PATH:
usr
/
share
/
crypto-policies
/
python
/
__pycache__
/
Editing: update-crypto-policies.cpython-36.opt-1.pyc
3 ."�d$! � @ sp d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlZd dlZd dl Zd dl Z dd� e_ dZ dZ dZdZd d � Zyejd Zeej_W n ek r� e ZY nX yejd Zeej_W n ek r� e ZY nX ejjed �Zejjed�Zejjed�Z ejjee�Z dd� Z dd� Z dd� Z dd� Z!dd� Z"dd� Z#d d � Z$G d d � d �Z%d d!� Z&e'd"k�rle&� dS )#� N)�mkstempc O s |j � dt| �j� � d�S )Nz: � )�__name__�str� capitalize)�msg�category�aZkwa� r �<./usr/share/crypto-policies/python/update-crypto-policies.py�<lambda> s r z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz /proc/sys/crypto/fips_enabledc O s t | dtji|�� d S )N�file)�print�sys�stderr)�args�kwargsr r r �eprint s r � profile_dir�base_dirzlocal.dz back-ends�statec C sr t jdd�} | j� }|jdddddd� |jd d d d � |jd d dd � | jdd t jd � | jdd dd � | j� S )zParse the command lineF)Z allow_abbrevz--set�?� ZPOLICYzset the policy POLICY)�nargs�default�metavar�helpz--show� store_truez.show the current policy from the configuration)�actionr z --is-appliedz+check whether the current policy is appliedz --no-checkz --no-reloadz3do not run the reload scripts when setting a policy)�argparse�ArgumentParserZ add_mutually_exclusive_group� add_argumentZSUPPRESS� parse_args)�parser�groupr r r r" 8 s r" c C s� y0t jt jjtd��j} t jt jjtd��j}W n tk rN tj d� Y nX | |krjt d� tj d� t d� tj d� d S )N�current�config�M z The configured policy is appliedr z$The configured policy is NOT applied� ) �os�stat�path�join� state_dir�st_mtimer �OSErrorr �exitr )Ztime1Ztime2r r r � is_appliedI s r1 c C s2 yt jt� t jt� W n tk r, Y nX d S )N)r) �makedirs�backend_config_dirr- r/ r r r r �setup_directoriesW s r4 c C s> y$t t��} t| j� �dkS Q R X W n tk r8 dS X d S )Nr F)�open�FIPS_MODE_FLAG�int�readr/ )�fr r r � fips_mode_ s r: c C s� t || d�\}}tj|t|d�� tj|� tj|d� zZytj|tjj| |�� W n: t k r� } z tj |� tj |� |�W Y d d }~X nX W d tj |� X d S )N)�prefix�dirzutf-8i� ) r r) �write�bytes�fsync�fchmod�renamer+ r, r/ �unlink�close)� directory�filename�contents�fdr+ �er r r � safe_writeg s rI c C s� t || d�\}}tj|� tj|� tj||� ytj|tjj| |�� W n0 tk rz } ztj|� |�W Y d d }~X nX d S )N)r; r< ) r r) rC rB �symlinkrA r+ r, r/ )rD rE �targetrG r+ rH r r r � safe_symlinkv s rL c $ C s| t jj||d �}ttj|��}d} x |D ]} t jj| �r*d} q*W t jj|t| �|d �} t j| t j�} | r�| r�t ||d | � d S | r�| j r�|r�t | ��} | j � }W d Q R X t ||d |� | �rxt jj||d �}x�|D ]�} y"t | d��}|j � }W d Q R X W n$ tk �r* td| � w�Y nX y$t |d��}|j|� W d Q R X W q� tk �rr td | � Y q�X q�W d S ) Nz -*.configFTz.txtz.config�rz Cannot read local policy file r z&Error applying local configuration to )r) r+ r, �sorted�glob�existsr �access�R_OKrL � subpoliciesr5 r8 rI r/ r r= )�pconfigZcfgnameZcfgdataZcfgdirZlocaldirZ profiledir�policy_was_emptyZlocal_cfg_pathZ local_cfgsZlocal_cfg_presentZlcfgZ profilepathZprofilepath_existsZf_preZcfgfileZlfZ local_dataZcfr r r � save_config� s: rV c @ s> e Zd Zdd� Zddd�Zdd� Zdd � Zd d � Zd d � ZdS )� ProfileConfigc C s d| _ g | _d S )Nr )�policyrS )�selfr r r �__init__� s zProfileConfig.__init__Fc s` |j � jd�� � d r2| r2� d | _� dd � � � fdd�� D �� |rV| jj� � n� | _d S )N�:r r( c s g | ] }� r|�qS r r )�.0�i)�lr r � <listcomp>� s z.ProfileConfig.parse_string.<locals>.<listcomp>)�upper�splitrX rS �append)rY �s� subpolicyr )r^ r � parse_string� s zProfileConfig.parse_stringc C sV d}t |��@}x8|D ]0}|jdd�d }|j� }|r| j||� d}qW W d Q R X d S )NF�#r( r T)r5 ra �stripre )rY rE rd r9 �liner r r � parse_file� s zProfileConfig.parse_filec s( |j � jd�� � fdd�| jD �| _d S )Nr[ c s g | ]}|� kr|�qS r r )r\ r] )r^ r r r_ � s z4ProfileConfig.remove_subpolicies.<locals>.<listcomp>)r` ra rS )rY rc r )r^ r �remove_subpolicies� s z ProfileConfig.remove_subpoliciesc C s& | j }dj| j�}|r"|d | }|S )Nr[ )rX r, rS )rY rc Zsubsr r r �__str__� s zProfileConfig.__str__c C s t t| �� d S )N)r r )rY r r r �show� s zProfileConfig.showN)F) r � __module__� __qualname__rZ re ri rj rk rl r r r r rW � s rW c ) C s� t � } | jr t� tjd� d}t� t� }d}tjjt d�}tj |tj �rX|j |� n&t � rj|jd� n|j tjjtd�� | jr�|j� tjd� | j}|�r|j}|j|� d}|j|k�r|jdkr�td� td� td � n(t � �rtd � td � td � td � t tk�r8tj� dk�s8td� tjd� ytj|jf|j�� }W nx tjjk �r� } zt|� tjd� W Y dd}~X n@ tjjk �r� } z td|� �� tjd� W Y dd}~X nX t dt |� � dd� t t �D �} x�| D ]�} t j | } | � } y| j!|j"| j#��} W n0 t$k �rL td| j% � td� d}Y nX y t&|| j%| t't(t|j)� d� W n0 t*k �r� td| j% � td� d}Y nX �q�W |�r�yt+t dt |�d � W n" t*k �r� td� d}Y nX yt+t,d t |�d � W n" t*k �r" td � d }Y nX yt+t,d t |�� W n" t*k �rZ td � d }Y nX t d!� t d"� t d#� | j-�s�t.j/d$t0g� tj|� dS )%z!The actual command implementationr Fr& ZFIPSzdefault-configTzHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz FIPS compliance.z8 Use 'fips-mode-setup --enable' command instead.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz! non-compliant with FIPS.z8 It can also break the ssh access to the system.zI Use 'fips-mode-setup --disable' to disable the system FIPS mode.z/You must be root to run update-crypto-policies.r( Nz%Errors found in policy, first one: zSetting system policy to c S s g | ]}d |kr|�qS )� Generatorr )r\ �gr r r r_ s zmain.<locals>.<listcomp>z Error generating config for z Keeping original configuration)rU zError saving config for r z.Error setting the current policy configuration� r% z$Error updating current policy marker� z CURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.z /bin/bash)1r" r1 r r0 r4 rW r) r+ r, r rQ rR ri r: re r rl �setrX r �DEFAULT_BASE_DIR�geteuid�cryptopolicies�UnscopedCryptoPolicyrS Z validationZPolicyFileNotFoundErrorZPolicySyntaxErrorr r r< �policygenerators�__dict__Zgenerate_configZscopedZSCOPES� LookupErrorZ CONFIG_NAMErV r3 � local_dirZis_emptyr/ rI r- Z no_reload� subprocessZcall�reload_cmd_path)Zcmdline�errrT Z set_configZ configfileZprofileZ oldpolicyZcp�exZ generatorsrp �cls�genr& r r r �main� s� r� �__main__)(r r r) r| Ztempfiler rO �warningsrv Zcryptopolicies.validationrx � formatwarningZDEFAULT_PROFILE_DIRrt ZRELOAD_CMD_NAMEr6 r �environr rw Z SHARE_DIR�KeyErrorr Z CONFIG_DIRr+ r, r{ r3 r- r} r" r1 r4 r: rI rL rV rW r� r r r r r �<module> sP +)s
SAVE
CANCEL