Server : Apache/2.4.52 (Ubuntu) System : Linux webserver 6.8.0-49-generic #49~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Nov 6 17:42:15 UTC 2 x86_64 User : www-data ( 33) PHP Version : 8.1.2-1ubuntu2.21 Disable Function : NONE Directory : /lib/python3/dist-packages/uaclient/entitlements/__pycache__/ |
o
���f�a � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m
Z
d dl m Z m
Z
mZmZmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d l m Z d d
l m Z d d l m!Z!m"Z" d d l#m$Z$m%Z%m&Z& e�'� Z(e �)e�*e+��Z,g d
�Z-ddgZ.e-e. e-e. e-d�Z/g d�Z0g d�Z1g d�Z2e-e. e0 e-e. e1 e-e2 d�Z3G dd� dej4�Z5G dd� de5�Z6G dd� de5�Z7G dd� de6�Z8dS )� N)�groupby)�Callable�List�Optional�Tuple�Union)�api�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�EntitlementWithMessage)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)�
strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal)�openssl� libssl1.0.0�libssl1.0.0-hmac)r% � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s� e Zd ZdZdZdZdZejj Z
g d�Z e dd� �Z
ded efd
d �Zd ejfd
d�Zd efdd�Zd ejfdd�Z d4d ejdeee ded df� fdd�
Zd efdd�Z d5ded ed dfd d �Zd ed ed ef� fd!d"� Ze d e e d#f fd$d%��Z e d ee f� fd&d'� �Z d e e eej! f f� fd(d)� Z"d6d*d+�Z#d ejd ef� fd,d-� Z$d ejd ef� fd.d/� Z%d0d1� Z&d ejd df� fd2d3� Z'� Z(S )7�FIPSCommonEntitlementi� zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledT) zfips-initramfszfips-initramfs-genericr* r+ �libgmp10� libgnutls30� libhogweed6�
libnettle8r& r' r& r' r( r) �libssl3�
linux-fipsr r r r! r% zopenssl-fips-module-3r r r z ubuntu-fipszubuntu-aws-fipszubuntu-azure-fips�ubuntu-gcp-fipsc C s* t �� j}t �� rt�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
)r
�get_release_info�series� is_container�#FIPS_CONTAINER_CONDITIONAL_PACKAGES�get�FIPS_CONDITIONAL_PACKAGES)�selfr5 � r; �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.py�conditional_packages� s
z*FIPSCommonEntitlement.conditional_packages�
assume_yes�returnc C s� t �� j}|du rt�d� dS t�d|�}t�d�}|durL|durL|� d�}t�
d||� t� ||�dk rJt �
tjj||d �� tjtj|d
�S d S t�d ||� d S )
ztCheck if installing a FIPS kernel will downgrade the kernel
and prompt for confirmation if it will.
Nz Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r2 �kernel_versionz*Kernel information: cur='%s' and fips='%s'r )�current_version� new_version)�msgr> z2Cannot gather kernel information for '%s' and '%s'T)r
�get_kernel_info� proc_version_signature_version�LOG�warning�re�searchr �get_pkg_candidate_version�group�debug�version_compare�event�infor �KERNEL_DOWNGRADE_WARNING�formatr �prompt_for_confirmation�
PROMPT_YES_NO)r: r> �our_full_kernel_str�our_m�fips_kernel_version_str�our_kernel_version_strr; r; r< �prompt_if_kernel_downgrade� sJ �
�
������ ��z0FIPSCommonEntitlement.prompt_if_kernel_downgrade�progressc C s� g }t �� }tt| j�dd� d�}|D ] \}}||v r ||7 }q|D ](}zt j|gddig d�d� W q" tjyJ |�dt j
j | j |d �� Y q"w d S )
Nc S s | � dd�S )Nz-hmac� )�replace)�pkg_namer; r; r< �<lambda>� � zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>)�key�DEBIAN_FRONTEND�noninteractive�z--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"��packages�override_env_vars� apt_optionsrO )�service�pkg)
r � get_installed_packages_namesr �sortedr= �run_apt_install_commandr �UbuntuProError�emitr �FIPS_PACKAGE_NOT_AVAILABLErQ �title)r: rY �desired_packages�installed_packages�
pkg_groupsr\ �pkg_listrh r; r; r< �&hardcoded_install_conditional_packages� s4 � �
� ����z<FIPSCommonEntitlement.hardcoded_install_conditional_packagesc C s* t j| jjdd�}t�� jdv }|p| S )Nz features.fips_auto_upgrade_all��config�
path_to_value> r$ r# r" )r �is_config_value_true�cfgr
r4 r5 )r: � install_all_updates_override�hardcoded_releaser; r; r< �auto_upgrade_all_on_enable� s
�
z0FIPSCommonEntitlement.auto_upgrade_all_on_enablec C s� dd� t �| j�D �}|�� t|�dkrJz"|�dtjjd� |�d�� | �
|� t j |ddig d �d
� W d S t j
yI |�dtj� Y d S w d S ) Nc S s g | ]}|j �qS r; )�name)�.0�packager; r; r< �
<listcomp>� s ��zMFIPSCommonEntitlement.install_all_available_fips_upgrades.<locals>.<listcomp>r rO � )rd r` ra rb rc )r �;get_installed_packages_with_uninstalled_candidate_in_origin�origin�sort�lenrm r �INSTALLING_PACKAGESrQ �join�unhold_packagesrk r rl � FIPS_PACKAGES_UPGRADE_FAILURE)r: rY �
to_upgrader; r; r< �#install_all_available_fips_upgrades� s0 �� ��
� ��z9FIPSCommonEntitlement.install_all_available_fips_upgradesN� package_list�cleanup_on_failurec sl | j }|rt� j||d� n |�tjj| jd�� | �� r#| � |� n| �
|� | � � r4t �
tj� dS dS )z�Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
)r� �ro N)rd �super�install_packagesrY r �INSTALLING_SERVICE_PACKAGESrQ ro r| r� rt �_check_for_rebootr �addr �FIPS_SYSTEM_REBOOT_REQUIRED)r: rY r� r� �mandatory_packages�� __class__r; r< r� s" ��
��z&FIPSCommonEntitlement.install_packagesc C s t �� S )z=Check if system needs to be rebooted because of this service.)r
�
should_reboot�r: r; r; r< r� 8 s z'FIPSCommonEntitlement._check_for_rebootF� operation�silentc C sN | � � }t�|� |r#|st�tjj|d�� |dkr%t�t j
� dS dS dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r� zdisable operationN) r� rN � needs_rebootrO r �ENABLE_REBOOT_REQUIRED_TMPLrQ r r� r � FIPS_DISABLE_REBOOT_REQUIRED)r: r� r� �reboot_requiredr; r; r< �_check_for_reboot_msg< s
����z+FIPSCommonEntitlement._check_for_reboot_msgr5 �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcpru T)r# r$ r3 )r rx ry �boolr� rd �r: r5 r� r� r; r< � _allow_fips_on_cloud_instanceR s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d u rd� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS )
Nzan AWSzan Azureza GCP)�aws�azurer� rZ )r5 �cloudc s �� �� �S �N)r� r; �r� r: r5 r; r< r] r^ z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r r
r4 r5 r �FIPS_BLOCK_ON_CLOUDrQ ro r8 )r: � cloud_titles�_�blocked_messager; r� r< �static_affordancesq s
���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS r� )r
r6 r� rd r� r� r; r< rd � s z FIPSCommonEntitlement.packagesc s� t � �� \}}t�� rt�� st�tj� ||fS t j
� | j �rSt�t
| j��s.t�tj� t�| j ��� dkrBt�tj� ||fS t�tj� tjtjj| j d�fS |tjkr\||fS tjtjfS )N�1)� file_name)r� �application_statusr
r6 r� r �remover r� �os�path�exists�FIPS_PROC_FILE�setrd � load_file�strip�FIPS_MANUAL_DISABLE_URLr� r �DISABLEDr �FIPS_PROC_FILE_ERRORrQ �ENABLED�FIPS_REBOOT_REQUIRED)r: � super_status� super_msgr� r; r< r� � s: ������
�z(FIPSCommonEntitlement.application_statusc C sT t t�� �}t | j��t | j��}|�|�}|r(t�t|�t j
j | j d�� dS dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r� N)
r� r ri rd �
differencer= � intersection�remove_packages�listr �DISABLE_FAILED_TMPLrQ ro )r: rq �fips_metapackager� r; r; r< r� � s
�
��z%FIPSCommonEntitlement.remove_packagesc s8 t � �|�rt�tj� t�tj� t�tj� dS dS �NTF)r� �_perform_enabler r� r � WRONG_FIPS_METAPACKAGE_ON_CLOUDr� r� �r: rY r� r; r< r� � s � z%FIPSCommonEntitlement._perform_enablec s( t � �|�r| �� rt�tj� dS dS r� )r� �_perform_disabler� r r� r r� r� r� r; r< r� � s �z&FIPSCommonEntitlement._perform_disablec C s| ddg}t �|tjjd�|�d��}g }|�� D ] }||v r#|�|� q|r<ddg| }t �|tjjd�|�d��}d S d S )Nzapt-mark� showholdsr� )�command�unhold)r �run_apt_commandr �EXECUTING_COMMAND_FAILEDrQ r� �
splitlines�append)r: �
package_names�cmd�holds�unholds�hold�
unhold_cmdr; r; r< r� � s& �
� ���z%FIPSCommonEntitlement.unhold_packagesc s | � | j� t� �|� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UbuntuProError: on failure to setup any aspect of this apt
configuration
N)r� �fips_pro_package_holdsr� �setup_apt_configr� r� r; r< r� � s z&FIPSCommonEntitlement.setup_apt_config�NT)F)r? N))�__name__�
__module__� __qualname__�repo_pin_priority�
repo_key_filer� �apt_noninteractiver �urls�FIPS_HOME_PAGE� help_doc_urlr� �propertyr= r� rX r �ProgressWrapperrt r| r� r r �strr� r� r� r� r r r� rd r � NamedMessager� r� r� r� r� r� �
__classcell__r; r; r� r< r, V sp
.
�#
�#��
���&���
���� �
*
r, c s� e Zd ZdZejZejZej Z
dZ ej Z
edeedf fdd��Zedeedf f� fdd� �Zedefd d
��Zd ejdef� fd d
� Z� ZS )�FIPSEntitlement�fips�
UbuntuFIPSr? .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
� uaclient.entitlements.livepatchr� � uaclient.entitlements.realtimer� r r �LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)r: r� r� r; r; r< �incompatible_services s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| jd�}tj}t|�� d |k��t� � }|r |j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )N)ry r F)r� � fips_updatesc � � S r� r; r; )�is_fips_updates_enabledr; r< r] ( � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r� r� r; r; )�fips_updates_once_enabledr; r< r] / r� )r� r� r� ry r r� r� r� r �readr� r �$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrQ ro �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r: r� r� �enabled_status�services_once_enabled_objr� )r� r� r< r� s2 ����
��
��z"FIPSEntitlement.static_affordancesc C s| d }t �� rtjj| jd�}| �� stjg}n| j}d }| j s-t
j dtj j| jd�ifg}t
j d|ifg| j
i fg||d�S �Nr� rC )�
pre_enable� pre_install� post_enable� pre_disable)r
r6 r � PROMPT_FIPS_CONTAINER_PRE_ENABLErQ ro r| �FIPS_RUN_APT_UPGRADE�pre_enable_msg�purger rR �PROMPT_FIPS_PRE_DISABLErX �r: r �pre_enable_promptr r; r; r< � messaging4 �< ������������zFIPSEntitlement.messagingrY c sR t � \}}|d u r|tjkrt�d� t�tj� t � �
|�r't � t
j� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r r �CLOUD_ID_ERRORrF rG rN rO r �.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr� r� r r� r �FIPS_INSTALL_OUT_OF_DATE)r: rY �
cloud_type�errorr� r; r< r� ` s
� �z FIPSEntitlement._perform_enable)r� r� r� r} r �
FIPS_TITLEro �FIPS_DESCRIPTION� description�FIPS_HELP_TEXT� help_textr� �PROMPT_FIPS_PRE_ENABLEr r� r r r� r r� r r r r� r� r� r� r; r; r� r< r� � s ! +r� c sn e Zd ZdZejZdZejZ ej
Z e de
edf fdd��Ze defdd��Zd ejdef� fd
d � Z� ZS ) r� z fips-updates�UbuntuFIPSUpdatesr? .c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r� r � FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r: r� r; r; r< r� x s ���z,FIPSUpdatesEntitlement.incompatible_servicesc C s| d }t �� rtjj| jd�}| �� stjg}ntj}d }| j s-t
j dtj j| jd�ifg}t
j d|ifg| j
i fg||d�S r )r
r6 r r rQ ro r| r � PROMPT_FIPS_UPDATES_PRE_ENABLEr
r rR r rX r r; r; r< r � r z FIPSUpdatesEntitlement.messagingrY c s& t � j|d�rt�tdd�� dS dS )N)rY T)r� F)r� r� r �writer r� r� r; r< r� � s �z&FIPSUpdatesEntitlement._perform_enable)r� r� r� r} r �FIPS_UPDATES_TITLEro r� �FIPS_UPDATES_DESCRIPTIONr �FIPS_UPDATES_HELP_TEXTr r� r r r� r r r r� r� r� r� r; r; r� r< r� q s
+r� c sh e Zd ZdZejZejZej Z
dZ ej Z
dZedeedf f� fdd� �Zded edefd
d �Z� ZS ) �FIPSPreviewEntitlementz fips-preview�UbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr? .c s t � jtttj�f S r� )r� r� r r� r r r� r� r; r< r� � s
��z,FIPSPreviewEntitlement.incompatible_servicesr5 r� c C s dS r� r; r� r; r; r< r� � s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r� r� r� r} r �FIPS_PREVIEW_TITLEro �FIPS_PREVIEW_DESCRIPTIONr �FIPS_PREVIEW_HELP_TEXTr r� � PROMPT_FIPS_PREVIEW_PRE_ENABLEr r� r� r r r� r� r� r� r� r; r; r� r< r# � s" ���r# )9�loggingr� rH � itertoolsr �typingr r r r r �uaclientr r r
r r r
r �uaclient.clouds.identityr r �uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.filesr �uaclient.files.noticesr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerrN � getLogger� replace_top_level_logger_namer� rF � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMACr9 �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALr7 �RepoEntitlementr, r� r� r# r; r; r; r< �<module> sh $ ���������� &xK