File: //usr/lib/python3.6/site-packages/ipaplatform/redhat/__pycache__/tasks.cpython-36.opt-1.pyc
3
�d[e�m � @ s@ d Z ddlmZmZ ddlZddlZddlZddlmZ ddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlmZ ddlmZ ddl
mZ ddlmZ dd lmZ dd
lmZ ddlZdd lm Z dd l m Z dd
l m Z ddl!m"Z" ej#e$�Z%de j&dgfgZ'ej(d�Z)eG dd� d��Z*G dd� de"�Z+e+� Z,dS )zZ
This module contains default Red Hat OS family-specific implementations of
system tasks.
� )�print_function�absolute_importN)�Path)� find_library)�total_ordering)�CalledProcessError)� PyAsn1Error)�directivesetter)�ipautil)� constants)�paths)�
get_auth_tool)�BaseTaskNamespaceZsofthsm2z
p11-kit-proxyz�
# auto-generated by IPA installer
[main]
dns={dnsprocessing}
[global-dns]
searches={searches}
[global-dns-domain-*]
servers={servers}
c @ sH e Zd ZdZedd� �Zdd� Zedd� �Zdd � Z d
d � Z
d d
� Z dS )�
IPAVersionNc C sH | j }|dkr>tjtd��}|j}tjtjg|_tj|_|| _ |||�S )z.Lazy load and call librpm's rpmvercmp
NZrpm) �_rpmvercmp_func�ctypesZCDLLr Z rpmvercmpZc_char_pZargtypesZc_intZrestype)�cls�a�bZrpmvercmp_funcZlibrpm� r �/usr/lib/python3.6/tasks.py�
_rpmvercmpS s zIPAVersion._rpmvercmpc C s || _ |jd�| _d S )Nzutf-8)�_version�encode�_bytes)�self�versionr r r �__init__a s zIPAVersion.__init__c C s | j S )N)r )r r r r r e s zIPAVersion.versionc C s" t |t�stS | j| j|j�dkS )Nr )�
isinstancer �NotImplementedr r )r �otherr r r �__eq__i s
zIPAVersion.__eq__c C s" t |t�stS | j| j|j�dk S )Nr )r r r r r )r r r r r �__lt__n s
zIPAVersion.__lt__c C s
t | j�S )N)�hashr )r r r r �__hash__s s zIPAVersion.__hash__) �__name__�
__module__� __qualname__r � classmethodr r �propertyr r! r" r$ r r r r r O s r c sZ e Zd ZdOdd�Zdd� Zejfdd�Zdd � Zd
d � Z d d
� Z
dd� Z dPdd�Z dd� Z
dd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� ZdQd*d+�Zd,d-� Zd.d/� Zd0d1� Zd2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z!d>d?� Z"dd)d@�� fdAdB�
Z#dR� fdCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(� fdMdN�Z)� Z*S )S�RedHatTaskNamespaceFc C sR t j}| j� s tjj|� r"dS |g}|r6|jd� |j|� tj|dd� dS )a Restore SELinux security context on the given filepath.
SELinux equivalent is /path/to/restorecon <filepath>
restorecon's return values are not reliable so we have to
ignore them (BZ #739604).
ipautil.run() will do the logging.
Nz-FF)Z
raiseonerr) r ZSBIN_RESTORECON�is_selinux_enabled�os�path�exists�appendr
�run)r �filepath�force�
restorecon�argsr r r �restore_contexty s
z#RedHatTaskNamespace.restore_contextc C sD yt jtjg� W n( t jk
r( dS tk
r: dS X dS dS )z2Check if SELinux is available and enabled
FTN)r
r0 r ZSELINUXENABLEDr �OSError)r r r r r+ � s z&RedHatTaskNamespace.is_selinux_enabledc C s( | j � s dS tjj|�s$td| ��dS )a�
We don't have a specific package requirement for policycoreutils
which provides restorecon. This is because we don't require
SELinux on client installs. However if SELinux is enabled then
this package is required.
This function returns nothing but may raise a Runtime exception
if SELinux is enabled but restorecon is not available.
FzoSELinux is enabled but %s does not exist.
Install the policycoreutils package and start the installation again.T)r+ r, r- r. � RuntimeError)r r3 r r r �check_selinux_status� s
z(RedHatTaskNamespace.check_selinux_statusc C s^ t jjtj�std��y&tjddd�}|j� dkr:t d��W n t k
rX td��Y nX dS )a Checks whether IPv6 kernel module is loaded.
Function checks if /proc/net/if_inet6 is present. If IPv6 stack is
enabled, it exists and contains the interfaces configuration.
:raises: RuntimeError when IPv6 stack is disabled
z�IPv6 stack has to be enabled in the kernel and some interface has to have ::1 address assigned. Typically this is 'lo' interface. If you do not wish to use IPv6 globally, disable it on the specific interfaces in sysctl.conf except 'lo' interface.z::1T)Zallow_loopbackNz"no interface for ::1 address foundz�IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf.)
r, r- r. r ZIF_INET6r7 r
ZCheckedIPAddressZget_matching_interface�
ValueError)r Z
localhost6r r r �check_ipv6_stack_enabled� s z,RedHatTaskNamespace.check_ipv6_stack_enabledc C sb yt jtjdgt jd�}W n4 t jk
rN } z|jdkr<dS � W Y dd}~X nX |jd�j� S dS )zsCheck if running inside a container
:returns: container runtime or None
:rtype: str, None
z --container)�stderr� Nzutf-8) �
subprocessZ check_outputr ZSYSTEMD_DETECT_VIRTZSTDOUTr �
returncode�decode�strip)r �output�er r r �detect_container� s
z$RedHatTaskNamespace.detect_containerc C s t � }|j||||� d S )N)r
Z unconfigure)r �fstore�
statestoreZwas_sssd_installedZwas_sssd_configured� auth_configr r r �$restore_pre_ipa_client_configuration� s z8RedHatTaskNamespace.restore_pre_ipa_client_configurationc C sz y*t tjd��}dd� |D �}W d Q R X W n tk
rB g }Y nX |jdj|�� t tjd��}|j|� W d Q R X d S )N�rc S s" g | ]}|j � j� jd �s|�qS )Z NISDOMAIN)r@ �upper�
startswith)�.0�liner r r �
<listcomp>� s z5RedHatTaskNamespace.set_nisdomain.<locals>.<listcomp>z
NISDOMAIN={}
�w)�openr ZSYSCONF_NETWORK�IOErrorr/ �format�
writelines)r Z nisdomain�f�contentr r r �
set_nisdomain� s
z!RedHatTaskNamespace.set_nisdomainTc C s t � }|j|||||� d S )N)r
Z configure)r �sssd� mkhomedirrE ZsudoZsubidrF r r r �modify_nsswitch_pam_stack� s z-RedHatTaskNamespace.modify_nsswitch_pam_stackc C s dS )NFr )r r r r �is_nosssd_supported� s z'RedHatTaskNamespace.is_nosssd_supportedc C s t � }|j|� d S )N)r
Zbackup)r r- rF r r r �backup_auth_configuration s z-RedHatTaskNamespace.backup_auth_configurationc C s t � }|j|� d S )N)r
Zrestore)r r- rF r r r �restore_auth_configuration s z.RedHatTaskNamespace.restore_auth_configurationc C s� |j dd�}tjdddg}|r(|jd� |jd� tj|� xdD ]}|jd|� qBW |jd d d� |jd d
d� |jd dt|�� dS )zg
Migrate the pam stack configuration from authconfig to an authselect
profile.
Z
authconfigrW ZselectrV z with-sudozwith-mkhomedirz--force�ldap�krb5�sssdauthZ
authselectZprofileZ
features_list� N)r\ r] rV r^ rW ) Z get_stater �
AUTHSELECTr/ r
r0 �
restore_state� backup_state�bool)r rE rW �authselect_cmd�confr r r �migrate_auth_configuration s
z.RedHatTaskNamespace.migrate_auth_configurationc C sR yt jtjg� W n, tk
r> } ztjd|� dS d }~X nX tjd� dS d S )Nz1Could not update systemwide CA trust database: %sFz Systemwide CA database updated.T)r
r0 r ZUPDATE_CA_TRUSTr �logger�error�info)r rB r r r �reload_systemwide_ca_store! s
z.RedHatTaskNamespace.reload_systemwide_ca_storec C s t | jtj|�| jtj�g�S )N)�any�write_p11kit_certsr � IPA_P11_KIT� remove_ca_certificates_bundle�SYSTEMWIDE_IPA_CA_CRT)r �ca_certsr r r �platform_insert_ca_certs, s z,RedHatTaskNamespace.platform_insert_ca_certsc . C s& ddl m} ddlm} t|�}yt|d�}W n" tk
rP tjd|� � Y nX |��� |j d� yt
j |j � d� W n" tk
r� tjd|� � Y nX t
� }�xr|D �]h\}} }
} y |j} |j}
|j}|j}W n( tt|fk
r� tjd | � � Y nX tjj| �}tjj| �} tjj|
�}
tjj|�}tjj|�}d
t|| |
||d � }|
d k�rd|d
7 }n|
dk�rv|d7 }|dj|j|jj�j d�d�7 }|j |� |j d k r�||kr�y
|j }W n$ tk
�r� tjd| � � Y nX tjj|�}dt|||d� }|j |� |j |� q�W W d Q R X d S )Nr )�x509)�CertificateErrorrN zFailed to open %sz.# This file was created by IPA. Do not edit.
i� zFailed to set mode of %sz!Failed to decode certificate "%s"z�[p11-kit-object-v1]
class: certificate
certificate-type: x-509
certificate-category: authority
label: "%(label)s"
subject: "%(subject)s"
issuer: "%(issuer)s"
serial-number: "%(serial_number)s"
x-public-key-info: "%(public_key_info)s"
)�label�subject�issuer�
serial_number�public_key_infoTztrusted: true
Fzx-distrusted: true
z{pem}
�ascii)Zpemz,Failed to encode extended key usage for "%s"z�[p11-kit-object-v1]
class: x-certificate-extension
label: "ExtendedKeyUsage for %(label)s"
x-public-key-info: "%(public_key_info)s"
object-id: 2.5.29.37
value: "%(value)s"
)rt rx �value) Zipalibrr Z
ipalib.errorsrs r rO rP rg rh �writer, �fchmod�fileno�setZ
subject_bytesZ issuer_bytesZserial_number_bytesZpublic_key_info_bytesr r9 �urllib�parseZquote�dictrQ Z public_bytesZEncodingZPEMr? Zextended_key_usageZextended_key_usage_bytes�add)r �filenamerp rr rs r- rS Zhas_ekuZcertZnicknameZtrustedZ_ext_key_usageru rv rw rx rt �objZ
ext_key_usagerz r r r rl 4 sz
z&RedHatTaskNamespace.write_p11kit_certsc C s t | jtj�| jtj�g�S )N)rk rn r rm ro )r r r r �platform_remove_ca_certs� s
z,RedHatTaskNamespace.platform_remove_ca_certsc C sH t |�}|j� sdS y |j� W n" tk
rB tjd|� � Y nX dS )NFzCould not remove %sT)r �is_file�unlink� Exceptionrg rh )r r� r- r r r rn � s z1RedHatTaskNamespace.remove_ca_certificates_bundlec C s6 t j}tjj|�r |j|� tj� }|jdd|� d S )N�network�hostname) r � ETC_HOSTNAMEr, r- r. � backup_file�socketZ gethostnamerb )r rD rE r1 � old_hostnamer r r �backup_hostname� s
z#RedHatTaskNamespace.backup_hostnamec C s� |j dd�}|d k rfy| j|� W nB tjk
rd } z$tjdtj� � tjd||� W Y d d }~X nX t j
}|j |�r�|j |� d S )Nr� r� z%sz3Failed to restore this machine hostname to %s (%s).)
ra � set_hostnamer
r rg �debug� traceback�
format_excrh r r� �has_file� restore_file)r rD rE r� rB r1 r r r �restore_hostname� s
z$RedHatTaskNamespace.restore_hostnameNc C s dd� }| j � sdS i }i }x�|j� D ]�\}}|d kr8q&yHtjtj|gdd�}|jj� d } |d k rn||| � | |kr~|||< W q& tjk
r� }
z t j
d||
� |||< W Y d d }
~
X q&X q&W |r�||�} ytj| � W n tjk
r� |j |� Y nX |�r t j
j|dj||��d ��dS )
Nc S s& t jdg}|jdd� | j� D �� |S )Nz-Pc S s g | ] }d | �qS )z%s=%sr )rK �updater r r rM � s zXRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_args.<locals>.<listcomp>)r Z SETSEBOOL�extend�items)Zchangesr4 r r r �get_setsebool_args� s
zDRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_argsFT)Zcapture_output� z#Cannot get SELinux boolean '%s': %s� )ZfailedZcommand)r+ r� r
r0 r Z GETSEBOOLrA �splitr rg rh r� � ipapython�errorsZSetseboolError�join) r Zrequired_settingsZ backup_funcr� Z updated_varsZ failed_varsZsetting�state�resultZoriginal_staterB r4 r r r �set_selinux_booleans� s>
z(RedHatTaskNamespace.set_selinux_booleansc C s t |�S )z�
:param version: textual version
:return: object implementing proper __cmp__ method for version compare
)r )r r r r r �parse_ipa_version� s z%RedHatTaskNamespace.parse_ipa_versionc C sn t jjtj�s t jtjd� tjt jjtj d�tj
t tj tj
tjd�� t jtj
d� | jtj
� | j� dS )zACreate systemd config for httpd service to work with IPA
i� zipa-httpd.conf.template)�KDCPROXY_CONFIG�IPA_HTTPD_KDCPROXY� KRB5CC_HTTPDi� N)r, r- r. r ZSYSTEMD_SYSTEM_HTTPD_D_DIR�mkdirr
�copy_template_filer� �USR_SHARE_IPA_DIR� SYSTEMD_SYSTEM_HTTPD_IPA_CONFr� r� r� r� �chmodr5 �systemd_daemon_reload)r r r r � configure_httpd_service_ipa_conf� s z4RedHatTaskNamespace.configure_httpd_service_ipa_confc C s t jtjddg� dS )z#Tell systemd to reload config filesz--systemz
daemon-reloadN)r
r0 r Z SYSTEMCTL)r r r r r� s z)RedHatTaskNamespace.systemd_daemon_reloadc C sL t jtjjtjd�tjttj t
j |tj d�� tj
tjd� | jtj� d S )Nzgssproxy.conf.template)� HTTP_KEYTAB�
HTTPD_USERZ IPAAPI_USERZSWEEPER_SOCKETi� )r
r� r, r- r� r r� Z
GSSPROXY_CONFr� r� r r� Z IPA_CCACHE_SWEEPER_GSSPROXY_SOCKr� r5 )r Zipauserr r r � configure_http_gssproxy_conf s z0RedHatTaskNamespace.configure_http_gssproxy_confc C s� t j}tjjdkrtj}ntj}|dks0|dkr>tj d� dS t
j j |�}t
j j
|�s`t
j|� tjt
j jt jd�|t|d�� t
j|d� | j|� dS )zmConfigure WSGI for correct Python version (Fedora)
See https://pagure.io/freeipa/issue/7394
r� Nz+Nothing to do for configure_httpd_wsgi_confz ipa-httpd-wsgi.conf.template)Z WSGI_MODULEi� )r ZHTTPD_IPA_WSGI_MODULES_CONF�sys� version_info�majorr ZMOD_WSGI_PYTHON2ZMOD_WSGI_PYTHON3rg ri r, r- �dirname�isdir�makedirsr
r� r� r� r� r� r5 )r re Z wsgi_moduleZconfdirr r r �configure_httpd_wsgi_conf s"
z-RedHatTaskNamespace.configure_httpd_wsgi_confc C sj yt jtj� W nL tk
r\ } z0|jtjkr>tjdtj� ntj dtj|� dS d}~X nX | j
� dS )z.Remove systemd config for httpd service of IPAz+Trying to remove %s but file does not existzError removing %s: %sN) r, r� r r� r6 �errno�ENOENTrg r� rh r� )r rB r r r � remove_httpd_service_ipa_conf1 s
z1RedHatTaskNamespace.remove_httpd_service_ipa_confc C s t jtjdd d� d S )NZ SSLProtocolF)r �
set_directiver �HTTPD_SSL_CONF)r r r r �configure_httpd_protocolD s z,RedHatTaskNamespace.configure_httpd_protocolc C s t jtjd|g� d S )Nz set-hostname)r
r0 r ZBIN_HOSTNAMECTL)r r� r r r r� J s z RedHatTaskNamespace.set_hostnamec C sJ y0t tjd��}|j� j� dkr$dS W dQ R X W n tk
rD Y nX dS )aA
Checks whether this host is FIPS-enabled.
Returns a boolean indicating if the host is FIPS-enabled, i.e. if the
file /proc/sys/crypto/fips_enabled contains a non-0 value. Otherwise,
or if the file /proc/sys/crypto/fips_enabled does not exist,
the function returns False.
rH �0TNF)rO r ZPROC_FIPS_ENABLED�readr@ rP )r rS r r r �is_fips_enabledM s z#RedHatTaskNamespace.is_fips_enabledc C s( t jtjddd� t jtjddd� d S )NZErrorLogzlogs/error_logFZ TransferLogzlogs/access_log)r r� r r� )r r r r �setup_httpd_logging` s z'RedHatTaskNamespace.setup_httpd_logging)�resolve1_enabledrD c sB t � j||||d� ddlm} |dk rB|jtj� rB|jtj� |d }|j� }|r�t j
dtj � |rnd}nd}t j
|d j|�d j|�d
�} ttj d �� }
tj|
j� d � |
j| � W dQ R X |j� | o�| �r>t j
d
tj� ddj
dj|��g} x |D ]} | jdj
| �� q�W ttjd ��}
|
jdj| �� W dQ R X dS )z�Configure global DNS resolver (e.g. /etc/resolv.conf)
:param nameservers: list of IP addresses
:param searchdomains: list of search domaons
:param fstore: optional file store for backup
)� nameservers�
searchdomainsr� rD r )�
knownservicesN�NetworkManagerz$Network Manager is enabled, write %szsystemd-resolved�default�,)�
dnsprocessingZserversZsearchesrN i� zLNeither Network Manager nor systemd-resolved are enabled, write %s directly.z!# auto-generated by IPA installerz search {}r� z
nameserver {}�
)�super�configure_dns_resolver�ipaplatform.servicesr� r� r Z RESOLV_CONFr� �
is_enabledrg r� �NETWORK_MANAGER_IPA_CONF� NM_IPA_CONFrQ r� rO r, r| r} r{ �reload_or_restartr/ ) r r� r� r� rD r� �nmZ
nm_enabledr� ZcfgrS Z
nameserver)� __class__r r r� h sF
z*RedHatTaskNamespace.configure_dns_resolverc sP t � j|d� ddlm} |d }tjjtj�rLtj tj� |j
� rL|j � dS )zxUnconfigure global DNS resolver (e.g. /etc/resolv.conf)
:param fstore: optional file store for restore
)rD r )r� r� N) r� �unconfigure_dns_resolverr� r� r, r- �isfiler r� r� r� r� )r rD r� r� )r� r r r� � s z,RedHatTaskNamespace.unconfigure_dns_resolverc
C s g }x�t D ]�\}}}tjjtjdj|��}tjj|�r�t|��}|j � }W dQ R X d|k} | r�|j
|� r�t j d|� |j
|� t|d��F}|jd� |jdj|�� |jdjd j|��� tj|j� d
� W dQ R X | j|� t j d |� |j|� q
W |S ) z5Disable global p11-kit configuration for NSS
z {}.moduleNZIPAzBacking up existing '%s'.rN z# created by IPA installer
z module: {}
zdisable-in: {}
z, i� z#Created PKCS#11 module config '%s'.)�PKCS11_MODULESr, r- r� r �ETC_PKCS11_MODULES_DIRrQ r� rO r� r� rg r� r� r{ r| r} r5 r/ )
r rD � filenames�name�moduleZ disabled_inr� rS rT Z is_ipa_filer r r �configure_pkcs11_modules� s*
z,RedHatTaskNamespace.configure_pkcs11_modulesc C st g }xjt D ]b\}}}tjjtjdj|��}ytj|� W n tk
rL Y n X |j |� |j
|�r
|j |� q
W |S )z5Restore global p11-kit configuration for NSS
z {}.module) r� r, r- r� r r� rQ r� r6 r/ r� r� )r rD r� r� �_moduleZ _disabled_inr� r r r �restore_pkcs11_modules� s
z*RedHatTaskNamespace.restore_pkcs11_modulesc C s t dd� tD ��S )z<Return the list of module config files setup by IPA
c s s* | ]"\}}}t jjtjd j|��V qdS )z {}.moduleN)r, r- r� r r� rQ )rK r� r� Z _disabledr r r � <genexpr>� s z9RedHatTaskNamespace.get_pkcs11_modules.<locals>.<genexpr>)�tupler� )r r r r �get_pkcs11_modules� s z&RedHatTaskNamespace.get_pkcs11_modulesc C s dS )z(sudo enablement is handled by authselectNr )r Z_fstorer r r �enable_sssd_sudo� s z$RedHatTaskNamespace.enable_sssd_sudoc sZ t t| �j|� tjddg}ytj|� W n* tjk
rT tj d� tj d� Y nX dS )z Disable ldap-based automountzdisable-featurezwith-custom-automountz/Unable to disable with-custom-automount featurezRIt may happen if the configuration was done using authconfig instead of authselectN)
r� r* �disable_ldap_automountr r` r
r0 r rg ri )r rE rd )r� r r r� � s
z*RedHatTaskNamespace.disable_ldap_automount)F)TF)N)N)+r% r& r' r5 r+ r Z
RESTORECONr8 r: rC rG rU rX rY rZ r[ rf rj rq rl r� rn r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r r )r� r r* w sJ
X
, D r* )-�__doc__Z
__future__r r r Zloggingr, Zpathlibr r� r� r� r r= r� �textwrapZ ctypes.utilr � functoolsr r Z pyasn1.errorr r� r r
Zipapython.errorsZipaplatform.constantsr Zipaplatform.pathsr Z ipaplatform.redhat.authconfigr
Zipaplatform.base.tasksr Z getLoggerr% rg ZLIBSOFTHSM2_SOr� �dedentr� r r* Ztasksr r r r �<module> sF
(