Your IP : 216.73.216.52
U
8�-d�F � @ sl d dl Z d dlZd dlmZ d dlmZmZmZ d dlm Z m
Z
m Z m Z m
Z
mZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d l m Z m Z d d l m Z m!Z!m"Z" e
�#� Z$d
dddgZ%ddgZ&e%e& e%e& e%d�Z'dddgZ(dddddgZ)dddddgZ*e%e& e( e%e& e) e%e* d�Z+G dd � d ej,�Z-G d d � d e-�Z.G d d � d e-�Z/dS )!� N)�groupby)�List�Optional�Tuple)�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�IncompatibleService)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance�
strongswan�strongswan-hmac�openssh-client�openssh-server�openssh-client-hmac�openssh-server-hmac)Zxenial�bionic�focal�openssl� libssl1.0.0�libssl1.0.0-hmac� libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s2 e Zd ZdZdZdZdZdZdddd d
d d
d d d
ddddddddgZe dd� �Z
d2e e e
eedd�� fdd�
Zd3e
edd �d d �Ze
e
ed �� fd!d"� Ze eed#f d$�d%d&��Ze e e
d$�� fd'd(� �Zeee ej f d$�� fd)d*� Zdd$�d+d,�Zd4eed-�� fd.d/�
Zd5edd-�� fd0d1�
Z � Z S )6�FIPSCommonEntitlementi� zubuntu-advantage-fips.gpgz /proc/sys/crypto/fips_enabledTz/https://ubuntu.com/security/certifications#fipszfips-initramfsr# r$ r! r" z
linux-fipsr r r r r r r r% r& zfips-initramfs-genericc C s0 t �� �dd�}t �� r$t�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
�series� )r
�get_platform_info�get� is_container�#FIPS_CONTAINER_CONDITIONAL_PACKAGES�FIPS_CONDITIONAL_PACKAGES)�selfr( � r0 �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.py�conditional_packagesu s z*FIPSCommonEntitlement.conditional_packagesN)� package_list�cleanup_on_failure�verbose�returnc
s� |rt �dj| jd�� | j}t� j|dd� g }t�� }t t
| j �dd� d�}|D ]\}} ||krT|| 7 }qT|D ]L}
zt� j|
gddd� W qr t j
k
r� t �tjj| j|
d �� Y qrX qrd
S ) a) Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
:param verbose: If true, print messages to stdout
zInstalling {title} packages��titleF)r3 r5 c S s | � dd�S )Nz-hmacr) )�replace)�pkg_namer0 r0 r1 �<lambda>� � z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>)�key)r3 r4 r5 )�service�pkgN)�event�info�formatr8 �packages�super�install_packagesr � get_installed_packages_namesr �sortedr2 r ZUserFacingErrorr ZFIPS_PACKAGE_NOT_AVAILABLE) r/ r3 r4 r5 Zmandatory_packagesZdesired_packages�installed_packagesZ
pkg_groupsr: Zpkg_listr? �� __class__r0 r1 rE � s<
��
�
��z&FIPSCommonEntitlement.install_packagesF)� operation�silentr6 c C s\ t �� }t�|� |rX|s.t�tjj|d�� |dkrDt� t
j � n|dkrXt� t
j � dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)rK �installzdisable operationN)
r
�
should_rebootr@ Z needs_rebootrA r ZENABLE_REBOOT_REQUIRED_TMPLrB r �addr �FIPS_SYSTEM_REBOOT_REQUIRED� FIPS_DISABLE_REBOOT_REQUIRED)r/ rK rL Zreboot_requiredr0 r0 r1 �_check_for_reboot_msg� s"
����z+FIPSCommonEntitlement._check_for_reboot_msg)r( �cloud_idr6 c s> |dkr:t j| jjdd�r dS |dkr*dS tdt� jk�S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcp)ZconfigZ
path_to_valueT)r r zubuntu-gcp-fips)r Zis_config_value_true�cfg�boolrD rC )r/ r( rS rI r0 r1 � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.�r6 c sd dddd�}t � \� }� d kr"d� t�� �dd��tjj��� |�� �d�}|� ��fdd �d
ffS ) Nzan AWSzan Azureza GCP)ZawsZazurerT r) r( )r( Zcloudc s �� �� �S �N)rW r0 �rS r/ r( r0 r1 r; r< z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T)r
r
r* r+ r ZFIPS_BLOCK_ON_CLOUDrB r8 )r/ Z cloud_titles�_Zblocked_messager0 rZ r1 �static_affordances� s
���z(FIPSCommonEntitlement.static_affordancesc s t �� r g S t� jS rY )r
r, rD rC )r/ rI r0 r1 rC s z FIPSCommonEntitlement.packagesc s� t � �� \}}t�� r2t�� s2t�tj� ||fS t j
� | j �r�t�t
| j��s\t�tj� t�| j ��� dkr�t�tj� ||fS t�tj� tjtjj| j d�fS |tjkr�||fS tjtjfS )N�1)� file_name)rD �application_statusr
r, rN r �remover rP �os�path�exists�FIPS_PROC_FILE�setrC Z load_file�stripZFIPS_MANUAL_DISABLE_URLrO r ZDISABLEDr ZFIPS_PROC_FILE_ERRORrB �ENABLED�FIPS_REBOOT_REQUIRED)r/ Z super_statusZ super_msgrI r0 r1 r_ s: ������
�z(FIPSCommonEntitlement.application_statusc C sP t t�� �}t | j��t | j��}|�|�}|rLt�t|�t j
j | j d�� dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r7 N)
re r rF rC �
differencer2 � intersection�remove_packages�listr ZDISABLE_FAILED_TMPLrB r8 )r/ rH Zfips_metapackagerk r0 r0 r1 rk 6 s
�
�z%FIPSCommonEntitlement.remove_packages�rL r6 c s: t � j|d�r6t�tj� t�tj� t�tj� dS dS )N�rL TF)rD �_perform_enabler r` r Z WRONG_FIPS_METAPACKAGE_ON_CLOUDrh rQ )r/ rL rI r0 r1 ro G s � z%FIPSCommonEntitlement._perform_enablec s| ddg}t �|d�|�d �}g }|�� D ]}|| jkr*|�|� q*|rjddg| }t �|d�|�d �}t� j|d� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UserFacingError: on failure to setup any aspect of this apt
configuration
zapt-markZ showholds� z failed.Zunholdrn N)r Zrun_apt_command�join�
splitlines�fips_pro_package_holds�appendrD �setup_apt_config)r/ rL �cmdZholdsZunholdsZholdZ
unhold_cmdrI r0 r1 ru R s
�z&FIPSCommonEntitlement.setup_apt_config)NTT)F)F)F) �__name__�
__module__� __qualname__Zrepo_pin_priorityZ
repo_key_filerd Zapt_noninteractiveZ help_doc_urlrs �propertyr2 r r �strrV rE rR rW r r r\ rC r r Z NamedMessager_ rk ro ru �
__classcell__r0 r0 rI r1 r' S sl �
�
�2 � � � �+ r' c s� e Zd ZdZdZdZdZeee df d�dd��Z
eee df d�� fd d
� �Z ee
d�d d ��Zdeed�� fdd�
Z� ZS )�FIPSEntitlement�fipsZFIPSz NIST-certified core packagesZ
UbuntuFIPS.rX c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
Z uaclient.entitlements.livepatchr � uaclient.entitlements.realtimer� r r ZLIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlementZ FIPS_UPDATES_INVALIDATES_FIPSZREALTIME_FIPS_INCOMPATIBLE)r/ r r� r0 r0 r1 �incompatible_serviceso s � � ��z%FIPSEntitlement.incompatible_servicesc s� t � j}t| j�}tj}t|�� d |k��t� � }|r>|j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )Nr F)r~ � fips_updatesc s � S rY r0 r0 )�is_fips_updates_enabledr0 r1 r; � r< z4FIPSEntitlement.static_affordances.<locals>.<lambda>c s � S rY r0 r0 )�fips_updates_once_enabledr0 r1 r; � r< )rD r\ r� rU r rg rV r_ r �readr� r Z$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrB r8 Z)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r/ r\ r� Zenabled_statusZservices_once_enabled_objrI )r� r� r1 r\ � s6
��� �
� �
��z"FIPSEntitlement.static_affordancesc C sZ d }t �� r&tjj| jd�}tjg}ntj}tj || j
d�fg|tj tj | j
d�fgd�S �Nr7 )�msg�
assume_yes)Z
pre_enable� post_enableZ pre_disable) r
r, r � PROMPT_FIPS_CONTAINER_PRE_ENABLErB r8 �FIPS_RUN_APT_UPGRADEZPROMPT_FIPS_PRE_ENABLEr �prompt_for_confirmationr� �PROMPT_FIPS_PRE_DISABLE�r/ r� Zpre_enable_promptr0 r0 r1 � messaging� s( ��
������zFIPSEntitlement.messagingFrm c sH t � \}}|d kr&|tjkr&t�d� t� j|d�rDt�t j
� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.rn TF) r
r ZCLOUD_ID_ERROR�loggingZwarningrD ro r r` r ZFIPS_INSTALL_OUT_OF_DATE)r/ rL Z
cloud_type�errorrI r0 r1 ro � s
��z FIPSEntitlement._perform_enable)F)rw rx ry �namer8 � description�originrz r r r� r r\ r r� rV ro r| r0 r0 rI r1 r} h s ! r} c sb e Zd ZdZdZdZdZeee df d�dd��Z
ee d�d d
��Z de
e
d �� fd
d�
Z� ZS )r� z fips-updatesz FIPS UpdatesZUbuntuFIPSUpdatesz;NIST-certified core packages with priority security updates.rX c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r} r Z FIPS_INVALIDATES_FIPS_UPDATESZ"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r/ r� r0 r0 r1 r� � s ���z,FIPSUpdatesEntitlement.incompatible_servicesc C sZ d }t �� r&tjj| jd�}tjg}ntj}tj || j
d�fg|tj tj | j
d�fgd�S r� ) r
r, r r� rB r8 r� Z PROMPT_FIPS_UPDATES_PRE_ENABLEr r� r� r� r� r0 r0 r1 r� � s( ��
������z FIPSUpdatesEntitlement.messagingFrm c sV t � j|d�rR| j�d�p i }|�| jdi� | jjd|d� t�t dd�� dS dS )Nrn zservices-once-enabledT)r= Zcontent)r� F)
rD ro rU Z
read_cache�updater� Z write_cacher �writer )r/ rL Zservices_once_enabledrI r0 r1 ro s � ��z&FIPSUpdatesEntitlement._perform_enable)F)rw rx ry r� r8 r� r� rz r r r� r r� rV ro r| r0 r0 rI r1 r� � s
r� )0r� ra � itertoolsr �typingr r r Zuaclientr r r r r
r Zuaclient.clouds.identityr r
Zuaclient.entitlementsr Zuaclient.entitlements.baser Z(uaclient.entitlements.entitlement_statusr Zuaclient.filesr Zuaclient.files.noticesr Zuaclient.files.state_filesr r Zuaclient.typesr r r Zget_event_loggerr@ Z CONDITIONAL_PACKAGES_EVERYWHEREZ!CONDITIONAL_PACKAGES_OPENSSH_HMACr. Z&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIALZ&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONICZ%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALr- ZRepoEntitlementr' r} r� r0 r0 r0 r1 �<module> s� �������������� j