Server : Apache/2.4.52 (Ubuntu) System : Linux webserver 6.8.0-49-generic #49~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Nov 6 17:42:15 UTC 2 x86_64 User : www-data ( 33) PHP Version : 8.1.2-1ubuntu2.21 Disable Function : NONE Directory : /lib/python3/dist-packages/uaclient/entitlements/__pycache__/ |
o
���f�7 � @ s� d dl Z d dlmZmZmZmZ d dlmZmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZmZ d dlmZ d dlmZ ddgZd d
d �Ze�� Ze �e� e ��Z G d d
� d
e�Z dd� Z dS )� N)�Any�Dict�Optional�Tuple) �api� event_logger�
exceptions�http� livepatch�messages�snap�system�util)�EntitlementWithMessage�
UAEntitlement)�ApplicationStatus)�StaticAffordanceg �?g �?z)Invalid Auth-Token provided to livepatch.z2Your running kernel is not supported by Livepatch.)zUnknown Auth-Tokenzunsupported kernelc sF e Zd ZejjZdZejZ ej
Z ej Z
dZdZdZdZedeedf fdd��Zedeedf fdd ��Zdefd
d �Zdefd d
�Zdej de fdd�Z d"dej de de de fdd�Z dej fdd�Z dee!e"ej# f fdd�Z$dee e"ej# f fdd�Z%dd � Z& d#d e'e(e)f d e'e(e)f d e de f� fd d!�
Z*� Z+S )$�LivepatchEntitlementr
FT�return.c C s0 ddl m} ddlm} t|tj�t|tj�fS )Nr ��FIPSEntitlement)�RealtimeKernelEntitlement)�uaclient.entitlements.fipsr � uaclient.entitlements.realtimer r r �LIVEPATCH_INVALIDATES_FIPS� REALTIME_LIVEPATCH_INCOMPATIBLE)�selfr r � r �A/usr/lib/python3/dist-packages/uaclient/entitlements/livepatch.py�incompatible_services, s ���z*LivepatchEntitlement.incompatible_servicesc s\ ddl m} || jd�}t|�� d tjk�� tjj | j
d�dd� dftj � fdd�dffS ) Nr r )�cfg)�titlec S s t �� S �N)r
� is_containerr r r r �<lambda>K s z9LivepatchEntitlement.static_affordances.<locals>.<lambda>Fc s � S r" r r ��is_fips_enabledr r r$ P s ) r r r �bool�application_statusr �ENABLEDr �"SERVICE_ERROR_INSTALL_ON_CONTAINER�formatr! �!LIVEPATCH_ERROR_WHEN_FIPS_ENABLED)r r �fips_entr r% r �static_affordances; s ���
��z'LivepatchEntitlement.static_affordancesc C � dS )N� r �r r r r � enable_stepsU � z!LivepatchEntitlement.enable_stepsc C r/ )N� r r1 r r r �
disable_stepsX r3 z"LivepatchEntitlement.disable_steps�progressc
C s� |� tj� t�� s|�dtjjdd�� t�� t� � sU|�dtjjdd�� zt�
d� W n% t j yT } zt
jd|d� |�dtjjdd�� W Y d }~nd }~ww t�|� zt�d� W n$ t j y� } zt
jd
|d� t�tjjd d�� W Y d }~nd }~ww t�d | jjtj�}t�d
| jjtj�}tj||tj d� t � � s�|�dtjjdd�� zt�
d� W n t j y� } zt j t |�d��d }~ww t �!||� | j"|ddd�S )zYEnable specific entitlement.
@return: True on success, False otherwise.
�info�snapd)�packagesz
snapd snapz!Failed to install snapd as a snap��exc_infozsnap install snapd��commandNz Failed to refresh snapd snapzsnap refresh snapdr �https)�
http_proxy� https_proxy� retry_sleepszcanonical-livepatch snapzcanonical-livepatch�� error_msgT)�process_directives�
process_token)#r6 r �INSTALLING_LIVEPATCHr �is_snapd_installed�emit�INSTALLING_PACKAGESr+ �
install_snapd� is_snapd_installed_as_a_snap� install_snapr �ProcessExecutionError�LOG�warning�EXECUTING_COMMAND_FAILED�run_snapd_wait_cmd� refresh_snap�eventr7 r �validate_proxyr r? � PROXY_VALIDATION_SNAP_HTTP_URLr@ � PROXY_VALIDATION_SNAP_HTTPS_URL�configure_snap_proxy�SNAP_INSTALL_RETRIESr
�is_livepatch_installed�ErrorInstallingLivepatch�str�configure_livepatch_proxy�setup_livepatch_config)r r6 �er? r@ r r r �_perform_enable[ s~ � �����
���� � ������ �z$LivepatchEntitlement._perform_enablerD rE c
C s� |� tj� | j�� �| j�}|rBzt|� W n* tj yA } z t
j t |�|d� |�
dtjjt |�d�� W Y d}~dS d}~ww |r�|�d�}|sXt
�d| j� | jjd }| �� \}}|tjkr�t
�d � |�
dtj� z
t�tjd
g� W n tj y� } zt
j t |�|d� W Y d}~dS d}~ww ztjtjd |gd d
� W d S tj y� } z0tj } t � � D ]\}
} |
t |�v r�| | 7 } nq�| tj kr�| t |�7 } |�
d| � W Y d}~dS d}~ww d S )a Processs configuration setup for livepatch directives.
:param process_directives: Boolean set True when directives should be
processsed.
:param process_token: Boolean set True when token should be
processsed.
r: r7 rB NF�
resourceTokenzHNo specific resourceToken present. Using machine token as %s credentials� machineTokenz&Disabling livepatch before re-enabling�disable�enableT��capture) r6 r �SETTING_UP_LIVEPATCH�machine_token_file� entitlements�get�name�process_config_directivesr rM rN �errorr[ rH � LIVEPATCH_UNABLE_TO_CONFIGUREr+ �debugr! �
machine_tokenr( r �DISABLEDr7 �LIVEPATCH_DISABLE_REATTACHr
�subpr
�
LIVEPATCH_CMD�LIVEPATCH_UNABLE_TO_ENABLE�
ERROR_MSG_MAP�items) r r6 rD rE �entitlement_cfgr^ �livepatch_tokenr( �_details�msg�
error_message�
print_messager r r r] � sr
����
��
��
�� �
��
z+LivepatchEntitlement.setup_livepatch_configc C sB t �� sdS t jdg}|�tjjd�|�d�� tj |dd� dS )zYDisable specific entitlement
@return: True on success, False otherwise.
Trb � r< rd )
r
rY rs r6 r �EXECUTING_COMMANDr+ �joinr
rr )r r6 �cmdr r r �_perform_disable� s
�z%LivepatchEntitlement._perform_disablec
C s� t jd f}t�� st jtjfS zt�� }W n tj y3 } zt j
tj j |j
d�fW Y d }~S d }~ww |d u r>t jtjfS |S )N)�livepatch_error)r r) r
rY rp r �LIVEPATCH_NOT_ENABLED�statusr rM �WARNING� LIVEPATCH_CLIENT_FAILURE_WARNINGr+ �stderr�+LIVEPATCH_APPLICATION_STATUS_CLIENT_FAILURE)r r� �livepatch_statusr^ r r r r( � s$
�����z'LivepatchEntitlement.application_statusc C sz t �� }|t jjkrt�� }dtjj|j |j
d�fS |t jj kr0t�� }dtj j|j |j
d�fS |t jj
kr;dtjfS dS )NT)�version�arch)FN)r
�on_supported_kernel�LivepatchSupport� UNSUPPORTEDr
�get_kernel_infor � LIVEPATCH_KERNEL_NOT_SUPPORTEDr+ �
uname_release�uname_machine_arch�
KERNEL_EOL�LIVEPATCH_KERNEL_EOL�KERNEL_UPGRADE_REQUIRED�!LIVEPATCH_KERNEL_UPGRADE_REQUIRED)r �support� kernel_infor r r �enabled_warning_status
s, �� �� �z+LivepatchEntitlement.enabled_warning_statusc C s" t �� t jjkrt�� stjS d S r" )r
r� r� r� r
r# r �*LIVEPATCH_KERNEL_NOT_SUPPORTED_DESCRIPTIONr1 r r r �status_description_override* s ��z0LivepatchEntitlement.status_description_override� orig_access�deltas� allow_enablec
s� t � �|||�r
dS |�di �}|�di ��dd�}|r'| �t�� �\}}|S | �� \}}|tjkr4dS |�di �} t ddg�}
t
|
� | ��} t
|�d d��} t | | g�rot
�d
� t�tjj| jd �� | jt�� | | d �S dS )
a1 Process any contract access deltas for this entitlement.
:param orig_access: Dictionary containing the original
resourceEntitlement access details.
:param deltas: Dictionary which contains only the changed access keys
and values.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:return: True when delta operations are processed; False when noop.
T� entitlement� obligations�enableByDefaultF�
directives�caCerts� remoteServerr` zANew livepatch directives or token. running setup_livepatch_config)�service)r6 rD rE )�super�process_contract_deltasri rc r �ProgressWrapperr( r rp �setr' � intersection�anyrN r7 rS r �#SERVICE_UPDATING_CHANGED_DIRECTIVESr+ rj r] )
r r� r� r� �delta_entitlement�process_enable_default�enable_success�_r( �delta_directives�supported_deltasrD rE �� __class__r r r� 3 sB �
� ����z,LivepatchEntitlement.process_contract_deltas)TT)F),�__name__�
__module__� __qualname__r �urls�LIVEPATCH_HOME_PAGE� help_doc_urlrj �LIVEPATCH_TITLEr! �LIVEPATCH_DESCRIPTION� description�LIVEPATCH_HELP_TEXT� help_text�#affordance_check_kernel_min_version� affordance_check_kernel_flavor�affordance_check_series�affordance_check_arch�propertyr r r r r. �intr2 r5 r r� r' r_ r] r� r r � NamedMessager( r� r� r r[ r r� �
__classcell__r r r� r r s\ I����
�A
�
�
�
�
���r c C s� | sdS | � di �� di �}|� d�}|r#tjtjdd�|�gdd� |� d d
�}|�d �r4|dd � }|rFtjtjdd
�|�gdd� dS dS )a� Process livepatch configuration directives.
We process caCerts before remoteServer because changing remote-server
in the canonical-livepatch CLI performs a PUT against the new server name.
If new caCerts were required for the new remoteServer, this
canonical-livepatch client PUT could fail on unmatched old caCerts.
@raises: ProcessExecutionError if unable to configure livepatch.
Nr� r� r� �configz ca-certs={}Trd r� � �/���zremote-server={})ri r
rr r
rs r+ �endswith)r r� �ca_certs�
remote_serverr r r rk l s0
��
�
��rk )!�logging�typingr r r r �uaclientr r r r r
r r r
r �uaclient.entitlements.baser r �(uaclient.entitlements.entitlement_statusr �uaclient.typesr �LIVEPATCH_RETRIESru �get_event_loggerrS � getLogger� replace_top_level_logger_namer� rN r rk r r r r �<module> s , � P