MOON
Server: Apache
System: Linux s5.yayogua.com.py 6.12.0-124.55.3.el10_1.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:54:02 EDT 2026 x86_64
User: w3com (1005)
PHP: 8.2.32
Disabled: NONE
Upload Files
File: //usr/share/crypto-policies/python/__pycache__/update-crypto-policies.cpython-312.pyc
�

��i�C��<�ddlZddlZddlZddlZddlZddlZddlZddlmZm	Z	ddl
Z
ddlZ
ddlZd�e_
dZdZdZdZdadadadadadad�Zdd	�Zd
�Zd�Zd�Zd
�Zd�Zd�Zd�Z d�Z!d�Z"d�Z#d�Z$	dd�Z%Gd�d�Z&d�Z'		dd�Z(d�Z)e*dk(re)�yy)�N)�mkdtemp�mkstempc�x�|j�dt|�ddj�t|�ddz�d�S)Nz: ��
)�__name__�str�upper)�msg�category�	_unused_a�_unused_kwas    �;/usr/share/crypto-policies/python/update-crypto-policies.py�<lambda>rs<�������C��H�R�a�L�.�.�0�3�s�8�A�B�<�?�@��C�z/usr/share/crypto-policiesz/etc/crypto-policieszreload-cmds.shz/proc/sys/crypto/fips_enabledc�:�t|dtji|��y)N�file)�print�sys�stderr)�args�kwargss  r�eprintr&s��	�4�+�c�j�j�+�F�+rc�>�	tjdattj_|�|an-	tjdattj_	tjjtd�a
tjjtd�atjjtd�atjjtt �ay#t$r	taY��wxYw#t$r	taY��wxYw)N�profile_dir�base_dirzlocal.d�	back-ends�state)�os�environr�cryptopolicies�UnscopedCryptoPolicy�	SHARE_DIR�KeyError�DEFAULT_PROFILE_DIRr�
CONFIG_DIR�DEFAULT_BASE_DIR�path�join�	local_dir�backend_config_dir�	state_dir�RELOAD_CMD_NAME�reload_cmd_path��alt_bases r�	dir_pathsr1*s���*��j�j��/��8C��+�+�5�����	(��z�z�*�-�H�=E�N�/�/�:������X�y�1�I������h��<�������X�w�/�I��g�g�l�l�;��@�O��!�*�)��*���	(�'�H�	(�s"�,C5�,D
�5D�D�
D�Dc���tj�}tj|�tjd�}d�|D�}t	|�}tj|�|S)N�.c3�RK�|]\}}}|t|�t|�f���!y�w�N)�sorted)�.0�root�dirs�filess    r�	<genexpr>zget_walk.<locals>.<genexpr>Ps'����N��4E�D�$��T�6�$�<����/��s�%')r�getcwd�chdir�walkr6)r(�old_cwdr>s   r�get_walkr@IsK���i�i�k�G��H�H�T�N�
�7�7�3�<�D�N��N�D��$�<�D��H�H�W���Krc�~�tjd��}|j�}|jddddd��|jd	d
d��|jd
d
d��|jdd
d��|jdd
tj��|jdd
d��|j�S)zParse the command lineF)�allow_abbrevz--set�?��POLICYzset the policy POLICY)�nargs�default�metavar�helpz--show�
store_truez.show the current policy from the configuration)�actionrIz--is-appliedz+check whether the current policy is appliedz--checkzAcheck whether the generated policy files match the current policyz
--no-checkz--no-reloadz3do not run the reload scripts when setting a policy)�argparse�ArgumentParser�add_mutually_exclusive_group�add_argument�SUPPRESS�
parse_args)�parser�groups  rrQrQVs���
�
$�
$�%�
8�F��/�/�1�E�	���w�c�2�x�3��5�	���x��L��N�	���~�l�I��K�	���y��7��8�����\�%�.�.��0�
���
�l�5��6�����rc�J�	tjtjjtd��j
}tjtjjtd��j
}ttjjtd�d��5}|j�}ddd�ttjjtd�d��5}|j�}ddd�k\r/k(r*t�s td�tjd�td�tjd	�y#1swY��xYw#1swY�jxYw#t$rtjd�Y��wxYw)
N�current�config�utf-8��encoding�Mz The configured policy is appliedrz$The configured policy is NOT appliedr)r�statr(r)r,�st_mtimer�open�read�OSErrorr�exit�is_fips_auto_bind_mountedr)�time1�time2�f�	contents1�	contents2s     r�
is_appliedrgks�����������Y�	�:�;�D�D����������X�x�8�9�B�B��
�"�'�'�,�,�y�)�4�w�
G�1�����I�H�
�"�'�'�,�,�x��2�W�
E������I�F�
	����Y�&�-�/�
�0�1������	�
0�1��H�H�Q�K�H�
G��
E�
E����������sB�B1F�3E)�7F�;E5�F�)E2�.F�5E>�:F�F"�!F"c
��t}t}t}t}t	�}t|��t
j|t��t
jtjj|d�tjjtd���t�t�}t|dd��t|�}tt�}t|�}tt�}	d}
||k7rd}
||	k7rd}
|t|f}|t|	f}||fD]�\}
}}|D]�\}}}|D]�}|
r�tjj|
||�}tjj|||�}t!|d�5}t!|d�5}|
s/|j#d�}|j#d�}||k7rd}
|sn|
s�/ddd�ddd�������t
j$|�|
r!t'd	�t)j*d
�yt-d�t)j*d�y#1swY�pxYw#1swY��xYw)
Nr/)�src�dstrVF)�
print_enabled�allow_symlinkingT�rbi z9The configured policy does NOT match the generated policyrz2The configured policy matches the generated policyr)rr*r+r,rr1�shutil�copytree�copyrr(r)�setup_directories�
parse_pconfig�apply_policyr@r]r^�rmtreerrr`r)�
orig_base_dir�orig_local_dir�orig_backend_config_dir�orig_state_dirr0�pconfig�walk_orig_backend�walk_backend�walk_orig_state�
walk_state�err�_backend�_state�orig_prefix�
tmp_prefixr>�d�_�flrd�f_orig�f_tmp�fp1�fp2�b1�b2s                          r�checkr�s����M��N�0���N��y�H�
�x� ��O�O��I�6�
�K�K�B�G�G�L�L���9��G�G�L�L��8�4�6�
���o�G�����F� �!8�9���.�/�L��~�.�O��)�$�J�
�C��L�(����*�$���&�(:�L�H�H�
�Y�
�
2�F�)1�6�)9�%��Z���H�A�q�"����������k�1�a�8�������Z��A�6���&�$�'�3��U�D�0A�S�!� �X�X�d�^�� �X�X�d�^����8�"&�C�!�!�
"�1B�'�'���*:�"�M�M�(��
��J�K������
�B�C������!1B�0A��'�'�s$�
H>	�1H2�H>	�2H;�7H>	�>I
c��	tjtdd��tjtdd��y#t$rYywxYw)Ni�T)�mode�exist_ok)r�makedirsr+r,r_�rrrqrq�s:��
�
���&�U�T�B�
���I�E�D�9���
��
�s�8;�	A�Ac��	ttd��5}t|j��dkDcddd�S#1swYyxYw#t$rYywxYw)N�asciirXrF)r]�FIPS_MODE_FLAG�intr^r_)rds r�	fips_moder��sB���
�.�7�
3�q��q�v�v�x�=�1�$�4�
3�
3������s*�A�9�	A�A�A�A�	A�Ac�4�|j�|j�}}tdd�5}t|j��D]:}|j	d�^}}}}}}||k(s� |j|�ccddd�S	ddd�y#1swYyxYw)Nz/proc/self/mountinfo�br� F)�encoder]�reversed�	readlines�split�endswith)�
whatsuffix�whererd�liner��what_�where_s       r�
is_mountedr��s���"�)�)�+�U�\�\�^��J�	
�$�d�	+�q��Q�[�[�]�+�D�)-���D�)9�&�A�q�!�U�F�Q�����~�~�j�1�1�	
,�	+�+�
,�
�
,�
�s�9B�'B�B�Bc���tjjtd�}tjjtd�}t	d|�xrt	d|�S)NrVrz$/crypto-policies/default-fips-configz/crypto-policies/back-ends/FIPS)rr(r)rr���policy_file�backendss  rrara�sL���'�'�,�,�x��2�K��w�w�|�|�H�k�2�H��=�{�K�
H��<�h�G�Irc��t�sJ�tjjtd�}tjjtd�}tjd|g�tjd|g�y)NrVrz/bin/umount)rarr(r)r�
subprocess�
check_callr�s  r�umount_fips_auto_bindr��s\��$�&�&�&��'�'�,�,�x��2�K��w�w�|�|�H�k�2�H����=�+�6�7����=�(�3�4rc���t||��\}}tj|t|d��tj|�tj
|d�	tj|tjj||��	tj|�y#t$r,tj|�tj|��wxYw#tj|�wxYw)N��prefix�dirrWi�)rr�write�bytes�fsync�fchmod�renamer(r)r_�unlink�close)�	directory�filename�contents�fdr(s     r�
safe_writer��s�����i�8�J�R���H�H�R��x��)�*��H�H�R�L��I�I�b�%���
�	�	�$������Y��9�:�	��������
�	�	�$��
�����
���
	�����s�4B(�(5C�C � C7c�T�t||��\}}tj|�tj|�tj||�	tj
|tjj||��y#t$rtj|��wxYw)Nr�)	rrr�r��symlinkr�r(r)r_)r�r��targetr�r(s     r�safe_symlinkr��su����i�8�J�R���H�H�R�L��I�I�d�O��J�J�v�t���
�	�	�$������Y��9�:����
�	�	�$��
��s�4B� B'c	�6�tjj||dz�}tt	j|��}	d}
|	D]%}tjj|�s�#d}
ntjj|t
|�|dz�}tj|tj�}
|
s|
r|rt||dz|�y|
r4|js(|r&t|d��5}|j�}ddd�t||dz|�|
r}tjj||dz�}	t|dd��5}|	D];}	t|d��5}|j�}ddd�	|j!��=	ddd�yy#1swY��xYw#1swY�4xYw#t$rtd	|���Y�zwxYw#t$rtd
|�d|���Y��wxYw#1swYyxYw#t$rtd|�d
��YywxYw)Nz	-*.configFTz.txtz.configrWrX�azCannot read local policy file z$Error appending local configuration z to zError opening configuration z" for appending local configuration)rr(r)r6�glob�existsr	�access�R_OKr��subpoliciesr]r^r�r_rr�)ry�cfgname�cfgdata�cfgdir�localdir�
profiledir�policy_was_emptyrl�local_cfg_path�
local_cfgs�local_cfg_present�lcfg�profilepath�profilepath_exists�f_pre�cfgfile�cf�lf�
local_datas                   r�save_configr��s����W�W�\�\�(�G�k�,A�B�N���	�	�.�1�2�J�����
�7�7�>�>�$�� $����
�'�'�,�,�z�3�w�<��6�9I�J�K����;����8���!3�8H��V�W�y�0�+�>���'�"5�"5�:J��+��
0�E��j�j�l�G�1��v�w��*�G�4���'�'�,�,�v�w��':�;��	8��g�s�W�5��&�D�!�!�$��9�R�)+����J�:�7�����,�'�6�5��1�
0��:�9��"�!��!?��v�F�G� �!��#�7��E�"&��t�G�9� 6�7�7��6�5���	8��1�'��;7�7�
8�	8�s��3F�G=�G1�
F4�$F(�5F4�>G�G1�G=�F%�(F1�-F4�4G�G1�
G�G1�G.�+G1�-G.�.G1�1G:�6G=�:G=�=H�Hc�2�eZdZd�Zdd�Zd�Zd�Zd�Zd�Zy)	�
ProfileConfigc� �d|_g|_y)NrD)�policyr���selfs r�__init__zProfileConfig.__init__2s�������rc���|j�jd�}|dr|s|d|_|dd}|D�cgc]}|s�|��	}}|r|jj	|�y||_ycc}w)N�:rr)r
r�r�r��extend)r��s�	subpolicy�l�is     r�parse_stringzProfileConfig.parse_string6so��
�G�G�I�O�O�C� ���Q�4�	��A�$�D�K��!�"��A����1�Q�Q��������#�#�A�&� �D���	
 s�A.�A.c���d}t|d��5}|D]>}|jdd�d}|j�}|s�+|j||�d}�@	ddd�y#1swYyxYw)NFrWrX�#rrT)r]r��stripr�)r�r�r�rdr�s     r�
parse_filezProfileConfig.parse_fileAsa���	�
�(�W�
-�����z�z�#�q�)�!�,���z�z�|����%�%�d�I�6� $�I��.�
-�
-�s�-A�A�A'c��|j�jd�}|jD�cgc]	}||vs�|��c}|_ycc}w�Nr�)r
r�r�)r�r�r�r�s    r�remove_subpoliciesz ProfileConfig.remove_subpoliciesKs>��
�G�G�I�O�O�C� ��'+�'7�'7�F�'7�!�1�A�:�A�'7�F����Fs
�	A�Ac�h�|j}dj|j�}|r|dz|z}|Sr�)r�r)r�)r�r��subss   r�__str__zProfileConfig.__str__Os4���K�K���x�x��(�(�)����C��$��A��rc�,�tt|��yr5)rr	r�s r�showzProfileConfig.showVs��
�c�$�i�rN�F)	r�
__module__�__qualname__r�r�r�r�r�r�r�rrr�r�1s!���	!�%�G��rr�c�p�t�}tjjtd�}tj
|tj�r|j|�|St�r|jd�|S|jtjjtd��|S)NrV�FIPSzdefault-config)r�rr(r)rr�r�r�r�r�r)ry�
configfiles  rrrrrZs����o�G������h��1�J�	�y�y��R�W�W�%����:�&��N�
�����V�$��N�	���2�7�7�<�<��5E�F�G��Nrc���d}d}|r�|j}|j|�d}tjj	d�}t�}|j|k7rp|rn|jdk(r&|s]|s[t
d�t
d�t
d�n9|r7t
d	�t
d
�t
d�t
d�t
d
�ttk(r7tj�dk7r t
d�tjd�	tj|jg|j���}	t%�r�t
d�t
dt&�d��|rt)d�t+�nht-j,tjj/t0d��rt
dt0�d��|St)dt&�dt0�d��|S|rt)dt3|�z�t5t6�D�cgc]	}d|vs�|��}}|D]f}t6j8|}
|
�}	|j;	�}	tA||j>tBt0tD	jG�|���h|r	tKtd!t3|�d"z�	tKt&d%t3|�d"z�	tKt&d(t3	��|r!t)d*�t)d+�t)d,�|S#tjj $r+}
t
|
�tjd�Yd}
~
��d}
~
wtjj"$r.}
t
d|
���tjd�Yd}
~
��Wd}
~
wwxYwcc}w#t<$r)t
d|j>z�t
d�d}Y���wxYw#tH$r)t
d |j>z�t
d�d}Y���wxYw#tH$rt
d#�d$}Y��zwxYw#tH$rt
d&�d'}Y��ywxYw#tH$rt
d)�d'}Y��{wxYw)-NrFTz/usr/bin/bootcr�zHWarning: Using 'update-crypto-policies --set FIPS' is not sufficient forz         FIPS compliance.zF         The kernel must be started with `fips=1` for FIPS compliance.zOWarning: Using 'update-crypto-policies --set' in FIPS mode will make the systemz!         non-compliant with FIPS.z4         It can also break ssh access to the system.zJ         Reboot without `fips=1` on the kernel command line to disable thez         system FIPS mode.z/You must be root to run update-crypto-policies.rz%Errors found in policy, first one:  
zDThere's an automatic FIPS policy bind-mount from booting with fips=1zThe information under z might not be accurate.z)Removing automatic FIPS policy bind-mountz
*-*.configzThere are drop-in files under z� that will beignored in an automatic FIPS policy. To make them effective, manually switch to a FIPS policy by running `update-crypto-policies --set FIPS`.ztConsider switching to a permanent FIPS policy with update-crypto-policies --set FIPS, so that the information under z. is accurate and files that might be added to z! in the future will be in effect.zSetting system policy to �	GeneratorzError generating config for zKeeping original configuration)r�rlzError saving config for rVrz.Error setting the current policy configuration�rUz$Error updating current policy marker�zCURRENT.polz"Error updating current policy dumpzFNote: System-wide crypto policies are applied on application start-up.zBIt is recommended to restart the system for the change of policieszto fully take place.)&r�r�rr(r�r�rrr'�geteuidrr`r!r"r��
validation�PolicyFileNotFoundError�PolicySyntaxErrorrar,rr�r�r)r*r	r��policygenerators�__dict__�generate_config�LookupError�CONFIG_NAMEr�r+r�is_emptyr_r�)ry�profilerkrlr~�
set_config�	oldpolicy�bootc�is_in_fips_mode�ucp�ex�g�
generators�cls�genrVs                rrsrshs���
�C��J���N�N�	����W�%��
������/�0��#�+���>�>�Y�&�=��~�~��'��_��4�5��6�7��3�4� ��4�5��:�;��M�N��.�/��3�4��#�#��
�
���(9��@�A��������1�1�'�.�.�H�3:�3F�3F�H��!�"�	�*�	+��'�	�{�2I�J�K���=�>�!�#�
�Y�Y�r�w�w�|�|�I�|�<�
=��3�I�;�?E�E�
F�
�J��+�+4�+�66�6?�[�A5�5�
6��J��
�)�C��L�8�9� �!1�2�G�2��k�Q�6F�!�2�J�G�
���'�'��*���e��	��(�(��-�F�	������&�*�I�{�),����)9�
;��(�	��x��3�w�<�$�+>�?�
��9�i��W���)<�=�
��9�m�S��X�6�
�
�5�	6�
�+�	,�
�$�%��J��q�$�$�<�<���r�
���������$�$�6�6���7��t�<�=����������JH���	��1�C�O�O�C�D��3�4��C�	���	��-����?�@��3�4��C�	���	��C�D��C�	�����5�6��������3�4����s��*L�	N�N�?N!�7O�
P�+P(�	Q�N�% M� N�+#N�N�!.O�O�.P�P�P%�$P%�(Q�Q�Q�Qc�
�t�t�}|jrt�tjd�|j
rt�tjd�t
�t�}|jr%|j�tjd�|j}t||�}|jstjdtg�tj|�y)z!The actual command implementationrz	/bin/bashN)r1rQrgrr`r�rqrrr��setrs�	no_reloadr��callr.)�cmdlineryr	r~s    r�mainr�s���
�K��l�G������������}�}�
����������o�G��|�|�����������k�k�G�
�w��
(�C��������o�6�7��H�H�S�Mr�__main__r5r�)NTT)+rLr�rrnr�r�warnings�tempfilerrr!�cryptopolicies.validationr�
formatwarningr%r'r-r�rrr*r+r,r.rr1r@rQrgr�rqr�r�rar�r�r�r�r�rrrsrrr�rr�<module>rs�����	�
��
��%�� ��D���3��)��"��0�������	����	���,�A�>
��*�(7�t
���I�5��	�49�.8�f&�&�R�7;�"&�}�@�B�z���F�r