관리-도구
편집 파일: update-crypto-policies.cpython-39.pyc
a � �g�7 � @ s* d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm Z d dl Z d dl Z d dl Z dd� e_ dZdZdZdZdadadadadadad d � Zd*d d �Zd d� Zdd� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd � Z!d+d d �Z"G d d!� d!�Z#d"d#� Z$d,d%d&�Z%d'd(� Z&e'd)k�r&e&� dS )-� N)�mkdtemp�mkstempc O s2 |j � dt| �d d� �� t| �dd � � d�S )Nz: � � )�__name__�str�upper)�msg�categoryZ _unused_aZ _unused_kwa� r �;/usr/share/crypto-policies/python/update-crypto-policies.py�<lambda> s r z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz /proc/sys/crypto/fips_enabledc O s t | dtji|�� d S )N�file)�print�sys�stderr)�args�kwargsr r r �eprint& s r c C s� zt jd attj_W n ty, taY n0 | d ur<| an.zt jd attj_ W n tyh t aY n0 t j � td�a t j � td�at j � td�at j � tt�ad S )N� profile_dir�base_dirzlocal.dz back-ends�state)�os�environr �cryptopolicies�UnscopedCryptoPolicyZ SHARE_DIR�KeyError�DEFAULT_PROFILE_DIRr Z CONFIG_DIR�DEFAULT_BASE_DIR�path�join� local_dir�backend_config_dir� state_dir�RELOAD_CMD_NAME�reload_cmd_path��alt_baser r r � dir_paths* s r( c C s@ t �� }t �| � t �d�}dd� |D �}t|�}t �|� |S )N�.c s s& | ] \}}}|t |�t |�fV qd S �N)�sorted)�.0�root�dirs�filesr r r � <genexpr>P � zget_walk.<locals>.<genexpr>)r �getcwd�chdir�walkr+ )r Zold_cwdr4 r r r �get_walkI s r5 c C s� t jdd�} | �� }|jdddddd� |jd d d d � |jd d dd � |jdd dd � | jdd t jd � | jdd dd � | �� S )zParse the command lineF)� allow_abbrevz--set�?� ZPOLICYzset the policy POLICY)�nargs�default�metavar�helpz--show� store_truez.show the current policy from the configuration)�actionr< z --is-appliedz+check whether the current policy is appliedz--checkzAcheck whether the generated policy files match the current policyz --no-checkz --no-reloadz3do not run the reload scripts when setting a policy)�argparse�ArgumentParser� add_mutually_exclusive_group� add_argument�SUPPRESS� parse_args)�parser�groupr r r rD V s* ������rD c C s~ z0t �t j�td��j} t �t j�td��j}W n tyL t� d� Y n0 | |krht d� t� d� t d� t� d� d S )N�current�config�M z The configured policy is appliedr z$The configured policy is NOT appliedr ) r �statr r r# �st_mtimer �OSErrorr �exitr )Ztime1Ztime2r r r � is_appliedk s rN c C s� t } t}t}t}t� }t|d� tj|td� tjt j � | d�t j � t d�d� t � t � }t|ddd� t|�}tt�}t|�}tt�} d} ||kr�d} || kr�d} |t|f} |t| f} | | fD ]�\} }}|D ]�\}}}|D ]�}| r� q�t j � | ||�}t j � |||�}t|d��r}t|d��F}| �sX|�d�}|�d�}||k�rJd} |�s"�qX�q"W d � n1 �sn0 Y W d � q�1 �s�0 Y q�q�q�t�|� | �r�td � t�d � ntd � t�d � d S ) Nr& )�src�dstrH F)� print_enabled�allow_symlinkingT�rbi z9The configured policy does NOT match the generated policyr z2The configured policy matches the generated policyr )r r! r" r# r r( �shutil�copytree�copyr r r �setup_directories� parse_pconfig� apply_policyr5 �open�read�rmtreer r rM r )Z orig_base_dirZorig_local_dirZorig_backend_config_dirZorig_state_dirr' �pconfigZwalk_orig_backendZ walk_backendZwalk_orig_stateZ walk_state�errZ_backend�_stateZ orig_prefixZ tmp_prefixr4 �d�_Zfl�fZf_origZf_tmp�fp1�fp2�b1�b2r r r �checky sZ � N rg c C s< z$t jtddd� t jtddd� W n ty6 Y n0 d S )Ni� T)�mode�exist_ok)r �makedirsr" r# rL r r r r rW � s rW c C s\ zBt tdd��"} t| �� �dkW d � W S 1 s60 Y W n tyV Y dS 0 d S )N�ascii��encodingr F)rZ �FIPS_MODE_FLAG�intr[ rL )rb r r r � fips_mode� s 4 rp c C s� t || d�\}}t�|t|d�� t�|� t�|d� zRzt�|tj�| |�� W n( t y| t� |� t� |� � Y n0 W t� |� n t� |� 0 d S )N��prefix�dir�utf-8i� ) r r �write�bytes�fsync�fchmod�renamer r rL �unlink�close)� directory�filename�contents�fdr r r r � safe_write� s r� c C sn t || d�\}}t�|� t�|� t�||� zt�|tj�| |�� W n tyh t�|� � Y n0 d S )Nrq ) r r r{ rz �symlinkry r r rL )r| r} �targetr r r r r � safe_symlink� s r� Fc C s� t j�||d �}tt�|��} d} | D ]} t j�| �r(d} qBq(t j�|t| �|d �} t �| t j�} | s�| r�|r�t ||d | � d S | r�| j s�|r�t | dd��}|� � }W d � n1 s�0 Y t ||d |� | �r�t j�||d �}z�t |ddd���}| D ]�} z:t | dd��}|� � }W d � n1 �s:0 Y W n( t�yn td | � �� Y �qY n0 z|�|� W n( t�y� td | � d |� �� Y n0 �qW d � n1 �s�0 Y W n$ t�y� td |� d �� Y n0 d S )Nz -*.configFTz.txtz.configrt rl �az Cannot read local policy file z$Error appending local configuration z to z Error opening configuration z" for appending local configuration)r r r r+ �glob�existsr �access�R_OKr� � subpoliciesrZ r[ r� rL r ru )r] ZcfgnameZcfgdataZcfgdirZlocaldirZ profiledir�policy_was_emptyrR Zlocal_cfg_pathZ local_cfgsZlocal_cfg_presentZlcfgZ profilepathZprofilepath_existsZf_preZcfgfile�cfZlfZ local_datar r r � save_config� sJ &, ��6r� c @ s> e Zd Zdd� Zddd�Zdd� Zdd � Zd d � Zd d � ZdS )� ProfileConfigc C s d| _ g | _d S )Nr8 )�policyr� ��selfr r r �__init__ s zProfileConfig.__init__Fc s^ |� � �d�� � d r0|s0� d | _� dd � � � fdd�� D �� |rT| j�� � n� | _d S )N�:r r c s g | ] }� r|�qS r r �r, �i��lr r � <listcomp> r1 z.ProfileConfig.parse_string.<locals>.<listcomp>)r �splitr� r� �extend)r� �s� subpolicyr r� r � parse_string s zProfileConfig.parse_stringc C sj d}t |dd��F}|D ]0}|�dd�d }|�� }|r| �||� d}qW d � n1 s\0 Y d S )NFrt rl �#r r T)rZ r� �stripr� )r� r} r� rb �liner r r � parse_file" s zProfileConfig.parse_filec s( |� � �d�� � fdd�| jD �| _d S )Nr� c s g | ]}|� vr|�qS r r r� r� r r r� . r1 z4ProfileConfig.remove_subpolicies.<locals>.<listcomp>)r r� r� )r� r� r r� r �remove_subpolicies, s z ProfileConfig.remove_subpoliciesc C s& | j }d�| j�}|r"|d | }|S )Nr� )r� r r� )r� r� Zsubsr r r �__str__0 s zProfileConfig.__str__c C s t t| �� d S r* )r r r� r r r �show7 s zProfileConfig.showN)F) r � __module__� __qualname__r� r� r� r� r� r� r r r r r� s r� c C sX t � } tj�td�}t�|tj�r.| �|� n&t� r@| � d� n| �tj�t d�� | S )NrH �FIPSzdefault-config) r� r r r r r� r� r� rp r� r )r] Z configfiler r r rX ; s rX Tc C s� d}d}|r�| j }| �|� d}tj�d�}| j |kr�|r�| j dkrb|s�td� td� td� n&t� r�td � td � td � td � ttkr�t� � dkr�td � t � d� zt j | j g| j�R � }W n| t jj�y } z t| � t � d� W Y d } ~ nJd } ~ 0 t jj�yD } z$td| � �� t � d� W Y d } ~ n d } ~ 0 0 |�r\tdt| � � dd� tt�D �} | D ]�} tj| } | � } z| �|�| j��}W n. t�y� td| j � td� d}Y n0 z"t | | j|t t t |� � |d� W n. t!�y td| j � td� d}Y n0 �qr|�rbzt"tdt| �d � W n t!�y` td� d}Y n0 zt"t#dt| �d � W n t!�y� td � d }Y n0 zt"t#d t|�� W n t!�y� td � d }Y n0 |�r�td � td!� td"� |S )#Nr FTz/usr/bin/bootcr� zHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz FIPS compliance.z8 Use 'fips-mode-setup --enable' command instead.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz! non-compliant with FIPS.z8 It can also break the ssh access to the system.zI Use 'fips-mode-setup --disable' to disable the system FIPS mode.z/You must be root to run update-crypto-policies.r z%Errors found in policy, first one: zSetting system policy to c S s g | ]}d |v r|�qS )� Generatorr )r, �gr r r r� w r1 z apply_policy.<locals>.<listcomp>z Error generating config for z Keeping original configuration)r� rR zError saving config for rH r z.Error setting the current policy configuration� rG z$Error updating current policy marker� z CURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.)$r� r� r r r� r rp r r �geteuidr rM r r r� Z validationZPolicyFileNotFoundErrorZPolicySyntaxErrorr r rs �policygenerators�__dict__Zgenerate_configZscopedZSCOPES� LookupErrorZ CONFIG_NAMEr� r" r! r Zis_emptyrL r� r# )r] �profilerQ rR r^ Z set_configZ oldpolicyZbootcZcp�ex� generatorsr� �cls�genrH r r r rY I s� � � rY c C s� t � t� } | jr"t� t�d� | jr8t� t�d� t� t� }| jr\|�� t�d� | j }t ||�}| j s�t � dtg� t�|� dS )z!The actual command implementationr z /bin/bashN)r( rD rN r rM rg rW rX r� �setrY Z no_reload� subprocess�callr% )Zcmdliner] r� r^ r r r �main� s$ r� �__main__)N)F)NTT)(r? r� r rT r� r �warningsZtempfiler r r Zcryptopolicies.validationr� � formatwarningr r r$ rn r r r! r" r# r% r r( r5 rD rN rg rW rp r� r� r� r� rX rY r� r r r r r �<module> sR : � 3) � a!