a
    iÙf¹7  ã                   @   s*  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	 d dl
Z
d dlZ
d dlZdd„ e_dZdZdZdZdadadadadadad	d
„ Zd*dd„Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Z dd„ Z!d+dd„Z"G d d!„ d!ƒZ#d"d#„ Z$d,d%d&„Z%d'd(„ Z&e'd)kr&e&ƒ  dS )-é    N)ÚmkdtempÚmkstempc                 O   s2   |j › dt| ƒd d…  ¡ t| ƒdd …  › dS )Nz: é   Ú
)Ú__name__ÚstrÚupper)ÚmsgÚcategoryZ	_unused_aZ_unused_kwa© r   ú;/usr/share/crypto-policies/python/update-crypto-policies.pyÚ<lambda>   s    r   z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz/proc/sys/crypto/fips_enabledc                  O   s   t | dtji|¤Ž d S )NÚfile)ÚprintÚsysÚstderr)ÚargsÚkwargsr   r   r   Úeprint&   s    r   c                 C   s¦   zt jd attj_W n ty,   taY n0 | d ur<| an.zt jd attj_	W n tyh   t
aY n0 t j td¡at j td¡at j td¡at j tt¡ad S )NÚprofile_dirÚbase_dirzlocal.dz	back-endsÚstate)ÚosÚenvironr   ÚcryptopoliciesÚUnscopedCryptoPolicyZ	SHARE_DIRÚKeyErrorÚDEFAULT_PROFILE_DIRr   Z
CONFIG_DIRÚDEFAULT_BASE_DIRÚpathÚjoinÚ	local_dirÚbackend_config_dirÚ	state_dirÚRELOAD_CMD_NAMEÚreload_cmd_path©Úalt_baser   r   r   Ú	dir_paths*   s     	



r(   c                 C   s@   t  ¡ }t  | ¡ t  d¡}dd„ |D ƒ}t|ƒ}t  |¡ |S )NÚ.c                 s   s&   | ]\}}}|t |ƒt |ƒfV  qd S ©N)Úsorted)Ú.0ÚrootÚdirsÚfilesr   r   r   Ú	<genexpr>P   ó    zget_walk.<locals>.<genexpr>)r   ÚgetcwdÚchdirÚwalkr+   )r   Zold_cwdr4   r   r   r   Úget_walkI   s    


r5   c                  C   s‚   t jdd} |  ¡ }|jdddddd |jd	d
dd |jdd
dd |jdd
dd | jdd
t jd | jdd
dd |  ¡ S )zParse the command lineF)Úallow_abbrevz--setú?Ú ZPOLICYzset the policy POLICY)ÚnargsÚdefaultÚmetavarÚhelpz--showÚ
store_truez.show the current policy from the configuration)Úactionr<   z--is-appliedz+check whether the current policy is appliedz--checkzAcheck whether the generated policy files match the current policyz
--no-checkz--no-reloadz3do not run the reload scripts when setting a policy)ÚargparseÚArgumentParserÚadd_mutually_exclusive_groupÚadd_argumentÚSUPPRESSÚ
parse_args)ÚparserÚgroupr   r   r   rD   V   s*    ÿÿÿÿÿÿrD   c                  C   s~   z0t  t j td¡¡j} t  t j td¡¡j}W n tyL   t 	d¡ Y n0 | |krht
dƒ t 	d¡ t
dƒ t 	d¡ d S )NÚcurrentÚconfigéM   z The configured policy is appliedr   z$The configured policy is NOT appliedr   )r   Ústatr   r    r#   Úst_mtimer   ÚOSErrorr   Úexitr   )Ztime1Ztime2r   r   r   Ú
is_appliedk   s    
rN   c                  C   sØ  t } t}t}t}tƒ }t|d tj|td tjt	j
 | d¡t	j
 t d¡d tƒ  tƒ }t|ddd t|ƒ}ttƒ}t|ƒ}ttƒ}	d}
||kršd}
||	kr¦d}
|t|f}|t|	f}||fD ]Ú\}}}|D ]Ê\}}}|D ]º}|
rê qÐt	j
 |||¡}t	j
 |||¡}t|dƒr}t|dƒF}|
sX| d¡}| d¡}||krJd}
|s"qXq"W d   ƒ n1 sn0    Y  W d   ƒ qÞ1 sŽ0    Y  qÞqÐqÂt |¡ |
rÂtd	ƒ t d
¡ ntdƒ t d¡ d S )Nr&   )ÚsrcÚdstrH   F)Úprint_enabledÚallow_symlinkingTÚrbi    z9The configured policy does NOT match the generated policyr   z2The configured policy matches the generated policyr   )r   r!   r"   r#   r   r(   ÚshutilÚcopytreeÚcopyr   r   r    Úsetup_directoriesÚparse_pconfigÚapply_policyr5   ÚopenÚreadÚrmtreer   r   rM   r   )Zorig_base_dirZorig_local_dirZorig_backend_config_dirZorig_state_dirr'   ÚpconfigZwalk_orig_backendZwalk_backendZwalk_orig_stateZ
walk_stateÚerrZ_backendÚ_stateZorig_prefixZ
tmp_prefixr4   ÚdÚ_ZflÚfZf_origZf_tmpÚfp1Úfp2Úb1Úb2r   r   r   Úchecky   sZ    
ÿ




N
rg   c                   C   s<   z$t jtddd t jtddd W n ty6   Y n0 d S )Nií  T)ÚmodeÚexist_ok)r   Úmakedirsr"   r#   rL   r   r   r   r   rW   ³   s
    rW   c                  C   s\   zBt tdd"} t|  ¡ ƒdkW  d   ƒ W S 1 s60    Y  W n tyV   Y dS 0 d S )NÚascii©Úencodingr   F)rZ   ÚFIPS_MODE_FLAGÚintr[   rL   )rb   r   r   r   Ú	fips_mode»   s
    4rp   c              	   C   sœ   t || d\}}t |t|dƒ¡ t |¡ t |d¡ zRzt |tj | |¡¡ W n( t	y|   t 
|¡ t |¡ ‚ Y n0 W t |¡ nt |¡ 0 d S )N©ÚprefixÚdirúutf-8i¤  )r   r   ÚwriteÚbytesÚfsyncÚfchmodÚrenamer   r    rL   ÚunlinkÚclose)Ú	directoryÚfilenameÚcontentsÚfdr   r   r   r   Ú
safe_writeÃ   s    



r€   c                 C   sn   t || d\}}t |¡ t |¡ t ||¡ zt |tj | |¡¡ W n tyh   t |¡ ‚ Y n0 d S )Nrq   )	r   r   r{   rz   Úsymlinkry   r   r    rL   )r|   r}   Útargetr   r   r   r   r   Úsafe_symlinkÒ   s    


rƒ   Fc              
   C   sø  t j ||d ¡}tt |¡ƒ}	d}
|	D ]}t j |¡r(d}
 qBq(t j |t| ƒ|d ¡}t  |t j¡}|
sˆ|rˆ|rˆt	||d |ƒ d S |rÊ| j
sÊ|rÊt|dd}| ¡ }W d   ƒ n1 sÀ0    Y  t||d |ƒ |
rôt j ||d ¡}zÜt|ddd¸}|	D ]¢}z:t|dd}| ¡ }W d   ƒ n1 s:0    Y  W n( tyn   td	|› ƒ Y qY n0 z| |¡ W n( ty¦   td
|› d|› ƒ Y n0 qW d   ƒ n1 sÂ0    Y  W n$ tyò   td|› dƒ Y n0 d S )Nz	-*.configFTz.txtz.configrt   rl   ÚazCannot read local policy file z$Error appending local configuration z to zError opening configuration z" for appending local configuration)r   r   r    r+   ÚglobÚexistsr   ÚaccessÚR_OKrƒ   ÚsubpoliciesrZ   r[   r€   rL   r   ru   )r]   ZcfgnameZcfgdataZcfgdirZlocaldirZ
profiledirÚpolicy_was_emptyrR   Zlocal_cfg_pathZ
local_cfgsZlocal_cfg_presentZlcfgZprofilepathZprofilepath_existsZf_preZcfgfileÚcfZlfZ
local_datar   r   r   Úsave_configß   sJ    &,ÿÿ6rŒ   c                   @   s>   e Zd Zdd„ Zddd„Zdd„ Zdd	„ Zd
d„ Zdd„ ZdS )ÚProfileConfigc                 C   s   d| _ g | _d S )Nr8   )Úpolicyr‰   ©Úselfr   r   r   Ú__init__  s    zProfileConfig.__init__Fc                    s^   |  ¡  d¡‰ ˆ d r0|s0ˆ d | _ˆ dd … ‰ ‡ fdd„ˆ D ƒ‰ |rT| j ˆ ¡ nˆ | _d S )Nú:r   r   c                    s   g | ]}ˆ r|‘qS r   r   ©r,   Úi©Úlr   r   Ú
<listcomp>  r1   z.ProfileConfig.parse_string.<locals>.<listcomp>)r   ÚsplitrŽ   r‰   Úextend)r   ÚsÚ	subpolicyr   r•   r   Úparse_string  s    
zProfileConfig.parse_stringc                 C   sj   d}t |ddF}|D ]0}| dd¡d }| ¡ }|r|  ||¡ d}qW d   ƒ n1 s\0    Y  d S )NFrt   rl   ú#r   r   T)rZ   r˜   Ústriprœ   )r   r}   r›   rb   Úliner   r   r   Ú
parse_file"  s    zProfileConfig.parse_filec                    s(   |  ¡  d¡‰ ‡ fdd„| jD ƒ| _d S )Nr’   c                    s   g | ]}|ˆ vr|‘qS r   r   r“   r•   r   r   r—   .  r1   z4ProfileConfig.remove_subpolicies.<locals>.<listcomp>)r   r˜   r‰   )r   rš   r   r•   r   Úremove_subpolicies,  s    z ProfileConfig.remove_subpoliciesc                 C   s&   | j }d | j¡}|r"|d | }|S )Nr’   )rŽ   r    r‰   )r   rš   Zsubsr   r   r   Ú__str__0  s
    zProfileConfig.__str__c                 C   s   t t| ƒƒ d S r*   )r   r   r   r   r   r   Úshow7  s    zProfileConfig.showN)F)	r   Ú
__module__Ú__qualname__r‘   rœ   r    r¡   r¢   r£   r   r   r   r   r     s   

r   c                  C   sX   t ƒ } tj td¡}t |tj¡r.|  |¡ n&tƒ r@|  	d¡ n|  tj t
d¡¡ | S )NrH   ÚFIPSzdefault-config)r   r   r   r    r   r‡   rˆ   r    rp   rœ   r   )r]   Z
configfiler   r   r   rX   ;  s    rX   Tc                 C   sô  d}d}|rˆ| j }|  |¡ d}tj d¡}| j |krˆ|rˆ| j dkrb|sˆtdƒ tdƒ tdƒ n&tƒ rˆtd	ƒ td
ƒ tdƒ tdƒ ttkr®t 	¡ dkr®tdƒ t
 d¡ ztj| j g| j¢R Ž }W n| tjjy }	 zt|	ƒ t
 d¡ W Y d }	~	nJd }	~	0  tjjyD }	 z$td|	› ƒ t
 d¡ W Y d }	~	n
d }	~	0 0 |r\tdt| ƒ ƒ dd„ ttƒD ƒ}
|
D ]®}tj| }|ƒ }z| | |j¡¡}W n. tyÊ   td|j ƒ tdƒ d}Y n0 z"t| |j|ttt|  ¡ |d W n. t!y   td|j ƒ tdƒ d}Y n0 qr|rbzt"tdt| ƒd ƒ W n  t!y`   tdƒ d}Y n0 zt"t#dt| ƒd ƒ W n  t!yš   tdƒ d}Y n0 zt"t#dt|ƒƒ W n  t!yÐ   tdƒ d}Y n0 |rðtd ƒ td!ƒ td"ƒ |S )#Nr   FTz/usr/bin/bootcr¦   zHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz         FIPS compliance.z8         Use 'fips-mode-setup --enable' command instead.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz!         non-compliant with FIPS.z8         It can also break the ssh access to the system.zI         Use 'fips-mode-setup --disable' to disable the system FIPS mode.z/You must be root to run update-crypto-policies.r   z%Errors found in policy, first one:  
zSetting system policy to c                 S   s   g | ]}d |v r|‘qS )Ú	Generatorr   )r,   Úgr   r   r   r—   w  r1   z apply_policy.<locals>.<listcomp>zError generating config for zKeeping original configuration)rŠ   rR   zError saving config for rH   r   z.Error setting the current policy configurationé   rG   z$Error updating current policy markeré   zCURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.)$rŽ   rœ   r   r   r†   r   rp   r   r   Úgeteuidr   rM   r   r   r‰   Z
validationZPolicyFileNotFoundErrorZPolicySyntaxErrorr   r   rs   ÚpolicygeneratorsÚ__dict__Zgenerate_configZscopedZSCOPESÚLookupErrorZCONFIG_NAMErŒ   r"   r!   r   Zis_emptyrL   r€   r#   )r]   ÚprofilerQ   rR   r^   Z
set_configZ	oldpolicyZbootcZcpÚexÚ
generatorsr¨   ÚclsÚgenrH   r   r   r   rY   I  s”    




ÿ 


ý



rY   c                  C   sŽ   t ƒ  tƒ } | jr"tƒ  t d¡ | jr8tƒ  t d¡ tƒ  tƒ }| jr\| ¡  t d¡ | j	}t
||ƒ}| js€t dtg¡ t |¡ dS )z!The actual command implementationr   z	/bin/bashN)r(   rD   rN   r   rM   rg   rW   rX   r£   ÚsetrY   Z	no_reloadÚ
subprocessÚcallr%   )Zcmdliner]   r¯   r^   r   r   r   Úmainª  s$    



r·   Ú__main__)N)F)NTT)(r?   r…   r   rT   rµ   r   ÚwarningsZtempfiler   r   r   Zcryptopolicies.validationr¬   Úformatwarningr   r   r$   rn   r   r   r!   r"   r#   r%   r   r(   r5   rD   rN   rg   rW   rp   r€   rƒ   rŒ   r   rX   rY   r·   r   r   r   r   r   Ú<module>   sR   

: ÿ
3)  ÿ
a!
