File: //lib/python3/dist-packages/uaclient/entitlements/__pycache__/fips.cpython-310.pyc
o
� ~c0I � @ sB d dl Z d dlZd dlmZ d dlmZmZmZ d dlm Z m
Z
m Z m Z m
Z
mZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZmZ d d
lm Z m Z m Z e
� � Z g d �Z!d d
gZ"e!e" e!e" e!d�Z#g d�Z$g d�Z%g d�Z&e!e" e$ e!e" e% e!e& d�Z'G dd� dej(�Z)G dd� de)�Z*G dd� de)�Z+dS )� N)�groupby)�List�Optional�Tuple)�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�IncompatibleService)�ApplicationStatus)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)�
strongswan�strongswan-hmac�openssh-client�openssh-server�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal)�openssl� libssl1.0.0�libssl1.0.0-hmac)r � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s( e Zd ZdZdZdZdZdZg d�Ze dd� �Z
d&d
e e e
d ed ed
d f� fdd�
Z d'de
ded
d fdd�Zde
de
d
ef� fdd� Ze d
eedf fdd��Ze d
e e
f� fd d � �Zd
eee ej f f� fd d � Zd(d d!�Zd'ded
ef� fd"d#�
Zd'ded
d f� fd$d%�
Z � Z S ))�FIPSCommonEntitlementi� zubuntu-advantage-fips.gpgz /proc/sys/crypto/fips_enabledTz/https://ubuntu.com/security/certifications#fips)zfips-initramfsr" r# r r! r r! z
linux-fipsr r r r r r r r$ r% zfips-initramfs-genericc C s0 t �� �dd�}t �� rt�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
�series� )r
�get_platform_info�get� is_container�#FIPS_CONTAINER_CONDITIONAL_PACKAGES�FIPS_CONDITIONAL_PACKAGES)�selfr' � r/ �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.py�conditional_packagess s z*FIPSCommonEntitlement.conditional_packagesN� package_list�cleanup_on_failure�verbose�returnc
s� |r t �dj| jd�� | j}t� j|dd� g }t�� }t t
| j �dd� d�}|D ] \}} ||v r6|| 7 }q*|D ]$}
z t� j|
gddd� W q9 t j
y] t �tjj| j|
d �� Y q9w d
S ) a) Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
:param verbose: If true, print messages to stdout
zInstalling {title} packages��titleF)r2 r4 c S s | � dd�S )Nz-hmacr( )�replace)�pkg_namer/ r/ r0 �<lambda>� � z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>)�key)r2 r3 r4 )�service�pkgN)�event�info�formatr7 �packages�super�install_packagesr � get_installed_packages_namesr �sortedr1 r �UserFacingErrorr �FIPS_PACKAGE_NOT_AVAILABLE) r. r2 r3 r4 �mandatory_packages�desired_packages�installed_packages�
pkg_groupsr9 �pkg_listr> �� __class__r/ r0 rD � s:
�� �
�����z&FIPSCommonEntitlement.install_packagesF� operation�silentc C st t �� }t�|� |r6|st�tjj|d�� |dkr'| jj �
dtj j � dS |dkr8| jj �
dtj
� dS dS dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)rP �installr( zdisable operationN)r
�
should_rebootr? � needs_rebootr@ r �ENABLE_REBOOT_REQUIRED_TMPLrA �cfg� notice_file�add�FIPS_SYSTEM_REBOOT_REQUIRED�msg� FIPS_DISABLE_REBOOT_REQUIRED)r. rP rQ �reboot_requiredr/ r/ r0 �_check_for_reboot_msg� s&
����� z+FIPSCommonEntitlement._check_for_reboot_msgr' �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcp)�config�
path_to_valueT)r r zubuntu-gcp-fips)r �is_config_value_truerV �boolrC rB )r. r' r^ rN r/ r0 � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c sd dddd�}t � \� }� d u rd� t�� �dd��tjj��� |�� �d�}|� ��fdd �d
ffS ) Nzan AWSzan Azureza GCP)�aws�azurer_ r( r' )r' �cloudc s �� �� �S �N)rd r/ �r^ r. r' r/ r0 r: � r; z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T)r
r
r) r* r �FIPS_BLOCK_ON_CLOUDrA r7 )r. � cloud_titles�_�blocked_messager/ ri r0 �static_affordances� s
���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS rh )r
r+ rC rB )r. rN r/ r0 rB s z FIPSCommonEntitlement.packagesc s t � �� \}}t�� r t�� s | jj�dtj j
� ||fS t j �
| j�rst�t| j��s6| jj�dtj j
� | jj�dtj� t�| j��� dkrV| jj�dtj� ||fS | jj�dtj� | jj�dtj� tjtjj| jd�fS | jj�dtj� |tjkr�||fS tjtj fS )Nr( �1)� file_name) rC �application_statusr
r+ rS rV rW �
try_remover rY rZ �os�path�exists�FIPS_PROC_FILE�setrB �FIPS_REBOOT_REQUIRED_MSG� load_file�strip� NOTICE_FIPS_MANUAL_DISABLE_URLr[ �try_addr �DISABLED�FIPS_PROC_FILE_ERRORrA �ENABLED�FIPS_REBOOT_REQUIRED)r. � super_status� super_msgrN r/ r0 rq sL ���������
�z(FIPSCommonEntitlement.application_statusc C st t t�� �}t | j��t | j��}|�|�}|r8ddi}ddg}tjg d�| t|� t j
j | j d�|d� dS dS ) z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
�DEBIAN_FRONTEND�noninteractivez$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold")zapt-get�removez --assume-yesr6 )�envN)
rw r rE rB �
differencer1 � intersection�run_apt_command�listr �DISABLE_FAILED_TMPLrA r7 )r. rK �fips_metapackage�remove_packagesr� � apt_optionsr/ r/ r0 r� > s(
�
���
��z%FIPSCommonEntitlement.remove_packagesc s: t � j|d�r| jj�dtj� | jj�dtj� dS dS )N�rQ r( TF)rC �_perform_enablerV rW rr r �&NOTICE_WRONG_FIPS_METAPACKAGE_ON_CLOUDrx �r. rQ rN r/ r0 r� W s ��z%FIPSCommonEntitlement._perform_enablec s| ddg}t �|d�|�d �}g }|�� D ] }|| jv r!|�|� q|r5ddg| }t �|d�|�d �}t� j|d� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UserFacingError: on failure to setup any aspect of this apt
configuration
zapt-mark� showholds� z failed.�unholdr� N)r r� �join�
splitlines�fips_pro_package_holds�appendrC �setup_apt_config)r. rQ �cmd�holds�unholds�hold�
unhold_cmdrN r/ r0 r� c s
� �z&FIPSCommonEntitlement.setup_apt_config)NTT�F)r5 N) �__name__�
__module__� __qualname__�repo_pin_priority�
repo_key_filerv �apt_noninteractive� help_doc_urlr� �propertyr1 r r �strrc rD r] rd r r rn rB r r � NamedMessagerq r� r� r� �
__classcell__r/ r/ rN r0 r& Q s\
�
����2���
���� �
5 r& c s� e Zd ZdZdZdZdZedee df fdd��Z
edee df f� fd d
� �Z ede
fd d ��Zddedef� fdd�
Z� ZS )�FIPSEntitlement�fips�FIPSz NIST-certified core packages�
UbuntuFIPSr5 .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
� uaclient.entitlements.livepatchr� � uaclient.entitlements.realtimer� r r �LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)r. r� r� r/ r/ r0 �incompatible_services� s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| j�}tj}t|�� d |k��t� � }|r |j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )Nr F)r� � fips_updatesc � � S rh r/ r/ )�is_fips_updates_enabledr/ r0 r: � � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r� rh r/ r/ )�fips_updates_once_enabledr/ r0 r: � r� )rC rn r� rV r r rc rq r �readr� r �$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrA r7 �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r. rn r� �enabled_status�services_once_enabled_objrN )r� r� r0 rn � s2
����
��
��z"FIPSEntitlement.static_affordancesc C �Z d }t �� rtjj| jd�}tjg}ntj}tj || j
d�fg|tj tj | j
d�fgd�S �Nr6 )rZ �
assume_yes)�
pre_enable� post_enable� pre_disable) r
r+ r � PROMPT_FIPS_CONTAINER_PRE_ENABLErA r7 �FIPS_RUN_APT_UPGRADE�PROMPT_FIPS_PRE_ENABLEr �prompt_for_confirmationr� �PROMPT_FIPS_PRE_DISABLE�r. r� �pre_enable_promptr/ r/ r0 � messaging� �( ��
������zFIPSEntitlement.messagingFrQ c sN t � \}}|d u r|tjkrt�d� t� j|d�r%| jj� dt
j � dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.r� r( TF) r
r �CLOUD_ID_ERROR�logging�warningrC r� rV rW rr r �FIPS_INSTALL_OUT_OF_DATE)r. rQ �
cloud_type�errorrN r/ r0 r� � s
��z FIPSEntitlement._perform_enabler� )r� r� r� �namer7 � description�originr� r r r� r rn r r� rc r� r� r/ r/ rN r0 r� y s ! r� c sd e Zd ZdZdZdZdZedee df fdd��Z
ede fd d
��Z dd e
de
f� fd
d�
Z� ZS )r� z fips-updatesz FIPS Updates�UbuntuFIPSUpdatesz;NIST-certified core packages with priority security updatesr5 .c C s$ ddl m} tttj�t|tj�fS )Nr r� )r� r� r r� r � FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r. r� r/ r/ r0 r� � s ���z,FIPSUpdatesEntitlement.incompatible_servicesc C r� r� ) r
r+ r r� rA r7 r� � PROMPT_FIPS_UPDATES_PRE_ENABLEr r� r� r� r� r/ r/ r0 r� � r� z FIPSUpdatesEntitlement.messagingFrQ c s8 t � j|d�r| jj�dtj� t�t dd�� dS dS )Nr� r( T)r� F)
rC r� rV rW rr r r[ r �writer r� rN r/ r0 r� s ��z&FIPSUpdatesEntitlement._perform_enabler� )r� r� r� r� r7 r� r� r� r r r� r r� rc r� r� r/ r/ rN r0 r� � s
r� ),r� rs � itertoolsr �typingr r r �uaclientr r r r r
r �uaclient.clouds.identityr r
�uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerr? � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMACr- �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALr, �RepoEntitlementr& r� r� r/ r/ r/ r0 �<module> s\ ���������� *j