Introduction of a new device class (teacherlaptop).

- Wifi-devices will be managed by NetworkManager
 - (USB-)Dockingstation with same MAC as internal device
   will be assigned to virbr1
 - users with role-teacher have privilege
   - to create new NetworkManager connections
   - install additional software
   - change luks-key
 - package plasma-discover will not be removed (for teacherlaptops)
 - http-proxy-Settings will be configured by auto-detect
 - providing sudo-script to mount default-school from server after
   wireguard-connection is established

roles/lmn_teacherlaptop/files/lmn-networkmanager.rules

@@ -0,0 +1,6 @@
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
+        subject.isInGroup("role-teacher")) {
+            return polkit.Result.YES;
+    }
+});

roles/lmn_teacherlaptop/files/lmn-packagekit.rules

@@ -0,0 +1,9 @@
+polkit.addRule(function(action, subject) {
+    if ((action.id == "org.freedesktop.packagekit.package-install" ||
+         action.id == "org.freedesktop.packagekit.package-reinstall" ||
+         action.id == "org.freedesktop.packagekit.system-update" ||
+         action.id == "org.freedesktop.packagekit.upgrade-system") &&
+         subject.isInGroup("role-teacher")) {
+            return polkit.Result.YES;
+    }
+});

roles/lmn_teacherlaptop/files/mountserver

@@ -0,0 +1,26 @@
+#!/usr/bin/bash
+set -eu
+
+exit_script() {
+    echo "unmounting media - terminated by trap!" >> "/tmp/${SUDO_UID}-exit-mount.log"
+    findmnt "/lmn/media/${SUDO_USER}/share" && umount "/lmn/media/${SUDO_USER}/share"
+    findmnt "/srv/samba/schools/default-school" && umount "/srv/samba/schools/default-school"
+    trap - SIGHUP SIGINT SIGTERM # clear the trap
+    kill -- -$$ # Sends SIGTERM to child/sub processes
+}
+
+findmnt /srv/samba/schools/default-school > /dev/null && exit 0
+
+umask 0002
+mkdir -p /srv/samba/schools/default-school
+chmod 777  /srv/samba/schools/default-school
+mkdir -p "/lmn/media/${SUDO_USER}/share"
+
+mount -t cifs //server/default-school/ /srv/samba/schools/default-school \
+      -o "sec=krb5i,cruid=${SUDO_UID},user=${SUDO_USER},uid=${SUDO_UID},gid=1010,file_mode=0770,dir_mode=0770,mfsymlinks,nobrl,actimeo=600,cache=loose,echo_interval=10"
+mount --bind /srv/samba/schools/default-school/share "/lmn/media/${SUDO_USER}/share"
+
+echo "Einbindung erfolgreich!"
+echo "Dieses Fenster bitte nicht schließen!"
+trap exit_script SIGHUP SIGINT SIGTERM
+sleep infinity

roles/lmn_teacherlaptop/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Copy polkit rule to allow install packages by role-teacher
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: /etc/polkit-1/rules.d/
+    mode: "0644"
+  loop:
+    - lmn-packagekit.rules
+    - lmn-networkmanager.rules
+
+- name: Copy mountserver script to /usr/local/bin
+  ansible.builtin.copy:
+    src: mountserver
+    dest: /usr/local/bin/
+    mode: "0755"
+
+- name: Deploy sudo configurations (apt for role-teacher) 
+  copy:
+    dest: /etc/sudoers.d/90-lmn-teacherlaptop
+    owner: root
+    group: root
+    mode: '0700'
+    content: |
+      %role-teacher ALL=(root) NOPASSWD: /usr/bin/apt
+      %role-teacher ALL=(root) NOPASSWD: /usr/sbin/cryptsetup
+      %role-teacher ALL=(root) NOPASSWD: /usr/local/bin/mountserver