CasperSecurity
o
��Jh�h � @ s� d dl mZ d dlmZmZ d dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
mZmZ d dlZd dlmZmZmZmZ d d lmZ d d
lmZ d d lmZm Z m Z m Z m Z d d l m!Z! d d
l"m#Z#m$Z$ d dl%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z. dZ/G dd� de�Z0dd� Z1edd�dd� �Z2de deej3 f fdd�Z4d ej3d ej5de6fd d �Z7edd�d e6d!e6de8fd"d#��Z9d$e6d%e
e6e f d!ej:de6fd&d'�Z;d(eej3 de e6eeej:e6f f fd)d*�Z<d+e!de
e6e f fd,d-�Z=dee
e6e f fd.d/�Z>d0e e6eeej:e6f f d%e
e6e f dee
e6e f fd1d2�Z?d+e!de
e6e f fd3d4�Z@ 5 6dUd7e e6eej3 f d8e6d9e8ddfd:d;�ZAd<d=� ZBd>d?� ZCd@e6dAe6dBe'dCe&dDeDdEeDdFe8fdGdH�ZEdIdJ� ZFd+e!fdKdL�ZGdMdN� ZHdOdP� ZIdQdR� ZJdSdT� ZKdS )V� )� defaultdict)�datetime�timezone)�Enum)� lru_cache)�choice)�Any� DefaultDict�Dict�List�TupleN)�
exceptions� livepatch�messages�util)�_reboot_required)� _is_attached)�PreserveAptCfg�get_apt_cache_datetime�get_apt_pkg_cache�get_esm_apt_pkg_cache�get_pkg_candidate_version)�UAConfig)�ESMAppsEntitlement�ESMInfraEntitlement)�ApplicabilityStatus�ApplicationStatus�ContractStatus)�get_distro_info�get_kernel_info�get_release_info�is_current_series_lts� is_supported)� esm-infra�esm-appsc @ s$ e Zd ZdZdZdZdZdZdZdS )� UpdateStatusz2Represents the availability of a security package.�upgrade_available� upgrade_available_not_preferred�pending_attach�pending_enable�upgrade_unavailableN) �__name__�
__module__� __qualname__�__doc__� AVAILABLE�AVAILABLE_NOT_PREFERRED�
UNATTACHED� NOT_ENABLED� UNAVAILABLE� r4 r4 �:/usr/lib/python3/dist-packages/uaclient/security_status.pyr% ( s r% c C s t t�| �� d S )N)�printr �create_package_list_str)�packagesr4 r4 r5 �print_package_list1 s r9 )�maxsizec C sR t � j} dd�| �fddd�| �fddd�| �fd dd
�| �fddd �| �fd iS ) N�Ubuntuz {}-security�standard-security�
UbuntuESMAppsz{}-apps-securityr$ � UbuntuESMz{}-infra-securityr# z{}-apps-updatesz{}-infra-updates)r �series�format)r? r4 r4 r5 �%get_origin_information_to_service_map5 s �rA �return�strc C sv t t�} tt��)}dd� |jD �}|| d< t�|�}|D ] }| t||� �|� q W d � | S 1 s4w Y | S )Nc S s g | ]}|j r|�qS r4 )� current_ver��.0�packager4 r4 r5 �
<listcomp>G s
��z4get_installed_packages_by_origin.<locals>.<listcomp>�all) r �listr r r8 �apt_pkg�DepCache� get_origin_for_installed_package�append)�result�cache�installed_packages� dep_cacherG r4 r4 r5 � get_installed_packages_by_originA s"
�
�
�
�
�
rS rG rR c C s� | j sdS | j j}t|�dkr |�| �}|r| j |kr dS |j}|D ]!\}}t� �|j|jfd�}|tv r9| S |jdkrC|j S q"dS )a
Returns the origin for a package installed in the system.
Technically speaking, packages don't have origins - their versions do.
We check the available versions (installed, candidate) to determine the
most reasonable origin for the package.
� � �unknownr; � third-party)
rD � file_list�len�get_candidate_verrA �get�origin�archive� ESM_SERVICES� component)rG rR �available_origins� candidater\ �_�servicer4 r4 r5 rM V s$
�
�rM �pkg�versionc C s t | dd�}|r ||kS dS )z;Returns True if the package version is a candidate version.F)�check_esm_cache)r )rd re �candidate_versionr4 r4 r5 �_is_candidate_version{ s rh � service_name�ua_infoc C sl | dv s|d r | |d v r t |jj|j�}|r tjjS tjjS |d s(tjjS | |d v r2tj jS tj
jS )z�Defines the update status for a package based on the service name.
For ESM-[Infra|Apps] packages, first checks if Pro is attached. If this is
the case, also check for availability of the service.
)r< �standard-updates�attached�enabled_services�entitled_services) rh �
parent_pkg�name�ver_strr% r/ �valuer0 r1 r2 r3 )ri rj re � is_candidater4 r4 r5 �get_update_status� s"
�
���� rt r8 c C s> t t�}tt���}| D ]�}|jr�|jD ]C}||jkrVd}|jD ] \}}t� �|j |j
f�}|r=|| � ||j f� d} nq |jd d } |sVd| j
vrV|d � || j f� q|j
|v r�||j
}
|
jD ]'}||jkr�|jD ] \}}t� �|j |j
f�}|r�|| � ||j f� nqnqdq W d � |S 1 s�w Y |S )z�Filters a list of packages looking for available updates.
All versions greater than the installed one are reported, based on where
it is provided, including ESM pockets, excluding backports.
FTr � backportsrk N)r rJ r r rD � version_listrX rA r[ r\ r] rN �siterp ) r8 rO � esm_cacherG re �counted_as_securityr\ rb rc �expected_origin� esm_packager4 r4 r5 �filter_updates� sZ
����
��
�����
�.�.r| �cfgc C s� t | �j}|g g d�}|rQt| �}t| �}|�� tjkr#|d �d� |�� d t j
kr3|d �d� |�� tjkrA|d �d� |�� d t j
krQ|d �d� |S )z7Returns the Pro information based on the config object.)rl rm rn rn r$ r rm r# ) r � is_attachedr r �contract_statusr �ENTITLEDrN �application_statusr �ENABLED)r} r~ rj �infra_entitlement�apps_entitlementr4 r4 r5 � get_ua_info� s*
�
�
�r� c C s� zt �� } W n tjy g Y S w t� j}| d urF|d urF|| jkrF| j d urF| j jdkrF| j jd urFt | j j�dkrFdd� | j jD �S g S )N�appliedr c S s" g | ]
}|j pd |jp dd��qS )rT F�rp �patchedr� )rF �fixr4 r4 r5 rH s ��z,get_livepatch_fixed_cves.<locals>.<listcomp>)
r �statusr
�ProcessExecutionErrorr � proc_version_signature_version�kernel�state�fixesrY )� lp_status�our_kernel_versionr4 r4 r5 �get_livepatch_fixed_cves s" �
�r� �upgradable_versionsc C sT g }| � � D ]!\}}|D ]\}}t|||�}|�|jj|j||||jd�� q q|S )N)rG re ri r� r\ �
download_size)�itemsrt rN ro rp rq �size)r� rj �updatesrc rv re r\ r� r4 r4 r5 �create_updates_list s ���
r� c C s t | �}d|i}t� }|d }t|�|d< t|�}g |d< t||�}t|d �|d< t|d �|d< t|d �|d
< t|d �|d < t|d
�|d< t|d �|d< t|d �|d< t|d �|d< t|d �|d< t|d �|d< t|d �|d< t| �j|d< d||dt� id �S ) ag Returns the status of security updates on a system.
The returned dict has a 'packages' key with a list of all installed
packages which can receive security updates, with or without ESM,
reflecting the availability of the update based on the Pro status.
There is also a summary with the Ubuntu Pro information and the package
counts.
�uarI �num_installed_packagesrk �main�num_main_packages�
restricted�num_restricted_packages�universe�num_universe_packages�
multiverse�num_multiverse_packagesrW �num_third_party_packagesrV �num_unknown_packagesr# �num_esm_infra_packagesr$ �num_esm_apps_packages�num_esm_infra_updates�num_esm_apps_updatesr< � num_standard_security_updates�reboot_requiredz0.1�
fixed_cves)�_schema_version�summaryr8 r )r� rS rY r| r� r r� r� )r} rj r� �packages_by_originrQ r� r� r4 r4 r5 �security_status_dict/ s:
���r� rI F�
package_lists�
show_items� always_showc C sB t | d �}ttjj|d�� dt t|��d }|dv r=t | d �t | d � t | d � }ttj�|�j||d d
�� |d v ret | d �t | d
� t | d � }|sW|rettj�|�j||dd
�� |dv r�t | d �}|ss|r�ttj�|�j||d�� |dv r�t | d �}|s�|r�ttj �|�j||d�� td� d S )NrI )�count� rU )rI r# r� r� r# �Main/Restricted)�offsetr� �
repository)rI r$ r� r� r$ �Universe/Multiverse)rI rW rW )r� r� )rI rV rV rT )
rY r6 r �SS_SUMMARY_TOTALr@ rC �SS_SUMMARY_ARCHIVE� pluralize�SS_SUMMARY_THIRD_PARTY�SS_SUMMARY_UNAVAILABLE) r� r� r� �total_packagesr� � packages_mr� packages_um�packages_thirdparty�packages_unknownr4 r4 r5 �_print_package_summarya sn
�
�� ��
�
�� �� ��� ��� r� c C sH t � j} t| �j}d�t|j�t|j��}tt j
j|d�� td� d S )Nz{}/{}��daterT ) r r? r �eolr@ rC �month�yearr6 r �SS_INTERIM_SUPPORT)r? �eol_dater� r4 r4 r5 � _print_interim_release_support� s
r� c C sD t � j} t| �rt| �j}ttjjt |j
�d�� d S ttj � d S )Nr� ) r r? r" r r� r6 r �SS_LTS_SUPPORTr@ rC r� �SS_NO_SECURITY_COVERAGE)r? r� r4 r4 r5 �_print_lts_support� s
r� rc r� �service_status�service_applicability�installed_updates�available_updatesr~ c
C s� t � j}t|�j}|tjkrtjj|| t |j
�d�} n tj j| |t |j
�d�} |r7| dtj �
|�j|d� 7 } |rG| dtj�
|�j|d� 7 } t| � |rd|tjkrd|tjkrdtd� ttjj| d�� td� d S )N)r� rc r� )rc r� r� r� )r� rT �rc )r r? r �eol_esmr r� r �SS_SERVICE_ENABLEDr@ rC r� �SS_SERVICE_ADVERTISE�SS_SERVICE_ENABLED_COUNTSr� �SS_SERVICE_ADVERTISE_COUNTSr6 �DISABLEDr �
APPLICABLE�SS_SERVICE_COMMAND)
rc r� r� r� r� r� r~ r? � eol_date_esm�messager4 r4 r5 �_print_service_support� sF
��
�
�
�
��
r� c C sf t � } | d u rttj� td� d S t�tj�}|| }|jdkr1ttj j
|jd�� td� d S d S )NrT r )�days) r r6 r �SS_UPDATE_UNKNOWNr �nowr �utcr� �SS_UPDATE_DAYSr@ )�last_apt_updater� �time_since_updater4 r4 r5 �_print_apt_update_call� s
�r� c
C s� t | �}t| �}|�� d }|�� d }|�� d }|�� d }t� j}t� }t| �d } t� }
t |
d |
d |
d �d } t |
d |
d |
d �d } t
|
� t t j
� t d � t� |spt|�rit� t t j� d S |tjkrxt� | r�t t j� nt t j� t d � tdd
||t|
d �t| �| d � |
d s�|
d s�|
d r�tdd ||t|
d �t| �| d � | s�t t j� d S d S )
Nr rl r� r� r# r� r� r$ rT r� �rc r� r� r� r� r� r~ r� )r r r� �applicability_statusr r? r! r� rS r| r� r6 r � SS_HELP_CALLr� r" r� �SS_NO_INTERIM_PRO_SUPPORTr r� r� �SS_IS_ATTACHED�SS_IS_NOT_ATTACHEDr� rY �
SS_LEARN_MORE)
r} �
esm_infra_ent� esm_apps_ent�esm_infra_status�esm_infra_applicability�esm_apps_status�esm_apps_applicabilityr? �is_ltsr~ r� �"security_upgradable_versions_infra�!security_upgradable_versions_appsr4 r4 r5 �security_status� s� ��������
� ���
�
�r� c C �z t � } | d }dd� |D �}t| ddd� |r6ttj� td� ttj� t|� ttjjt |�d�� d S ttj
� d S )NrW c S � g | ]}|j �qS r4 �rp rE r4 r4 r5 rH A � z-list_third_party_packages.<locals>.<listcomp>T�r� r� rT �rG ) rS r� r6 r �SS_THIRD_PARTY�SS_PACKAGES_HEADERr9 � SS_SHOW_HINTr@ r �SS_NO_THIRD_PARTY)r� �third_party_packages�
package_namesr4 r4 r5 �list_third_party_packages> s �
r c C r� )NrV c S r� r4 r� rE r4 r4 r5 rH U r� z-list_unavailable_packages.<locals>.<listcomp>Tr� rT r� ) rS r� r6 r �SS_UNAVAILABLEr� r9 r r@ r �SS_NO_UNAVAILABLE)r� �unknown_packagesr r4 r4 r5 �list_unavailable_packagesR s �
r c s� t � }|d }|d |d }|| }t� }t|�d }|D ]
\}}|�|j� q t� j} t� }
t| �} t | �} | �
� d }
| � � d }t dd� |D ���t dd� |D ��� t � �fdd�|D ��}t
|dd d
� |
syt| �rrt� ttj� d S |
tjkr�t� td � tdd |
|t|�t|�d
d� ttjjdd�� td � t| �s� r�ttjjdd�� t� � �r�ttj jdd�� t�� � pƈ}|r�|r�tj jdd�}ntj jdd�}t|� t|� |r�ttj jt |�d�� d S d S d S )Nr# r� r� r c S r� r4 r� rE r4 r4 r5 rH r� z+list_esm_infra_packages.<locals>.<listcomp>c S r� r4 r� rE r4 r4 r5 rH � r� c �& g | ]}|j �vr|j � vr|j �qS r4 r� rE ��available_package_names�installed_package_namesr4 r5 rH � �
�Tr� rT r� Fr� r� r� )!rS �setr| �addro r r? r! r r r� r� �sortedr� r" r� r6 r r� r r� r� r� rY �SS_SERVICE_HELPr@ �SS_UPDATES_AVAILABLEr9 �SS_UPDATES_INSTALLED�SS_FURTHER_OTHER_PACKAGES�SS_OTHER_PACKAGESr r )r} r� �infra_packages� mr_packages�all_infra_packages�
infra_updates� security_upgradable_versions�updaterb r? r� r� r� r� r� �remaining_package_names� hint_list�msgr4 r
r5 �list_esm_infra_packagesg s� � � � �� �
� ��r c s� t � }|d }|d |d }|| }t� }t|�d }|D ]
\}}|�|j� q t� } t| �}
|
�� d } |
�� d } t dd� |D ���t dd� |D ��� t � �fdd�|D ��}
t
|dd d
� | sjt t j
� d S tdd | | t|�t|�d d
� t t jjdd�� t d� |rԈ r�t t jjdd�� t� � �r�t t jjdd�� t�� � p��}|
r�|r�t jjdd�}nt jjdd�}t |� t|
� |r�t t jjt|�d�� d S d S d S )Nr$ r� r� r c S r� r4 r� rE r4 r4 r5 rH � r� z*list_esm_apps_packages.<locals>.<listcomp>c S r� r4 r� rE r4 r4 r5 rH � r� c r r4 r� rE r
r4 r5 rH � r
Tr� r� Fr� r� rT r� )rS r r| r ro r! r r� r� r r� r6 r r� r� rY r r@ r r9 r r r r r )r} r� �
apps_packages� um_packages�all_apps_packages� apps_updatesr r rb r� r� r� r� r r r r4 r
r5 �list_esm_apps_packages� s~ �� � � �� �
� ��r$ )rI F)L� collectionsr r r �enumr � functoolsr �randomr �typingr r r
r r rK �uaclientr
r r r �5uaclient.api.u.pro.security.status.reboot_required.v1r �(uaclient.api.u.pro.status.is_attached.v1r � uaclient.aptr r r r r �uaclient.configr �uaclient.entitlementsr r �(uaclient.entitlements.entitlement_statusr r r �uaclient.systemr r r r! r" r^ r% r9 rA �PackagerS rL rC rM �boolrh �Versionrt r| r� r� r� r� r� r� r� �intr� r� r� r r r r$ r4 r4 r4 r5 �<module> s�
���
�%�
��
� �
�@!�
�
�4����
�? ������
�2M Y