File manager - Edit - /usr/lib/python3/dist-packages/uaclient/entitlements/__pycache__/fips.cpython-310.pyc
Back
o ,2�d�F � @ sZ d dl Z d dlZd dlmZ d dlmZmZmZ d dlm Z m Z m Z m Z m Z mZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lmZ d d l m Z m Z d d l m Z m!Z!m"Z" e �#� Z$g d �Z%ddgZ&e%e& e%e& e%d�Z'g d�Z(g d�Z)g d�Z*e%e& e( e%e& e) e%e* d�Z+G dd� dej,�Z-G dd� de-�Z.G dd� de-�Z/dS )� N)�groupby)�List�Optional�Tuple)�apt� event_logger� exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�IncompatibleService)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)� strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal)�openssl� libssl1.0.0�libssl1.0.0-hmac)r" � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s( e Zd ZdZdZdZdZdZg d�Ze dd� �Z d&d e e e d ed ed d f� fdd� Z d'de ded d fdd�Zde de d ef� fdd� Ze d eedf fdd��Ze d e e f� fd d � �Zd eee ej f f� fd d � Zd(d d!�Zd'ded ef� fd"d#� Zd'ded d f� fd$d%� Z � Z S ))�FIPSCommonEntitlementi� zubuntu-advantage-fips.gpgz /proc/sys/crypto/fips_enabledTz/https://ubuntu.com/security/certifications#fips)zfips-initramfsr% r& r# r$ r# r$ z linux-fipsr r r r r" r r r' r( zfips-initramfs-genericr c C s* t �� j}t �� rt�|g �S t�|g �S )a� Dictionary of conditional packages to be installed when enabling FIPS services. For example, if we are enabling FIPS services in a machine that has openssh-client installed, we will perform two actions: 1. Upgrade the package to the FIPS version 2. Install the corresponding hmac version of that package when available. )r �get_release_info�series� is_container�#FIPS_CONTAINER_CONDITIONAL_PACKAGES�get�FIPS_CONDITIONAL_PACKAGES)�selfr+ � r1 �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.py�conditional_packagesw s z*FIPSCommonEntitlement.conditional_packagesN� package_list�cleanup_on_failure�verbose�returnc s� |r t �dj| jd�� | j}t� j|dd� g }t�� }t t | j �dd� d�}|D ] \}} ||v r6|| 7 }q*|D ]$} z t� j| gddd� W q9 t j y] t �tjj| j| d �� Y q9w d S ) a) Install contract recommended packages for the entitlement. :param package_list: Optional package list to use instead of self.packages. :param cleanup_on_failure: Cleanup apt files if apt install fails. :param verbose: If true, print messages to stdout zInstalling {title} packages��titleF)r4 r6 c S s | � dd�S )Nz-hmac� )�replace)�pkg_namer1 r1 r2 �<lambda>� � z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>)�key)r4 r5 r6 )�service�pkgN)�event�info�formatr9 �packages�super�install_packagesr � get_installed_packages_namesr �sortedr3 r �UserFacingErrorr �FIPS_PACKAGE_NOT_AVAILABLE) r0 r4 r5 r6 �mandatory_packages�desired_packages�installed_packages� pkg_groupsr< �pkg_listrA �� __class__r1 r2 rG � s: �� � �����z&FIPSCommonEntitlement.install_packagesF� operation�silentc C sf t �� }t�|� |r/|st�tjj|d�� |dkr#t� t j � dS |dkr1t� t j � dS dS dS )z�Check if user should be alerted that a reboot must be performed. @param operation: The operation being executed. @param silent: Boolean set True to silence print/log of messages )rS �installzdisable operationN) r � should_rebootrB � needs_rebootrC r �ENABLE_REBOOT_REQUIRED_TMPLrD r �addr �FIPS_SYSTEM_REBOOT_REQUIRED� FIPS_DISABLE_REBOOT_REQUIRED)r0 rS rT �reboot_requiredr1 r1 r2 �_check_for_reboot_msg� s& ����� z+FIPSCommonEntitlement._check_for_reboot_msgr+ �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series. On Xenial GCP there will be no cloud-optimized kernel so block default ubuntu-fips enable. This can be overridden in config with features.allow_xenial_fips_on_cloud. GCP doesn't yet have a cloud-optimized kernel or metapackage so block enable of fips if the contract does not specify ubuntu-gcp-fips. This also can be overridden in config with features.allow_default_fips_metapackage_on_gcp. :return: False when this cloud, series or config override allows FIPS. �gcez.features.allow_default_fips_metapackage_on_gcp)�config� path_to_valueT)r r! zubuntu-gcp-fips)r �is_config_value_true�cfg�boolrF rE )r0 r+ r^ rQ r1 r2 � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d u rd� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS ) Nzan AWSzan Azureza GCP)�aws�azurer_ r: )r+ �cloudc s �� �� �S �N)re r1 �r^ r0 r+ r1 r2 r= r> z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r r r* r+ r �FIPS_BLOCK_ON_CLOUDrD r9 r. )r0 � cloud_titles�_�blocked_messager1 rj r2 �static_affordances� s ���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS ri )r r, rF rE )r0 rQ r1 r2 rE s z FIPSCommonEntitlement.packagesc s� t � �� \}}t�� rt�� st�tj� ||fS t j � | j �rSt�t | j��s.t�tj� t�| j ��� dkrBt�tj� ||fS t�tj� tjtjj| j d�fS |tjkr\||fS tjtjfS )N�1)� file_name)rF �application_statusr r, rV r �remover rZ �os�path�exists�FIPS_PROC_FILE�setrE � load_file�strip�FIPS_MANUAL_DISABLE_URLrY r �DISABLEDr �FIPS_PROC_FILE_ERRORrD �ENABLED�FIPS_REBOOT_REQUIRED)r0 � super_status� super_msgrQ r1 r2 rr s: ������ �z(FIPSCommonEntitlement.application_statusc C sT t t�� �}t | j��t | j��}|�|�}|r(t�t|�t j j | j d�� dS dS )z�Remove fips meta package to disable the service. FIPS meta-package will unset grub config options which will deactivate FIPS on any related packages. r8 N) rx r rH rE � differencer3 � intersection�remove_packages�listr �DISABLE_FAILED_TMPLrD r9 )r0 rN �fips_metapackager� r1 r1 r2 r� 8 s � ��z%FIPSCommonEntitlement.remove_packagesc s: t � j|d�rt�tj� t�tj� t�tj� dS dS )N�rT TF)rF �_perform_enabler rs r � WRONG_FIPS_METAPACKAGE_ON_CLOUDr r[ )r0 rT rQ r1 r2 r� I s � z%FIPSCommonEntitlement._perform_enablec s| ddg}t �|d�|�d �}g }|�� D ] }|| jv r!|�|� q|r5ddg| }t �|d�|�d �}t� j|d� dS )z�Setup apt config based on the resourceToken and directives. FIPS-specifically handle apt-mark unhold :raise UserFacingError: on failure to setup any aspect of this apt configuration zapt-mark� showholds� z failed.�unholdr� N)r �run_apt_command�join� splitlines�fips_pro_package_holds�appendrF �setup_apt_config)r0 rT �cmd�holds�unholds�hold� unhold_cmdrQ r1 r2 r� T s � �z&FIPSCommonEntitlement.setup_apt_config)NTT�F)r7 N) �__name__� __module__� __qualname__�repo_pin_priority� repo_key_filerw �apt_noninteractive� help_doc_urlr� �propertyr3 r r �strrd rG r] re r r ro rE r r � NamedMessagerr r� r� r� � __classcell__r1 r1 rQ r2 r) T s\ � ����2��� ���� � + r) c s� e Zd ZdZdZdZdZedee df fdd��Z edee df f� fd d � �Z ede fd d ��Zddedef� fdd� Z� ZS )�FIPSEntitlement�fips�FIPSz NIST-certified core packages� UbuntuFIPSr7 .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement) � uaclient.entitlements.livepatchr� � uaclient.entitlements.realtimer� r r �LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)r0 r� r� r1 r1 r2 �incompatible_servicesq s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| j�}tj}t|�� d |k��t� � }|r |j nd� |t j j | j|jd��fdd�dft jj | j|jd�� fdd�dff S )Nr F)r� � fips_updatesc � � S ri r1 r1 )�is_fips_updates_enabledr1 r2 r= � � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r� ri r1 r1 )�fips_updates_once_enabledr1 r2 r= � r� )rF ro r� rc r r~ rd rr r �readr� r �$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrD r9 �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r0 ro r� �enabled_status�services_once_enabled_objrQ )r� r� r2 ro � s2 ���� �� ��z"FIPSEntitlement.static_affordancesc C �Z d }t �� rtjj| jd�}tjg}ntj}tj || j d�fg|tj tj | j d�fgd�S �Nr8 )�msg� assume_yes)� pre_enable� post_enable� pre_disable) r r, r � PROMPT_FIPS_CONTAINER_PRE_ENABLErD r9 �FIPS_RUN_APT_UPGRADE�PROMPT_FIPS_PRE_ENABLEr �prompt_for_confirmationr� �PROMPT_FIPS_PRE_DISABLE�r0 r� �pre_enable_promptr1 r1 r2 � messaging� �( �� ������zFIPSEntitlement.messagingFrT c sH t � \}}|d u r|tjkrt�d� t� j|d�r"t�t j � dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.r� TF) r r �CLOUD_ID_ERROR�logging�warningrF r� r rs r �FIPS_INSTALL_OUT_OF_DATE)r0 rT � cloud_type�errorrQ r1 r2 r� � s ��z FIPSEntitlement._perform_enabler� )r� r� r� �namer9 � description�originr� r r r� r ro r r� rd r� r� r1 r1 rQ r2 r� j s ! r� c sd e Zd ZdZdZdZdZedee df fdd��Z ede fd d ��Z dd e de f� fd d� Z� ZS )r� z fips-updatesz FIPS Updates�UbuntuFIPSUpdatesz;NIST-certified core packages with priority security updatesr7 .c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r� r � FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r0 r� r1 r1 r2 r� � s ���z,FIPSUpdatesEntitlement.incompatible_servicesc C r� r� ) r r, r r� rD r9 r� � PROMPT_FIPS_UPDATES_PRE_ENABLEr r� r� r� r� r1 r1 r2 r� � r� z FIPSUpdatesEntitlement.messagingFrT c sV t � j|d�r)| j�d�pi }|�| jdi� | jjd|d� t�t dd�� dS dS )Nr� zservices-once-enabledT)r? �content)r� F) rF r� rc � read_cache�updater� � write_cacher �writer )r0 rT �services_once_enabledrQ r1 r2 r� s ���z&FIPSUpdatesEntitlement._perform_enabler� )r� r� r� r� r9 r� r� r� r r r� r r� rd r� r� r1 r1 rQ r2 r� � s r� )0r� rt � itertoolsr �typingr r r �uaclientr r r r r r �uaclient.clouds.identityr r �uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.filesr �uaclient.files.noticesr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerrB � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMACr/ �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALr- �RepoEntitlementr) r� r� r1 r1 r1 r2 �<module> s` ���������� j
| ver. 1.4 |
Github
|
.
| PHP 8.2.9 | Generation time: 0.01 |
proxy
|
phpinfo
|
Settings