D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
self
/
root
/
lib
/
python3.9
/
site-packages
/
ipaplatform
/
redhat
/
__pycache__
/
Filename :
tasks.cpython-39.pyc
back
Copy
a �jiwl � @ sF d Z ddlmZmZ ddlZddlZddlZddlmZ ddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlmZ ddlmZ ddl mZ ddlmZ dd lmZ dd lmZ ddlZdd lm Z dd l m Z dd l m Z ddl!m"Z"m#Z# e�$e%�Z&de j'dgfgZ(e�)d�Z*eG dd� de#��Z+G dd� de"�Z,e,� Z-dS )zZ This module contains default Red Hat OS family-specific implementations of system tasks. � )�print_function�absolute_importN)�Path)� find_library)�total_ordering)�CalledProcessError)� PyAsn1Error)�directivesetter)�ipautil)� constants)�paths)� get_auth_tool)�BaseTaskNamespace�IPAAbstractVersionZsofthsm2z p11-kit-proxyz� # auto-generated by IPA installer [main] dns={dnsprocessing} [global-dns] searches={searches} [global-dns-domain-*] servers={servers} c @ s e Zd ZdZdd� ZdS )� IPAVersionNc C sH | j }|du r>t�td��}|j}tjtjg|_tj|_|| _ |||�S )z.Lazy load and call librpm's rpmvercmp NZrpm) �_rpmvercmp_func�ctypesZCDLLr Z rpmvercmpZc_char_p�argtypesZc_intZrestype)�self�a�bZrpmvercmp_funcZlibrpm� r �</usr/lib/python3.9/site-packages/ipaplatform/redhat/tasks.py�_vercmpS s zIPAVersion._vercmp)�__name__� __module__� __qualname__r r r r r r r O s r c sj e Zd ZdQdd�Zdd� Zejfdd�Zdd � Zd d � Z d d � Z dd� Z dRdd�Z dd� Z dd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� ZdSd*d+�Zed,d-� �Zd.d/� Zd0d1� Z d2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z!d<d=� Z"d>d?� Z#dd)d@�� fdAdB� Z$dT� fdCdD� Z%dEdF� Z&dGdH� Z'dIdJ� Z(dKdL� Z)� fdMdN�Z*� fdOdP�Z+� Z,S )U�RedHatTaskNamespaceFc C sN t j}| �� rtj�|�s dS |g}|r2|�d� |�|� tj|dd� dS )a Restore SELinux security context on the given filepath. SELinux equivalent is /path/to/restorecon <filepath> restorecon's return values are not reliable so we have to ignore them (BZ #739604). ipautil.run() will do the logging. Nz-FF)Z raiseonerr) r ZSBIN_RESTORECON�is_selinux_enabled�os�path�exists�appendr �run)r �filepath�force� restorecon�argsr r r �restore_contextc s z#RedHatTaskNamespace.restore_contextc C sD zt �tjg� W n( t jy( Y dS ty: Y dS 0 dS dS )z2Check if SELinux is available and enabled FTN)r r# r ZSELINUXENABLEDr �OSError�r r r r r y s z&RedHatTaskNamespace.is_selinux_enabledc C s( | � � s dS tj�|�s$td| ��dS )a� We don't have a specific package requirement for policycoreutils which provides restorecon. This is because we don't require SELinux on client installs. However if SELinux is enabled then this package is required. This function returns nothing but may raise a Runtime exception if SELinux is enabled but restorecon is not available. FzoSELinux is enabled but %s does not exist. Install the policycoreutils package and start the installation again.T)r r r r! � RuntimeError)r r& r r r �check_selinux_status� s �z(RedHatTaskNamespace.check_selinux_statusc C s\ t j�tj�std��z&tjddd�}|�� du r:t d��W n t yV td��Y n0 dS )a Checks whether IPv6 kernel module is loaded. Function checks if /proc/net/if_inet6 is present. If IPv6 stack is enabled, it exists and contains the interfaces configuration. :raises: RuntimeError when IPv6 stack is disabled z�IPv6 stack has to be enabled in the kernel and some interface has to have ::1 address assigned. Typically this is 'lo' interface. If you do not wish to use IPv6 globally, disable it on the specific interfaces in sysctl.conf except 'lo' interface.z::1T)Zallow_loopbackNz"no interface for ::1 address foundz�IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf.) r r r! r ZIF_INET6r+ r ZCheckedIPAddressZget_matching_interface� ValueError)r Z localhost6r r r �check_ipv6_stack_enabled� s � �z,RedHatTaskNamespace.check_ipv6_stack_enabledc C sn zt jtjdgt jd�}W n@ t jyZ } z&|jdkrDW Y d}~dS � W Y d}~nd}~0 0 |�d��� S dS )zsCheck if running inside a container :returns: container runtime or None :rtype: str, None z --container)�stderr� Nzutf-8) � subprocessZ check_outputr ZSYSTEMD_DETECT_VIRTZSTDOUTr � returncode�decode�strip)r �output�er r r �detect_container� s � z$RedHatTaskNamespace.detect_containerc C s t � }|�||||� d S �N)r Z unconfigure)r �fstore� statestoreZwas_sssd_installedZwas_sssd_configured� auth_configr r r �$restore_pre_ipa_client_configuration� s �z8RedHatTaskNamespace.restore_pre_ipa_client_configurationc C s� z>t tjd�� }dd� |D �}W d � n1 s20 Y W n tyT g }Y n0 |�d�|�� t tjd��}|�|� W d � n1 s�0 Y d S )N�rc S s" g | ]}|� � �� �d �s|�qS )Z NISDOMAIN)r4 �upper� startswith)�.0�liner r r � <listcomp>� s �z5RedHatTaskNamespace.set_nisdomain.<locals>.<listcomp>z NISDOMAIN={} �w)�openr ZSYSCONF_NETWORK�IOErrorr" �format� writelines)r Z nisdomain�f�contentr r r � set_nisdomain� s �( z!RedHatTaskNamespace.set_nisdomainTc C s t � }|�|||||� d S r8 )r Z configure)r �sssd� mkhomedirr: ZsudoZsubidr; r r r �modify_nsswitch_pam_stack� s z-RedHatTaskNamespace.modify_nsswitch_pam_stackc C s dS )NFr r* r r r �is_nosssd_supported� s z'RedHatTaskNamespace.is_nosssd_supportedc C s t � }|�|� d S r8 )r Zbackup�r r r; r r r �backup_auth_configuration� s z-RedHatTaskNamespace.backup_auth_configurationc C s t � }|�|� d S r8 )r ZrestorerO r r r �restore_auth_configuration� s z.RedHatTaskNamespace.restore_auth_configurationc C s� |� dd�}tjdddg}|r(|�d� |�d� t�|� dD ]}|�d|� q@|�d d d� |�d d d � |�d dt|�� d S )zg Migrate the pam stack configuration from authconfig to an authselect profile. Z authconfigrL ZselectrK z with-sudozwith-mkhomedirz--force)ZldapZkrb5rK ZsssdauthrL Z authselectZprofileZ features_list� N) Z get_stater � AUTHSELECTr" r r# � restore_state� backup_state�bool)r r: rL �authselect_cmd�confr r r �migrate_auth_configuration� s �z.RedHatTaskNamespace.migrate_auth_configurationc C sX zt �tjg� W n2 tyD } zt�d|� W Y d }~dS d }~0 0 t�d� dS d S )Nz1Could not update systemwide CA trust database: %sFz Systemwide CA database updated.T)r r# r ZUPDATE_CA_TRUSTr �logger�error�info�r r6 r r r �reload_systemwide_ca_store s � z.RedHatTaskNamespace.reload_systemwide_ca_storec C s t | �tj|�| �tj�g�S r8 )�any�write_p11kit_certsr � IPA_P11_KIT� remove_ca_certificates_bundle�SYSTEMWIDE_IPA_CA_CRT)r �ca_certsr r r �platform_insert_ca_certs s ��z,RedHatTaskNamespace.platform_insert_ca_certsc C s0 ddl m} ddlm} t|�}zt|d�}W n tyN t�d|� � Y n0 |��� |� d� zt � |� � d� W n ty� t�d|� � Y n0 t � }|D �]f\}} } } } z |j} |j}|j}|j}W n& tt|fy� t�d | � � Y n0 tj�| �}tj�| �} tj�|�}tj�|�}tj�|�}d t|| |||d � }| d u �r\|d 7 }n| du �rn|d7 }|dj|�|jj�� d�d�7 }|� |� |j d ur�||vr�z |j }W n" t�y� t�d| � � Y n0 tj�|�}dt|||d� }|� |� |� |� q�W d � n1 �s"0 Y d S )Nr )�x509)�CertificateErrorrC zFailed to open %sz.# This file was created by IPA. Do not edit. � zFailed to set mode of %sz!Failed to decode certificate "%s"z�[p11-kit-object-v1] class: certificate certificate-type: x-509 certificate-category: authority label: "%(label)s" subject: "%(subject)s" issuer: "%(issuer)s" serial-number: "%(serial_number)s" x-public-key-info: "%(public_key_info)s" )�label�subject�issuer� serial_number�public_key_infoTztrusted: true Fzx-distrusted: true z{pem} �ascii)Zpemz,Failed to encode extended key usage for "%s"z�[p11-kit-object-v1] class: x-certificate-extension label: "ExtendedKeyUsage for %(label)s" x-public-key-info: "%(public_key_info)s" object-id: 2.5.29.37 value: "%(value)s" )ri rm �value) Zipalibrf Z ipalib.errorsrg r rD rE rZ r[ �writer �fchmod�fileno�setZ subject_bytesZ issuer_bytesZserial_number_bytesZpublic_key_info_bytesr r- �urllib�parse�quote�dictrF Z public_bytesZEncodingZPEMr3 Zextended_key_usageZextended_key_usage_bytes�add)r �filenamerd rf rg r rH Zhas_ekuZcertZnicknameZtrustedZ_ext_key_usageZ_serialrj rk rl rm ri �objZ ext_key_usagero r r r r` s� � �� � � � �� ,z&RedHatTaskNamespace.write_p11kit_certsc C s t | �tj�| �tj�g�S r8 )r_ rb r ra rc r* r r r �platform_remove_ca_certsv s �z,RedHatTaskNamespace.platform_remove_ca_certsc C sF t |�}|�� sdS z |�� W n ty@ t�d|� � Y n0 dS )NFzCould not remove %sT)r �is_file�unlink� ExceptionrZ r[ )r ry r r r r rb | s z1RedHatTaskNamespace.remove_ca_certificates_bundlec C s6 t j}tj�|�r |�|� t�� }|�dd|� d S )N�network�hostname) r � ETC_HOSTNAMEr r r! � backup_file�socketZ gethostnamerU )r r9 r: r$ � old_hostnamer r r �backup_hostname� s z#RedHatTaskNamespace.backup_hostnamec C s� |� dd�}|d urhz| �|� W nD tjyf } z*t�dt�� � t�d||� W Y d }~n d }~0 0 t j }|� |�r�|� |� d S )Nr r� z%sz3Failed to restore this machine hostname to %s (%s).) rT � set_hostnamer r rZ �debug� traceback� format_excr[ r r� �has_file� restore_file)r r9 r: r� r6 r$ r r r �restore_hostname� s � z$RedHatTaskNamespace.restore_hostnameNc C s dd� }| � � sdS i }i }|�� D ]�\}}|d u r6q$zHtjtj|gdd�}|j�� d } |d url||| � | |kr||||< W q$ tjy� } z"t � d|| � |||< W Y d } ~ q$d } ~ 0 0 q$|r�||�} zt�| � W n tjy� |� |� Y n0 |�rt j j|d�||��d ��dS ) Nc S s& t jdg}|�dd� | �� D �� |S )Nz-Pc S s g | ] }d | �qS )z%s=%sr )r@ �updater r r rB � � zXRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_args.<locals>.<listcomp>)r Z SETSEBOOL�extend�items)Zchangesr' r r r �get_setsebool_args� s zDRedHatTaskNamespace.set_selinux_booleans.<locals>.get_setsebool_argsFT)Zcapture_output� z#Cannot get SELinux boolean '%s': %s� )ZfailedZcommand)r r� r r# r Z GETSEBOOLr5 �splitr rZ r[ r� � ipapython�errorsZSetseboolError�join) r Zrequired_settingsZ backup_funcr� Z updated_varsZ failed_varsZsetting�state�resultZoriginal_stater6 r' r r r �set_selinux_booleans� sB � �z(RedHatTaskNamespace.set_selinux_booleansc C s t | �S )z� :param version: textual version :return: object implementing proper __cmp__ method for version compare )r )�versionr r r �parse_ipa_version� s z%RedHatTaskNamespace.parse_ipa_versionc C sn t j�tj�s t �tjd� t�t j�tj d�tj t tj tj tjd�� t �tj d� | �tj � | �� dS )zACreate systemd config for httpd service to work with IPA i� zipa-httpd.conf.template)�KDCPROXY_CONFIG�IPA_HTTPD_KDCPROXY� KRB5CC_HTTPDrh N)r r r! r ZSYSTEMD_SYSTEM_HTTPD_D_DIR�mkdirr �copy_template_filer� �USR_SHARE_IPA_DIR� SYSTEMD_SYSTEM_HTTPD_IPA_CONFrw r� r� r� �chmodr( �systemd_daemon_reloadr* r r r � configure_httpd_service_ipa_conf� s �� z4RedHatTaskNamespace.configure_httpd_service_ipa_confc C s t �tjddg� dS )z#Tell systemd to reload config filesz--systemz daemon-reloadN)r r# r Z SYSTEMCTLr* r r r r� � s z)RedHatTaskNamespace.systemd_daemon_reloadc C sL t �tj�tjd�tjttj t j |tj d�� t� tjd� | �tj� d S )Nzgssproxy.conf.template)� HTTP_KEYTAB� HTTPD_USERZ IPAAPI_USERZSWEEPER_SOCKETi� )r r� r r r� r r� Z GSSPROXY_CONFrw r� r r� Z IPA_CCACHE_SWEEPER_GSSPROXY_SOCKr� r( )r Zipauserr r r � configure_http_gssproxy_conf� s �� z0RedHatTaskNamespace.configure_http_gssproxy_confc C s� t j}tjjdkrtj}ntj}|du s0|du r>t� d� dS t j � |�}t j � |�s`t �|� t�t j �t jd�|t|d�� t �|d� | �|� dS )zmConfigure WSGI for correct Python version (Fedora) See https://pagure.io/freeipa/issue/7394 r� Nz+Nothing to do for configure_httpd_wsgi_confz ipa-httpd-wsgi.conf.template)Z WSGI_MODULErh )r ZHTTPD_IPA_WSGI_MODULES_CONF�sys� version_info�majorr ZMOD_WSGI_PYTHON2ZMOD_WSGI_PYTHON3rZ r\ r r �dirname�isdir�makedirsr r� r� r� rw r� r( )r rX Z wsgi_moduleZconfdirr r r �configure_httpd_wsgi_conf� s& �� z-RedHatTaskNamespace.configure_httpd_wsgi_confc C sp zt �tj� W nR tyb } z:|jtjkr<t�dtj� nt� dtj|� W Y d}~dS d}~0 0 | � � dS )z.Remove systemd config for httpd service of IPAz+Trying to remove %s but file does not existzError removing %s: %sN) r r} r r� r) �errno�ENOENTrZ r� r[ r� r] r r r � remove_httpd_service_ipa_conf s ��z1RedHatTaskNamespace.remove_httpd_service_ipa_confc C s t �tjdd d� d S )NZ SSLProtocolF�r Z set_directiver ZHTTPD_SSL_CONFr* r r r �configure_httpd_protocol/ s �z,RedHatTaskNamespace.configure_httpd_protocolc C s t �tjd|g� d S )Nz set-hostname)r r# r ZBIN_HOSTNAMECTL)r r� r r r r� 5 s z RedHatTaskNamespace.set_hostnamec C sj zRt tjd��2}|�� �� dkr2W d � W dS W d � n1 sF0 Y W n tyd Y n0 dS )aA Checks whether this host is FIPS-enabled. Returns a boolean indicating if the host is FIPS-enabled, i.e. if the file /proc/sys/crypto/fips_enabled contains a non-0 value. Otherwise, or if the file /proc/sys/crypto/fips_enabled does not exist, the function returns False. r= �0NTF)rD r ZPROC_FIPS_ENABLED�readr4 rE )r rH r r r �is_fips_enabled8 s 4 z#RedHatTaskNamespace.is_fips_enabledc C s( t �tjddd� t �tjddd� d S )NZErrorLogzlogs/error_logFZ TransferLogzlogs/access_logr� r* r r r �setup_httpd_loggingK s ��z'RedHatTaskNamespace.setup_httpd_logging)�resolve1_enabledr9 c s� |rt |t�sJ �|r t |t�s$J �t� j||||d� ddlm} |durd|�tj�sd|� tj� |d }|� � }|r�t � dtj � |r�d}nd}tj|d �|�d �|�d �} ttj d ��*} t�| �� d � | �| � W d � n1 s�0 Y |�� |�s�|�s�t � d tj� dd�d�|��g} |D ]} | �d�| �� �q0ttjd �� } | �d�| �� W d � n1 �s|0 Y dS )z�Configure global DNS resolver (e.g. /etc/resolv.conf) :param nameservers: list of IP addresses :param searchdomains: list of search domaons :param fstore: optional file store for backup )� nameservers� searchdomainsr� r9 r �� knownservicesN�NetworkManagerz$Network Manager is enabled, write %szsystemd-resolved�default�,)� dnsprocessingZserversZsearchesrC rh zLNeither Network Manager nor systemd-resolved are enabled, write %s directly.z!# auto-generated by IPA installerz search {}r� z nameserver {}� )� isinstance�list�super�configure_dns_resolver�ipaplatform.servicesr� r� r Z RESOLV_CONFr� � is_enabledrZ r� �NETWORK_MANAGER_IPA_CONF� NM_IPA_CONFrF r� rD r rq rr rp �reload_or_restartr" ) r r� r� r� r9 r� �nmZ nm_enabledr� ZcfgrH Z nameserver�� __class__r r r� S sT � ��( ��z*RedHatTaskNamespace.configure_dns_resolverc sP t � j|d� ddlm} |d }tj�tj�rLt� tj� |� � rL|� � dS )zxUnconfigure global DNS resolver (e.g. /etc/resolv.conf) :param fstore: optional file store for restore )r9 r r� r� N) r� �unconfigure_dns_resolverr� r� r r �isfiler r� r} r� r� )r r9 r� r� r� r r r� � s z,RedHatTaskNamespace.unconfigure_dns_resolverc C s" g }t D �]\}}}tj�tjd�|��}tj�|�r�t|��}|� � }W d � n1 s\0 Y d|v } | s�|� |�s�t � d|� |� |� t|d��P}|�d� |�d�|�� |�d�d �|��� t�|�� d � W d � n1 s�0 Y | �|� t � d |� |�|� q|S ) z5Disable global p11-kit configuration for NSS � {}.moduleNZIPAzBacking up existing '%s'.rC z# created by IPA installer z module: {} zdisable-in: {} z, rh z#Created PKCS#11 module config '%s'.)�PKCS11_MODULESr r r� r �ETC_PKCS11_MODULES_DIRrF r� rD r� r� rZ r� r� rp rq rr r( r" ) r r9 � filenames�name�moduleZ disabled_inry rH rI Z is_ipa_filer r r �configure_pkcs11_modules� s, � & . z,RedHatTaskNamespace.configure_pkcs11_modulesc C sn g }t D ]`\}}}tj�tjd�|��}zt�|� W n tyH Y n 0 |� |� |� |�r|� |� q|S )z5Restore global p11-kit configuration for NSS r� ) r� r r r� r r� rF r} r) r" r� r� )r r9 r� r� �_moduleZ _disabled_inry r r r �restore_pkcs11_modules� s � z*RedHatTaskNamespace.restore_pkcs11_modulesc C s t dd� tD ��S )z<Return the list of module config files setup by IPA c s s* | ]"\}}}t j�tjd �|��V qdS )r� N)r r r� r r� rF )r@ r� r� Z _disabledr r r � <genexpr>� s � �z9RedHatTaskNamespace.get_pkcs11_modules.<locals>.<genexpr>)�tupler� r* r r r �get_pkcs11_modules� s �z&RedHatTaskNamespace.get_pkcs11_modulesc C s dS )z(sudo enablement is handled by authselectNr )r Z_fstorer r r �enable_sssd_sudo� s z$RedHatTaskNamespace.enable_sssd_sudoc sX t t| ��|� tjddg}zt�|� W n( tjyR t� d� t� d� Y n0 dS )z Disable ldap-based automountzdisable-featurezwith-custom-automountz/Unable to disable with-custom-automount featurezRIt may happen if the configuration was done using authconfig instead of authselectN) r� r �disable_ldap_automountr rS r r# r rZ r\ )r r: rW r� r r r� � s � z*RedHatTaskNamespace.disable_ldap_automountc s( t � �� }| �� s|S tdd� |D ��S )Nc s s | ]}|� d �s|V qdS )ZcamelliaN)r? )r@ r6 r r r r� � r� z=RedHatTaskNamespace.get_supported_enctypes.<locals>.<genexpr>)r� �get_supported_enctypesr� r� )r Zenctypesr� r r r� � s z*RedHatTaskNamespace.get_supported_enctypes)F)TF)N)N)-r r r r( r r Z RESTORECONr, r. r7 r< rJ rM rN rP rQ rY r^ re r` r{ rb r� r� r� � staticmethodr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r r r� r r a sR � X , �E r ).�__doc__Z __future__r r r Zloggingr �pathlibr r� r� r� rt r1 r� �textwrapZ ctypes.utilr � functoolsr r Z pyasn1.errorr r� r r Zipapython.errorsZipaplatform.constantsr Zipaplatform.pathsr Z ipaplatform.redhat.authconfigr Zipaplatform.base.tasksr r Z getLoggerr rZ ZLIBSOFTHSM2_SOr� �dedentr� r r Ztasksr r r r �<module> sH �