort von '{u.name}' wirklich leeren?"):
            return
        mnt = self.current.our_mount
        if self.current.os_kind == "linux":
            self._run(lambda: linux.blank_password(mnt, u.name),
                      f"{u.name}: Passwort geleert.")
        else:
            self._run(lambda: windows.blank_password(mnt, u.name),
                      f"{u.name}: Passwort geleert.")

    def do_set(self) -> None:
        u = self._selected_user()
        if not u or not self.current:
            return
        if self.current.os_kind != "linux":
            return
        pw = simpledialog.askstring(
            "Neues Passwort", f"Neues Passwort fuer '{u.name}':", show="*")
        if pw is None:
            return
        if not pw:
            messagebox.showinfo("Hinweis", "Leer = benutze stattdessen 'Passwort leeren'.")
            return
        mnt = self.current.our_mount
        self._run(lambda: linux.set_password(mnt, u.name, pw),
                  f"{u.name}: neues Passwort gesetzt.")

    def do_unlock(self) -> None:
        u = self._selected_user()
        if not u or not self.current:
            return
        mnt = self.current.our_mount
        if self.current.os_kind == "linux":
            self._run(lambda: linux.unlock(mnt, u.name), f"{u.name}: entsperrt.")
        else:
            self._run(lambda: windows.unlock(mnt, u.name), f"{u.name}: entsperrt/aktiviert.")

    def do_admin(self) -> None:
        u = self._selected_user()
        if not u or not self.current or self.current.os_kind != "windows":
            return
        if not messagebox.askyesno(
                "Bestaetigen", f"'{u.name}' zum Administrator machen?"):
            return
        mnt = self.current.our_mount
        self._run(lambda: windows.promote_admin(mnt, u.name),
                  f"{u.name}: zur Administratorengruppe hinzugefuegt.")

    # -------------------------------------------------------------- Exit
    def _on_close(self) -> None:
        disks.unmount_all(self.parts)
        self.destroy()

    def _power(self, action: str, label: str, cmds: list[list[str]]) -> None:
        """Alles aushaengen und System herunterfahren/neustarten."""
        if not messagebox.askyesno("Bestaetigen", f"System jetzt {label}?"):
            return
        disks.unmount_all(self.parts)
        self._log(f"Alle Datentraeger ausgehaengt. System wird {label}...")
        self.update_idletasks()
        for cmd in cmds:
            if shutil.which(cmd[0]) is None:
                continue
            try:
                subprocess.Popen(cmd)
                self.destroy()
                return
            except Exception:  # noqa: BLE001
                continue
        messagebox.showerror(
            "Fehler", f"Konnte nicht {label} (kein passendes Kommando gefunden).")

    def do_reboot(self) -> None:
        self._power("reboot", "neu starten",
                    [["systemctl", "reboot"], ["reboot"]])

    def do_shutdown(self) -> None:
        self._power("poweroff", "herunterfahren",
                    [["systemctl", "poweroff"], ["poweroff"],
                     ["shutdown", "-h", "now"]])


def main() -> int:
    if os.geteuid() != 0:
        msg = "PC-Unlocker benoetigt root-Rechte (z.B. 'sudo pc_unlocker.py')."
        try:
            r = tk.Tk(); r.withdraw()
            messagebox.showerror("Root erforderlich", msg)
        except Exception:  # noqa: BLE001
            print(msg, file=sys.stderr)
        return 1
    App().mainloop()
    return 0


if __name__ == "__main__":
    raise SystemExit(main())