Your IP : 216.73.216.218
U
��.d 1 � @ s� d dl Z d dlZd dlmZmZmZmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZmZ d dlmZ d dlmZ ddgZd d
d �Ze �� ZG d d
� d
e�Zdd� Z dS )� N)�Any�Dict�Optional�Tuple)�apt� event_logger�
exceptions� livepatch�messages�snap�system�util)�IncompatibleService�
UAEntitlement)�ApplicationStatus)�StaticAffordanceg �?g �?z)Invalid Auth-Token provided to livepatch.z2Your running kernel is not supported by Livepatch.)zUnknown Auth-Tokenzunsupported kernelc s� e Zd ZdZdZdZdZdZdZdZ dZ
e e e
df d�d d
��Ze e edf d�d d ��Zd eed
�dd�Zd eeed�dd�Zd dd�Ze eeej f d�dd�Ze eeej f d�dd�Zdd� Zd!e e e f e e e f eed�� fd d �
Z � Z S )"�LivepatchEntitlementz%https://ubuntu.com/security/livepatchr Z LivepatchzCanonical Livepatch serviceFT.)�returnc C s0 ddl m} ddlm} t|tj�t|tj�fS )Nr ��FIPSEntitlement)�RealtimeKernelEntitlement)�uaclient.entitlements.fipsr Z uaclient.entitlements.realtimer r r
ZLIVEPATCH_INVALIDATES_FIPSZ REALTIME_LIVEPATCH_INCOMPATIBLE)�selfr r � r �A/usr/lib/python3/dist-packages/uaclient/entitlements/livepatch.py�incompatible_services+ s ���z*LivepatchEntitlement.incompatible_servicesc sP ddl m} || j�}t|�� d tjk�� tjdd� dftj � fdd�dffS )Nr r c S s t �� S �N)r � is_containerr r r r �<lambda>H � z9LivepatchEntitlement.static_affordances.<locals>.<lambda>Fc s � S r r r �Zis_fips_enabledr r r M r )
r r �cfg�bool�application_statusr �ENABLEDr
Z$LIVEPATCH_ERROR_INSTALL_ON_CONTAINERZ!LIVEPATCH_ERROR_WHEN_FIPS_ENABLED)r r Zfips_entr r r �static_affordances: s
��
��z'LivepatchEntitlement.static_affordances)�silentr c
C s� t �tj�s�t�d� t�tj� z t� � W n4 t
j k
rb } zt �
dt|�� W 5 d}~X Y nX z t jddddgtjd� W q� t
jk
r� t
�� �Y q�X nt�� s�t
jtj| jd ��z t jtjd
d d gd
d� W nL t
jk
�r$ } z*t�dt|��� ��rt �tj� n� W 5 d}~X Y nX t� d| j j tj �}t� d| j j tj!�}tj"||tj#d� t$�%� �s�t�d� z t jtjddgd
tj#d� W n6 t
jk
�r� } zt
j&t|�d��W 5 d}~X Y nX t$�'||� | j(d
d
d�S )zYEnable specific entitlement.
@return: True on success, False otherwise.
zInstalling snapdz<Trying to install snapd. Ignoring apt-get update failure: %sNzapt-get�installz --assume-yesZsnapd�� retry_sleeps)Zsnap_cmd�service�waitr z seed.loadedT��capturezunknown command .*waitZhttpZhttps)�
http_proxy� https_proxyr) z#Installing canonical-livepatch snapzcanonical-livepatch)r- r) )Z error_msg��process_directives�
process_token))r Zwhichr ZSNAP_CMD�event�infor
ZAPT_UPDATING_LISTSr Zrun_apt_update_commandr ZUserFacingError�logging�debug�str�subpZ APT_RETRIES�ProcessExecutionErrorZCannotInstallSnapdErrorZ is_installedZ SnapdNotProperlyInstalledError�title�re�search�lowerZwarningZ SNAPD_DOES_NOT_HAVE_WAIT_CMDr
Zvalidate_proxyr! r. Z PROXY_VALIDATION_SNAP_HTTP_URLr/ Z PROXY_VALIDATION_SNAP_HTTPS_URLZconfigure_snap_proxyZSNAP_INSTALL_RETRIESr �is_livepatch_installedZErrorInstallingLivepatchZconfigure_livepatch_proxy�setup_livepatch_config)r r& �er. r/ r r r �_perform_enableR sz
�
�
� �
� ��
�
" �z$LivepatchEntitlement._perform_enable)r1 r2 r c
C s� | j jj�| j�}|rnz t|� W nJ tjk
rl } z*dt|� }t �
|� t � |� W Y �dS d}~X Y nX |�r�|�d�}|s�t �
d| j� | j jd }| �� \}}|tjk�rt �
d| j� zt�tjdg� W n: tjk
�r } zt � t|�� W Y �dS d}~X Y nX ztjtjd |gd
d � W n� tjk
�r� } z^d }t�� D ]&\} }
| t|�k�rN||
7 } �qv�qN|d k�r�|t|�7 }t �
|� W Y �dS d}~X Y nX t �
d
� d
S )a Processs configuration setup for livepatch directives.
:param process_directives: Boolean set True when directives should be
processsed.
:param process_token: Boolean set True when token should be
processsed.
z Unable to configure Livepatch: FN�
resourceTokenzHNo specific resourceToken present. Using machine token as %s credentialsZ machineTokenz.Disabling %s prior to re-attach with new token�disable�enableTr, z Unable to enable Livepatch: z Canonical livepatch enabled.)r! Zmachine_token_fileZ entitlements�get�name�process_config_directivesr r9 r7 r3 r4 r5 �errorr6 r: Z
machine_tokenr# r �DISABLEDr r8 r �
LIVEPATCH_CMD�
ERROR_MSG_MAP�items) r r1 r2 Zentitlement_cfgr@ �msgZlivepatch_tokenr# Z_detailsZ
error_messageZ
print_messager r r r? � s^
�
� �
�
z+LivepatchEntitlement.setup_livepatch_configc C s$ t �� s dS tjt jdgdd� dS )zYDisable specific entitlement
@return: True on success, False otherwise.
TrC r, )r r> r r8 rJ )r r& r r r �_perform_disable� s z%LivepatchEntitlement._perform_disablec
C s� t jd f}t�� s t jtjfS ztjtj dgt
d� W nP t j k
r� } z0t
�dt|�� t jtjdt|�d�f W Y �S d }~X Y nX |S )N�statusr( zLivepatch not enabled. %s� )rF rM )r r$ r r> rI r
ZLIVEPATCH_NOT_ENABLEDr r8 rJ �LIVEPATCH_RETRIESr r9 r5 r6 r7 � NamedMessage)r rO r@ r r r r# � s
�
�z'LivepatchEntitlement.application_statusc C s6 t �� dkr2t�� }t�� }dtjj|j|d�fS dS )NFT)�version�arch)FN) r �on_supported_kernelr Zget_kernel_infoZ
get_dpkg_archr
Z LIVEPATCH_KERNEL_NOT_SUPPORTED�formatZ
uname_release)r Z kernel_inforT r r r �enabled_warning_status� s ��z+LivepatchEntitlement.enabled_warning_statusc C s t �� dkrt�� stjS d S )NF)r rU r r r
Z*LIVEPATCH_KERNEL_NOT_SUPPORTED_DESCRIPTION)r r r r �status_description_override s
��z0LivepatchEntitlement.status_description_override)� orig_access�deltas� allow_enabler c
s� t � �|||�rdS |�di �}|�di ��dd�}|rH| �� \}}|S | �� \}}|tjkrbdS |�di �} tddg�}
t|
� | ��} t|�d d��} t
| | g�r�t � d
| j
� | j| | d �S dS ) a1 Process any contract access deltas for this entitlement.
:param orig_access: Dictionary containing the original
resourceEntitlement access details.
:param deltas: Dictionary which contains only the changed access keys
and values.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:return: True when delta operations are processed; False when noop.
T� entitlementZ obligationsZenabledByDefaultF�
directives�caCerts� remoteServerrB z$Updating '%s' on changed directives.r0 )�super�process_contract_deltasrE rD r# r rI �setr" � intersection�anyr5 r4 rF r? )
r rY rZ r[ Zdelta_entitlementZprocess_enable_defaultZenable_success�_r# Zdelta_directivesZsupported_deltasr1 r2 �� __class__r r ra s4 �
� �z,LivepatchEntitlement.process_contract_deltas)F)TT)F)F)!�__name__�
__module__� __qualname__Z help_doc_urlrF r: Z descriptionZ#affordance_check_kernel_min_versionZ affordance_check_kernel_flavorZaffordance_check_seriesZaffordance_check_arch�propertyr r r r r% r" rA r? rN r r r
rR r# rW rX r r7 r ra �
__classcell__r r rf r r sB E � � ;
� � �
�r c C s� | sdS | � di �� di �}|� d�}|rFtjtjdd�|�gdd� |� d d
�}|�d �rh|dd � }|r�tjtjdd
�|�gdd� dS )a� Process livepatch configuration directives.
We process caCerts before remoteServer because changing remote-server
in the canonical-livepatch CLI performs a PUT against the new server name.
If new caCerts were required for the new remoteServer, this
canonical-livepatch client PUT could fail on unmatched old caCerts.
@raises: ProcessExecutionError if unable to configure livepatch.
Nr\ r] r^ Zconfigz ca-certs={}Tr, r_ rP �/���zremote-server={})rE r r8 r rJ rV �endswith)r! r] Zca_certsZ
remote_serverr r r rG 9 s.
��
��rG ) r5 r; �typingr r r r Zuaclientr r r r r
r r r
Zuaclient.entitlements.baser r Z(uaclient.entitlements.entitlement_statusr Zuaclient.typesr rQ rK Zget_event_loggerr3 r rG r r r r �<module> s (
�