????
Your IP : 216.73.216.67
a
�jiwl � @ sF d Z ddlmZmZ ddlZddlZddlZddlmZ ddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlmZ ddlmZ ddl
mZ ddlmZ dd lmZ dd
lmZ ddlZdd lm Z dd l m Z dd
l m Z ddl!m"Z"m#Z# e�$e%�Z&de j'dgfgZ(e�)d�Z*eG dd� de#��Z+G dd� de"�Z,e,� Z-dS )zZ
This module contains default Red Hat OS family-specific implementations of
system tasks.
� )�print_function�absolute_importN)�Path)� find_library)�total_ordering)�CalledProcessError)� PyAsn1Error)�directivesetter)�ipautil)� constants)�paths)�
get_auth_tool)�BaseTaskNamespace�IPAAbstractVersionZsofthsm2z
p11-kit-proxyz�
# auto-generated by IPA installer
[main]
dns={dnsprocessing}
[global-dns]
searches={searches}
[global-dns-domain-*]
servers={servers}
c @ s e Zd ZdZdd� ZdS )�
IPAVersionNc C sH | j }|du r>t�td��}|j}tjtjg|_tj|_|| _ |||�S )z.Lazy load and call librpm's rpmvercmp
NZrpm) �_rpmvercmp_func�ctypesZCDLLr Z rpmvercmpZc_char_p�argtypesZc_intZrestype)�self�a�bZrpmvercmp_funcZlibrpm� r �</usr/lib/python3.9/site-packages/ipaplatform/redhat/tasks.py�_vercmpS s zIPAVersion._vercmp)�__name__�
__module__� __qualname__r r r r r r r O s r c sj e Zd ZdQdd�Zdd� Zejfdd�Zdd � Zd
d � Z d d
� Z
dd� Z dRdd�Z dd� Z
dd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� ZdSd*d+�Zed,d-� �Zd.d/� Zd0d1� Z d2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z!d<d=� Z"d>d?� Z#dd)d@�� fdAdB�
Z$dT� fdCdD� Z%dEdF� Z&dGdH� Z'dIdJ� Z(dKdL� Z)� fdMdN�Z*� fdOdP�Z+� Z,S )U�RedHatTaskNamespaceFc C sN t j}| �� rtj�|�s dS |g}|r2|�d� |�|� tj|dd� dS )a Restore SELinux security context on the given filepath.
SELinux equivalent is /path/to/restorecon <filepath>
restorecon's return values are not reliable so we have to
ignore them (BZ #739604).
ipautil.run() will do the logging.
Nz-FF)Z
raiseonerr) r ZSBIN_RESTORECON�is_selinux_enabled�os�path�exists�appendr
�run)r �filepath�force�
restorecon�argsr r r �restore_contextc s
z#RedHatTaskNamespace.restore_contextc C sD zt �tjg� W n( t jy( Y dS ty: Y dS 0 dS dS )z2Check if SELinux is available and enabled
FTN)r
r# r ZSELINUXENABLEDr �OSError�r r r r r y s z&RedHatTaskNamespace.is_selinux_enabledc C s( | � � s dS tj�|�s$td| ��dS )a�
We don't have a specific package requirement for policycoreutils
which provides restorecon. This is because we don't require
SELinux on client installs. However if SELinux is enabled then
this package is required.
This function returns nothing but may raise a Runtime exception
if SELinux is enabled but restorecon is not available.
FzoSELinux is enabled but %s does not exist.
Install the policycoreutils package and start the installation again.T)r r r r! � RuntimeError)r r& r r r �check_selinux_status� s
�z(RedHatTaskNamespace.check_selinux_statusc C s\ t j�tj�std��z&tjddd�}|�� du r:t d��W n t yV td��Y n0 dS )a Checks whether IPv6 kernel module is loaded.
Function checks if /proc/net/if_inet6 is present. If IPv6 stack is
enabled, it exists and contains the interfaces configuration.
:raises: RuntimeError when IPv6 stack is disabled
z�IPv6 stack has to be enabled in the kernel and some interface has to have ::1 address assigned. Typically this is 'lo' interface. If you do not wish to use IPv6 globally, disable it on the specific interfaces in sysctl.conf except 'lo' interface.z::1T)Zallow_loopbackNz"no interface for ::1 address foundz�IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf.)
r r r! r ZIF_INET6r+ r
ZCheckedIPAddressZget_matching_interface�
ValueError)r Z
localhost6r r r �check_ipv6_stack_enabled� s � �z,RedHatTaskNamespace.check_ipv6_stack_enabledc
C sn zt jtjdgt jd�}W n@ t jyZ } z&|jdkrDW Y d}~dS � W Y d}~nd}~0 0 |�d��� S dS )zsCheck if running inside a container
:returns: container runtime or None
:rtype: str, None
z --container)�stderr� Nzutf-8) �
subprocessZ check_outputr ZSYSTEMD_DETECT_VIRTZSTDOUTr �
returncode�decode�strip)r �output�er r r �detect_container� s �
z$RedHatTaskNamespace.detect_containerc C s t � }|�||||� d S �N)r
Z unconfigure)r �fstore�
statestoreZwas_sssd_installedZwas_sssd_configured� auth_configr r r �$restore_pre_ipa_client_configuration� s �z8RedHatTaskNamespace.restore_pre_ipa_client_configurationc C s� z>t tjd�� }dd� |D �}W d � n1 s20 Y W n tyT g }Y n0 |�d�|�� t tjd��}|�|� W d � n1 s�0 Y d S )N�rc S s" g | ]}|� � �� �d �s|�qS )Z NISDOMAIN)r4 �upper�
startswith)�.0�liner r r �
<listcomp>� s �z5RedHatTaskNamespace.set_nisdomain.<locals>.<listcomp>z
NISDOMAIN={}
�w)�openr ZSYSCONF_NETWORK�IOErrorr" �format�
writelines)r Z nisdomain�f�contentr r r �
set_nisdomain� s �(
z!RedHatTaskNamespace.set_nisdomainTc C s t � }|�|||||� d S r8 )r
Z configure)r �sssd� mkhomedirr: ZsudoZsubidr; r r r �modify_nsswitch_pam_stack� s z-RedHatTaskNamespace.modify_nsswitch_pam_stackc C s dS )NFr r* r r r �is_nosssd_supported� s z'RedHatTaskNamespace.is_nosssd_supportedc C s t � }|�|� d S r8 )r
Zbackup�r r r; r r r �backup_auth_configuration� s z-RedHatTaskNamespace.backup_auth_configurationc C s t � }|�|� d S r8 )r
ZrestorerO r r r �restore_auth_configuration� s z.RedHatTaskNamespace.restore_auth_configurationc C s� |� dd�}tjdddg}|r(|�d� |�d� t�|� dD ]}|�d|� q@|�d d
d� |�d d d � |�d dt|�� d
S )zg
Migrate the pam stack configuration from authconfig to an authselect
profile.
Z
authconfigrL ZselectrK z with-sudozwith-mkhomedirz--force)ZldapZkrb5rK ZsssdauthrL Z
authselectZprofileZ
features_list� N) Z get_stater �
AUTHSELECTr" r
r# �
restore_state� backup_state�bool)r r: rL �authselect_cmd�confr r r �migrate_auth_configuration� s
�z.RedHatTaskNamespace.migrate_auth_configurationc
C sX zt �tjg� W n2 tyD } zt�d|� W Y d }~dS d }~0 0 t�d� dS d S )Nz1Could not update systemwide CA trust database: %sFz Systemwide CA database updated.T)r
r# r ZUPDATE_CA_TRUSTr �logger�error�info�r r6 r r r �reload_systemwide_ca_store s �
z.RedHatTaskNamespace.reload_systemwide_ca_storec C s t | �tj|�| �tj�g�S r8 )�any�write_p11kit_certsr � IPA_P11_KIT� remove_ca_certificates_bundle�SYSTEMWIDE_IPA_CA_CRT)r �ca_certsr r r �platform_insert_ca_certs s ��z,RedHatTaskNamespace.platform_insert_ca_certsc C s0 ddl m} ddlm} t|�}zt|d�}W n tyN t�d|� � Y n0 |��� |� d� zt
� |� � d� W n ty� t�d|� � Y n0 t
� }|D �]f\}} }
} } z |j}
|j}|j}|j}W n& tt|fy� t�d | � � Y n0 tj�| �}tj�|
�}
tj�|�}tj�|�}tj�|�}d
t||
|||d � }|
d u �r\|d
7 }n|
du �rn|d7 }|dj|�|jj�� d�d�7 }|� |� |j d ur�||vr�z
|j }W n" t�y� t�d| � � Y n0 tj�|�}dt|||d� }|� |� |� |� q�W d � n1 �s"0 Y d S )Nr )�x509)�CertificateErrorrC zFailed to open %sz.# This file was created by IPA. Do not edit.
� zFailed to set mode of %sz!Failed to decode certificate "%s"z�[p11-kit-object-v1]
class: certificate
certificate-type: x-509
certificate-category: authority
label: "%(label)s"
subject: "%(subject)s"
issuer: "%(issuer)s"
serial-number: "%(serial_number)s"
x-public-key-info: "%(public_key_info)s"
)�label�subject�issuer�
serial_number�public_key_infoTztrusted: true
Fzx-distrusted: true
z{pem}
�ascii)Zpemz,Failed to encode extended key usage for "%s"z�[p11-kit-object-v1]
class: x-certificate-extension
label: "ExtendedKeyUsage for %(label)s"
x-public-key-info: "%(public_key_info)s"
object-id: 2.5.29.37
value: "%(value)s"
)ri rm �value) Zipalibrf Z
ipalib.errorsrg r rD rE rZ r[ �writer �fchmod�fileno�setZ
subject_bytesZ issuer_bytesZserial_number_bytesZpublic_key_info_bytesr r- �urllib�parse�quote�dictrF Z public_bytesZEncodingZPEMr3 Zextended_key_usageZextended_key_usage_bytes�add)r �filenamerd rf rg r rH Zhas_ekuZcertZnicknameZtrustedZ_ext_key_usageZ_serialrj rk rl rm ri �objZ
ext_key_usagero r r r r` s�
� ��
�
�
� ��
,z&RedHatTaskNamespace.write_p11kit_certsc C s t | �tj�| �tj�g�S r8 )r_ rb r ra rc r* r r r �platform_remove_ca_certsv s
�z,RedHatTaskNamespace.platform_remove_ca_certsc C sF t |�}|�� sdS z |�� W n ty@ t�d|� � Y n0 dS )NFzCould not remove %sT)r �is_file�unlink� ExceptionrZ r[ )r ry r r r r rb | s z1RedHatTaskNamespace.remove_ca_certificates_bundlec C s6 t j}tj�|�r |�|� t�� }|�dd|� d S )N�network�hostname) r � ETC_HOSTNAMEr r r! � backup_file�socketZ gethostnamerU )r r9 r: r$ � old_hostnamer r r �backup_hostname� s
z#RedHatTaskNamespace.backup_hostnamec
C s� |� dd�}|d urhz| �|� W nD tjyf } z*t�dt�� � t�d||� W Y d }~n
d }~0 0 t j
}|� |�r�|� |� d S )Nr r� z%sz3Failed to restore this machine hostname to %s (%s).)
rT � set_hostnamer
r rZ �debug� traceback�
format_excr[ r r� �has_file� restore_file)r r9 r: r� r6 r$ r r r �restore_hostname� s �
z$RedHatTaskNamespace.restore_hostnameNc C s dd� }| � � sdS i }i }|�� D ]�\}}|d u r6q$zHtjtj|gdd�}|j�� d } |d url||| � | |kr||||< W q$ tjy� }
z"t �
d||
� |||< W Y d }
~
q$d }
~
0 0 q$|r�||�} zt�| � W n tjy� |� |� Y n0 |�rt j
j|d�||��d ��dS )
Nc S s& t jdg}|�dd� | �� D �� |S )Nz-Pc S s g | ] }d | �qS )z%s=%sr )r@ �updater r r rB � � zXRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_args.<locals>.<listcomp>)r Z SETSEBOOL�extend�items)Zchangesr' r r r �get_setsebool_args� s
zDRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_argsFT)Zcapture_output� z#Cannot get SELinux boolean '%s': %s� )ZfailedZcommand)r r� r
r# r Z GETSEBOOLr5 �splitr rZ r[ r� � ipapython�errorsZSetseboolError�join) r Zrequired_settingsZ backup_funcr� Z updated_varsZ failed_varsZsetting�state�resultZoriginal_stater6 r' r r r �set_selinux_booleans� sB �
�z(RedHatTaskNamespace.set_selinux_booleansc C s t | �S )z�
:param version: textual version
:return: object implementing proper __cmp__ method for version compare
)r )�versionr r r �parse_ipa_version� s z%RedHatTaskNamespace.parse_ipa_versionc C sn t j�tj�s t �tjd� t�t j�tj d�tj
t tj tj
tjd�� t �tj
d� | �tj
� | �� dS )zACreate systemd config for httpd service to work with IPA
i� zipa-httpd.conf.template)�KDCPROXY_CONFIG�IPA_HTTPD_KDCPROXY� KRB5CC_HTTPDrh N)r r r! r ZSYSTEMD_SYSTEM_HTTPD_D_DIR�mkdirr
�copy_template_filer� �USR_SHARE_IPA_DIR� SYSTEMD_SYSTEM_HTTPD_IPA_CONFrw r� r� r� �chmodr( �systemd_daemon_reloadr* r r r � configure_httpd_service_ipa_conf� s ��
z4RedHatTaskNamespace.configure_httpd_service_ipa_confc C s t �tjddg� dS )z#Tell systemd to reload config filesz--systemz
daemon-reloadN)r
r# r Z SYSTEMCTLr* r r r r� � s z)RedHatTaskNamespace.systemd_daemon_reloadc
C sL t �tj�tjd�tjttj t
j |tj d�� t�
tjd� | �tj� d S )Nzgssproxy.conf.template)� HTTP_KEYTAB�
HTTPD_USERZ IPAAPI_USERZSWEEPER_SOCKETi� )r
r� r r r� r r� Z
GSSPROXY_CONFrw r� r r� Z IPA_CCACHE_SWEEPER_GSSPROXY_SOCKr� r( )r Zipauserr r r � configure_http_gssproxy_conf� s �� z0RedHatTaskNamespace.configure_http_gssproxy_confc C s� t j}tjjdkrtj}ntj}|du s0|du r>t� d� dS t
j � |�}t
j �
|�s`t
�|� t�t
j �t jd�|t|d�� t
�|d� | �|� dS )zmConfigure WSGI for correct Python version (Fedora)
See https://pagure.io/freeipa/issue/7394
r� Nz+Nothing to do for configure_httpd_wsgi_confz ipa-httpd-wsgi.conf.template)Z WSGI_MODULErh )r ZHTTPD_IPA_WSGI_MODULES_CONF�sys� version_info�majorr ZMOD_WSGI_PYTHON2ZMOD_WSGI_PYTHON3rZ r\ r r �dirname�isdir�makedirsr
r� r� r� rw r� r( )r rX Z wsgi_moduleZconfdirr r r �configure_httpd_wsgi_conf� s&
�� z-RedHatTaskNamespace.configure_httpd_wsgi_confc
C sp zt �tj� W nR tyb } z:|jtjkr<t�dtj� nt� dtj|� W Y d}~dS d}~0 0 | �
� dS )z.Remove systemd config for httpd service of IPAz+Trying to remove %s but file does not existzError removing %s: %sN) r r} r r� r) �errno�ENOENTrZ r� r[ r� r] r r r � remove_httpd_service_ipa_conf s ��z1RedHatTaskNamespace.remove_httpd_service_ipa_confc C s t �tjdd d� d S )NZ SSLProtocolF�r Z
set_directiver ZHTTPD_SSL_CONFr* r r r �configure_httpd_protocol/ s
�z,RedHatTaskNamespace.configure_httpd_protocolc C s t �tjd|g� d S )Nz set-hostname)r
r# r ZBIN_HOSTNAMECTL)r r� r r r r� 5 s z RedHatTaskNamespace.set_hostnamec C sj zRt tjd��2}|�� �� dkr2W d � W dS W d � n1 sF0 Y W n tyd Y n0 dS )aA
Checks whether this host is FIPS-enabled.
Returns a boolean indicating if the host is FIPS-enabled, i.e. if the
file /proc/sys/crypto/fips_enabled contains a non-0 value. Otherwise,
or if the file /proc/sys/crypto/fips_enabled does not exist,
the function returns False.
r= �0NTF)rD r ZPROC_FIPS_ENABLED�readr4 rE )r rH r r r �is_fips_enabled8 s 4 z#RedHatTaskNamespace.is_fips_enabledc C s( t �tjddd� t �tjddd� d S )NZErrorLogzlogs/error_logFZ TransferLogzlogs/access_logr� r* r r r �setup_httpd_loggingK s ��z'RedHatTaskNamespace.setup_httpd_logging)�resolve1_enabledr9 c s� |rt |t�sJ �|r t |t�s$J �t� j||||d� ddlm} |durd|�tj�sd|� tj� |d }|�
� }|r�t � dtj
� |r�d}nd}tj|d �|�d �|�d
�} ttj
d ��*}
t�|
�� d � |
�| � W d � n1 s�0 Y |�� |�s�|�s�t � d
tj� dd�d�|��g} |D ]} | �d�| �� �q0ttjd �� }
|
�d�| �� W d � n1 �s|0 Y dS )z�Configure global DNS resolver (e.g. /etc/resolv.conf)
:param nameservers: list of IP addresses
:param searchdomains: list of search domaons
:param fstore: optional file store for backup
)� nameservers�
searchdomainsr� r9 r ��
knownservicesN�NetworkManagerz$Network Manager is enabled, write %szsystemd-resolved�default�,)�
dnsprocessingZserversZsearchesrC rh zLNeither Network Manager nor systemd-resolved are enabled, write %s directly.z!# auto-generated by IPA installerz search {}r� z
nameserver {}�
)�
isinstance�list�super�configure_dns_resolver�ipaplatform.servicesr� r� r Z RESOLV_CONFr� �
is_enabledrZ r� �NETWORK_MANAGER_IPA_CONF� NM_IPA_CONFrF r� rD r rq rr rp �reload_or_restartr" ) r r� r� r� r9 r� �nmZ
nm_enabledr� ZcfgrH Z
nameserver�� __class__r r r� S sT � ��( ��z*RedHatTaskNamespace.configure_dns_resolverc sP t � j|d� ddlm} |d }tj�tj�rLt� tj� |�
� rL|� � dS )zxUnconfigure global DNS resolver (e.g. /etc/resolv.conf)
:param fstore: optional file store for restore
)r9 r r� r� N) r� �unconfigure_dns_resolverr� r� r r �isfiler r� r} r� r� )r r9 r� r� r� r r r� � s z,RedHatTaskNamespace.unconfigure_dns_resolverc
C s" g }t D �]\}}}tj�tjd�|��}tj�|�r�t|��}|� � }W d � n1 s\0 Y d|v } | s�|�
|�s�t � d|� |�
|� t|d��P}|�d� |�d�|�� |�d�d �|��� t�|�� d
� W d � n1 s�0 Y | �|� t � d |� |�|� q|S ) z5Disable global p11-kit configuration for NSS
� {}.moduleNZIPAzBacking up existing '%s'.rC z# created by IPA installer
z module: {}
zdisable-in: {}
z, rh z#Created PKCS#11 module config '%s'.)�PKCS11_MODULESr r r� r �ETC_PKCS11_MODULES_DIRrF r� rD r� r� rZ r� r� rp rq rr r( r" )
r r9 � filenames�name�moduleZ disabled_inry rH rI Z is_ipa_filer r r �configure_pkcs11_modules� s, �
&
.
z,RedHatTaskNamespace.configure_pkcs11_modulesc C sn g }t D ]`\}}}tj�tjd�|��}zt�|� W n tyH Y n 0 |� |� |�
|�r|� |� q|S )z5Restore global p11-kit configuration for NSS
r� ) r� r r r� r r� rF r} r) r" r� r� )r r9 r� r� �_moduleZ _disabled_inry r r r �restore_pkcs11_modules� s �
z*RedHatTaskNamespace.restore_pkcs11_modulesc C s t dd� tD ��S )z<Return the list of module config files setup by IPA
c s s* | ]"\}}}t j�tjd �|��V qdS )r� N)r r r� r r� rF )r@ r� r� Z _disabledr r r � <genexpr>� s �
�z9RedHatTaskNamespace.get_pkcs11_modules.<locals>.<genexpr>)�tupler� r* r r r �get_pkcs11_modules� s �z&RedHatTaskNamespace.get_pkcs11_modulesc C s dS )z(sudo enablement is handled by authselectNr )r Z_fstorer r r �enable_sssd_sudo� s z$RedHatTaskNamespace.enable_sssd_sudoc sX t t| ��|� tjddg}zt�|� W n( tjyR t� d� t� d� Y n0 dS )z Disable ldap-based automountzdisable-featurezwith-custom-automountz/Unable to disable with-custom-automount featurezRIt may happen if the configuration was done using authconfig instead of authselectN)
r� r �disable_ldap_automountr rS r
r# r rZ r\ )r r: rW r� r r r� � s �
z*RedHatTaskNamespace.disable_ldap_automountc s( t � �� }| �� s|S tdd� |D ��S )Nc s s | ]}|� d �s|V qdS )ZcamelliaN)r? )r@ r6 r r r r� � r� z=RedHatTaskNamespace.get_supported_enctypes.<locals>.<genexpr>)r� �get_supported_enctypesr� r� )r Zenctypesr� r r r� � s
z*RedHatTaskNamespace.get_supported_enctypes)F)TF)N)N)-r r r r( r r Z
RESTORECONr, r. r7 r< rJ rM rN rP rQ rY r^ re r` r{ rb r� r� r� � staticmethodr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r r r� r r a sR
�
X
,
�E
r ).�__doc__Z
__future__r r r Zloggingr �pathlibr r� r� r� rt r1 r� �textwrapZ ctypes.utilr � functoolsr r Z pyasn1.errorr r� r r
Zipapython.errorsZipaplatform.constantsr Zipaplatform.pathsr Z ipaplatform.redhat.authconfigr
Zipaplatform.base.tasksr r Z getLoggerr rZ ZLIBSOFTHSM2_SOr� �dedentr� r r Ztasksr r r r �<module> sH
�