/usr/lib/python3/dist-packages/uaclient/entitlements/__pycache__
Edit: /usr/lib/python3/dist-packages/uaclient/entitlements/__pycache__/fips.cpython-310.pyc (18397B)
o
Kig @ s d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z m Z m
Z
mZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z d d l m Z m Z d d l!m"Z"m#Z#m$Z$ e % Z&e 'e(e)Z*g d
Z+ddgZ,e+e, e+e, e+dZ-g dZ.g dZ/g dZ0e+e, e. e+e, e/ e+e0 dZ1G dd dej2Z3G dd de3Z4G dd de3Z5G dd de4Z6dS ) N)groupby)ListOptionalTuple)apiapt event_logger
exceptionsmessagessystemutil)NoCloudTypeReasonget_cloud_type)repo)EntitlementWithMessage)ApplicationStatus)notices)Notice)ServicesOnceEnabledDataservices_once_enabled_file)MessagingOperationsMessagingOperationsDictStaticAffordance)
strongswanstrongswan-hmacopenssh-clientopenssh-server shim-signedopenssh-client-hmacopenssh-server-hmac)xenialbionicfocal)openssl libssl1.0.0libssl1.0.0-hmac)r# libssl1.1libssl1.1-hmac libgcrypt20libgcrypt20-hmacc s e Zd ZdZdZdZejZdZ dZ
ej j Z
g dZedefddZed d
Zd edefd d
ZdejfddZdefddZdejfddZ d6dejdeee deddf fdd
Z defddZ d7d e d eddfd d Z d!e d"e def fd#d$ Z ede!e"d%f fd&d'Z#edee f fd(d) Z$de!e%eej& f f fd*d+ Z'd8d,d-Z(dejdef fd.d/ Z)dejdef fd0d1 Z*d2d3 Z+dejddf fd4d5 Z, Z-S )9FIPSCommonEntitlementi zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledT) zfips-initramfszfips-initramfs-genericr( r) libgmp10 libgnutls30 libhogweed6
libnettle8r$ r% r$ r% r& r' libssl3z
linux-fipsr r r r r# openssl-fips-module-3r r r ubuntu-fipszubuntu-aws-fipszubuntu-azure-fipsubuntu-gcp-fipsreturnc C s0 d }d }| j s't r tjj| jd}| stjg}n| j }t
j d|ifg}d }| j s=| j s=t
j dtj
j| jdifg}| j sF| ji fgnd }||||d}t| jdkr| jd }td|}|ri|d} nd} t j}
| |
kr|dpzg }tjj| | j| |
pd d
} |t
j d| if ||d< |S ) Ntitlemsg)
pre_enable pre_install post_enable pre_disable r zubuntu-([a-z]+)-fipsgenericr7 unknown)variantservice base_flavorcurrent_flavor) access_onlyr is_containerr
PROMPT_FIPS_CONTAINER_PRE_ENABLEformatr5 auto_upgrade_all_on_enableFIPS_RUN_APT_UPGRADEpre_enable_msgr prompt_for_confirmationpurgePROMPT_FIPS_PRE_DISABLEprompt_if_kernel_downgradelenpackagesrematchgroupget_kernel_infoflavorget#KERNEL_FLAVOR_CHANGE_WARNING_PROMPTnameappend) selfr7 r9 pre_enable_promptr: r8 messagingubuntu_fips_package_name ubuntu_fips_package_flavor_matchubuntu_fips_package_flavorrA r6 r^ \d+\.\d+\.\d+)r1 r; r ubuntulinuxkernel_versionz*Kernel information: cur='%s' and fips='%s')current_version new_version)r6 re z2Cannot gather kernel information for '%s' and '%s'T)r rR proc_version_signature_versionLOGwarningrO searchrM rN r get_pkg_candidate_versionreplacerQ debugversion_compareeventinfor
KERNEL_DOWNGRADE_WARNINGrE r rI
PROMPT_YES_NO)rX re our_full_kernel_strour_m fips_packagefips_kernel_version_strour_kernel_version_strr^ r^ r_ rL sT
z0FIPSCommonEntitlement.prompt_if_kernel_downgradeprogressc C s g }t }tt| jdd d}|D ] \}}||v r ||7 }q|D ](}zt j|gddig dd W q" tjyJ |dt j
j | j |d Y q"w d S )
Nc S s | ddS )Nz-hmac )rp )pkg_namer^ r^ r_
- zNFIPSCommonEntitlement.hardcoded_install_conditional_packages..)keyDEBIAN_FRONTENDnoninteractivez--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"rN override_env_vars apt_optionsrt )r? pkg)
r get_installed_packages_namesr sortedrd run_apt_install_commandr UbuntuProErroremitr
FIPS_PACKAGE_NOT_AVAILABLErE r5 )rX r| desired_packagesinstalled_packages
pkg_groupsr~ pkg_listr r^ r^ r_ &hardcoded_install_conditional_packages$ s4
z r" r! r )r is_config_value_truecfgr r` ra )rX install_all_updates_overridehardcoded_releaser^ r^ r_ rF G s
z0FIPSCommonEntitlement.auto_upgrade_all_on_enablec C s dd t | jD }t jdkr|d | t|dkrVz"| dt
j j d
|d | | t j|d d
ig d d W d S tjyU | dt
j Y d S w d S )
Nc S s g | ]}|j qS r^ )rV ).0packager^ r^ r_
V s zMFIPSCommonEntitlement.install_all_available_fips_upgrades..jammyr0 r rt )rN r r r r )r ;get_installed_packages_with_uninstalled_candidate_in_originoriginr r` ra rW sortrM r r
INSTALLING_PACKAGESrE joinunhold_packagesr r r FIPS_PACKAGES_UPGRADE_FAILURE)rX r|
to_upgrader^ r^ r_ #install_all_available_fips_upgradesS s4
z9FIPSCommonEntitlement.install_all_available_fips_upgradesN package_listcleanup_on_failurec sl | j }|rt j||d n |tjj| jd | r#| | n|
| | r4t
tj dS dS )zInstall contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
)r r4 N)rN superinstall_packagesr| r
INSTALLING_SERVICE_PACKAGESrE r5 rF r r _check_for_rebootr addr FIPS_SYSTEM_REBOOT_REQUIRED)rX r| r r mandatory_packages __class__r^ r_ r w s"
z&FIPSCommonEntitlement.install_packagesc C s t S )z=Check if system needs to be rebooted because of this service.)r
should_rebootrX r^ r^ r_ r s z'FIPSCommonEntitlement._check_for_rebootF operationsilentc C sN | }t| |r#|sttjj|d |dkr%tt j
dS dS dS )zCheck if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r zdisable operationN) r rs needs_rebootrt r
ENABLE_REBOOT_REQUIRED_TMPLrE r r r FIPS_DISABLE_REBOOT_REQUIRED)rX r r reboot_requiredr^ r^ r_ _check_for_reboot_msg s
z+FIPSCommonEntitlement._check_for_reboot_msgra cloud_idc s> |dkr t j| jjddrdS |dv rdS tdt jv S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
gcez.features.allow_default_fips_metapackage_on_gcpr T)r! r" r2 )r r r boolr rN rX ra r r r^ r_ _allow_fips_on_cloud_instance s z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd}t \ } d u rd t jtjj | d}| fddd ffS )
Nzan AWSzan Azureza GCP)awsazurer r} )ra cloudc s S N)r r^ r rX ra r^ r_ r r z:FIPSCommonEntitlement.static_affordances..T) r r r` ra r
FIPS_BLOCK_ON_CLOUDrE r5 rT )rX cloud_titles_blocked_messager^ r r_ static_affordances s
z(FIPSCommonEntitlement.static_affordancesc s t rg S t jS r )r rC r rN r r r^ r_ rN s z FIPSCommonEntitlement.packagesc s t \}}t rt sttj ||fS t j
| j rStt
| js.ttj t| j dkrBttj ||fS ttj tjtjj| j dfS |tjkr\||fS t }g }| jD ] }||vrp|| qe|rtj tj jd || j dfS tjtj fS )N1) file_namer )rN r? )!r application_statusr rC r r remover r ospathexistsFIPS_PROC_FILEsetrN load_filestripFIPS_MANUAL_DISABLE_URLr r DISABLEDr
FIPS_PROC_FILE_ERRORrE ENABLEDr r rW WARNINGFIPS_PACKAGES_NOT_INSTALLEDr rV FIPS_REBOOT_REQUIRED)rX super_status super_msgr missingr r r^ r_ r sR
z(FIPSCommonEntitlement.application_statusc C sT t t }t | jt | j}||}|r(tt|t j
j | j d dS dS )zRemove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r4 N)
r r r rN
differencerd intersectionremove_packageslistr
DISABLE_FAILED_TMPLrE r5 )rX r fips_metapackager r^ r^ r_ r * s
z%FIPSCommonEntitlement.remove_packagesc s8 t |rttj ttj ttj dS dS NTF)r _perform_enabler r r WRONG_FIPS_METAPACKAGE_ON_CLOUDr r rX r| r r^ r_ r ; s z%FIPSCommonEntitlement._perform_enablec s( t |r| rttj dS dS r )r _perform_disabler r r r r r r r^ r_ r F s z&FIPSCommonEntitlement._perform_disablec C s| ddg}t |tjjd|d}g }| D ] }||v r#|| q|r.c r r r^ r^ )fips_updates_once_enabledr^ r_ r r )r r r r r r r r r readr r
$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrE r5 )FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)rX r r disabled_statusservices_once_enabled_objr )r r r_ r s2
z"FIPSEntitlement.static_affordancesr| c sR t \}}|d u r|tjkrtd ttj t
|r't t
j dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r r
CLOUD_ID_ERRORrl rm rs rt r
.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr r r r r FIPS_INSTALL_OUT_OF_DATE)rX r|
cloud_typeerrorr r^ r_ r s
z FIPSEntitlement._perform_enable)r r r rV r
FIPS_TITLEr5 FIPS_DESCRIPTION descriptionFIPS_HELP_TEXT help_textr r rH r r r r r r r r r r r
r^ r^ r r_ r o s !r c sb e Zd ZdZejZdZejZ ej
Z ej Z
edeedf fddZdejdef fdd Z ZS )
r z fips-updatesUbuntuFIPSUpdatesr3 .c C s$ ddl m} tttjt|tjfS )Nr r )r r r r r
FIPS_INVALIDATES_FIPS_UPDATES"REALTIME_FIPS_UPDATES_INCOMPATIBLE)rX r r^ r^ r_ r s z,FIPSUpdatesEntitlement.incompatible_servicesr| c s& t j|drttdd dS dS )N)r| T)r F)r r r writer r r r^ r_ r s z&FIPSUpdatesEntitlement._perform_enable)r r r rV r
FIPS_UPDATES_TITLEr5 r FIPS_UPDATES_DESCRIPTIONr) FIPS_UPDATES_HELP_TEXTr+ PROMPT_FIPS_UPDATES_PRE_ENABLErH r r r r r r r r r
r^ r^ r r_ r s
r c sh e Zd ZdZejZejZej Z
dZ ej Z
dZedeedf f fdd Zded edefd
d Z ZS ) FIPSPreviewEntitlementz fips-previewUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr3 .c s t jtttjf S r )r r r r r
r- r r r^ r_ r s
z,FIPSPreviewEntitlement.incompatible_servicesra r c C s dS r r^ r r^ r^ r_ r s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r r r rV r
FIPS_PREVIEW_TITLEr5 FIPS_PREVIEW_DESCRIPTIONr) FIPS_PREVIEW_HELP_TEXTr+ r PROMPT_FIPS_PREVIEW_PRE_ENABLErH r r r r r r r r r
r^ r^ r r_ r4 s" r4 )7loggingr rO itertoolsr typingr r r uaclientr r r r r
r r uaclient.clouds.identityr
r uaclient.entitlementsr uaclient.entitlements.baser (uaclient.entitlements.entitlement_statusr uaclient.filesr uaclient.files.noticesr uaclient.files.state_filesr r uaclient.typesr r r get_event_loggerrs getLogger replace_top_level_logger_namer rl CONDITIONAL_PACKAGES_EVERYWHERE!CONDITIONAL_PACKAGES_OPENSSH_HMACrc &UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrb RepoEntitlementr* r r r4 r^ r^ r^ r_ sj $ L