File: //usr/lib/python3/dist-packages/uaclient/entitlements/__pycache__/fips.cpython-310.pyc
o
nHJe�O � @ s� d dl Z d dlZd dlmZ d dlmZmZmZ d dlm Z m
Z
m Z m Z m
Z
mZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d l m Z m Z d d l m Z m!Z!m"Z" e
�#� Z$e �%e�&e'��Z(g d
�Z)ddgZ*g d�Z+e)e* e)e* e)e)e+ d�Z,g d�Z-g d�Z.g d�Z/g d�Z0e)e* e- e)e* e. e)e/ e)e+ e0 d�Z1G dd� dej2�Z3G dd� de3�Z4G dd� de3�Z5G dd � d e4�Z6dS ) � N)�groupby)�List�Optional�Tuple)�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�IncompatibleService)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)�
strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�
libnettle8� libhogweed6� libgnutls30�libgmp10)�xenial�bionic�focal�jammy)�openssl� libssl1.0.0�libssl1.0.0-hmac)r' � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmac)�gawkzupdate-notifier-commonr' zopenssl-fips-module-3�libssl3r, r- c s, e Zd ZdZdZdZdZejj Z
g d�Z e dd� �Z
d%d eee d
ed ed df� fd
d�
Z d&deded dfdd�Zdeded ef� fdd� Ze d eedf fdd��Ze d ee f� fdd � �Zd eeeej f f� fd d � Zd'd d �Z d&ded ef� fd!d"�
Z d&ded df� fd#d$�
Z � Z S )(�FIPSCommonEntitlementi� zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledT)zfips-initramfsr* r+ r( r) r( r) z
linux-fipsr r r r r' r r r, r- zfips-initramfs-genericr c C s* t �� j}t �� rt�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
)r
�get_release_info�series� is_container�#FIPS_CONTAINER_CONDITIONAL_PACKAGES�get�FIPS_CONDITIONAL_PACKAGES)�selfr2 � r8 �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.py�conditional_packages� s
z*FIPSCommonEntitlement.conditional_packagesN� package_list�cleanup_on_failure�verbose�returnc
s� |r
t �tjj| jd�� | j}t� j|dd� g }t �
� }t t | j
�dd� d�}|D ] \}} ||v r7|| 7 }q+|D ]$}
z t� j|
gddd� W q: tjy^ t �tjj| j|
d�� Y q:w d S )
a) Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
:param verbose: If true, print messages to stdout
��titleF)r; r= c S s | � dd�S )Nz-hmac� )�replace)�pkg_namer8 r8 r9 �<lambda>� � z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>)�key)r; r< r= )�service�pkgN)�event�infor �INSTALLING_SERVICE_PACKAGES�formatr@ �packages�super�install_packagesr � get_installed_packages_namesr �sortedr: r �UbuntuProError�FIPS_PACKAGE_NOT_AVAILABLE) r7 r; r< r= �mandatory_packages�desired_packages�installed_packages�
pkg_groupsrC �pkg_listrH �� __class__r8 r9 rO � s>
��� �
�����z&FIPSCommonEntitlement.install_packagesF� operation�silentc C sf t �� }t�|� |r/|st�tjj|d�� |dkr#t� t
j � dS |dkr1t� t
j � dS dS dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r[ �installzdisable operationN)
r
�
should_rebootrI � needs_rebootrJ r �ENABLE_REBOOT_REQUIRED_TMPLrL r �addr �FIPS_SYSTEM_REBOOT_REQUIRED� FIPS_DISABLE_REBOOT_REQUIRED)r7 r[ r\ �reboot_requiredr8 r8 r9 �_check_for_reboot_msg� s&
����� z+FIPSCommonEntitlement._check_for_reboot_msgr2 �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcp)�config�
path_to_valueT)r$ r% zubuntu-gcp-fips)r �is_config_value_true�cfg�boolrN rM �r7 r2 rf rY r8 r9 � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d u rd� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS )
Nzan AWSzan Azureza GCP)�aws�azurerg rA )r2 �cloudc s �� �� �S �N)rn r8 �rf r7 r2 r8 r9 rD rE z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r
r
r1 r2 r �FIPS_BLOCK_ON_CLOUDrL r@ r5 )r7 � cloud_titles�_�blocked_messager8 rs r9 �static_affordances s
���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS rr )r
r3 rN rM �r7 rY r8 r9 rM s z FIPSCommonEntitlement.packagesc s� t � �� \}}t�� rt�� st�tj� ||fS t j
� | j �rSt�t
| j��s.t�tj� t�| j ��� dkrBt�tj� ||fS t�tj� tjtjj| j d�fS |tjkr\||fS tjtjfS )N�1)� file_name)rN �application_statusr
r3 r^ r �remover rb �os�path�exists�FIPS_PROC_FILE�setrM � load_file�strip�FIPS_MANUAL_DISABLE_URLra r �DISABLEDr �FIPS_PROC_FILE_ERRORrL �ENABLED�FIPS_REBOOT_REQUIRED)r7 � super_status� super_msgrY r8 r9 r| " s: ������
�z(FIPSCommonEntitlement.application_statusc C sT t t�� �}t | j��t | j��}|�|�}|r(t�t|�t j
j | j d�� dS dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r? N)
r� r rP rM �
differencer: � intersection�remove_packages�listr �DISABLE_FAILED_TMPLrL r@ )r7 rV �fips_metapackager� r8 r8 r9 r� L s
�
��z%FIPSCommonEntitlement.remove_packagesc s: t � j|d�rt�tj� t�tj� t�tj� dS dS )N�r\ TF)rN �_perform_enabler r} r � WRONG_FIPS_METAPACKAGE_ON_CLOUDr� rc )r7 r\ rY r8 r9 r� ] s � z%FIPSCommonEntitlement._perform_enablec s� ddg}t �|tjjd�|�d��}g }|�� D ] }|| jv r$|�|� q|r;ddg| }t �|tjjd�|�d��}t � j
|d� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UbuntuProError: on failure to setup any aspect of this apt
configuration
zapt-mark� showholds� )�command�unholdr� N) r �run_apt_commandr �EXECUTING_COMMAND_FAILEDrL �join�
splitlines�fips_pro_package_holds�appendrN �setup_apt_config)r7 r\ �cmd�holds�unholds�hold�
unhold_cmdrY r8 r9 r� h s& �
� ��z&FIPSCommonEntitlement.setup_apt_config)NTT�F)r> N) �__name__�
__module__� __qualname__�repo_pin_priority�
repo_key_filer� �apt_noninteractiver �urls�FIPS_HOME_PAGE� help_doc_urlr� �propertyr: r r �strrl rO re rn r r rx rM r � NamedMessager| r� r� r� �
__classcell__r8 r8 rY r9 r0 h s\
�
����4���
���� �
* r0 c s� e Zd ZdZejZejZej Z
dZ ej Z
edeedf fdd��Zedeedf f� fdd� �Zedefd d
��Zdd edef� fd
d�
Z� ZS )�FIPSEntitlement�fips�
UbuntuFIPSr> .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
� uaclient.entitlements.livepatchr� � uaclient.entitlements.realtimer� r r �LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)r7 r� r� r8 r8 r9 �incompatible_services� s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| j�}tj}t|�� d |k��t� � }|r |j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )Nr F)r� � fips_updatesc � � S rr r8 r8 )�is_fips_updates_enabledr8 r9 rD � � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r� rr r8 r8 )�fips_updates_once_enabledr8 r9 rD � r� )rN rx r� rk r r� rl r| r �readr� r �$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrL r@ �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r7 rx r� �enabled_status�services_once_enabled_objrY )r� r� r9 rx � s2
����
��
��z"FIPSEntitlement.static_affordancesc C sr d }t �� rtjj| jd�}tjg}n| j}d }| js+t j
tj j| jd�| j d�fg}t j
|| j d�fg||d�S �Nr? )�msg�
assume_yes)�
pre_enable� post_enable� pre_disable)
r
r3 r � PROMPT_FIPS_CONTAINER_PRE_ENABLErL r@ �FIPS_RUN_APT_UPGRADE�pre_enable_msg�purger �prompt_for_confirmation�PROMPT_FIPS_PRE_DISABLEr� �r7 r� �pre_enable_promptr� r8 r8 r9 � messaging� �2 ��
����
���zFIPSEntitlement.messagingFr\ c sT t � \}}|d u r|tjkrt�d� t�tj� t � j
|d�r(t � t
j� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.r� TF)r
r �CLOUD_ID_ERROR�LOG�warningrI rJ r �.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGErN r� r r} r �FIPS_INSTALL_OUT_OF_DATE)r7 r\ �
cloud_type�errorrY r8 r9 r� � s
� �z FIPSEntitlement._perform_enabler� )r� r� r� �namer �
FIPS_TITLEr@ �FIPS_DESCRIPTION� description�FIPS_HELP_TEXT� help_text�origin�PROMPT_FIPS_PRE_ENABLEr� r� r r r� r rx r r� rl r� r� r8 r8 rY r9 r� � s ! %r� c sn e Zd ZdZejZdZejZ ej
Z e de
edf fdd��Ze defdd��Zd
d
edef� fd d �
Z� ZS )r� z fips-updates�UbuntuFIPSUpdatesr> .c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r� r � FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r7 r� r8 r8 r9 r� � s ���z,FIPSUpdatesEntitlement.incompatible_servicesc C sr d }t �� rtjj| jd�}tjg}ntj}d }| js+t j
tj j| jd�| j d�fg}t j
|| j d�fg||d�S r� )
r
r3 r r� rL r@ r� � PROMPT_FIPS_UPDATES_PRE_ENABLEr� r r� r� r� r� r8 r8 r9 r� r� z FIPSUpdatesEntitlement.messagingFr\ c sV t � j|d�r)| j�d�pi }|�| jdi� | jjd|d� t�t dd�� dS dS )Nr� zservices-once-enabledT)rF �content)r� F)
rN r� rk �
read_cache�updater� � write_cacher �writer )r7 r\ �services_once_enabledrY r8 r9 r� 1 s ���z&FIPSUpdatesEntitlement._perform_enabler� )r� r� r� r� r �FIPS_UPDATES_TITLEr@ r� �FIPS_UPDATES_DESCRIPTIONr� �FIPS_UPDATES_HELP_TEXTr� r� r r r� r r� rl r� r� r8 r8 rY r9 r� � s
%r� c sh e Zd ZdZejZejZej Z
dZ ej Z
dZedeedf f� fdd� �Zded edefd
d �Z� ZS ) �FIPSPreviewEntitlementz fips-preview�UbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr> .c s t � jtttj�f S rr )rN r� r r� r r� ry rY r8 r9 r� L s
��z,FIPSPreviewEntitlement.incompatible_servicesr2 rf c C s dS )NTr8 rm r8 r8 r9 rn T s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r� r� r� r� r �FIPS_PREVIEW_TITLEr@ �FIPS_PREVIEW_DESCRIPTIONr� �FIPS_PREVIEW_HELP_TEXTr� r� � PROMPT_FIPS_PREVIEW_PRE_ENABLEr� r� r� r r r� r� rl rn r� r8 r8 rY r9 r� C s" ���r� )7�loggingr~ � itertoolsr �typingr r r �uaclientr r r r r
r �uaclient.clouds.identityr r
�uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.filesr �uaclient.files.noticesr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerrI � getLogger� replace_top_level_logger_namer� r� � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMAC�CONDITIONAL_PACKAGES_JAMMYr6 �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCAL�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_JAMMYr4 �RepoEntitlementr0 r� r� r� r8 r8 r8 r9 �<module> st ����
�������� rM