File: //lib/python3/dist-packages/uaclient/entitlements/__pycache__/livepatch.cpython-310.pyc
o
nHJe�2 � @ s� d dl Z d dlmZmZmZmZ d dlmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZ d dlmZ d dlmZ ddgZd d
d �Ze�� Ze �e�e ��Z G d d
� d
e�Z dd� Z dS )� N)�Any�Dict�Optional�Tuple)� event_logger�
exceptions�http� livepatch�messages�snap�system�util)�IncompatibleService�
UAEntitlement)�ApplicationStatus)�StaticAffordanceg �?g �?z)Invalid Auth-Token provided to livepatch.z2Your running kernel is not supported by Livepatch.)zUnknown Auth-Tokenzunsupported kernelc s e Zd ZejjZdZejZ ej
Z ej Z
dZdZdZdZedeedf fdd��Zedeedf fdd ��Zd d
edefd d �Z d d
ededefdd�Zd dd�Zdee e ej f fdd�Z deee ej f fdd�Z dd� Z! d de"e#e$f de"e#e$f dedef� fd d �
Z%� Z&S ) �LivepatchEntitlementr FT�return.c C s0 ddl m} ddlm} t|tj�t|tj�fS )Nr ��FIPSEntitlement)�RealtimeKernelEntitlement)�uaclient.entitlements.fipsr � uaclient.entitlements.realtimer r r
�LIVEPATCH_INVALIDATES_FIPS� REALTIME_LIVEPATCH_INCOMPATIBLE)�selfr r � r �A/usr/lib/python3/dist-packages/uaclient/entitlements/livepatch.py�incompatible_services+ s ���z*LivepatchEntitlement.incompatible_servicesc sZ ddl m} || j�}t|�� d tjk�� tjj | j
d�dd� dftj � fdd�dffS )Nr r ��titlec S s t �� S �N)r � is_containerr r r r �<lambda>J s z9LivepatchEntitlement.static_affordances.<locals>.<lambda>Fc s � S r! r r ��is_fips_enabledr r r# O s ) r r �cfg�bool�application_statusr �ENABLEDr
�"SERVICE_ERROR_INSTALL_ON_CONTAINER�formatr �!LIVEPATCH_ERROR_WHEN_FIPS_ENABLED)r r �fips_entr r$ r �static_affordances: s
���
��z'LivepatchEntitlement.static_affordances�silentc
C sJ t �� st�tjjdd�� t �� t �� sLt�tjjdd�� zt � d� W n$ t
j yK } zt j
d|d� t�tjjdd�� W Y d}~nd}~ww t �� t�d | jjtj�}t�d
| jjtj�}t j||t jd � t�� s�t�tjjd d�� zt � d
� W n t
j y� } zt
jt |�d��d}~ww t� ||� | j ddd�S )zYEnable specific entitlement.
@return: True on success, False otherwise.
�snapd)�packagesz
snapd snapz!Failed to install snapd as a snap��exc_infozsnap install snapd)�commandNr �https)�
http_proxy� https_proxy� retry_sleepszcanonical-livepatch snapzcanonical-livepatch�� error_msgT��process_directives�
process_token) r �is_snapd_installed�event�infor
�INSTALLING_PACKAGESr+ �
install_snapd� is_snapd_installed_as_a_snap� install_snapr �ProcessExecutionError�LOG�warning�EXECUTING_COMMAND_FAILED�run_snapd_wait_cmdr �validate_proxyr& r6 � PROXY_VALIDATION_SNAP_HTTP_URLr7 � PROXY_VALIDATION_SNAP_HTTPS_URL�configure_snap_proxy�SNAP_INSTALL_RETRIESr �is_livepatch_installed�ErrorInstallingLivepatch�str�configure_livepatch_proxy�setup_livepatch_config)r r/ �er6 r7 r r r �_perform_enableT s\ ����� � ������ �z$LivepatchEntitlement._perform_enabler< r= c
C s� | j jj�| j�}|r;zt|� W n) tjy: } z tj t
|�|d� t � t
jjt
|�d�� W Y d}~dS d}~ww |r�|�d�}|sQt�d| j� | j jd }| �� \}}|tjkr�t� d� t � t
j� z
t�tjd g� W n tjy� } ztj t
|�|d� W Y d}~dS d}~ww z
tjtjd
|gd d � W n< tjy� } z/t
j}t � � D ]\} }
| t
|�v r�||
7 } nq�|t
jkr�|t
|�7 }t � |� W Y d}~dS d}~ww t � t
j jd
d�� d S )a Processs configuration setup for livepatch directives.
:param process_directives: Boolean set True when directives should be
processsed.
:param process_token: Boolean set True when token should be
processsed.
r2 r9 NF�
resourceTokenzHNo specific resourceToken present. Using machine token as %s credentials� machineTokenz&Disabling livepatch before re-enabling�disable�enableT��capturezCanonical Livepatchr ) r& �machine_token_file� entitlements�get�name�process_config_directivesr rE rF �errorrQ r? r@ r
� LIVEPATCH_UNABLE_TO_CONFIGUREr+ �debugr �
machine_tokenr( r �DISABLED�LIVEPATCH_DISABLE_REATTACHr �subpr �
LIVEPATCH_CMD�LIVEPATCH_UNABLE_TO_ENABLE�
ERROR_MSG_MAP�items� ENABLED_TMPL) r r< r= �entitlement_cfgrT �livepatch_tokenr( �_details�msg�
error_message�
print_messager r r rS � sr
� ����
�
��
� �
��
�z+LivepatchEntitlement.setup_livepatch_configc C s$ t �� sdS tjt jdgdd� dS )zYDisable specific entitlement
@return: True on success, False otherwise.
TrX rZ )r rO r rg rh )r r/ r r r �_perform_disable� s z%LivepatchEntitlement._perform_disablec C s: t jd f}t�� st jtjfS t�� d u rt jtjfS |S r! ) r r) r rO re r
�LIVEPATCH_NOT_ENABLED�status�+LIVEPATCH_APPLICATION_STATUS_CLIENT_FAILURE)r ru r r r r( � s
�z'LivepatchEntitlement.application_statusc C sz t �� }|t jjkrt�� }dtjj|j |j
d�fS |t jj kr0t�� }dtj j|j |j
d�fS |t jj
kr;dtjfS dS )NT)�version�arch)FN)r �on_supported_kernel�LivepatchSupport� UNSUPPORTEDr �get_kernel_infor
� LIVEPATCH_KERNEL_NOT_SUPPORTEDr+ �
uname_release�uname_machine_arch�
KERNEL_EOL�LIVEPATCH_KERNEL_EOL�KERNEL_UPGRADE_REQUIRED�!LIVEPATCH_KERNEL_UPGRADE_REQUIRED)r �support� kernel_infor r r �enabled_warning_status� s, �� �� �z+LivepatchEntitlement.enabled_warning_statusc C s" t �� t jjkrt�� stjS d S r! )r ry rz r{ r r" r
�*LIVEPATCH_KERNEL_NOT_SUPPORTED_DESCRIPTION)r r r r �status_description_override s ��z0LivepatchEntitlement.status_description_override� orig_access�deltas� allow_enablec
s� t � �|||�r
dS |�di �}|�di ��dd�}|r$| �� \}}|S | �� \}}|tjkr1dS |�di �} tddg�}
t|
� | ��} t|�d d��} t
| | g�rit � d
� t
� tjj| jd �� | j| | d �S dS )
a1 Process any contract access deltas for this entitlement.
:param orig_access: Dictionary containing the original
resourceEntitlement access details.
:param deltas: Dictionary which contains only the changed access keys
and values.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:return: True when delta operations are processed; False when noop.
T� entitlement� obligations�enabledByDefaultF�
directives�caCerts� remoteServerrV zANew livepatch directives or token. running setup_livepatch_config)�servicer; )�super�process_contract_deltasr^ rY r( r re �setr' � intersection�anyrF r@ r? r
�#SERVICE_UPDATING_CHANGED_DIRECTIVESr+ r_ rS )
r r� r� r� �delta_entitlement�process_enable_default�enable_success�_r( �delta_directives�supported_deltasr< r= �� __class__r r r� s@ �
� ����z,LivepatchEntitlement.process_contract_deltas)F)TT)'�__name__�
__module__� __qualname__r
�urls�LIVEPATCH_HOME_PAGE� help_doc_urlr_ �LIVEPATCH_TITLEr �LIVEPATCH_DESCRIPTION� description�LIVEPATCH_HELP_TEXT� help_text�#affordance_check_kernel_min_version� affordance_check_kernel_flavor�affordance_check_series�affordance_check_arch�propertyr r r r r. r' rU rS rs r r � NamedMessager( r� r� r rQ r r� �
__classcell__r r r� r r sR 6���
�
>
�
�
�
�
���r c C s� | sdS | � di �� di �}|� d�}|r#tjtjdd�|�gdd� |� d d
�}|�d �r4|dd � }|rFtjtjdd
�|�gdd� dS dS )a� Process livepatch configuration directives.
We process caCerts before remoteServer because changing remote-server
in the canonical-livepatch CLI performs a PUT against the new server name.
If new caCerts were required for the new remoteServer, this
canonical-livepatch client PUT could fail on unmatched old caCerts.
@raises: ProcessExecutionError if unable to configure livepatch.
Nr� r� r� �configz ca-certs={}TrZ r� � �/���zremote-server={})r^ r rg r rh r+ �endswith)r& r� �ca_certs�
remote_serverr r r r` A s0
��
�
��r` ) �logging�typingr r r r �uaclientr r r r r
r r r
�uaclient.entitlements.baser r �(uaclient.entitlements.entitlement_statusr �uaclient.typesr �LIVEPATCH_RETRIESrj �get_event_loggerr? � getLogger� replace_top_level_logger_namer� rF r r` r r r r �<module> s (
� &