PHP WebShell
Текущая директория: /usr/lib/python3/dist-packages/uaclient/entitlements/__pycache__
Просмотр файла: fips.cpython-310.pyc
o
l�g}b � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z m Z m
Z
mZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z d d l m Z m Z d d l!m"Z"m#Z#m$Z$ e �%� Z&e �'e�(e)��Z*g d
�Z+ddgZ,e+e, e+e, e+d�Z-g d�Z.g d�Z/g d�Z0e+e, e. e+e, e/ e+e0 d�Z1G dd� dej2�Z3G dd� de3�Z4G dd� de3�Z5G dd� de4�Z6dS )� N)�groupby)�List�Optional�Tuple)�api�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�EntitlementWithMessage)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)�
strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal)�openssl� libssl1.0.0�libssl1.0.0-hmac)r# � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s� e Zd ZdZdZdZejZdZ ej
j Z g d�Z
edefdd��Zed d
� �Zd edefd d
�Zdejfdd�Zdefdd�Zdejfdd�Z d6dejdeee deddf� fdd�
Z defdd�Z d7d ed eddfd d �Z d!ed"edef� fd#d$� Z ede e!d%f fd&d'��Z"edee f� fd(d)� �Z#de e$eej% f f� fd*d+� Z&d8d,d-�Z'dejdef� fd.d/� Z(dejdef� fd0d1� Z)d2d3� Z*dejddf� fd4d5� Z+� Z,S )9�FIPSCommonEntitlementi� zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledT) zfips-initramfszfips-initramfs-genericr( r) �libgmp10� libgnutls30� libhogweed6�
libnettle8r$ r% r$ r% r& r' �libssl3�
linux-fipsr r r r r# �openssl-fips-module-3r r r z ubuntu-fipszubuntu-aws-fipszubuntu-azure-fips�ubuntu-gcp-fips�returnc C s d }t �� rtjj| jd�}| �� stjg}n| j}d }| j s-t
j dtj j| jd�ifg}t
j d|ifg| j
i fg||d�}t| j�dkr�| jd }t�d|�}|rX|�d�}nd}t �� j}||kr�|�d�pig } tjj|| j||ptd d
�}
| �t
j d|
if� | |d< |S ) N��title�msg)�
pre_enable� pre_install� post_enable� pre_disable� r zubuntu-([a-z]+)-fips�genericr7 �unknown)�variant�service� base_flavor�current_flavor)r � is_containerr
� PROMPT_FIPS_CONTAINER_PRE_ENABLE�formatr5 �auto_upgrade_all_on_enable�FIPS_RUN_APT_UPGRADE�pre_enable_msg�purger �prompt_for_confirmation�PROMPT_FIPS_PRE_DISABLE�prompt_if_kernel_downgrade�len�packages�re�match�group�get_kernel_info�flavor�get�#KERNEL_FLAVOR_CHANGE_WARNING_PROMPT�name�append) �selfr9 �pre_enable_promptr: � messaging�ubuntu_fips_package_name� ubuntu_fips_package_flavor_match�ubuntu_fips_package_flavorrA r7 r6 � r] �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyrY � sn ������������
��
���z FIPSCommonEntitlement.messagingc C s* t �� j}t �� rt�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
)r �get_release_info�seriesrB �#FIPS_CONTAINER_CONDITIONAL_PACKAGESrS �FIPS_CONDITIONAL_PACKAGES)rW r` r] r] r^ �conditional_packages� s
z*FIPSCommonEntitlement.conditional_packages�
assume_yesc C s� t �� j}|du rt�d� dS t�d|�}t�d�}|durL|durL|� d�}t�
d||� t� ||�dk rJt �
tjj||d �� tjtj|d
�S d S t�d ||� d S )
ztCheck if installing a FIPS kernel will downgrade the kernel
and prompt for confirmation if it will.
Nz Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r0 �kernel_versionz*Kernel information: cur='%s' and fips='%s'r )�current_version� new_version)r6 rd z2Cannot gather kernel information for '%s' and '%s'T)r rQ � proc_version_signature_version�LOG�warningrN �searchr �get_pkg_candidate_versionrP �debug�version_compare�event�infor
�KERNEL_DOWNGRADE_WARNINGrD r rI �
PROMPT_YES_NO)rW rd �our_full_kernel_str�our_m�fips_kernel_version_str�our_kernel_version_strr] r] r^ rK � sJ �
�
������ ��z0FIPSCommonEntitlement.prompt_if_kernel_downgrade�progressc C s� g }t �� }tt| j�dd� d�}|D ] \}}||v r ||7 }q|D ](}zt j|gddig d�d� W q" tjyJ |�dt j
j | j |d �� Y q"w d S )
Nc S s | � dd�S )Nz-hmac� )�replace)�pkg_namer] r] r^ �<lambda> � zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>)�key�DEBIAN_FRONTEND�noninteractive�z--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"�rM �override_env_vars� apt_optionsrp )r? �pkg)
r � get_installed_packages_namesr �sortedrc �run_apt_install_commandr �UbuntuProError�emitr
�FIPS_PACKAGE_NOT_AVAILABLErD r5 )rW rw �desired_packages�installed_packages�
pkg_groupsrz �pkg_listr� r] r] r^ �&hardcoded_install_conditional_packages s4 � �
� ����z<FIPSCommonEntitlement.hardcoded_install_conditional_packagesc C s* t j| jjdd�}t�� jdv }|p| S )Nz features.fips_auto_upgrade_all��config�
path_to_value> r" r! r )r �is_config_value_true�cfgr r_ r` )rW � install_all_updates_override�hardcoded_releaser] r] r^ rE 2 s
�
z0FIPSCommonEntitlement.auto_upgrade_all_on_enablec C s� dd� t �| j�D �}t�� jdkr|�d� |�� t|�dkrVz"|� dt
j j d�
|�d�� | �|� t j|d d
ig d �d � W d S tjyU |� dt
j� Y d S w d S )
Nc S s g | ]}|j �qS r] )rU )�.0�packager] r] r^ �
<listcomp>A s ��zMFIPSCommonEntitlement.install_all_available_fips_upgrades.<locals>.<listcomp>�jammyr1 r rp � )rM r~ r r� r� )r �;get_installed_packages_with_uninstalled_candidate_in_origin�originr r_ r` rV �sortrL r� r
�INSTALLING_PACKAGESrD �join�unhold_packagesr� r r� � FIPS_PACKAGES_UPGRADE_FAILURE)rW rw �
to_upgrader] r] r^ �#install_all_available_fips_upgrades> s4 ��
��
� ��z9FIPSCommonEntitlement.install_all_available_fips_upgradesN� package_list�cleanup_on_failurec sl | j }|rt� j||d� n |�tjj| jd�� | �� r#| � |� n| �
|� | � � r4t �
tj� dS dS )z�Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
)r� r4 N)rM �super�install_packagesrw r
�INSTALLING_SERVICE_PACKAGESrD r5 rE r� r� �_check_for_rebootr �addr �FIPS_SYSTEM_REBOOT_REQUIRED)rW rw r� r� �mandatory_packages�� __class__r] r^ r� b s" ��
��z&FIPSCommonEntitlement.install_packagesc C s t �� S )z=Check if system needs to be rebooted because of this service.)r �
should_reboot�rW r] r] r^ r� � s z'FIPSCommonEntitlement._check_for_rebootF� operation�silentc C sN | � � }t�|� |r#|st�tjj|d�� |dkr%t�t j
� dS dS dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r� zdisable operationN) r� ro � needs_rebootrp r
�ENABLE_REBOOT_REQUIRED_TMPLrD r r� r � FIPS_DISABLE_REBOOT_REQUIRED)rW r� r� �reboot_requiredr] r] r^ �_check_for_reboot_msg� s
����z+FIPSCommonEntitlement._check_for_reboot_msgr` �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcpr� T)r! r" r2 )r r� r� �boolr� rM �rW r` r� r� r] r^ � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d u rd� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS )
Nzan AWSzan Azureza GCP)�aws�azurer� rx )r` �cloudc s �� �� �S �N)r� r] �r� rW r` r] r^ r{ � r| z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r r r_ r` r
�FIPS_BLOCK_ON_CLOUDrD r5 rS )rW � cloud_titles�_�blocked_messager] r� r^ �static_affordances� s
���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS r� )r rB r� rM r� r� r] r^ rM � s z FIPSCommonEntitlement.packagesc s� t � �� \}}t�� rt�� st�tj� ||fS t j
� | j �rSt�t
| j��s.t�tj� t�| j ��� dkrBt�tj� ||fS t�tj� tjtjj| j d�fS |tjkr\||fS tjtjfS )N�1)� file_name)r� �application_statusr rB r� r �remover r� �os�path�exists�FIPS_PROC_FILE�setrM � load_file�strip�FIPS_MANUAL_DISABLE_URLr� r �DISABLEDr
�FIPS_PROC_FILE_ERRORrD �ENABLED�FIPS_REBOOT_REQUIRED)rW � super_status� super_msgr� r] r^ r� � s: ������
�z(FIPSCommonEntitlement.application_statusc C sT t t�� �}t | j��t | j��}|�|�}|r(t�t|�t j
j | j d�� dS dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r4 N)
r� r r� rM �
differencerc � intersection�remove_packages�listr
�DISABLE_FAILED_TMPLrD r5 )rW r� �fips_metapackager� r] r] r^ r� s
�
��z%FIPSCommonEntitlement.remove_packagesc s8 t � �|�rt�tj� t�tj� t�tj� dS dS �NTF)r� �_perform_enabler r� r � WRONG_FIPS_METAPACKAGE_ON_CLOUDr� r� �rW rw r� r] r^ r� s � z%FIPSCommonEntitlement._perform_enablec s( t � �|�r| �� rt�tj� dS dS r� )r� �_perform_disabler� r r� r r� r� r� r] r^ r� s �z&FIPSCommonEntitlement._perform_disablec C s| ddg}t �|tjjd�|�d��}g }|�� D ] }||v r#|�|� q|r<ddg| }t �|tjjd�|�d��}d S d S )Nzapt-mark� showholdsr� )�command�unhold)r �run_apt_commandr
�EXECUTING_COMMAND_FAILEDrD r� �
splitlinesrV )rW �
package_names�cmd�holds�unholds�hold�
unhold_cmdr] r] r^ r� * s& �
� ���z%FIPSCommonEntitlement.unhold_packagesc s | � | j� t� �|� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UbuntuProError: on failure to setup any aspect of this apt
configuration
N)r� �fips_pro_package_holdsr� �setup_apt_configr� r� r] r^ r� = s z&FIPSCommonEntitlement.setup_apt_config�NT)F)r3 N)-�__name__�
__module__� __qualname__�repo_pin_priority�
repo_key_filer� r
�PROMPT_FIPS_PRE_ENABLErG �apt_noninteractive�urls�FIPS_HOME_PAGE� help_doc_urlr� �propertyr rY rc r� rK r �ProgressWrapperr� rE r� r r �strr� r� r� r� r r r� rM r � NamedMessager� r� r� r� r� r� �
__classcell__r] r] r� r^ r* V sv J
.
�#
�'��
���&���
���� �
*
r* c s� e Zd ZdZejZejZej Z
dZ ej Z
edeedf fdd��Zedeedf f� fdd� �Zd ejdef� fd
d � Z� ZS ) �FIPSEntitlement�fips�
UbuntuFIPSr3 .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
� uaclient.entitlements.livepatchr � uaclient.entitlements.realtimer r r
�LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)rW r r r] r] r^ �incompatible_servicesQ s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| jd�}tj}t|�� d |k��t� � }|r |j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )N)r� r F)r � fips_updatesc � � S r� r] r] )�is_fips_updates_enabledr] r^ r{ x � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r r� r] r] )�fips_updates_once_enabledr] r^ r{ r )r� r� r r� r r� r� r� r �readr r
�$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrD r5 �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)rW r� r �enabled_status�services_once_enabled_objr� )r r r^ r� b s2 ����
��
��z"FIPSEntitlement.static_affordancesrw c sR t � \}}|d u r|tjkrt�d� t�tj� t � �
|�r't � t
j� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r r
�CLOUD_ID_ERRORri rj ro rp r
�.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr� r� r r� r �FIPS_INSTALL_OUT_OF_DATE)rW rw �
cloud_type�errorr� r] r^ r� � s
� �z FIPSEntitlement._perform_enable)r� r� r� rU r
�
FIPS_TITLEr5 �FIPS_DESCRIPTION� description�FIPS_HELP_TEXT� help_textr� r� rG r� r r r r r� r r� r� r� r r] r] r� r^ r I s !r c sb e Zd ZdZejZdZejZ ej
Z ej Z
edeedf fdd��Zdejdef� fdd � Z� ZS )
r z fips-updates�UbuntuFIPSUpdatesr3 .c C s$ ddl m} tttj�t|tj�fS )Nr r )r
r r r r
� FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)rW r r] r] r^ r � s ���z,FIPSUpdatesEntitlement.incompatible_servicesrw c s& t � j|d�rt�tdd�� dS dS )N)rw T)r F)r� r� r �writer r� r� r] r^ r� � s �z&FIPSUpdatesEntitlement._perform_enable)r� r� r� rU r
�FIPS_UPDATES_TITLEr5 r� �FIPS_UPDATES_DESCRIPTIONr! �FIPS_UPDATES_HELP_TEXTr# � PROMPT_FIPS_UPDATES_PRE_ENABLErG r� r r r r r� r� r� r r] r] r� r^ r � s
r c sh e Zd ZdZejZejZej Z
dZ ej Z
dZedeedf f� fdd� �Zded edefd
d �Z� ZS ) �FIPSPreviewEntitlementz fips-preview�UbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr3 .c s t � jtttj�f S r� )r� r r r r
r% r� r� r] r^ r � s
��z,FIPSPreviewEntitlement.incompatible_servicesr` r� c C s dS r� r] r� r] r] r^ r� � s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r� r� r� rU r
�FIPS_PREVIEW_TITLEr5 �FIPS_PREVIEW_DESCRIPTIONr! �FIPS_PREVIEW_HELP_TEXTr# r� � PROMPT_FIPS_PREVIEW_PRE_ENABLErG r� r� r r r r r� r� r r] r] r� r^ r, � s" ���r, )7�loggingr� rN � itertoolsr �typingr r r �uaclientr r r r r
r r �uaclient.clouds.identityr
r �uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.filesr �uaclient.files.noticesr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerro � getLogger� replace_top_level_logger_namer� ri � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMACrb �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALra �RepoEntitlementr* r r r, r] r] r] r^ �<module> sh $ ���������� vL Выполнить команду
Для локальной разработки. Не используйте в интернете!