| Current File : //kunden/usr/share/crypto-policies/python/__pycache__/update-crypto-policies.cpython-39.pyc |
a
�
�g�7 � @ s* d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm Z d dl
Z
d dl Z
d dl Z dd� e_
dZdZdZdZdadadadadadad d
� Zd*d d �Zd
d� Zdd� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd � Z!d+d d �Z"G d d!� d!�Z#d"d#� Z$d,d%d&�Z%d'd(� Z&e'd)k�r&e&� dS )-� N)�mkdtemp�mkstempc O s2 |j � dt| �d d� �� t| �dd � � d�S )Nz: � �
)�__name__�str�upper)�msg�categoryZ _unused_aZ _unused_kwa� r �;/usr/share/crypto-policies/python/update-crypto-policies.py�<lambda> s r
z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz /proc/sys/crypto/fips_enabledc O s t | dtji|�� d S )N�file)�print�sys�stderr)�args�kwargsr r r �eprint& s r c C s� zt jd attj_W n ty, taY n0 | d ur<| an.zt jd attj_ W n tyh t
aY n0 t j � td�a
t j � td�at j � td�at j � tt�ad S )N� profile_dir�base_dirzlocal.dz back-ends�state)�os�environr �cryptopolicies�UnscopedCryptoPolicyZ SHARE_DIR�KeyError�DEFAULT_PROFILE_DIRr Z
CONFIG_DIR�DEFAULT_BASE_DIR�path�join� local_dir�backend_config_dir� state_dir�RELOAD_CMD_NAME�reload_cmd_path��alt_baser r r � dir_paths* s
r( c C s@ t �� }t �| � t �d�}dd� |D �}t|�}t �|� |S )N�.c s s& | ] \}}}|t |�t |�fV qd S �N)�sorted)�.0�root�dirs�filesr r r � <genexpr>P � zget_walk.<locals>.<genexpr>)r �getcwd�chdir�walkr+ )r Zold_cwdr4 r r r �get_walkI s
r5 c C s� t jdd�} | �� }|jdddddd� |jd d
d d � |jd
d
dd � |jdd
dd � | jdd
t jd � | jdd
dd � | �� S )zParse the command lineF)� allow_abbrevz--set�?� ZPOLICYzset the policy POLICY)�nargs�default�metavar�helpz--show�
store_truez.show the current policy from the configuration)�actionr< z --is-appliedz+check whether the current policy is appliedz--checkzAcheck whether the generated policy files match the current policyz
--no-checkz --no-reloadz3do not run the reload scripts when setting a policy)�argparse�ArgumentParser� add_mutually_exclusive_group� add_argument�SUPPRESS�
parse_args)�parser�groupr r r rD V s* ������rD c C s~ z0t �t j�td��j} t �t j�td��j}W n tyL t� d� Y n0 | |krht
d� t� d� t
d� t� d� d S )N�current�config�M z The configured policy is appliedr z$The configured policy is NOT appliedr ) r �statr r r# �st_mtimer �OSErrorr �exitr )Ztime1Ztime2r r r �
is_appliedk s
rN c C s� t } t}t}t}t� }t|d� tj|td� tjt j
� | d�t j
� t d�d� t � t
� }t|ddd� t|�}tt�}t|�}tt�} d}
||kr�d}
|| kr�d}
|t|f} |t| f} | | fD ]�\}
}}|D ]�\}}}|D ]�}|
r� q�t j
� |
||�}t j
� |||�}t|d��r}t|d��F}|
�sX|�d�}|�d�}||k�rJd}
|�s"�qX�q"W d � n1 �sn0 Y W d � q�1 �s�0 Y q�q�q�t�|� |
�r�td � t�d
� ntd � t�d � d S )
Nr& )�src�dstrH F)�
print_enabled�allow_symlinkingT�rbi z9The configured policy does NOT match the generated policyr z2The configured policy matches the generated policyr )r r! r" r# r r( �shutil�copytree�copyr r r �setup_directories�
parse_pconfig� apply_policyr5 �open�read�rmtreer r rM r )Z
orig_base_dirZorig_local_dirZorig_backend_config_dirZorig_state_dirr' �pconfigZwalk_orig_backendZ walk_backendZwalk_orig_stateZ
walk_state�errZ_backend�_stateZ orig_prefixZ
tmp_prefixr4 �d�_Zfl�fZf_origZf_tmp�fp1�fp2�b1�b2r r r �checky sZ
�
N
rg c C s< z$t jtddd� t jtddd� W n ty6 Y n0 d S )Ni� T)�mode�exist_ok)r �makedirsr" r# rL r r r r rW � s
rW c C s\ zBt tdd��"} t| �� �dkW d � W S 1 s60 Y W n tyV Y dS 0 d S )N�ascii��encodingr F)rZ �FIPS_MODE_FLAG�intr[ rL )rb r r r � fips_mode� s
4 rp c C s� t || d�\}}t�|t|d�� t�|� t�|d� zRzt�|tj�| |�� W n( t y| t�
|� t� |� � Y n0 W t� |� n t� |� 0 d S )N��prefix�dir�utf-8i� ) r r �write�bytes�fsync�fchmod�renamer r rL �unlink�close)� directory�filename�contents�fdr r r r �
safe_write� s
r� c C sn t || d�\}}t�|� t�|� t�||� zt�|tj�| |�� W n tyh t�|� � Y n0 d S )Nrq ) r r r{ rz �symlinkry r r rL )r| r} �targetr r r r r � safe_symlink� s
r� Fc
C s� t j�||d �}tt�|��} d}
| D ]} t j�| �r(d}
qBq(t j�|t| �|d �} t �| t j�}
|
s�|
r�|r�t ||d | � d S |
r�| j
s�|r�t | dd��}|� � }W d � n1 s�0 Y t
||d |� |
�r�t j�||d �}z�t |ddd���}| D ]�} z:t | dd��}|� � }W d � n1 �s:0 Y W n( t�yn td | � �� Y �qY n0 z|�|� W n( t�y� td
| � d |� �� Y n0 �qW d � n1 �s�0 Y W n$ t�y� td |� d
�� Y n0 d S )Nz -*.configFTz.txtz.configrt rl �az Cannot read local policy file z$Error appending local configuration z to z Error opening configuration z" for appending local configuration)r r r r+ �glob�existsr �access�R_OKr� � subpoliciesrZ r[ r� rL r ru )r] ZcfgnameZcfgdataZcfgdirZlocaldirZ
profiledir�policy_was_emptyrR Zlocal_cfg_pathZ
local_cfgsZlocal_cfg_presentZlcfgZ profilepathZprofilepath_existsZf_preZcfgfile�cfZlfZ
local_datar r r � save_config� sJ &, ��6r� c @ s> e Zd Zdd� Zddd�Zdd� Zdd � Zd
d � Zd d
� ZdS )�
ProfileConfigc C s d| _ g | _d S )Nr8 )�policyr� ��selfr r r �__init__ s zProfileConfig.__init__Fc s^ |� � �d�� � d r0|s0� d | _� dd � � � fdd�� D �� |rT| j�� � n� | _d S )N�:r r c s g | ] }� r|�qS r r �r, �i��lr r �
<listcomp> r1 z.ProfileConfig.parse_string.<locals>.<listcomp>)r �splitr� r� �extend)r� �s� subpolicyr r� r � parse_string s
zProfileConfig.parse_stringc C sj d}t |dd��F}|D ]0}|�dd�d }|�� }|r| �||� d}qW d � n1 s\0 Y d S )NFrt rl �#r r T)rZ r� �stripr� )r� r} r� rb �liner r r �
parse_file" s zProfileConfig.parse_filec s( |� � �d�� � fdd�| jD �| _d S )Nr� c s g | ]}|� vr|�qS r r r� r� r r r� . r1 z4ProfileConfig.remove_subpolicies.<locals>.<listcomp>)r r� r� )r� r� r r� r �remove_subpolicies, s z ProfileConfig.remove_subpoliciesc C s& | j }d�| j�}|r"|d | }|S )Nr� )r� r r� )r� r� Zsubsr r r �__str__0 s
zProfileConfig.__str__c C s t t| �� d S r* )r r r� r r r �show7 s zProfileConfig.showN)F) r �
__module__� __qualname__r� r� r� r� r� r� r r r r r� s
r� c C sX t � } tj�td�}t�|tj�r.| �|� n&t� r@| � d� n| �tj�t
d�� | S )NrH �FIPSzdefault-config) r� r r r r r� r� r� rp r� r )r] Z
configfiler r r rX ; s rX Tc C s� d}d}|r�| j }| �|� d}tj�d�}| j |kr�|r�| j dkrb|s�td� td� td� n&t� r�td � td
� td � td � ttkr�t� � dkr�td
� t
� d� zt j
| j g| j�R � }W n| t jj�y } z t| � t
� d� W Y d } ~ nJd } ~ 0 t jj�yD } z$td| � �� t
� d� W Y d } ~ n
d } ~ 0 0 |�r\tdt| � � dd� tt�D �}
|
D ]�} tj| } | � }
z|
�|�|
j��}W n. t�y� td|
j � td� d}Y n0 z"t | |
j|t t t |� � |d� W n. t!�y td|
j � td� d}Y n0 �qr|�rbzt"tdt| �d � W n t!�y` td� d}Y n0 zt"t#dt| �d � W n t!�y� td � d }Y n0 zt"t#d t|�� W n t!�y� td � d }Y n0 |�r�td � td!� td"� |S )#Nr FTz/usr/bin/bootcr� zHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz FIPS compliance.z8 Use 'fips-mode-setup --enable' command instead.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz! non-compliant with FIPS.z8 It can also break the ssh access to the system.zI Use 'fips-mode-setup --disable' to disable the system FIPS mode.z/You must be root to run update-crypto-policies.r z%Errors found in policy, first one:
zSetting system policy to c S s g | ]}d |v r|�qS )� Generatorr )r, �gr r r r� w r1 z apply_policy.<locals>.<listcomp>z Error generating config for z Keeping original configuration)r� rR zError saving config for rH r z.Error setting the current policy configuration� rG z$Error updating current policy marker� z CURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.)$r� r� r r r� r rp r r �geteuidr rM r r r� Z
validationZPolicyFileNotFoundErrorZPolicySyntaxErrorr r rs �policygenerators�__dict__Zgenerate_configZscopedZSCOPES� LookupErrorZ CONFIG_NAMEr� r" r! r Zis_emptyrL r� r# )r] �profilerQ rR r^ Z
set_configZ oldpolicyZbootcZcp�ex�
generatorsr� �cls�genrH r r r rY I s�
�
�
rY c C s� t � t� } | jr"t� t�d� | jr8t� t�d� t� t� }| jr\|�� t�d� | j }t
||�}| j s�t �
dtg� t�|� dS )z!The actual command implementationr z /bin/bashN)r( rD rN r rM rg rW rX r� �setrY Z no_reload�
subprocess�callr% )Zcmdliner] r� r^ r r r �main� s$
r� �__main__)N)F)NTT)(r? r� r rT r� r �warningsZtempfiler r r Zcryptopolicies.validationr� �
formatwarningr r r$ rn r r r! r" r# r% r r( r5 rD rN rg rW rp r� r� r� r� rX rY r� r r r r r �<module> sR
: �
3) �
a!