shell bypass 403
3
."�d$! � @ sp d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlZd dlZd dl Zd dl
Z
dd� e_ dZ dZ
dZdZd d
� Zyejd Zeej_W n ek
r� e ZY nX yejd Zeej_W n ek
r� e
ZY nX ejjed
�Zejjed�Zejjed�Z ejjee�Z dd� Z dd� Z dd� Z dd� Z!dd� Z"dd� Z#d d � Z$G d d � d �Z%d d!� Z&e'd"k�rle&� dS )#� N)�mkstempc O s |j � dt| �j� � d�S )Nz: �
)�__name__�str�
capitalize)�msg�category�aZkwa� r
�<./usr/share/crypto-policies/python/update-crypto-policies.py�<lambda> s r z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz /proc/sys/crypto/fips_enabledc O s t | dtji|�� d S )N�file)�print�sys�stderr)�args�kwargsr
r
r �eprint s r � profile_dir�base_dirzlocal.dz back-ends�statec C sr t jdd�} | j� }|jdddddd� |jd d
d d � |jd
d
dd � | jdd
t jd � | jdd
dd � | j� S )zParse the command lineF)Z allow_abbrevz--set�?� ZPOLICYzset the policy POLICY)�nargs�default�metavar�helpz--show�
store_truez.show the current policy from the configuration)�actionr z --is-appliedz+check whether the current policy is appliedz
--no-checkz --no-reloadz3do not run the reload scripts when setting a policy)�argparse�ArgumentParserZ add_mutually_exclusive_group� add_argumentZSUPPRESS�
parse_args)�parser�groupr
r
r r" 8 s
r" c C s� y0t jt jjtd��j} t jt jjtd��j}W n tk
rN tj d� Y nX | |krjt
d� tj d� t
d� tj d� d S )N�current�config�M z The configured policy is appliedr z$The configured policy is NOT applied� ) �os�stat�path�join� state_dir�st_mtimer �OSErrorr �exitr )Ztime1Ztime2r
r
r �
is_appliedI s
r1 c C s2 yt jt� t jt� W n tk
r, Y nX d S )N)r) �makedirs�backend_config_dirr- r/ r
r
r
r �setup_directoriesW s
r4 c C s> y$t t��} t| j� �dkS Q R X W n tk
r8 dS X d S )Nr F)�open�FIPS_MODE_FLAG�int�readr/ )�fr
r
r � fips_mode_ s
r: c C s� t || d�\}}tj|t|d�� tj|� tj|d� zZytj|tjj| |�� W n: t k
r� } z tj
|� tj |� |�W Y d d }~X nX W d tj |� X d S )N)�prefix�dirzutf-8i� ) r r) �write�bytes�fsync�fchmod�renamer+ r, r/ �unlink�close)� directory�filename�contents�fdr+ �er
r
r �
safe_writeg s
rI c C s� t || d�\}}tj|� tj|� tj||� ytj|tjj| |�� W n0 tk
rz } ztj|� |�W Y d d }~X nX d S )N)r; r< ) r r) rC rB �symlinkrA r+ r, r/ )rD rE �targetrG r+ rH r
r
r � safe_symlinkv s
rL c $ C s| t jj||d �}ttj|��}d} x |D ]}
t jj|
�r*d} q*W t jj|t| �|d �} t j| t j�} | r�| r�t ||d | � d S | r�| j
r�|r�t | ��}
|
j � }W d Q R X t
||d |� | �rxt jj||d �}x�|D ]�}
y"t |
d��}|j � }W d Q R X W n$ tk
�r* td| � w�Y nX y$t |d��}|j|� W d Q R X W q� tk
�rr td | � Y q�X q�W d S )
Nz -*.configFTz.txtz.config�rz Cannot read local policy file r z&Error applying local configuration to )r) r+ r, �sorted�glob�existsr �access�R_OKrL � subpoliciesr5 r8 rI r/ r r= )�pconfigZcfgnameZcfgdataZcfgdirZlocaldirZ
profiledir�policy_was_emptyZlocal_cfg_pathZ
local_cfgsZlocal_cfg_presentZlcfgZ profilepathZprofilepath_existsZf_preZcfgfileZlfZ
local_dataZcfr
r
r � save_config� s:
rV c @ s> e Zd Zdd� Zddd�Zdd� Zdd � Zd
d � Zd d
� ZdS )�
ProfileConfigc C s d| _ g | _d S )Nr )�policyrS )�selfr
r
r �__init__� s zProfileConfig.__init__Fc s` |j � jd�� � d r2| r2� d | _� dd � � � fdd�� D �� |rV| jj� � n� | _d S )N�:r r( c s g | ] }� r|�qS r
r
)�.0�i)�lr
r �
<listcomp>� s z.ProfileConfig.parse_string.<locals>.<listcomp>)�upper�splitrX rS �append)rY �s� subpolicyr
)r^ r � parse_string� s
zProfileConfig.parse_stringc C sV d}t |��@}x8|D ]0}|jdd�d }|j� }|r| j||� d}qW W d Q R X d S )NF�#r( r T)r5 ra �stripre )rY rE rd r9 �liner
r
r �
parse_file� s
zProfileConfig.parse_filec s( |j � jd�� � fdd�| jD �| _d S )Nr[ c s g | ]}|� kr|�qS r
r
)r\ r] )r^ r
r r_ � s z4ProfileConfig.remove_subpolicies.<locals>.<listcomp>)r` ra rS )rY rc r
)r^ r �remove_subpolicies� s z ProfileConfig.remove_subpoliciesc C s& | j }dj| j�}|r"|d | }|S )Nr[ )rX r, rS )rY rc Zsubsr
r
r �__str__� s
zProfileConfig.__str__c C s t t| �� d S )N)r r )rY r
r
r �show� s zProfileConfig.showN)F) r �
__module__� __qualname__rZ re ri rj rk rl r
r
r
r rW � s
rW c ) C s� t � } | jr t� tjd� d}t� t� }d}tjjt d�}tj
|tj �rX|j |� n&t
� rj|jd� n|j tjjtd�� | jr�|j� tjd� | j}|�r|j}|j|� d}|j|k�r|jdkr�td� td� td � n(t
� �rtd
� td � td � td
� t tk�r8tj� dk�s8td� tjd� ytj|jf|j�� }W nx tjjk
�r� } zt|� tjd� W Y dd}~X n@ tjjk
�r� } z td|� �� tjd� W Y dd}~X nX t dt |� � dd� t t �D �} x�| D ]�}
t j |
} | � } y| j!|j"| j#��}
W n0 t$k
�rL td| j% � td� d}Y nX y t&|| j%|
t't(t|j)� d� W n0 t*k
�r� td| j% � td� d}Y nX �q�W |�r�yt+t dt |�d � W n" t*k
�r� td� d}Y nX yt+t,d t |�d � W n" t*k
�r" td � d }Y nX yt+t,d t |�� W n" t*k
�rZ td � d }Y nX t d!� t d"� t d#� | j-�s�t.j/d$t0g� tj|� dS )%z!The actual command implementationr Fr& ZFIPSzdefault-configTzHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz FIPS compliance.z8 Use 'fips-mode-setup --enable' command instead.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz! non-compliant with FIPS.z8 It can also break the ssh access to the system.zI Use 'fips-mode-setup --disable' to disable the system FIPS mode.z/You must be root to run update-crypto-policies.r( Nz%Errors found in policy, first one:
zSetting system policy to c S s g | ]}d |kr|�qS )� Generatorr
)r\ �gr
r
r r_ s zmain.<locals>.<listcomp>z Error generating config for z Keeping original configuration)rU zError saving config for r z.Error setting the current policy configuration� r% z$Error updating current policy marker� z CURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.z /bin/bash)1r" r1 r r0 r4 rW r) r+ r, r rQ rR ri r: re r rl �setrX r �DEFAULT_BASE_DIR�geteuid�cryptopolicies�UnscopedCryptoPolicyrS Z
validationZPolicyFileNotFoundErrorZPolicySyntaxErrorr r r< �policygenerators�__dict__Zgenerate_configZscopedZSCOPES� LookupErrorZ CONFIG_NAMErV r3 � local_dirZis_emptyr/ rI r- Z no_reload�
subprocessZcall�reload_cmd_path)Zcmdline�errrT Z
set_configZ
configfileZprofileZ oldpolicyZcp�exZ
generatorsrp �cls�genr& r
r
r �main� s�
r� �__main__)(r r r) r| Ztempfiler rO �warningsrv Zcryptopolicies.validationrx �
formatwarningZDEFAULT_PROFILE_DIRrt ZRELOAD_CMD_NAMEr6 r �environr rw Z SHARE_DIR�KeyErrorr Z
CONFIG_DIRr+ r, r{ r3 r- r} r" r1 r4 r: rI rL rV rW r� r r
r
r
r �<module> sP
+)s