File: //usr/lib/python3/dist-packages/uaclient/__pycache__/security.cpython-310.pyc
o
S��cA� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZmZmZ d dlmZmZmZmZmZmZ d dlmZmZmZ d dl m Z d dl m Z m Z d d l!m"Z" d d
l#m$Z$m%Z% d d l&m'Z' d Z(d
Z)dZ*dZ+dZ,dZ-dZ.dZ/e
dde0fdee1 fdee1 fde0fg�Z2ej3G dd� dej4��Z5G dd � d ej6�Z7G d d � d �Z8G d d � d �Z9G d!d"� d"�Z:d#e e1e e1e1f f fd$d%�Z;d&e e: d'e e1e0f d#e e1e e1e e1e1f f f fd(d)�Z<d*d+� Z= ,dod-e d.e1d/e0d#e5fd0d1�Z>d2d3� Z?d4d5� Z@d6e:d7e e1e e1e1f f d#e e1e8f fd8d9�ZAd:e9d7e e1e e1e1f f d#e e1e8f fd;d<�ZBd.e1d=e e1e8f fd>d?�ZCd@e8dAe e1e e1e1f f d#e8fdBdC�ZDdDdE� ZEdFe ee1e8f dGeFdHeFd#e1fdIdJ�ZGdKe1d-e fdLdM�ZHdKe1d-e d#e0fdNdO�ZId-e dPe e1e ee1e8f f dQe e1e e1 f dGeFdHeFd/e0d#e2fdRdS�ZJde e1 d#e1fdTdU�ZKd-e d.e1d=e e1e8f d7e e1e e1e1f f dVe e1e e1e e1e1f f f d/e0d#e5fdWdX�ZLdpdYdZ�ZMd-e d[e1d#e0fd\d]�ZNd-e d#e0fd^d_�ZOd-e d`e1d#e0fdadb�ZPd-e d/e0d#e0fdcdd�ZQdKe1d-e d/e0d#e0fdedf�ZRd-e d#e0fdgdh�ZSdie e1e
f d-e d/e0d#e0fdjdk�ZTd-e dle e1 dKe1d/e0d#e0f
dmdn�ZUdS )q� N)� defaultdict)�datetime)�Any�Dict�List�
NamedTuple�Optional�Set�Tuple)�apt�
exceptions�messages�
serviceclient�system�util)�CLOUD_TYPE_TO_TITLE�
PRO_CLOUDS�get_cloud_type)�UAConfig)� BASE_UA_URL�PRINT_WRAP_WIDTH)�entitlement_factory)�ApplicabilityStatus�UserFacingStatus)�colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z cves.jsonzcves/{cve}.jsonz notices.jsonznotices/{notice}.jsonzUbuntu standard updateszUbuntu Pro: ESM InfrazUbuntu Pro: ESM Apps� ReleasedPackagesInstallResult�
fix_status� unfixed_pkgs�installed_pkgs�all_already_installedc @ s e Zd ZdZdZdZdZdS )� FixStatuszD
An enum to represent the system status after fix operation
r � � N)�__name__�
__module__� __qualname__�__doc__�SYSTEM_NON_VULNERABLE�SYSTEM_STILL_VULNERABLE� SYSTEM_VULNERABLE_UNTIL_REBOOT� r* r* �3/usr/lib/python3/dist-packages/uaclient/security.pyr 3 s
r c s6 e Zd ZdZdZejZdee e
f dee e
f fdd�Z e j
ejg d�d� d#� fd
d � �Z d$d ee d
ee dee dee dee dee dee deee ded fdd�Zde ddfdd�Z d%dee dee dee dee d ee ded f d d �Zd e dd fd!d"�Z� ZS )&�UASecurityClient� � security_url� query_params�returnc C s. | j j �di ��di �}|r|�|� |S |S )zD
Update query params with data from feature config.
�features�extra_security_params)�cfg�get�update)�selfr/ r2 r* r* r+ �_get_query_paramsD s �
z"UASecurityClient._get_query_params)r! � � )� retry_sleepsNc s" | � |�}t� j|||||dd�S )NF)�path�data�headers�methodr/ �potentially_sensitive)r7 �super� request_url)r6 r; r< r= r> r/ �� __class__r* r+ rA T s
�z UASecurityClient.request_url�query�priority�package�limit�offset� component�version�status�CVEc s: ||||||||d�} � j t| d�\}
} � fdd�|
D �S )znQuery to match multiple-CVEs.
@return: List of CVE instances based on the the JSON response.
)�qrE rF rG rH rI rJ rK �r/ c s g | ]}t � |d ��qS )��client�response)rL )�.0�cve_md�r6 r* r+ �
<listcomp>~ s z-UASecurityClient.get_cves.<locals>.<listcomp>)rA � API_V1_CVES) r6 rD rE rF rG rH rI rJ rK r/ �
cves_response�_headersr* rT r+ �get_cvesb s �
�zUASecurityClient.get_cves�cve_idc C �" | � tj|d��\}}t| |d�S )zkQuery to match single-CVE.
@return: CVE instance for JSON response from the Security API.
)�cverO )rA �API_V1_CVE_TMPL�formatrL )r6 rZ � cve_responserX r* r* r+ �get_cve� �
� zUASecurityClient.get_cve�details�release�order�USNc sJ � ||||d�}�j t|d�\}}t� �fdd�|�dg �D �dd� d�S ) zuQuery to match multiple-USNs.
@return: Sorted list of USN instances based on the the JSON response.
)rb rc rG rH rd rN c s0 g | ]}� d u s� |� dg �v rt�|d��qS )N�cves_idsrO )r4 re )rR �usn_md�rb r6 r* r+ rU � s ��
�z0UASecurityClient.get_notices.<locals>.<listcomp>�noticesc S � | j S �N��id��xr* r* r+ �<lambda>� � z.UASecurityClient.get_notices.<locals>.<lambda>��key)rA �API_V1_NOTICES�sortedr4 ) r6 rb rc rG rH rd r/ �
usns_responserX r* rh r+ � get_notices� s
�
�
��z UASecurityClient.get_notices� notice_idc C r[ )zbQuery to match single-USN.
@return: USN instance representing the JSON response.
)�noticerO )rA �API_V1_NOTICE_TMPLr^ re )r6 rx �notice_responserX r* r* r+ �
get_notice� ra zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r# r$ r% � url_timeout�cfg_url_base_attrr �SecurityAPIError�
api_error_clsr �strr r7 r �retry�socket�timeoutrA r �intr rY r` rw r| �
__classcell__r* r* rB r+ r, > sv
�
����������
�
� ������
� r, c @ s� e Zd ZdZdeeef fdd�Zedd� �Z edd� �Z
ed d
� �Z ed d � �Z ed
d� �Z
edd� �Zedefdd��Zedd� �ZdS )�CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu seriesr_ c C s
|| _ d S rk �rQ )r6 r_ r* r* r+ �__init__� s
zCVEPackageStatus.__init__c C �
| j d S �N� descriptionr� rT r* r* r+ r� � �
z CVEPackageStatus.descriptionc C rj rk )r� rT r* r* r+ �
fixed_version� s z CVEPackageStatus.fixed_versionc C r� )N�pocketr� rT r* r* r+ r� � r� zCVEPackageStatus.pocketc C r� )N�release_codenamer� rT r* r* r+ r� � r� z!CVEPackageStatus.release_codenamec C r� )NrK r� rT r* r* r+ rK � r� zCVEPackageStatus.statusc C sz | j dkrdS | j dkrdS | j dkrdS | j dv r dS | j d kr#d
S | j d kr*d S | j d
kr7tjj| jd�S d�| j �S )N�neededz Sorry, no fix is available yet.z needs-triagez7Ubuntu security engineers are investigating this issue.�pendingz)A fix is coming soon. Try again tomorrow.)�ignored�deferredzSorry, no fix is available.�DNEz.Source package does not exist on this release.� not-affectedz/Source package is not affected on this release.�released)�
fix_streamz UNKNOWN: {})rK r
�SECURITY_FIX_RELEASE_STREAMr^ �
pocket_sourcerT r* r* r+ �status_message� s"
� z CVEPackageStatus.status_messager0 c C s t | jtk�S )z?Return True if the package requires an active Pro subscription.)�boolr� � UBUNTU_STANDARD_UPDATES_POCKETrT r* r* r+ � requires_ua� � z CVEPackageStatus.requires_uac C sP | j dkr t}|S | j dkrt}|S | j dv rt}|S d| jv r$t}|S t}|S )z>Human-readable string representing where the fix is published.� esm-infra�esm-apps)�updates�security�esm)r� �UA_INFRA_POCKET�UA_APPS_POCKETr� r� )r6 �
fix_sourcer* r* r+ r� � s
�
�
��z CVEPackageStatus.pocket_sourceN)r# r$ r% r& r r� r r� �propertyr� r� r� r� rK r� r� r� r� r* r* r* r+ r� � s&
r� c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z
e d d
� �Z d d � Z
e dee fd
d��Ze ded fdd��Ze dd� �Ze deeef fdd��ZdS )rL z7Class representing CVE response from the SecurityClientrP rQ c C � || _ || _d S rk �rQ rP �r6 rP rQ r* r* r+ r� � �
z CVE.__init__r0 c C � t |t�sdS | j|jkS �NF)�
isinstancerL rQ �r6 �otherr* r* r+ �__eq__ �
z
CVE.__eq__c C � | j �dd��� S )Nrm �UNKNOWN_CVE_ID�rQ r4 �upperrT r* r* r+ rm � zCVE.idc C s> | j }| jD ]}|j} dj| j|d�d�| j�g}d�|�S )z2Return a string representing the URL for this cve.�{issue}: {title}��issue�title� https://ubuntu.com/security/{}�
)r� ri r� r^ rm �join)r6 r� ry �linesr* r* r+ �get_url_header
s
�
zCVE.get_url_headerc C � | j �dg �S )N� notices_ids�rQ r4 rT r* r* r+ r� s zCVE.notices_idsre c �< t � d�st� fdd�� j�dg �D �dd� dd�� _� jS ) z�Return a list of USN instances from API response 'notices'.
Cache the value to avoid extra work on multiple calls.
�_noticesc � g | ]}t � j|��qS r* )re rP )rR ry rT r* r+ rU # �
��z CVE.notices.<locals>.<listcomp>ri c S rj rk rl ��nr* r* r+ rp ' rq z CVE.notices.<locals>.<lambda>T�rs �reverse)�hasattrru rQ r4 r� rT r* rT r+ ri �
��z CVE.noticesc C � | j �d�S r� r� rT r* r* r+ r� , � zCVE.descriptionc C sd t | d�r| jS i | _t�� d }| jd D ]}|d D ]}|d |kr-t|�| j|d < q q| jS )z�Dict of package status dicts for the current Ubuntu series.
Top-level keys are source packages names and each value is a
CVEPackageStatus object
�_packages_status�series�packages�statusesr� �name)r� r� r �get_platform_inforQ r� )r6 r� rF �
pkg_statusr* r* r+ �packages_status0 s
���zCVE.packages_statusN)r# r$ r% r& r, r r� r r� r� r� r� rm r� r r� ri r� r� r� r* r* r* r+ rL � s
rL c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z
e defd d
��Z e de
e fd d ��Ze de
e fd
d��Ze dd� �Ze dd� �Zdd� Ze deeeeeeef f f fdd��ZdS )re z7Class representing USN response from the SecurityClientrP rQ c C r� rk r� r� r* r* r+ r� G r� z USN.__init__r0 c C r� r� )r� re rQ r� r* r* r+ r� K r� z
USN.__eq__c C r� )Nrm �UNKNOWN_USN_IDr� rT r* r* r+ rm P r� zUSN.idc C r� )z$List of CVE IDs related to this USN.rf r� rT r* r* r+ rf T r� z USN.cves_idsc r� ) z�List of CVE instances based on API response 'cves' key.
Cache the values to avoid extra work for multiple call-sites.
�_cvesc r� r* )rL rP )rR r\ rT r* r+ rU a r� z USN.cves.<locals>.<listcomp>�cvesc S rj rk rl r� r* r* r+ rp e rq zUSN.cves.<locals>.<lambda>Tr� )r� ru rQ r4 r� rT r* rT r+ r� Y r� zUSN.cvesc C r� )Nr� r� rT r* r* r+ r� j r� z USN.titlec C r� )N�
referencesr� rT r* r* r+ r� n r� zUSN.referencesc C sr dj | j| jd�g}| jr!|�d� | jD ]
}|�d� |�� qn| jr4|�d� | jD ]}|�|� q,d�|�S )z5Return a string representing the URL for this notice.r� r� z Found CVEs:r� zFound Launchpad bugs:r� )r^ rm r� rf �appendr� r� )r6 r� r\ � referencer* r* r+ r� r s
�
zUSN.get_url_headerc C sJ t | d�r| jS t�� d }i | _| j�di ��|g �D ]�}|�d�rW|d | jv rMd| j|d v rCtjdj| j |d d�| j d ��|| j|d d< q d|i| j|d < q |�d
�sltjd j| j |d d �| j d ��d
|d
vr�tjdj| j |d |d
d�| j d ��|d
�
d
�d }|| jvr�i | j|< || j| |d < q | jS )aW Binary package information available for this release.
Reformat the USN.release_packages response to key it based on source
package name and related binary package names.
:return: Dict keyed by source package name. The second-level key will
be binary package names generated from that source package and the
values will be the dict response from USN.release_packages for
that binary package. The binary metadata contains the following
keys: name, version.
Optional additional keys: pocket and component.
�_release_packagesr� �release_packages� is_sourcer� �sourcez6{usn} metadata defines duplicate source packages {pkg})�usn�pkg��issue_id� source_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r� �bin_pkg�/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r� r� �link���) r� r� r r� rQ r4 r �SecurityAPIMetadataErrorr^ rm �split)r6 r� r� �source_pkg_namer* r* r+ r� � sN
��
�� ��
zUSN.release_packagesN)r# r$ r% r& r, r r� r r� r� r� r� rm r rf rL r� r� r� r� r� r* r* r* r+ re D s"
,re r0 c C s| d} t �dd| d dg�\}}i }|�� D ]%}|�d�\}}}}|s%|}d|vr*q||v r5||| |< q||i||< q|S )z�Return a dict of all source packages installed on the system.
The dict keys will be source package name: "krb5". The value will be a dict
with keys binary_pkg and version.
z${db:Status-Status}z
dpkg-queryz#-f=${Package},${Source},${Version},r� z-W�,� installed)r �subp�
splitlinesr� ) � status_field�out�_err�installed_packages�pkg_line�pkg_namer� � pkg_versionrK r* r* r+ �#query_installed_source_pkg_versions� s$
�� r� �usns� beta_pocketsc s� i }| D ]Q}|j �� D ]I\}}� fdd�|�� D �}||vr%|r%|||< q ||v rT|| }|�� D ]"\}} ||vr>| ||< q1|| d }
| d } t�| |
d�sS| ||< q1q q|S )a Walk related USNs, merging the released binary package versions.
For each USN, iterate over release_packages to collect released binary
package names and required fix version. If multiple related USNs
require different version fixes to the same binary package, track the
maximum version required across all USNs.
:param usns: List of USN response instances from which to calculate merge.
:param beta_pockets: Dict keyed on service name: esm-infra, esm-apps
the values of which will be true of USN response instances
from which to calculate merge.
:return: Dict keyed by source package name. Under each source package will
be a dict with binary package name as keys and binary package metadata
as the value.
c s. i | ]\}}d � � |� dd�d �u r||�qS )Fr� �None�r4 )rR � bin_pkg_name�
bin_pkg_md�r� r* r+ �
<dictcomp>� s ���z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rJ �le)r� �itemsr �compare_versions) r� r� �usn_pkg_versionsr� �src_pkg�binary_pkg_versions�public_bin_pkg_versions� usn_src_pkgr� �
binary_pkg_md� prev_version�current_versionr* r r+ �*merge_usn_released_binary_package_versions� s,
�
���r c C sX | j s| gS i }| j D ]}|jD ]}||vr |j|d�||< qq tt|�� dd� d��S )z�For a give usn, get the related USNs for it.
For each CVE associated with the given USN, we capture
other USNs that are related to the CVE. We consider those
USNs related to the original USN.
�rx c S rj rk rl rn r* r* r+ rp $ rq z"get_related_usns.<locals>.<lambda>rr )r� r� r| �listru �values)r� rP � related_usnsr\ �related_usn_idr* r* r+ �get_related_usns s
���r Fr3 r� �dry_runc
s6 |rt tj� � �� � t| d�}t� }tt| �tt| �d�}d� v r�d }z t �
g d��\}}W n
t j y9 Y nw |r{z2t
�|�d d d }|rm|�dg �} t� fd d
�| D ��rmt tjj� |�d d �d
�� tjW S W n tttfyz Y nw z|j� d�}
|j� d�} W n# t jy� } zt| �}
d|
� � v r�tj j� d�}
t � |
��d } ~ ww t |
|d�}t |
� � � t!| |�}nRz
|j"� d�}t#||�} W n# t jy� } zt| �}
d|
� � v r�tj j� d�}
t � |
��d } ~ ww t$||d�}t!| |�}t |� � � |j%d �st j&d�� �� d��t'| � ||||d�S )N)r3 )r� r� rL )zcanonical-livepatchrK z --verbosez
--format=json�Statusr � Livepatch�Fixesc 3 s( � | ]}|d � � � ko|d V qdS )�Name�PatchedN)�lower)rR �fixr� r* r+ � <genexpr>M s
� �
�z(fix_security_issue_id.<locals>.<genexpr>�VersionzN/A)r� rJ )rZ )rb z not foundr� )r\ r� r �r� r� r� z.{} metadata defines no fixed package versions.)r3 r� �affected_pkg_statusr� �usn_released_pkgsr )(�printr
�SECURITY_DRY_RUN_WARNINGr� r, r� � _is_pocket_used_by_beta_servicer� r� r r� r �ProcessExecutionError�json�loadsr4 �any�CVE_FIXED_BY_LIVEPATCHr^ r r' �
ValueError�KeyError�
IndexErrorr` rw r r� r � SECURITY_FIX_NOT_FOUND_ISSUE�UserFacingError�'get_cve_affected_source_packages_statusr� r r| r � get_usn_affected_packages_statusrQ r� � prompt_for_affected_packages)r3 r� r rP r� r� �
status_stdout�_� parsed_patch�fixesr\ r� �e�msgr r! r� r* r� r+ �fix_security_issue_id' s�
� ��� �
���� �
��� � �
���� ���r8 c C s^ i }| D ](}t ||��� D ] \}}||vr|||< q
|| j}t�||jd�s+|||< q
q|S )Nr )r/ r r� r r )r� r� �
affected_pkgsr\ r� r� � current_verr* r* r+ � get_affected_packages_from_cves� s" �
�
��� r; c C s� i }| j �� D ]7\}}||vrqtt�}d|d< dd� |�� D �}|s1d}tj|�| j�| jd��|�� |d< t |d�||< q|S ) Nr� rK c S s" h | ]
\}}|� d �r|d �qS )r� r� )rR r3 � pkg_bin_infor* r* r+ � <setcomp>� s ��z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r� r� )r_ )
r� r r r� r r� r^ rm �popr� )r� r� r9 r� �pkg_infor_ � all_pocketsr7 r* r* r+ � get_affected_packages_from_usn� s$ ��� rA r� r� c C s | j r t| j |�S t| |�S )z�Walk CVEs related to a USN and return a dict of all affected packages.
:return: Dict keyed on source package name, with active CVEPackageStatus
for the current Ubuntu release.
)r� r; rA r r* r* r+ r0 � s
r0 r\ c C s8 i }| j �� D ]\}}|jdkrq||v r|||< q|S )z�Get a dict of any CVEPackageStatuses affecting this Ubuntu release.
:return: Dict of active CVEPackageStatus keyed by source package names.
r� )r� r rK )r\ r� �affected_pkg_versions�
source_pkg�package_statusr* r* r+ r/ � s
�r/ r c C s� t |�}|dkr ttjjddd�d � ttjj| d�� dS |dkr&d }nd}tjj||d�d
d �t|�� �� }tt j
|t d d
�� dS )a Print header strings describing affected packages related to a CVE/USN.
:param issue_id: String of USN or CVE issue id.
:param affected_pkg_status: Dict keyed on source package name, with active
CVEPackageStatus for the current Ubuntu release.
r �Nozs are)�count�
plural_str�.�r� Nr! z isz: �, � ��width�subsequent_indent) �lenr" r
�SECURITY_AFFECTED_PKGSr^ �SECURITY_ISSUE_UNAFFECTEDr� ru �keys�textwrap�fillr )r� r rF rG r7 r* r* r+ � print_affected_packages_header� s. �������rU r� �usn_src_released_pkgsc C sh t �| �}|r2|�d�r2d|jd< |d d |jd< |�� D ]\}}|�d�}|r1||jd< |S q |S )a� Parse release status based on both pkg_status and USN.release_packages.
Since some source packages in universe are not represented in
CVEPackageStatus, rely on presence of such source packages in
usn_src_released_pkgs to represent package as a "released" status.
:param pkg_status: the CVEPackageStatus for this source package.
:param usn_src_released_pkgs: The USN.release_packages representing only
this source package. Normally, release_packages would have data on
multiple source packages.
:return: Tuple of:
human-readable status message, boolean whether released,
boolean whether the fix requires access to UA
r� r� rK rJ r� r� )�copy�deepcopyr4 rQ r )r� rV �usn_pkg_statusr� �usn_released_pkgr� r* r* r+ �#override_usn_release_package_status s
�
�
�r[ c C sd i }t | �� �D ]'\}}|�|i �}t||�}|j�dd�}||vr&g ||< || �||f� q|S )Nr� r� )ru r r4 r[ rK �replacer� )r r! �
status_groupsr r� �usn_released_srcrY � status_groupr* r* r+ �group_by_usn_package_status& s �r` �pkg_status_list� pkg_index�num_pkgsc C s� | sdS g }g }| D ]\}}|d7 }|� d�||�� |� |� q
tjd�dd�|� d d�t|���tdd �}d
�||j�S ) z;Format the packages and status to an user friendly message.� r! z{}/{}z{} {}:�(rJ �)rK rL z{}
{})r� r^ rS rT r� ru r r� )ra rb rc � msg_index�src_pkgsr r� �
msg_headerr* r* r+ �_format_packages_message4 s ��rj r� c C s: d}| t kr d}n| tkrd}t||d�}|r||�S d S )Nzno-service-neededr� r� )r3 r� )r� r� r )r� r3 �service_to_check�ent_clsr* r* r+ �_get_service_for_pocketN s rm c C s4 t | |�}|r|�� \}}|tjkrdS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)rm �user_facing_statusr �ACTIVE�
valid_service)r� r3 �ent�
ent_statusr3 r* r* r+ r$ Y s
r$ �src_pocket_pkgs�binary_pocket_pkgsc C s� d}d}t � }t � } |rWtttfD ]E}
||
} ||
} |rDt| ||d�}
|
r4t|
� | s2ttj� qd}|t| �7 }|t | | |
|d�M }|sQ|�
dd� | D �� q| �
| � qt ||| |d�S )a% Handle the packages that could be fixed and have a released status.
:returns: Tuple of
boolean whether all packages were successfully upgraded,
list of strings containing the packages that were not upgraded,
boolean whether all packages were already installed
T�ra rb rc F)r3 � upgrade_pkgsr� r c S � g | ]\}}|�qS r* r* �rR r r3 r* r* r+ rU � � z2_handle_released_package_fixes.<locals>.<listcomp>)r r r r ) �setr� r� r� rj r" r
�SECURITY_UPDATE_INSTALLEDrO �upgrade_packages_and_attachr5 r )r3 rs rt rb rc r r �upgrade_statusr r r� �
pkg_src_group� binary_pkgsr7 r* r* r+ � _handle_released_package_fixesi sN ��
� �r� c
C sF t | �}tjd�||dkrdnd|dkrdndd�t| ���tdd �S )
z�Format the list of unfixed packages into an message.
:returns: A string containing the message output for the unfixed
packages.
z"{} package{} {} still affected: {}r! �srd �are�isrJ rK rL )rO rS rT r^ r� ru r )r �num_pkgs_unfixedr* r* r+ � _format_unfixed_packages_msg� s ��r� r! c C sJ t |�}t||� |dkrtjS tjj|d�}tt�}tt�} d}
t ||�} g } t
| � � �D ]�\}
}|
dkrVtj j|d�}t
t||
|d�� |
t |�7 }
| dd� |D �7 } q.|D ]V\}}||j �||f� || � � D ]A\}}|�|i �}||vr�| dd� |D �7 } dj||d �}|t| �7 }t�||��|| }|d
}t�||d �s�| |j �|� qlqXq.t| || |
||d �}| |j7 } | r�t
t| �� |j�r|jr�t
t� |�� | r�tj S tjS t j |j d
��rtj!jdd�}t
|� | j"�#d|� t
t� tj j|d��� tj$S t
t� |�� | �rtj S tjS t
t� tj j|d��� tj S )a Process security CVE dict returning a CVEStatus object.
Since CVEs point to a USN if active, get_notice may be called to fill in
CVE title details.
:returns: An FixStatus enum value corresponding to the system state
after processing the affected packages
r rI r� ru c S rw r* r* rx r* r* r+ rU � ry z0prompt_for_affected_packages.<locals>.<listcomp>c S rw r* r* rx r* r* r+ rU � s �z5{issue} metadata defines no fixed version for {pkg}.
)r� r� rJ r )r3 rs rt rb rc r )r z
fix operation)� operationrd )%rO rU r r' r
�SECURITY_ISSUE_RESOLVEDr^ r r r` ru r �SECURITY_ISSUE_NOT_RESOLVEDr" rj r� r� r4 r� r r� r r r� r r r r �handle_unicode_charactersr( r �
should_rebootr �ENABLE_REBOOT_REQUIRED_TMPL� notice_file�addr) )r3 r� r r� r! r rF � fix_messagers rt rb �pkg_status_groupsr � status_value�pkg_status_groupr r� �
binary_pkgrJ r^ r7 � fixed_pkgr� � released_pkgs_install_result�
reboot_msgr* r* r+ r1 � s�
����
� ��� �
�����
����� ����� ��r1 c C s4 t � \} }| tv rttjjt�| �| d�� dS dS )z:Alert the user when running Pro on cloud with PRO support.)r� �cloudN)r r r" r
�SECURITY_USE_PRO_TMPLr^ r r4 )�
cloud_typer3 r* r* r+ �*_inform_ubuntu_pro_existence_if_applicableE s
���r� �tokenc
C s� ddl }ddlm} ttdd|gg�� z|�|j|dddd�| �}|dkW S tjy? } z t|j � W Y d}~d S d}~ww )
ztAttach to an Ubuntu Pro subscription with a given token.
:return: True if attach performed without errors.
r N��cli�pro�attachTr� )r� � auto_enabler^ �
attach_configF)
�argparse�uaclientr� r" r �
action_attach� Namespacer r. r7 )r3 r� r� r� �ret_code�errr* r* r+ �_run_ua_attachP s ��
��r� c C sp t � ttj� tjdg d�d�}|dkrdS |dkr$ttj� td� |dv r6ttj� td �}t | |�S d
S ) zZPrompt for attach to a subscription or token.
:return: True if attach performed.
zBChoose: [S]ubscribe at ubuntu.com [A]ttach existing token [C]ancel)r� �a�c��
valid_choicesr� Fr� z*Hit [Enter] when subscription is complete.)r� r� �> T)
r� r" r
�*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr �prompt_choices�PROMPT_UA_SUBSCRIPTION_URL�input�PROMPT_ENTER_TOKENr� )r3 �choicer� r* r* r+ �_prompt_for_attachg s
�
r� �servicec C s� ddl }ddlm} ttjj|d�� tjd�|�ddgd�}|dkr@tt d d
|gg�� t
d|� |j |gd d d
d d�| �k�S d S )zMPrompt for enable a pro service.
:return: True if enable performed.
r Nr� �r� z Choose: [E]nable {} [C]ancelr6 r� r� r� �enableTFr� )r� �
assume_yes�betar^ � access_only)
r� r� r� r" r
�SECURITY_SERVICE_DISABLEDr^ r r� r r� �
action_enabler� )r3 r� r� r� r� r* r* r+ �_prompt_for_enable� s0 �����r� c C s |r t tj� dS t| �S )z<Verify if machine is attached to an Ubuntu Pro subscription.T)r" r
� SECURITY_DRY_RUN_UA_NOT_ATTACHEDr� )r3 r r* r* r+ �_check_attached� s
r� c C s� t | |�}|rK|�� \}}|tjkrdS |�� \}}|tjkrA|r-ttj j
|j d�� dS t ||j �r5dS ttj
j
|j d�� dS ttjj
|j d�� dS )zQ
Verify if the Ubuntu Pro subscription has the required service enabled.
Tr� F)rm rn r ro �applicability_statusr �
APPLICABLEr" r
�'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDr^ r� r� � SECURITY_UA_SERVICE_NOT_ENABLED� SECURITY_UA_SERVICE_NOT_ENTITLED)r� r3 r rq rr r3 r� r* r* r+ �(_check_subscription_for_required_service� s8
�� �� ���r� c C s� ddl }ddlm} t� ttj� tjd� t
�ddgd�}|dkrDttj � t d�}tt
d d
gg�� |�|jd d d
�| � t| |�S dS )zdPrompt for attach a new subscription token to the user.
:return: True if attach performed.
r Nr� z2Choose: [R]enew your subscription (at {}) [C]ancel�rr� r� r� r� �detachTr� )r� r^ F)r� r� r� r� r" r
�%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr r� r^ r �PROMPT_EXPIRED_ENTER_TOKENr� r �
action_detachr� r� )r3 r� r� r� r� r* r* r+ �_prompt_for_new_token� s&
��
�
r� � status_cachec C sJ | � d�}|du r dS |j}|t�|�k r#|r ttj� dS t|� S dS )zuCheck if the Ubuntu Pro subscription is expired.
:returns: True if subscription is expired and not renewed.
�expiresNF)r4 �tzinfor �nowr" r
�(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONr� )r� r3 r �contract_expiry_datetimer� r* r* r+ � _check_subscription_is_expired� s
r� rv c C s� |sdS t �� dkr|sttj� dS |tkr=| �d�p i }|�dd�s,t| |�s+dS n t || |d�r5dS t
|| |�s=dS tt g d�g d� t |� g�� |sdt
�� t
jg d �| tjjd
d id � dS )
a Upgrade available packages to fix a CVE.
Upgrade all packages in upgrades_packages and, if necessary,
prompt regarding system attach prior to upgrading Ubuntu Pro packages.
:return: True if package upgrade completed or unneeded, False otherwise.
Tr Fz status-cache�attached)r� r3 r )r r5 z&&)r �install�--only-upgrade�-y)zapt-getr� r� r� �DEBIAN_FRONTEND�noninteractive)�cmd� error_msg�env)�os�getuidr" r
�SECURITY_APT_NON_ROOTr� �
read_cacher4 r� r� r� r ru r �run_apt_update_command�run_apt_command�APT_INSTALL_FAILEDr7 )r3 rv r� r r� r* r* r+ r| sF
�� �����
�r| )F)r0 N)VrW �enumr& r� r� rS � collectionsr r �typingr r r r r r r
r� r r r
r r r �uaclient.clouds.identityr r r �uaclient.configr �uaclient.defaultsr r �uaclient.entitlementsr �(uaclient.entitlements.entitlement_statusr r �uaclient.statusr �CVE_OR_USN_REGEXrV r] rt rz r� r� r� r� r� r �unique�Enumr �UAServiceClientr, r� rL re r� r r r8 r; rA r0 r/ rU r[ r` r� rj rm r$ r� r� r1 r� r� r� r� r� r� r� r� r| r* r* r* r+ �<module> sJ $ �
��
wEJ | �
�
�1����
�k ��
���
��
�"��
�#���
� ������
�D��
����
�
"���
�*
���
������