/_[c @ s d d k Z d d k Z d d k l Z d d k l Z d d k Z d d k Td d k Z d Z
e f Z d Z d d d d
d f Z
d Z d
e i i f d YZ d Z d Z d Z d Z d Z d Z d Z d Z d f d YZ d Z d Z d Z d Z d Z d Z d Z! d f d! YZ" d" Z# d# Z$ d$ Z% d% Z& d& Z' d' Z( e) d( j o d) GHn d S(* iN( t TYPE_INTERACTIVE( t UpdateMetadata( t *s 2.5s yum-plugin-securityt securityt bugfixt enhancementt recommendedt
newpackagec C s= t i i | d | d | d f | d | d | d f S( s- Compare two "std." tuples, (n, a, e, v, r). i i i ( t rpmUtilst miscutilst
compareEVR( t tup1t tup2( ( s /usr/lib/yum-plugins/security.pyt _rpm_tup_vercmp= s !t CliErrorc B s e Z d Z d d Z RS( s3
Command line interface related Exception.
t c C s t i i i | | | _ d S( N( t yumt Errorst YumBaseErrort __init__t args( t selfR ( ( s /usr/lib/yum-plugins/security.pyR H s ( t __name__t
__module__t __doc__R ( ( ( s /usr/lib/yum-plugins/security.pyR B s c C s_ t } xO | D]G } | i p q n y | i | Wq t i i j
o
q q Xq W| S( s3 Generate the info. from the updateinfo.xml files. ( R t enabledt addR R t RepoMDError( t repost md_infot repo( ( s /usr/lib/yum-plugins/security.pyt ysp_gen_metadataL s
c C s | d j o g S| S( sj Sometimes refs == None, if so return the empty list here.
So we don't have to check everywhere. N( t None( t refs( ( s /usr/lib/yum-plugins/security.pyt ysp__safe_refsY s
c C sC x< | D]4 } t i | | o | S| d | j o | Sq Wd S( Nt update_id( t fnmatchR ( t sec_cmdst pkgnamet noticet i( ( s /usr/lib/yum-plugins/security.pyt _match_sec_cmd` s c C s^ xW t | D]I } | d | j o q
n | d | j o q
n t | | | d <| SWd S( s# Check if the given ID is a match. t typet idN( R" t TrueR ( t used_mapR! t ref_typet ref_idst ref( ( s /usr/lib/yum-plugins/security.pyt _has_idh s
c C s t | i | | } | o t | d | s i t installedt updatest available( R s updates( t setRK R R) RG t reversedt rpmdbt searchNamesR t pkgSackt searchPkgTuplet verLEt appendR ( R RQ R] RS R RD t show_pkgst done_pkgsR` R' Rd R t ipkgst pkgs( ( s /usr/lib/yum-plugins/security.pyt doCommand_li_new{ s4
'
%
c C s d } d } t | d j o\ d } | d | i j o | i | i d } n | } | o | t j o
d } q{ n | | | f S( Ni i ( R RX R t popR? ( R RS t filt_typeR^ ( ( s /usr/lib/yum-plugins/security.pyt _parse_extcmds s c st | i | _ t | i i t i d } d } | i i \ } | i | \ } } d | o$ | d d j o | i d n d j o. | i | | | | d | d g f S| _
t h t o np d j o t
| } t | nG d j o t | } n* d j o t | } t | n f d
}
g } x t | D] } x |
| | D] \ }
} h } |
\ | d <| d <| d
<| d <| d <| d
d j o d | d ( Rd RV R R' ( R_ R R R- R] R< ( s /usr/lib/yum-plugins/security.pyt _show_pkgtup s
'
' R t at et vt rR R R s %s:s %(n)s-%(epoch)s%(v)s-%(r)s.%(a)ss done( s updatess availables installeds all( s availables all( R R t listEnabledRm Rn t pluginst cmdlineR R R R% RC R; t _get_name2allpkgtupt _get_name2instpkgtupt _get_name2oldpkgtupt _get_name2aallpkgtupRK R RE ( R RQ RR RS R t loggerRD R R^ t name2tupR R` R& Rd R' t d( ( R_ R R- R R] R< s /usr/lib/yum-plugins/security.pyR sT
)
( R R RL RN RO RP RT Rh Ru R R R R? R R R R R ( ( ( s /usr/lib/yum-plugins/security.pyRF sD
( 2
c C s1 | i i d j o | i i d t n d S( sd
Verify that the program is being run by the root user.
@param base: a YumBase object.
i s, You need to be root to perform this command.N( t conft uidR t criticalR ( RQ ( ( s /usr/lib/yum-plugins/security.pyt yumcommands_checkRootUID s c C so | i p^ x[ | i i D]F } | i d j o0 | i d j o d } | i i | t q q Wn d S( Nt falseR s
You have enabled checking of packages via GPG keys. This is a good thing.
However, you do not have any GPG public keys installed. You need to download
the keys for packages you wish to install and install them.
You can do that by running the command:
rpm --import public.gpg.key
Alternatively you can specify the url to the key you would like to use
for a repository in the 'gpgkey' option in a repository section and yum
will install it for you.
For more information contact your distribution or package provider.
( t gpgKeyCheckR R t gpgcheckt gpgkeyR R R ( RQ R RD ( ( s /usr/lib/yum-plugins/security.pyt yumcommands_checkGPGKey s
c C s_ h } xR | D]J } | d | j o% t | | d | d j o q
n | | | d t updateRX t tsInfo( R RQ RR RS R R< R- t ndataR t oldpkgtupR` Rd R' RV RD ( ( s /usr/lib/yum-plugins/security.pyR 6 s: (
' ( R R RN RO RP RT R ( ( ( s /usr/lib/yum-plugins/security.pyR ( s
c C s | i } | p d St | d o
| i } n | i t | i t d } d } d } d } d } d } | i d d
d d | d d
d t d d | i d d
d d | d d d t d d | i d d
d d d d | d d d g d d | i d d
d d | d d d g d d d d | i d d
d d | d d d g d d d d | i d d
d d | d d! d g d d d d" d S(# s
Yum Plugin Config Hook:
Setup the option parser with the '--advisory', '--bz', '--cve',
'--security' and '--severity' command line options. Also the 'updateinfo'
and 'update-minimal' commands.
Nt plugin_option_groupc S s t | i _ d S( N( R, t valuesR ( t optR t valt parser( ( s /usr/lib/yum-plugins/security.pyt osecr s c S s t | i _ d S( N( R, R R: ( R R R R ( ( s /usr/lib/yum-plugins/security.pyt obugu s c S s | i i i | i d d S( Nt ,( R R6 t extendt split( R R R R ( ( s /usr/lib/yum-plugins/security.pyt ocvew s c S s | i i i t | d S( N( R R9 R RY ( R R R R ( ( s /usr/lib/yum-plugins/security.pyt obzy s c S s | i i i | i d d S( NR ( R R8 R R ( R R R R ( ( s /usr/lib/yum-plugins/security.pyt oadv{ s c S s | i i i | i d d S( NR ( R R3 R R ( R R R R ( ( s /usr/lib/yum-plugins/security.pyt osev} s s
--securityt actiont callbackt destR t defaultt helps" Include security relevant packagess
--bugfixesR: s Include bugfix relevant packagess --cveR* t stringR6 s, Include packages needed to fix the given CVEs --bzR9 t ints+ Include packages needed to fix the given BZs --sec-severityR3 s4 Include security relevant packages, of this severitys
--advisoryR8 s1 Include packages needed to fix the given advisory( t getOptParserRZ R t registerCommandRF R t
add_optionR; ( t conduitR R R R R R R ( ( s /usr/lib/yum-plugins/security.pyt config_hooka s>
c C sI | d } x8 | i | D]' \ } } t | | | | o t Sq Wt S( sA Do we want to keep this package to satisfy the security limits. i ( R R> R, R; ( R< Rd R R- RV R' ( ( s /usr/lib/yum-plugins/security.pyt ysp_should_keep_pkg s
c C s | i \ } } | i p% | i p | i p | i p | i } d } t | d j ox | d d j o) | d d j o h | d 6t d 6} n | d d j o) | d d j o h | d 6t d 6} q n t | o | d d
j o | h t d 6t d 6t d 6f S| d d j o h | d 6t d 6} n | d d j o h | d 6t d 6} n | d d j o | h t d 6t d 6f S| d t
i j o | h t d 6t d 6f Sn | o | | f S| p | i d d n | h t d 6t d 6t d 6f S( s4 Stuff we need to do in both list and update modes. i i RG i t obsoletesR t skipt list_cmdRH s update-minimalRD s check-updateR t upgradeRJ s' Skipping security plugin, other commandN( s obsoletess updates( s obsoletess updates( s updateR (
t
getCmdLineR R: R8 R9 R6 R RX R, R; RF RL t error( R R< R R t ret( ( s /usr/lib/yum-plugins/security.pyt ysp_check_func_enter s2 ""
c s@ t \ } } | d o d S| d p d St d o i t n i d d t i i } f d } g | _ t | } t
t i i
d d i i i
d d
i } i } t i } g } xV | D]N }
|
i } | | j p t | | | | | o | i |
i qqqW| o= x: i i
d d d | d
t i D] } | | qWn t
t i i
d d i i i
d d
i }
t | f d |
o i d d |
| f n i d d | t i | f d d S( sk
Yum Plugin Exclude Hook:
Check and remove packages that don't align with the security config.
R NR t registerPackageNamei s0 Limiting package lists to security relevant onesc s. i d d | | i f i | d S( s7 Deletes a package from all trees that yum knows about i s' --> %s from %s excluded (non-security)N( RH t repoidt
delPackage( Re ( R ( s /usr/lib/yum-plugins/security.pyt ysp_del_pkg s t pkgnarrowR R R t patternst showdupsc s i d | S( i ( R ( Rv ( R ( s /usr/lib/yum-plugins/security.pyR s s6 %d package(s) needed for security, out of %d availables6 No packages needed for security; %d packages availablec s i d | S( i ( RH ( Rv ( R ( s /usr/lib/yum-plugins/security.pyR s ( R RZ R R RH R t getReposR R% RC RX R t _baset doPackageListsR R t getPackagesR RV R R R, R RE R~ ( R R< RH R R R- t totR R t pkgs_to_delRe RV t pt cnt( ( R s /usr/lib/yum-plugins/security.pyt exclude_hook sF
% c
C s+ t t i d p d St i i | i } | d d j o d St } x | i | D] \ } } | p | d d j o qY n t } | i i
| } | p qY n | d } d } | d d j o d | d } n d | d | | d
| d | d f } | d
| | d | PqY Wd S( Nt get_running_kernel_pkgtupi R* R R i R s %s:s
%s-%s%s-%s.%si i i s, Security: %s is an installed security updates- Security: %s is the currently running version( RZ R t miscR t tsR R; R R, R R (
t ybR RD t kern_pkgtupt found_secRd R' t ipkgR t rpkg( ( s /usr/lib/yum-plugins/security.pyR~ s0
c sL t \ } } | d o d S| d o d St d o i t n i d d t i i } f d } d } d } g | _ t | } i
i } t } t t
t g }
t } x2 | D]* } | i |
j o | i | i q q Wt i }
x | D] } | i |
j o | d 7} n | i i } | |
j p t | |
| | | o q6n | i |
j o | d 7} n | i | i q6W| } t } x | o t } x | D] } | i | j o] x | i D]K \ } } | | j o2 | | j o | d 7} n | i | t } q
q
WqxZ | i D]O \ } } | | j o6 | | j o | d 7} n | i | i t } PqgqgWqWqWx, | D]$ } | i | j o | | qqWt | f d
| o% i d d | | | | f n i d d | d S(
sn
Yum Plugin PreResolve Hook:
Check and remove packages that don't align with the security config.
R NR R i s+ Limiting packages to security relevant onesc s7 i d d | i | i i f i | i d S( s) Deletes a package within a transaction. i s' --> %s from %s excluded (non-security)N( RH t poR t removeRd ( t tspkg( R t tsinfo( s /usr/lib/yum-plugins/security.pyR 2 s i i c s i d | S( i ( R ( Rv ( R ( s /usr/lib/yum-plugins/security.pyR p s sD %d package(s) needed (+%d related) for security, out of %d availables6 No packages needed for security; %d packages available( R RZ R R RH R R R R% RC t getTsInfot
getMembersR t TS_INSTALL_STATESt TS_ERASEt output_stateR R R R RV R R, R; t relatedtoRE ( R R< RH R R R
R
R- t tspkgst keep_pkgst count_statest
count_pkgsR R RV t scntt mini_depsolve_againR t reason( ( R R s /usr/lib/yum-plugins/security.pyt preresolve_hook s
%t __main__s8 This is a plugin that is supposed to run from inside YUM(* R R$ t yum.pluginsR t
yum.update_mdR Rm t
yum.constantst rpmUtils.miscutilsR t requires_api_versiont plugin_typeR R? R
R R R R R" R) R1 R> RB RC RE RF R R R R R R R R R R R R R~ R( R ( ( ( s /usr/lib/yum-plugins/security.pyt * sN
6 9 < $ 8 X