From 35d12fd68d3e3db30282aa85d56d2dcf50566945 Mon Sep 17 00:00:00 2001
From: unman <unman@thirdeyesecurity.org>
Date: Thu, 23 Aug 2018 12:53:44 +0000
Subject: [PATCH] Remove user from sudo group on removing passwordless-root.

---
 .../qubes-core-agent-passwordless-root.postrm | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100755 debian/qubes-core-agent-passwordless-root.postrm

diff --git a/debian/qubes-core-agent-passwordless-root.postrm b/debian/qubes-core-agent-passwordless-root.postrm
new file mode 100755
index 0000000..e07b8ba
--- /dev/null
+++ b/debian/qubes-core-agent-passwordless-root.postrm
@@ -0,0 +1,51 @@
+#!/bin/sh
+# postrm script for core-agent-linux
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# The prerm script may be called in the following ways:
+#   * <postrm> 'remove'
+#   * <postrm> 'purge'
+#   * <old-postrm> 'upgrade' <new-version>
+#   * <disappearer's-postrm> 'disappear' <overwriter> <overwriter-version>
+#
+#     The postrm script is called after the package's files have been removed
+# or replaced. The package whose postrm is being called may have previously been
+# deconfigured and only be "Unpacked", at which point subsequent package changes
+# do not consider its dependencies. Therefore, all postrm actions may only rely
+# on essential packages and must gracefully skip any actions that require the
+# package's dependencies if those dependencies are unavailable.[48]
+#
+#   * <new-postrm> 'failed-upgrade' <old-version>
+#
+#     Called when the old postrm upgrade action fails. The new package will be
+# unpacked, but only essential packages and pre-dependencies can be relied on.
+# Pre-dependencies will either be configured or will be "Unpacked" or
+# "Half-Configured" but previously had been configured and was never removed.
+#
+#   * <new-postrm> 'abort-install'
+#   * <new-postrm> 'abort-install' <old-version>
+#   * <new-postrm> 'abort-upgrade' <old-version>
+#
+#     Called before unpacking the new package as part of the error handling of
+# preinst failures. May assume the same state as preinst can assume.
+#
+#    For details, see http://www.debian.org/doc/debian-policy/ or
+# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
+# the debian-policy package
+
+if [ "${1}" = "remove" ] ; then
+    gpasswd -d user sudo
+fi
+
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+# vim: set ts=4 sw=4 sts=4 et :