File manager - Edit - /usr/lib/python3/dist-packages/uaclient/__pycache__/security.cpython-310.pyc
Back
o ,2�d�� � @ s d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZ d dlmZ d dlmZmZ d dl m Z m Z d d l m Z m!Z!m"Z" d d l#m$Z$ d d l%m&Z&m'Z' d d l(m)Z) d d l*m+Z+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:e dde;fde;fg�Z<e d d e=fd e e< fd e e; fd e=fg�Z>e d!d"e;fd#e;fd$e;fg�Z?e d%d&e=fd'e e; fg�Z@G d(d)� d)ejA�ZBe d*d&eBfd e e e< fg�ZCG d+d,� d,ejD�ZEG d-d.� d.�ZFG d/d0� d0�ZGG d1d2� d2�ZHd3e e;e e;e;f f fd4d5�ZId6e eH d7e e;e=f d3e e;e e;e e;e;f f f fd8d9�ZJd:d;� ZKd<e;d3ee eB e e; f fd=d>�ZLd?eGd6e eH d<e;d@e e;e e;e;f f dAe$d7e e;e=f dBe=d3eBfdCdD�ZMdEeHdFe eH d<e;d@e e;e e;e;f f dAe$d7e e;e=f dBe=dGe=d3eBfdHdI�ZN J Jd�dAe$d<e;dBe=dGe=d3eBf dKdL�ZOdMdN� ZPdOdP� ZQdEeHd@e e;e e;e;f f d3e e;eFf fdQdR�ZRd?eGd@e e;e e;e;f f d3e e;eFf fdSdT�ZSd<e;dUe e;eFf fdVdW�ZTdXeFdYe e;e e;e;f f d3eFfdZd[�ZUd\d]� ZVd^e ee;eFf d_eWd`eWd3e;fdadb�ZXdce;dAe$fddde�ZYdce;dAe$d3e=fdfdg�ZZ hd�d&eBd<e;die;fdjdk�Z[dAe$dle e;e ee;eFf f dme e;e e? f d_eWd`eWdBe=d3e>fdndo�Z\d e e< d3e;fdpdq�Z]dAe$d<e;dUe e;eFf d@e e;e e;e;f f dre e;e e;e e;e;f f f dBe=d3eCfdsdt�Z^d�dudv�Z_dAe$dwe;d3e=fdxdy�Z`dAe$fdzd{�ZadAe$d3e=fd|d}�ZbdAe$d~e;d3e=fdd��ZcdAe$dBe=d3e=fd�d��Zddce;dAe$dBe=d3e=fd�d��ZedAe$d3e=fd�d��Zfd�e e;ef dAe$dBe=d3e=fd�d��ZgdAe$d�e e; dce;dBe=d3e@f d�d��ZhdS )�� N)� defaultdict)�datetime)�Any�Dict�List� NamedTuple�Optional�Set�Tuple)�apt� exceptions� livepatch�messages� serviceclient�system�util)� _initiate)�MagicAttachRevokeOptions�_revoke)�MagicAttachWaitOptions�_wait)�CLOUD_TYPE_TO_TITLE� PRO_CLOUDS�get_cloud_type)�UAConfig)� BASE_UA_URL�PRINT_WRAP_WIDTH)�entitlement_factory)�ApplicabilityStatus�UserFacingStatus)�notices)�Notice)�colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z cves.jsonzcves/{cve}.jsonz notices.jsonznotices/{notice}.jsonzUbuntu standard updateszUbuntu Pro: ESM InfrazUbuntu Pro: ESM Apps�UnfixedPackage�pkg�unfixed_reason� ReleasedPackagesInstallResult� fix_status� unfixed_pkgs�installed_pkgs�all_already_installed�BinaryPackageFix� source_pkg� binary_pkg� fixed_version� UpgradeResult�status�failure_reasonc @ sJ e Zd ZdZG dd� d�Zed�Zed�Zed�Zed�Ze dd� �Z d S ) � FixStatuszD An enum to represent the system status after fix operation c @ s e Zd Zdd� ZdS )zFixStatus._Valuec C � || _ d S �N��value)�selfr6 � r8 �3/usr/lib/python3/dist-packages/uaclient/security.py�__init__f � zFixStatus._Value.__init__N)�__name__� __module__� __qualname__r: r8 r8 r8 r9 �_Valuee s r? r � � c C s | j j S r4 r5 �r7 r8 r8 r9 � exit_coden s zFixStatus.exit_codeN) r< r= r> �__doc__r? �SYSTEM_NON_VULNERABLE�SYSTEM_NOT_AFFECTED�SYSTEM_STILL_VULNERABLE� SYSTEM_VULNERABLE_UNTIL_REBOOT�propertyrC r8 r8 r8 r9 r2 ` s r2 � FixResultc s6 e Zd ZdZdZejZdee e f dee e f fdd�Z e j ejg d�d� d#� fd d � �Z d$d ee d ee dee dee dee dee dee deee ded fdd�Zde ddfdd�Z d%dee dee dee dee d ee ded f d d �Zd e dd fd!d"�Z� ZS )&�UASecurityClient� � security_url� query_params�returnc C s. | j j �di ��di �}|r|�|� |S |S )zD Update query params with data from feature config. �features�extra_security_params)�cfg�get�update)r7 rN rQ r8 r8 r9 �_get_query_params� s � z"UASecurityClient._get_query_params)r@ � � )� retry_sleepsNc s" | � |�}t� j|||||dd�S )NF)�path�data�headers�methodrN �log_response_body)rU �super� request_url)r7 rY rZ r[ r\ rN �� __class__r8 r9 r_ � s �z UASecurityClient.request_url�query�priority�package�limit�offset� component�versionr0 �CVEc s: ||||||||d�} � j t| d�\} } � fdd�| D �S )znQuery to match multiple-CVEs. @return: List of CVE instances based on the the JSON response. )�qrc rd re rf rg rh r0 �rN c s g | ]}t � |d ��qS )��client�response)ri )�.0�cve_mdrB r8 r9 � <listcomp>� s z-UASecurityClient.get_cves.<locals>.<listcomp>)r_ � API_V1_CVES) r7 rb rc rd re rf rg rh r0 rN � cves_response�_headersr8 rB r9 �get_cves� s � �zUASecurityClient.get_cves�cve_idc C �" | � tj|d��\}}t| |d�S )zkQuery to match single-CVE. @return: CVE instance for JSON response from the Security API. )�cverl )r_ �API_V1_CVE_TMPL�formatri )r7 rv � cve_responsert r8 r8 r9 �get_cve� � � zUASecurityClient.get_cve�details�release�order�USNc sJ � ||||d�}�j t|d�\}}t� �fdd�|�dg �D �dd� d�S ) zuQuery to match multiple-USNs. @return: Sorted list of USN instances based on the the JSON response. )r~ r re rf r� rk c s0 g | ]}� d u s� |� dg �v rt�|d��qS )N�cves_idsrl )rS r� )ro �usn_md�r~ r7 r8 r9 rq � s �z0UASecurityClient.get_notices.<locals>.<listcomp>r c S � | j S r4 ��id��xr8 r8 r9 �<lambda>� � z.UASecurityClient.get_notices.<locals>.<lambda>��key)r_ �API_V1_NOTICES�sortedrS ) r7 r~ r re rf r� rN � usns_responsert r8 r� r9 � get_notices� s � � ��z UASecurityClient.get_notices� notice_idc C rw )zbQuery to match single-USN. @return: USN instance representing the JSON response. )�noticerl )r_ �API_V1_NOTICE_TMPLrz r� )r7 r� �notice_responsert r8 r8 r9 � get_notice� r} zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r< r= r> � url_timeout�cfg_url_base_attrr �SecurityAPIError� api_error_clsr �strr rU r �retry�socket�timeoutr_ r �intr ru r| r� r� � __classcell__r8 r8 r` r9 rK | sv � ���������� � � ������ � rK c @ s� e Zd ZdZdeeef fdd�Zedd� �Z edd� �Z ed d � �Z ed d � �Z ed d� �Z edd� �Zedefdd��Zedd� �ZdS )�CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu seriesr{ c C r3 r4 �rn )r7 r{ r8 r8 r9 r: � r; zCVEPackageStatus.__init__c C � | j d S �N� descriptionr� rB r8 r8 r9 r� � � z CVEPackageStatus.descriptionc C r� r4 )r� rB r8 r8 r9 r. � s z CVEPackageStatus.fixed_versionc C r� )N�pocketr� rB r8 r8 r9 r� r� zCVEPackageStatus.pocketc C r� )N�release_codenamer� rB r8 r8 r9 r� r� z!CVEPackageStatus.release_codenamec C r� )Nr0 r� rB r8 r8 r9 r0 r� zCVEPackageStatus.statusc C s� | j dkrtjS | j dkrtjS | j dkrtjS | j dv r tjS | j dkr(tjS | j dkr0tjS | j dkr=tjj | j d�S tj j | j d �S ) N�neededz needs-triage�pending)�ignored�deferred�DNE� not-affected�released)� fix_stream)r0 ) r0 r �SECURITY_CVE_STATUS_NEEDED�SECURITY_CVE_STATUS_TRIAGE�SECURITY_CVE_STATUS_PENDING�SECURITY_CVE_STATUS_IGNORED�SECURITY_CVE_STATUS_DNE� SECURITY_CVE_STATUS_NOT_AFFECTED�SECURITY_FIX_RELEASE_STREAMrz � pocket_source�SECURITY_CVE_STATUS_UNKNOWNrB r8 r8 r9 �status_message s" �z CVEPackageStatus.status_messagerO c C s t | jtk�S )z?Return True if the package requires an active Pro subscription.)�boolr� � UBUNTU_STANDARD_UPDATES_POCKETrB r8 r8 r9 � requires_ua! � z CVEPackageStatus.requires_uac C sP | j dkr t}|S | j dkrt}|S | j dv rt}|S d| jv r$t}|S t}|S )z>Human-readable string representing where the fix is published.� esm-infra�esm-apps)�updates�security�esm)r� �UA_INFRA_POCKET�UA_APPS_POCKETr� r. )r7 � fix_sourcer8 r8 r9 r� & s � � ��z CVEPackageStatus.pocket_sourceN)r< r= r> rD r r� r r: rI r� r. r� r� r0 r� r� r� r� r8 r8 r8 r9 r� � s& r� c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z e d d � �Z d d � Z e dee fd d��Ze ded fdd��Ze dd� �Ze deeef fdd��ZdS )ri z7Class representing CVE response from the SecurityClientrm rn c C � || _ || _d S r4 �rn rm �r7 rm rn r8 r8 r9 r: ; � z CVE.__init__rO c C � t |t�sdS | j|jkS �NF)� isinstanceri rn �r7 �otherr8 r8 r9 �__eq__? � z CVE.__eq__c C � | j �dd��� S )Nr� �UNKNOWN_CVE_ID�rn rS �upperrB r8 r8 r9 r� D � zCVE.idc C s> | j }| jD ]}|j} dj| j|d�d�| j�g}d�|�S )z2Return a string representing the URL for this cve.�{issue}: {title}��issue�title�! - https://ubuntu.com/security/{}� )r� r r� rz r� �join)r7 r� r� �linesr8 r8 r9 �get_url_headerH s � zCVE.get_url_headerc C � | j �dg �S )N� notices_ids�rn rS rB r8 r8 r9 r� U s zCVE.notices_idsr� c �< t � d�st� fdd�� j�dg �D �dd� dd�� _� jS ) z�Return a list of USN instances from API response 'notices'. Cache the value to avoid extra work on multiple calls. �_noticesc � g | ]}t � j|��qS r8 )r� rm )ro r� rB r8 r9 rq a � ��z CVE.notices.<locals>.<listcomp>r c S r� r4 r� ��nr8 r8 r9 r� e r� z CVE.notices.<locals>.<lambda>T�r� �reverse)�hasattrr� rn rS r� rB r8 rB r9 r Y � ��z CVE.noticesc C � | j �d�S r� r� rB r8 r8 r9 r� j � zCVE.descriptionc C sb t | d�r| jS i | _t�� j}| jd D ]}|d D ]}|d |kr,t|�| j|d < qq| jS )z�Dict of package status dicts for the current Ubuntu series. Top-level keys are source packages names and each value is a CVEPackageStatus object �_packages_status�packages�statusesr� �name)r� r� r �get_release_info�seriesrn r� )r7 r� rd � pkg_statusr8 r8 r9 �packages_statusn s ���zCVE.packages_statusN)r< r= r> rD rK r r� r r: r� r� rI r� r� r r� r r� r� r� r8 r8 r8 r9 ri 8 s ri c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z e defd d ��Z e de e fd d ��Ze de e fd d��Ze dd� �Ze dd� �Zdd� Ze deeeeeeef f f fdd��ZdS )r� z7Class representing USN response from the SecurityClientrm rn c C r� r4 r� r� r8 r8 r9 r: � r� z USN.__init__rO c C r� r� )r� r� rn r� r8 r8 r9 r� � r� z USN.__eq__c C r� )Nr� �UNKNOWN_USN_IDr� rB r8 r8 r9 r� � r� zUSN.idc C r� )z$List of CVE IDs related to this USN.r� r� rB r8 r8 r9 r� � r� z USN.cves_idsc r� ) z�List of CVE instances based on API response 'cves' key. Cache the values to avoid extra work for multiple call-sites. �_cvesc r� r8 )ri rm )ro rx rB r8 r9 rq � r� z USN.cves.<locals>.<listcomp>�cvesc S r� r4 r� r� r8 r8 r9 r� � r� zUSN.cves.<locals>.<lambda>Tr� )r� r� rn rS r� rB r8 rB r9 r� � r� zUSN.cvesc C r� )Nr� r� rB r8 r8 r9 r� � r� z USN.titlec C r� )N� referencesr� rB r8 r8 r9 r� � r� zUSN.referencesc C sv dj | j| jd�g}| jr!|�d� | jD ] }|�d� |�� qn| jr6|�d� | jD ] }|�d| � q,d�|�S )z5Return a string representing the URL for this notice.r� r� z Found CVEs:r� zFound Launchpad bugs:z - r� )rz r� r� r� �appendr� r� )r7 r� rx � referencer8 r8 r9 r� � s � zUSN.get_url_headerc C sH t | d�r| jS t�� j}i | _| j�di ��|g �D ]�}|�d�rV|d | jv rLd| j|d v rBtjdj | j |d d�| j d��|| j|d d< qd|i| j|d < q|�d �sktjd j | j |d d �| j d��d |d vr�tjd j | j |d |d d�| j d��|d � d �d }|| jvr�i | j|< || j| |d < q| jS )aW Binary package information available for this release. Reformat the USN.release_packages response to key it based on source package name and related binary package names. :return: Dict keyed by source package name. The second-level key will be binary package names generated from that source package and the values will be the dict response from USN.release_packages for that binary package. The binary metadata contains the following keys: name, version. Optional additional keys: pocket and component. �_release_packages�release_packages� is_sourcer� �sourcez6{usn} metadata defines duplicate source packages {pkg})�usnr$ ��issue_id� source_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r� �bin_pkg�/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r� r �link���) r� r� r r� r� rn rS r �SecurityAPIMetadataErrorrz r� �split)r7 r� r$ �source_pkg_namer8 r8 r9 r� � sN �� �� �� zUSN.release_packagesN)r< r= r> rD rK r r� r r: r� r� rI r� r r� ri r� r� r� r� r� r8 r8 r8 r9 r� � s" ,r� rO c C s| d} t �dd| d dg�\}}i }|�� D ]%}|�d�\}}}}|s%|}d|vr*q||v r5||| |< q||i||< q|S )z�Return a dict of all source packages installed on the system. The dict keys will be source package name: "krb5". The value will be a dict with keys binary_pkg and version. z${db:Status-Status}z dpkg-queryz#-f=${Package},${Source},${Version},r� z-W�,� installed)r �subp� splitlinesr ) � status_field�out�_err�installed_packages�pkg_line�pkg_namer � pkg_versionr0 r8 r8 r9 �#query_installed_source_pkg_versions� s$ �� r �usns� beta_pocketsc s� i }| D ]Q}|j �� D ]I\}}� fdd�|�� D �}||vr%|r%|||< q ||v rT|| }|�� D ]"\}} ||vr>| ||< q1|| d } | d } t�| | d�sS| ||< q1q q|S )a Walk related USNs, merging the released binary package versions. For each USN, iterate over release_packages to collect released binary package names and required fix version. If multiple related USNs require different version fixes to the same binary package, track the maximum version required across all USNs. :param usns: List of USN response instances from which to calculate merge. :param beta_pockets: Dict keyed on service name: esm-infra, esm-apps the values of which will be true of USN response instances from which to calculate merge. :return: Dict keyed by source package name. Under each source package will be a dict with binary package name as keys and binary package metadata as the value. c s. i | ]\}}d � � |� dd�d �u r||�qS )Fr� �None�rS )ro � bin_pkg_name� bin_pkg_md�r r8 r9 � <dictcomp>2 s ��z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rh �le)r� �itemsr �compare_versions) r r �usn_pkg_versionsr �src_pkg�binary_pkg_versions�public_bin_pkg_versions� usn_src_pkgr � binary_pkg_md� prev_version�current_versionr8 r r9 �*merge_usn_released_binary_package_versions s, � ���r+ c C sb | j sg S i }| j D ]}|jD ]}|| jkrq||vr#|j|d�||< qq tt|�� dd� d��S )z�For a give usn, get the related USNs for it. For each CVE associated with the given USN, we capture other USNs that are related to the CVE. We consider those USNs related to the original USN. �r� c S r� r4 r� r� r8 r8 r9 r� c r� z"get_related_usns.<locals>.<lambda>r� )r� r� r� r� �listr� �values)r rm � related_usnsrx �related_usn_idr8 r8 r9 �get_related_usnsL s ���r1 r c C sf t �� }|d ur1|j d ur1|j jd ur1|j jD ]}|j| �� kr0|jr0|j jp(d}tj|f S qdS )NzN/A)NN) r r0 �fixesr� �lower�patchedrh r2 rE )r � lp_status�fixrh r8 r8 r9 � _check_cve_fixed_by_livepatchf s �r7 rx r rR �dry_runc C s2 t | |d�}t||�}t� t||||||d�jS )N)rx r �rR r �affected_pkg_statusr �usn_released_pkgsr8 )�'get_cve_affected_source_packages_statusr+ �print� prompt_for_affected_packagesr0 ) rx r r r rR r r8 r: r; r8 r8 r9 �_fix_cvex s" ����r? r r/ � no_relatedc C s� t dtjj|d� � t| |d�}t| g|�} t||||| |d�\} } | tjtj fvr-| S |r1|r3| S t dtj jd� dd� |D ��d� � t dtj � i } |D ])} t d �| j �� t| |d�}t| g|�} t|| j ||| |d�}|| | j < t � qQt tj� t| |d d � d }|D ]C} | | j j}t|| j d d � |tjkr�t dtjjdd� � d}|tjkr�| | j jp�g }|D ]}|jr�t d�|j|j�� q�d}q�|r�t dtjj|d� � | S )Nr� r �r r r9 z - c s � � | ]}|j V qd S r4 r� )ro r r8 r8 r9 � <genexpr>� s � z_fix_usn.<locals>.<genexpr>)r/ z- {}z [requested])� extra_infoFz [related]�- � fix operation�� operationTz - {}: {})r= r � SECURITY_FIXING_REQUESTED_USNrz � get_affected_packages_from_usnr+ r> r2 rE rF �SECURITY_RELATED_USNSr� � SECURITY_FIXING_RELATED_USNSr� �SECURITY_USN_SUMMARY�_handle_fix_status_messager0 rH �ENABLE_REBOOT_REQUIRED_TMPLrG r( r% r$ �SECURITY_RELATED_USN_ERROR)r r/ r r rR r r8 r@ r: r; �target_fix_status�_�related_usn_status� related_usn�related_fix_status�failure_on_related_usnr0 r( � unfixed_pkgr8 r8 r9 �_fix_usn� s� ��� � ������� � � ��� ����� ��rX Fc C s� |rt tj� |�� }t| d�}t� }tt| �tt| �d�}d|v rxt |�\}}|r6t tj j ||d�� |S z|j |d�} |j |d�} W n" tjyf } zt| �} | jdkr]tjj |d�} t�| ��d } ~ ww t | �� � t| | ||| ||d �S z |j|d �} t| |�} W n" tjy� } zt| �} | jdkr�tjj |d�} t�| ��d } ~ ww t | �� � | jd s�tjd � |�|d��t| | ||| |||d �S )N�rR )r� r� ri )r� rh )rv )r~ i� r )rx r r r rR r r8 r, r� z.{} metadata defines no fixed package versions.)r r/ r r rR r r8 r@ )r= r �SECURITY_DRY_RUN_WARNINGr� rK r � _is_pocket_used_by_beta_servicer� r� r7 �CVE_FIXED_BY_LIVEPATCHrz r| r� r r� r� �code� SECURITY_FIX_NOT_FOUND_ISSUE�UserFacingErrorr� r? r� r1 rn r rX )rR r r8 r@ rm r r �livepatch_cve_status� patch_versionrx r �e�msgr r8 r8 r9 �fix_security_issue_id s� ���� � �� � � �� ���rd c C s^ i }| D ](}t ||��� D ] \}}||vr|||< q || j}t�||jd�s+|||< q q|S )Nr )r< r! r. r r" )r� r � affected_pkgsrx r r� � current_verr8 r8 r9 � get_affected_packages_from_cves\ s" � � ��� rg c C s� i }| j �� D ]7\}}||vrqtt�}d|d< dd� |�� D �}|s1d}tj|�| j�| jd��|�� |d< t |d�||< q|S ) Nr� r0 c S s" h | ] \}}|� d �r|d �qS )r� r )ro rR � pkg_bin_infor8 r8 r9 � <setcomp>y s ��z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r r� )r{ ) r� r! r r� r r rz r� �popr� )r r re r �pkg_infor{ � all_pocketsrc r8 r8 r9 rJ o s$ ��� rJ c C s | j r t| j |�S t| |�S )z�Walk CVEs related to a USN and return a dict of all affected packages. :return: Dict keyed on source package name, with active CVEPackageStatus for the current Ubuntu release. )r� rg rJ rA r8 r8 r9 � get_usn_affected_packages_status� s rm c C s8 i }| j �� D ]\}}|jdkrq||v r|||< q|S )z�Get a dict of any CVEPackageStatuses affecting this Ubuntu release. :return: Dict of active CVEPackageStatus keyed by source package names. r� )r� r! r0 )rx r �affected_pkg_versionsr, �package_statusr8 r8 r9 r< � s �r< r: c C s� t |�}|dkr"ttjjddd�d � tdtjj| dd� � d S |d kr)d }nd}tjj||d�d d �t|�� �� }tt j |t ddd�� d S )a Print header strings describing affected packages related to a CVE/USN. :param issue_id: String of USN or CVE issue id. :param affected_pkg_status: Dict keyed on source package name, with active CVEPackageStatus for the current Ubuntu release. r �Nozs are)�count� plural_str�.r� � �r� rD Nr@ z isz: �, � F)�width�subsequent_indent�replace_whitespace) �lenr= r �SECURITY_AFFECTED_PKGSrz �SECURITY_ISSUE_UNAFFECTEDr� r� �keys�textwrap�fillr )r r: rq rr rc r8 r8 r9 � print_affected_packages_header� sH ������������r� r� �usn_src_released_pkgsc C sh t �| �}|r2|�d�r2d|jd< |d d |jd< |�� D ]\}}|�d�}|r1||jd< |S q |S )a� Parse release status based on both pkg_status and USN.release_packages. Since some source packages in universe are not represented in CVEPackageStatus, rely on presence of such source packages in usn_src_released_pkgs to represent package as a "released" status. :param pkg_status: the CVEPackageStatus for this source package. :param usn_src_released_pkgs: The USN.release_packages representing only this source package. Normally, release_packages would have data on multiple source packages. :return: Tuple of: human-readable status message, boolean whether released, boolean whether the fix requires access to UA r r� r0 rh r� r� )�copy�deepcopyrS rn r! )r� r� �usn_pkg_statusr �usn_released_pkgr� r8 r8 r9 �#override_usn_release_package_status� s � � �r� c C sd i }t | �� �D ]'\}}|�|i �}t||�}|j�dd�}||vr&g ||< || �||f� q|S )Nr� r� )r� r! rS r� r0 �replacer� )r: r; � status_groupsr$ r� �usn_released_srcr� � status_groupr8 r8 r9 �group_by_usn_package_status� s �r� �pkg_status_list� pkg_index�num_pkgsc C s� | sdS g }g }| D ]\}}|d7 }|� d�||�� |� |� q tjd�dd�|� d d�t|���tdd �}d �||j�S ) z;Format the packages and status to an user friendly message.rt r@ z{}/{}z{} {}:�(rv �)rw �rx ry z{} {})r� rz r r� r� r� r r� )r� r� r� � msg_index�src_pkgsr$ r� � msg_headerr8 r8 r9 �_format_packages_message s ��r� r� c C s: d}| t kr d}n| tkrd}t||d�}|r||�S d S )Nzno-service-neededr� r� )rR r� )r� r� r )r� rR �service_to_check�ent_clsr8 r8 r9 �_get_service_for_pocket$ s r� c C s4 t | |�}|r|�� \}}|tjkrdS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)r� �user_facing_statusr �ACTIVE� valid_service)r� rR �ent� ent_statusrR r8 r8 r9 r[ / s r[ rt rD c C s� | t jkrtt�tjj||d��� d S | t jkr(tt�tj j||d��� d S | t j kr<tt�tj j||d��� d S tt�tj j||d��� d S )Nru ) r2 rE r= r �handle_unicode_charactersr �SECURITY_ISSUE_RESOLVEDrz rF r} rH �SECURITY_ISSUE_NOT_RESOLVED)r0 r rD r8 r8 r9 rN ? s> ��� ��� ������rN �src_pocket_pkgs�binary_pocket_pkgsc sj d}d}g }t � } |r�tttfD ]�} || } || } tjj| d�� |r�t| ||d�} | r:t| � | s8ttj � qd}g }t | �D ]:}| tk}t j |j |d�}|r_t �|j|d�r_|�|j � q@tjj|j |jd�j}td| � |�t|j|d �� q@|t| �7 }t| || |d �}||jM }|jp�d � |s�|�� fd d �| D �� q| �dd� | D �� qt||| |d�S )a% Handle the packages that could be fixed and have a released status. :returns: Tuple of boolean whether all packages were successfully upgraded, list of strings containing the packages that were not upgraded, boolean whether all packages were already installed T��service�r� r� r� F)�check_esm_cacher )rd rh rE �r$ r% )rR � upgrade_pkgsr� r8 rt c � g | ] \}}t |� d ��qS �r� �r# �ro r$ rR �� failure_msgr8 r9 rq � s ���z2_handle_released_package_fixes.<locals>.<listcomp>c s rB r4 )r- )ro r- r8 r8 r9 rC � s � �z1_handle_released_package_fixes.<locals>.<genexpr>)r' r( r) r* ) �setr� r� r� r � SECURITY_UA_SERVICE_REQUIREDrz r� r= �SECURITY_UPDATE_INSTALLEDr� r �get_pkg_candidate_versionr- r" r. r� �FIX_CANNOT_INSTALL_PACKAGErc r# r, r{ �upgrade_packages_and_attachr0 r1 �extendrT r& )rR r� r� r� r� r8 r* �upgrade_statusr( r) r� � pkg_src_group� binary_pkgsrc r� r- r� �candidate_versionr% �upgrade_resultr8 r� r9 � _handle_released_package_fixesd s� ��� ���� �� � �� ��r� c C sZ t dd� | D ��}t|�}tjtjj||dkrdnd|dkr dndd�|�d �jt d d �S ) z�Format the list of unfixed packages into an message. :returns: A string containing the message output for the unfixed packages. c S s h | ]}|j �qS r8 )r$ )ro r$ r8 r8 r9 ri � s z/_format_unfixed_packages_msg.<locals>.<setcomp>r@ �srt �are�isrv )r� r� �verb�pkgsrw r� ) r� r{ r r� r �SECURITY_PKG_STILL_AFFECTEDrz r� rc r )r( � sorted_pkgs�num_pkgs_unfixedr8 r8 r9 � _format_unfixed_packages_msg� s ��r� r; c s t |�}t||� |dkrttjdd�S tt�}tt�}d} t||�} g } t| � � �D ]r\} } | dkrXtj }t t | | |d�� | t | �7 } | d d j � | � fdd�| D �7 } q+| D ]B\}}||j �||f� || � � D ]-\}}|�|i �}||vr}qn|�|i ��d d �}t�||d �s�||j �t|||d �� qnqZq+t| ||| ||d �}| |j7 } t � | r�t t| �� |jr�|jr�| r�tjntj }n/tj|j d�r�t j j dd�}t |� t j!t"j#dd� | r�tjntj$}n | r�tjntj }ntj}t%||� t|| d�S )a Process security CVE dict returning a CVEStatus object. Since CVEs point to a USN if active, get_notice may be called to fill in CVE title details. :returns: An FixStatus enum value corresponding to the system state after processing the affected packages r N)r0 r( r� r� r@ c r� r� r� r� �� status_msgr8 r9 rq s ��z0prompt_for_affected_packages.<locals>.<listcomp>rh rt r )r, r- r. )rR r� r� r� r� r8 )r) rF rG )&r{ r� rJ r2 rF r r- r� r� r! rE r= r� r� r� r� rS r r" r+ r� r( r� r' r* rG r � should_rebootr) r rO rz r �addr! �ENABLE_REBOOT_REQUIREDrH rN )rR r r: r r; r8 rq r� r� r� �pkg_status_groupsr( � status_value�pkg_status_group� fix_resultr$ r� r- rh r� r. � released_pkgs_install_result� reboot_msgr8 r� r9 r> � s� ���� � � � ������ ������� �� �r> c C s4 t � \} }| tv rttjjt�| �| d�� dS dS )z:Alert the user when running Pro on cloud with PRO support.)r� �cloudN)r r r= r �SECURITY_USE_PRO_TMPLrz r rS )� cloud_typerR r8 r8 r9 �*_inform_ubuntu_pro_existence_if_applicablei s ���r� �tokenc C s� ddl }ddlm} ttdd|gg�� z|�|j|dddd�| �}|dkW S tjy? } z t|j � W Y d}~d S d}~ww ) ztAttach to an Ubuntu Pro subscription with a given token. :return: True if attach performed without errors. r N��cli�pro�attachTr� )r� � auto_enablerz � attach_configF) �argparse�uaclientr� r= r" � action_attach� Namespacer r_ rc )rR r� r� r� �ret_code�errr8 r8 r9 �_run_ua_attacht s �� ��r� c C s� t tj� t| d�}t dtjj|jd� � t|jd�}zt || d�}W n t j yD } zt tj � t |jd�}t|| d� |�d }~ww t dtj � t| |j�S )NrY r� )� user_code)� magic_token)�optionsrR )r= r �CLI_MAGIC_ATTACH_INITr �CLI_MAGIC_ATTACH_SIGN_INrz r� r r� r r �MagicAttachTokenError�CLI_MAGIC_ATTACH_FAILEDr r �CLI_MAGIC_ATTACH_PROCESSINGr� �contract_token)rR � initiate_resp� wait_options� wait_resprb �revoke_optionsr8 r8 r9 �_perform_magic_attach� s. ��� � �� r� c C sh t � ttj� tjtjg d�d�}|dkrdS |dkr t| �S |dkr2ttj� t d�}t | |�S dS ) zZPrompt for attach to a subscription or token. :return: True if attach performed. )r� �a�c�� valid_choicesr� Fr� r� �> T) r� r= r �*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr �prompt_choices�SECURITY_FIX_ATTACH_PROMPTr� �PROMPT_ENTER_TOKEN�inputr� )rR �choicer� r8 r8 r9 �_prompt_for_attach� s � r� r� c C s� ddl }ddlm} ttjj|d�� tjd�|�ddgd�}|dkr@tt d d |gg�� t d|� |j |gd d d d d�| �k�S d S )zMPrompt for enable a pro service. :return: True if enable performed. r Nr� r� z Choose: [E]nable {} [C]ancelrb r� r� r� �enableTFr� )r� � assume_yes�betarz � access_only) r� r� r� r= r �SECURITY_SERVICE_DISABLEDrz r r� r" r� � action_enabler� )rR r� r� r� r� r8 r8 r9 �_prompt_for_enable� s0 �����r c C s |r t dtj � dS t| �S )z<Verify if machine is attached to an Ubuntu Pro subscription.r� T)r= r � SECURITY_DRY_RUN_UA_NOT_ATTACHEDr� )rR r8 r8 r8 r9 �_check_attached� s r c C s� t | |�}|rM|�� \}}|tjkrdS |�� \}}|tjkrC|r/tdtj j |j d� � dS t ||j �r7dS ttj j |j d�� dS ttjj |j d�� dS )zQ Verify if the Ubuntu Pro subscription has the required service enabled. Tr� r� F)r� r� r r� �applicability_statusr � APPLICABLEr= r �'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDrz r� r � SECURITY_UA_SERVICE_NOT_ENABLED� SECURITY_UA_SERVICE_NOT_ENTITLED)r� rR r8 r� r� rR r r8 r8 r9 �(_check_subscription_for_required_service� s< ��� �� ���r c C s� ddl }ddlm} t� ttj� tjd� t �ddgd�}|dkrDttj � t d�}tt d d gg�� |�|jd d d �| � t| |�S dS )zdPrompt for attach a new subscription token to the user. :return: True if attach performed. r Nr� z2Choose: [R]enew your subscription (at {}) [C]ancel�rr� r� r� r� �detachTr� )r� rz F)r� r� r� r� r= r �%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr r� rz r �PROMPT_EXPIRED_ENTER_TOKENr� r" � action_detachr� r� )rR r� r� r� r� r8 r8 r9 �_prompt_for_new_token s& �� � r � status_cachec C sV | � dd�}|s dS | � d�}|du s|t�|j�k r)|r$ttj� dS t|� S dS )zuCheck if the Ubuntu Pro subscription is expired. :returns: True if subscription is expired and not renewed. �attachedF�expiresN)rS r �now�tzinfor= r �(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONr )r rR r8 r �contract_expiry_datetimer8 r8 r9 � _check_subscription_is_expired/ s � r r� c C sh |st ddd�S t�� s|stj}t|� t d|d�S |tkr`| �d�p%i }|�dd�s=t | |�s<t dtj j |d�d�S nt || |d�rOt dtj j |d�d�S t|| |�s`t dtjj |d�d�S ttg d �g d � t|� g�� |s�zt�� tjg d �| d d id� W n' ty� } zt|dt|��}t|�� � t dtjd�W Y d}~S d}~ww t ddd�S )a Upgrade available packages to fix a CVE. Upgrade all packages in upgrades_packages and, if necessary, prompt regarding system attach prior to upgrading Ubuntu Pro packages. :return: True if package upgrade completed or unneeded, False otherwise. TN)r0 r1 Fz status-cacher r� )r rR r8 )r rT z&&)r �install�--only-upgrade�-y)zapt-getr r r �DEBIAN_FRONTEND�noninteractive)�cmd�override_env_varsrc )r/ r �we_are_currently_rootr �SECURITY_APT_NON_ROOTr= r� � read_cacherS r r� rz r �$SECURITY_UA_SERVICE_WITH_EXPIRED_SUBr �%SECURITY_UA_SERVICE_NOT_ENABLED_SHORTr" r� r �run_apt_update_command�run_apt_command� Exception�getattrr� �strip�SECURITY_UA_APT_FAILURE)rR r� r� r8 rc r rb r8 r8 r9 r� I sz ������ ������� � � ��� r� )FF)rt )rO N)ir� �enumr� r � collectionsr r �typingr r r r r r r r� r r r r r r r �+uaclient.api.u.pro.attach.magic.initiate.v1r �)uaclient.api.u.pro.attach.magic.revoke.v1r r �'uaclient.api.u.pro.attach.magic.wait.v1r r �uaclient.clouds.identityr r r �uaclient.configr �uaclient.defaultsr r �uaclient.entitlementsr �(uaclient.entitlements.entitlement_statusr r �uaclient.filesr �uaclient.files.noticesr! �uaclient.statusr" �CVE_OR_USN_REGEXrr ry r� r� r� r� r� r� r# r� r& r+ r/ �Enumr2 rJ �UAServiceClientrK r� ri r� r r+ r1 r7 r? rX rd rg rJ rm r< r� r� r� r� r� r� r[ rN r� r� r> r� r� r� r� r r r r r r� r8 r8 r8 r9 �<module> s� $$ ��� �� �� �� �� wEJ | � � �1� ������ �� ������ ��� �r����� �Z �� ��� �� �.�� �#��� � ��� �%������ �l�� ���� � "��� �+ ��� ������
| ver. 1.4 |
Github
|
.
| PHP 8.2.9 | Generation time: 0.02 |
proxy
|
phpinfo
|
Settings