File: //lib/python3/dist-packages/uaclient/entitlements/__pycache__/livepatch.cpython-38.pyc
U
��Jh�7 � @ s� d dl Z d dlmZmZmZmZ d dlmZmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZmZ d dlmZ d dlmZ ddgZd d
d �Ze�� Ze �e� e ��Z G d d
� d
e�Z dd� Z dS )� N)�Any�Dict�Optional�Tuple) �api� event_logger�
exceptions�http� livepatch�messages�snap�system�util)�EntitlementWithMessage�
UAEntitlement)�ApplicationStatus)�StaticAffordanceg �?g �?z)Invalid Auth-Token provided to livepatch.z2Your running kernel is not supported by Livepatch.)zUnknown Auth-Tokenzunsupported kernelc s2 e Zd ZejjZdZejZ ej
Z ej Z
dZdZdZdZeeedf d�dd��Zeeedf d�dd ��Zed�d
d �Zed�d d
�Zej e d�dd�Z d ej e e e d�dd�Z ej d�dd�Z ee!e"ej# f d�dd�Z$ee e"ej# f d�dd�Z%dd � Z&d!e'e(e)f e'e(e)f e e d �� fd d �
Z*� Z+S )"�LivepatchEntitlementr
FT.)�returnc C s0 ddl m} ddlm} t|tj�t|tj�fS )Nr ��FIPSEntitlement)�RealtimeKernelEntitlement)�uaclient.entitlements.fipsr Z uaclient.entitlements.realtimer r r ZLIVEPATCH_INVALIDATES_FIPSZ REALTIME_LIVEPATCH_INCOMPATIBLE)�selfr r � r �A/usr/lib/python3/dist-packages/uaclient/entitlements/livepatch.py�incompatible_services, s ���z*LivepatchEntitlement.incompatible_servicesc s\ ddl m} || jd�}t|�� d tjk�� tjj | j
d�dd� dftj � fdd�dffS ) Nr r )�cfg)�titlec S s t �� pt �� dkS )NZwsl)r
� is_containerZ
get_virt_typer r r r �<lambda>K s z9LivepatchEntitlement.static_affordances.<locals>.<lambda>Fc s � S �Nr r �Zis_fips_enabledr r r Q � ) r r r �bool�application_statusr �ENABLEDr Z"SERVICE_ERROR_INSTALL_ON_CONTAINER�formatr Z!LIVEPATCH_ERROR_WHEN_FIPS_ENABLED)r r Zfips_entr r" r �static_affordances; s ���
��z'LivepatchEntitlement.static_affordancesc C s dS )N� r �r r r r � enable_stepsV s z!LivepatchEntitlement.enable_stepsc C s dS )N� r r* r r r �
disable_stepsY s z"LivepatchEntitlement.disable_steps)�progressr c
C s� |� tj� t�� s2|�dtjjdd�� t�� t� � s�|�dtjjdd�� zt�
d� W nH t j k
r� } z(t
jd|d� |�dtjjdd�� W 5 d }~X Y nX t�|� zt�d� W nH t j k
�r } z&t
jd
|d� t�tjjd d�� W 5 d }~X Y nX t�d | jjtj�}t�d
| jjtj�}tj||tj d� t � � �s�|�dtjjdd�� zt�
d� W n6 t j k
�r� } zt j t |�d��W 5 d }~X Y nX t �!||� | j"|ddd�S )zYEnable specific entitlement.
@return: True on success, False otherwise.
�infoZsnapd)Zpackagesz
snapd snapz!Failed to install snapd as a snap��exc_infozsnap install snapd�ZcommandNz Failed to refresh snapd snapzsnap refresh snapdr Zhttps)�
http_proxy� https_proxyZ retry_sleepszcanonical-livepatch snapzcanonical-livepatch�Z error_msgT)�process_directives�
process_token)#r. r ZINSTALLING_LIVEPATCHr Zis_snapd_installed�emitZINSTALLING_PACKAGESr' Z
install_snapdZ is_snapd_installed_as_a_snapZ install_snapr �ProcessExecutionError�LOGZwarningZEXECUTING_COMMAND_FAILEDZrun_snapd_wait_cmdZ refresh_snap�eventr/ r Zvalidate_proxyr r3 Z PROXY_VALIDATION_SNAP_HTTP_URLr4 Z PROXY_VALIDATION_SNAP_HTTPS_URLZconfigure_snap_proxyZSNAP_INSTALL_RETRIESr
�is_livepatch_installedZErrorInstallingLivepatch�strZconfigure_livepatch_proxy�setup_livepatch_config)r r. �er3 r4 r r r �_perform_enable\ s� � ���
�� � ��
��" �z$LivepatchEntitlement._perform_enable)r. r6 r7 r c
C s� |� tj� | j�� �| j�}|r�z t|� W nV tj k
r� } z6t
j t |�|d� |�
dtjjt |�d�� W Y �dS d}~X Y nX |�r�|�d�}|s�t
�d| j� | jjd }| �� \}}|tjk�r8t
�d � |�
dtj� zt�tjd
g� W n> tj k
�r6 } z t
j t |�|d� W Y �dS d}~X Y nX ztjtjd |gd d
� W n� tj k
�r� } zdtj } t � � D ]&\}
} |
t |�k�rv| | 7 } �q��qv| tj k�r�| t |�7 } |�
d| � W Y �dS d}~X Y nX d S )a Processs configuration setup for livepatch directives.
:param process_directives: Boolean set True when directives should be
processsed.
:param process_token: Boolean set True when token should be
processsed.
r0 r/ r5 FN�
resourceTokenzHNo specific resourceToken present. Using machine token as %s credentialsZ machineTokenz&Disabling livepatch before re-enabling�disable�enableT�Zcapture) r. r ZSETTING_UP_LIVEPATCHZmachine_token_fileZ entitlements�get�name�process_config_directivesr r9 r: �errorr= r8 Z LIVEPATCH_UNABLE_TO_CONFIGUREr' �debugr Z
machine_tokenr% r �DISABLEDr/ ZLIVEPATCH_DISABLE_REATTACHr
�subpr
�
LIVEPATCH_CMDZLIVEPATCH_UNABLE_TO_ENABLE�
ERROR_MSG_MAP�items) r r. r6 r7 Zentitlement_cfgr? Zlivepatch_tokenr% Z_details�msgZ
error_messageZ
print_messager r r r> � sb
��
��
�
z+LivepatchEntitlement.setup_livepatch_config)r. c C sB t �� s dS t jdg}|�tjjd�|�d�� tj |dd� dS )zYDisable specific entitlement
@return: True on success, False otherwise.
TrB � r2 rD )
r
r< rL r. r ZEXECUTING_COMMANDr' �joinr
rK )r r. �cmdr r r �_perform_disable� s
�z%LivepatchEntitlement._perform_disablec
C s� t jd f}t�� s t jtjfS z t�� }W n> tj k
rh } z t j
tj j |j
d�f W Y �S d }~X Y nX |d kr~t jtjfS |S )N)Zlivepatch_error)r r& r
r< rJ r ZLIVEPATCH_NOT_ENABLED�statusr r9 ZWARNINGZ LIVEPATCH_CLIENT_FAILURE_WARNINGr' �stderrZ+LIVEPATCH_APPLICATION_STATUS_CLIENT_FAILURE)r rT Zlivepatch_statusr? r r r r% � s
���z'LivepatchEntitlement.application_statusc C sz t �� }|t jjkr4t�� }dtjj|j |j
d�fS |t jj kr`t�� }dtj j|j |j
d�fS |t jj
krvdtjfS dS )NT)�versionZarch)FN)r
�on_supported_kernel�LivepatchSupport� UNSUPPORTEDr
Zget_kernel_infor Z LIVEPATCH_KERNEL_NOT_SUPPORTEDr' Z
uname_releaseZuname_machine_archZ
KERNEL_EOLZLIVEPATCH_KERNEL_EOLZKERNEL_UPGRADE_REQUIREDZ!LIVEPATCH_KERNEL_UPGRADE_REQUIRED)r ZsupportZ kernel_infor r r �enabled_warning_status s, �� �� �z+LivepatchEntitlement.enabled_warning_statusc C s" t �� t jjkr t�� s tjS d S r! )r
rW rX rY r
r r Z*LIVEPATCH_KERNEL_NOT_SUPPORTED_DESCRIPTIONr* r r r �status_description_override+ s ���z0LivepatchEntitlement.status_description_override)� orig_access�deltas� allow_enabler c
s� t � �|||�rdS |�di �}|�di ��dd�}|rN| �t�� �\}}|S | �� \}}|tjkrhdS |�di �} t ddg�}
t
|
� | ��} t
|�d d��} t | | g�r�t
�d
� t�tjj| jd �� | jt�� | | d �S dS )
a1 Process any contract access deltas for this entitlement.
:param orig_access: Dictionary containing the original
resourceEntitlement access details.
:param deltas: Dictionary which contains only the changed access keys
and values.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:return: True when delta operations are processed; False when noop.
T� entitlementZ obligationsZenableByDefaultF�
directives�caCerts� remoteServerrA zANew livepatch directives or token. running setup_livepatch_config)�service)r. r6 r7 )�super�process_contract_deltasrE rC r �ProgressWrapperr% r rJ �setr$ � intersection�anyr: r/ r; r Z#SERVICE_UPDATING_CHANGED_DIRECTIVESr' rF r> )
r r\ r] r^ Zdelta_entitlementZprocess_enable_defaultZenable_success�_r% Zdelta_directivesZsupported_deltasr6 r7 �� __class__r r re 4 sD �
� ����z,LivepatchEntitlement.process_contract_deltas)TT)F),�__name__�
__module__� __qualname__r ZurlsZLIVEPATCH_HOME_PAGEZ help_doc_urlrF ZLIVEPATCH_TITLEr ZLIVEPATCH_DESCRIPTIONZ descriptionZLIVEPATCH_HELP_TEXTZ help_textZ#affordance_check_kernel_min_versionZ affordance_check_kernel_flavorZaffordance_check_seriesZaffordance_check_arch�propertyr r r r r( �intr+ r- r rf r$ r@ r> rS r r Z NamedMessager% rZ r[ r r= r re �
__classcell__r r rk r r sJ I �� A� �
�
�r c C s� | sdS | � di �� di �}|� d�}|rFtjtjdd�|�gdd� |� d d
�}|�d �rh|dd � }|r�tjtjdd
�|�gdd� dS )a� Process livepatch configuration directives.
We process caCerts before remoteServer because changing remote-server
in the canonical-livepatch CLI performs a PUT against the new server name.
If new caCerts were required for the new remoteServer, this
canonical-livepatch client PUT could fail on unmatched old caCerts.
@raises: ProcessExecutionError if unable to configure livepatch.
Nr_ r` ra Zconfigz ca-certs={}TrD rb � �/���zremote-server={})rE r
rK r
rL r' �endswith)r r` Zca_certsZ
remote_serverr r r rG m s.
��
��rG )!Zlogging�typingr r r r Zuaclientr r r r r
r r r
r Zuaclient.entitlements.baser r Z(uaclient.entitlements.entitlement_statusr Zuaclient.typesr ZLIVEPATCH_RETRIESrM Zget_event_loggerr; Z getLoggerZ replace_top_level_logger_namerm r: r rG r r r r �<module> s , � Q