File: //usr/lib/python3/dist-packages/certbot/compat/__pycache__/filesystem.cpython-39.pyc
a
�`�u � @ s� d Z ddlmZ ddlZddlZddlZddlZddlmZ z<ddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZW n ey� dZY n0 dZG dd� d�Ze� Zd d
� Zd d � Zd
d� ZdBdd�Zdd� Zdd� Zdd� ZdCdd�ZdDdd�Z dEd d �Z d d � Z d d!� Z d"d#� Z d$d%� Z!d&d'� Z"d(d)� Z#d*d+� Z$d,d-� Z%d.d/� Z&d0d1� Z'dFd2d3�Z(d4d5� Z)d6d7� Z*d8d9� Z+d:d;� Z,d<d=� Z-d>d?� Z.d@dA� Z/dS )Gz;Compat module to handle files security on Windows and Linux� )�absolute_importN)�ListTFc @ s e Zd ZdZdd� ZdS )�
_WindowsUmaskz+Store the current umask to apply on Windowsc C s
d| _ d S )N� )�mask)�self� r �;/usr/lib/python3/dist-packages/certbot/compat/filesystem.py�__init__ s z_WindowsUmask.__init__N)�__name__�
__module__� __qualname__�__doc__r
r r r r r s r c C s t rt�| |� n
t| |� dS )a[
Apply a POSIX mode on given file_path:
- for Linux, the POSIX mode will be directly applied using chmod,
- for Windows, the POSIX mode will be translated into a Windows DACL that make sense for
Certbot context, and applied to the file using kernel calls.
The definition of the Windows DACL that correspond to a POSIX mode, in the context of Certbot,
is explained at https://github.com/certbot/certbot/issues/6356 and is implemented by the
method `_generate_windows_flags()`.
:param str file_path: Path of the file
:param int mode: POSIX mode to apply
N)�
POSIX_MODE�os�chmod�_apply_win_mode�� file_path�moder r r r ' s r c C s t rt�| �S tj}| t_|S )a$
Set the current numeric umask and return the previous umask. On Linux, the built-in umask
method is used. On Windows, our Certbot-side implementation is used.
:param int mask: The user file-creation mode mask to apply.
:rtype: int
:return: The previous umask value.
)r r �umask�_WINDOWS_UMASKr )r Zprevious_umaskr r r r = s
r c C sV t r:t�| �}|r|jnd}|r&|jnd}t�|||� n|rHt| |� t||� dS )a�
Copy ownership (user and optionally group on Linux) from the source to the
destination, then apply given mode in compatible way for Linux and Windows.
This replaces the os.chown command.
:param str src: Path of the source file
:param str dst: Path of the destination file
:param int mode: Permission mode to apply on the destination file
:param bool copy_user: Copy user if `True`
:param bool copy_group: Copy group if `True` on Linux (has no effect on Windows)
���N)r r �stat�st_uid�st_gid�chown�_copy_win_ownershipr )�src�dstr � copy_user�
copy_group�stats�user_id�group_idr r r � copy_ownership_and_apply_modeX s
r% c C sb t rFt�| �}|r|jnd}|r&|jnd}t�|||� t||j� n|rTt| |� t | |� dS )aU
Copy ownership (user and optionally group on Linux) and mode/DACL
from the source to the destination.
:param str src: Path of the source file
:param str dst: Path of the destination file
:param bool copy_user: Copy user if `True`
:param bool copy_group: Copy group if `True` on Linux (has no effect on Windows)
r N)
r r r r r r r �st_moder �_copy_win_mode)r r r r! r" r# r$ r r r �copy_ownership_and_modey s
r( c C s$ t rt�t�| �j�|kS t| |�S )aa
Check if the given mode matches the permissions of the given file.
On Linux, will make a direct comparison, on Windows, mode will be compared against
the security model.
:param str file_path: Path of the file
:param int mode: POSIX mode to test
:rtype: bool
:return: True if the POSIX mode matches the file permissions
)r r �S_IMODEr r& �_check_win_moder r r r �
check_mode� s r+ c C s8 t rt�| �jt�� kS t�| tj�}|�� }t � |kS )z�
Check if given file is owned by current user.
:param str file_path: File path to check
:rtype: bool
:return: True if given file is owned by current user, False otherwise.
)
r r r r �getuid�
win32security�GetFileSecurity�OWNER_SECURITY_INFORMATION�GetSecurityDescriptorOwner�_get_current_user)r �security�userr r r � check_owner� s
r4 c C s t | �ot| |�S )z�
Check if given file has the given mode and is owned by current user.
:param str file_path: File path to check
:param int mode: POSIX mode to check
:rtype: bool
:return: True if file has correct mode and owner, False otherwise.
)r4 r+ r r r r �check_permissions� s
r5 � c
C sN t rt�| ||�S |tj@ �r4|tj@ r.tjntj}t� � }|j
}t � }t ||t
j�}|�|d� |�d|d� d}z�z$t�| tjtjtj@ ||dd�}W n^ tjy� } zD| jtjkr�ttj | j ��| jtj kr�ttj | j ��| �W Y d} ~ n
d} ~ 0 0 W |�r |� � n|�r|� � 0 t�| |tjA tjA �S t�| |�}t!| |� |S )aw
Wrapper of original os.open function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int flags: Flags to apply on file while opened
:param int mode: POSIX mode to apply on file when opened,
Python defaults will be applied if ``None``
:returns: the file descriptor to the opened file
:rtype: int
:raise: OSError(errno.EEXIST) if the file already exists and os.O_CREAT & os.O_EXCL are set,
OSError(errno.EACCES) on Windows if the file already exists and is a directory, and
os.O_CREAT is set.
r � N)"r r �open�O_CREAT�O_EXCL�win32conZ
CREATE_NEWZ
CREATE_ALWAYSr- �SECURITY_ATTRIBUTES�SECURITY_DESCRIPTORr1 �_generate_daclr r �SetSecurityDescriptorOwner�SetSecurityDescriptorDacl� win32fileZ
CreateFileZ GENERIC_READZFILE_SHARE_READZFILE_SHARE_WRITE�
pywintypes�error�winerrorZERROR_FILE_EXISTS�OSError�errno�EEXIST�strerrorZERROR_SHARING_VIOLATIONZEACCESZCloser )
r �flagsr Z disposition�
attributesr2 r3 �daclZhandle�errr r r r8 � s<
�
�
r8 c C s� t d�}zjt |d|A B � tr4t�| |�W t |� S tj}z$tt_t�| |�W |t_W t |� S |t_0 W t |� n
t |� 0 dS )a4
Rewrite of original os.makedirs function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on leaf directory when created, Python defaults
will be applied if ``None``
r r6 N)r r r �makedirs�mkdir)r r Z
current_umaskZ
orig_mkdir_fnr r r rM s"
� ��
rM c
C s� t rt�| |�S t�� }|j}t� }t||tj �}|�
|d� |� d|d� zt �
| |� W nJ tjy� } z0|jtjkr�ttj|j| |j��|�W Y d}~n
d}~0 0 dS )a,
Rewrite of original os.mkdir function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on directory when created, Python defaults
will be applied if ``None``
Fr7 r N)r r rN r- r< r= r1 r> r r r? r@ rA ZCreateDirectoryrB rC rD ZERROR_ALREADY_EXISTSrE rF rG rH )r r rJ r2 r3 rK rL r r r rN / s
rN c C s, t td�r ttd�| |� n t�| |� dS )z�
Rename a file to a destination path and handles situations where the destination exists.
:param str src: The current file path.
:param str dst: The new file path.
�replaceN)�hasattrr �getattr�rename)r r r r r rO O s
rO c C s� | }t stjdkr<tj�| �}tj�|�r8td�|���|S g }tj�| �r�| }t� | �} tj�
| �s|tj� tj� |�| �} | |v r�td�|���|�
| � q@tj�| �S )a
Find the real path for the given path. This method resolves symlinks, including
recursive symlinks, and is protected against symlinks that creates an infinite loop.
:param str file_path: The path to resolve
:returns: The real path for the given path
:rtype: str
)� � zError, link {0} is a loop!)r �sys� version_infor �path�realpath�islink� RuntimeError�format�readlink�isabs�join�dirname�append�abspath)r Z
original_pathrW Zinspected_paths� link_pathr r r rX a s
rX c C s@ t �| �}ts|�d�s |S t|�dk r4|dd� S td��dS )a
Return a string representing the path to which the symbolic link points.
:param str link_path: The symlink path to resolve
:return: The path the symlink points to
:returns: str
:raise: ValueError if a long path (260> characters) is encountered on Windows
z\\?\i � Nz3Long paths are not supported by Certbot on Windows.)r r\ r �
startswith�len�
ValueError)rb rW r r r r\ � s
r\ c C s& t r tj�| �o t�| tj�S t| �S )z�
Is path an executable file?
:param str path: path to test
:return: True if path is an executable file
:rtype: bool
)r r rW �isfile�access�X_OK�_win_is_executable)rW r r r �
is_executable� s rk c C sV t r tt�t�| �j�tj@ �S t�| tj �}|�
� }t|� tj tj
t�d�d���S )z�
Check if everybody/world has any right (read/write/execute) on a file given its path.
:param str path: path to test
:return: True if everybody/world has any right to the file
:rtype: bool
�S-1-1-0�Z TrusteeFormZ TrusteeTypeZ
Identifier)r �boolr r) r r& �S_IRWXOr- r. �DACL_SECURITY_INFORMATION�GetSecurityDescriptorDacl�GetEffectiveRightsFromAcl�TRUSTEE_IS_SID�TRUSTEE_IS_USER�ConvertStringSidToSid)rW r2 rK r r r �has_world_permissions� s �rv c C s: t r6t�t�| �j�tjtjB tjB tjB @ }||B S |S )a
Calculate the POSIX mode to apply to a private key given the previous private key.
:param str old_key: path to the previous private key
:param int base_mode: the minimum modes to apply to a private key
:return: the POSIX mode to apply
:rtype: int
) r r r) r r& �S_IRGRP�S_IWGRP�S_IXGRP�S_IROTH)Zold_keyZ base_modeZold_moder r r �compute_private_key_mode� s
�r{ c C sd t r0t�| �}t�|�}|j|jf|j|jfkS t�| tj�}|�� }t�|tj�}|�� }||kS )as
Return True if the ownership of two files given their respective path is the same.
On Windows, ownership is checked against owner only, since files do not have a group owner.
:param str path1: path to the first file
:param str path2: path to the second file
:return: True if both files have the same ownership, False otherwise
:rtype: bool
) r r r r r r- r. r/ r0 )Zpath1Zpath2Zstats1Zstats2Z security1Zuser1Z security2Zuser2r r r �has_same_ownership� s
r| c C s� t r t�| �j}|||B kS t| �} t�| tjtjB �}|� � }|�
� }t ||�}t |�
� �D ]F}|�|�}|d } |d }|�tjtj|d��}
|
|
| B kr^ dS q^dS )a�
Check if a file given its path has at least the permissions defined by the given minimal mode.
On Windows, group permissions are ignored since files do not have a group owner.
:param str path: path to the file to check
:param int min_mode: the minimal permissions expected
:return: True if the file matches the minimal permissions expectations, False otherwise
:rtype: bool
r7 � rm FT)r r r r& rX r- r. r/ rp r0 rq r> �range� GetAceCount�GetAcerr rs rt ) rW Zmin_moder& r2 r3 rK Zmin_dacl�indexZmin_acer Zeffective_maskr r r �has_min_permissions� s, �
� r� c C sN t j�| �sdS t�| tj�}|�� }|�tjtj t
� d��}|t j @ t j kS )NFrm )
r rW rg r- r. rp rq rr rs rt r1 �
ntsecuritycon�FILE_GENERIC_EXECUTE)rW r2 rK r r r r rj * s �rj c C sJ t | �} t�| tj�}|�� }t||�}|�d|d� t�| tj|� dS )z�
This function converts the given POSIX mode into a Windows ACL list, and applies it to the
file given its path. If the given path is a symbolic link, it will resolved to apply the
mode on the targeted file.
r7 r N) rX r- r. r/ r0 r> r@ �SetFileSecurityrp )r r r2 r3 rK r r r r : s
r c C s� |r|d| @ }t |�}t�d�}t�d�}t�d�}t�� }| ||fvrjt|d �}|rj|�tj|| � t|d �} | r�|�tj| |� tdddd��}
|�tj|
|� |�tj|
|� |S ) Nr6 zS-1-5-18z S-1-5-32-544rl r3 �allT��read�write�execute)�
_analyze_moder- ru ZACL�_generate_windows_flagsZAddAccessAllowedAceZ ACL_REVISION) Zuser_sidr r Zanalysis�systemZadminsZeveryonerK Z
user_flagsZeverybody_flagsZfull_permissionsr r r r> M s$
r> c C s> | t j@ | t j@ | t j@ d�| t j@ | t j@ | t j@ d�d�S )Nr� )r3 r� )r �S_IRUSR�S_IWUSR�S_IXUSRrz �S_IWOTH�S_IXOTH)r r r r r� q s ���r� c C sL t | �} t�| tj�}|�� }t�|tj�}|�|d� t�|tj|� d S �NF)rX r- r. r/ r0 r? r� )r r � security_srcZuser_src� security_dstr r r r � s r c C sN t | �} t�| tj�}|�� }t�|tj�}|�d|d� t�|tj|� d S )Nr7 r )rX r- r. rp rq r@ r� )r r r� rK r� r r r r' � s r' c C sJ d}| d r|t jB }| d r4|t jt jA t jA B }| d rF|t jB }|S )Nr r� r� r� )r� ZFILE_GENERIC_READZFILE_ALL_ACCESSr� )Z rights_desc�flagr r r r� � s
��
r� c C sH t | �} t�| tjtjB �}|�� }|�� }|s4dS t||�}t||�S r� ) rX r- r. r/ rp rq r0 r> �_compare_dacls)r r r2 rK r3 Zref_daclr r r r* � s
�
r* c s4 � fdd�t � �� �D ��fdd�t ��� �D �kS )z�
This method compare the two given DACLs to check if they are identical.
Identical means here that they contains the same set of ACEs in the same order.
c s g | ]}� � |��qS r �r� ��.0r� )�dacl1r r �
<listcomp>� � z"_compare_dacls.<locals>.<listcomp>c s g | ]}� � |��qS r r� r� )�dacl2r r r� � r� )r~ r �r� r� r r� r r� � s �r� c C s$ d� t�� t�� �} t�d| �d S )z=
Return the pySID corresponding to the current user.
z{0}\{1}Nr )r[ �win32apiZ
GetDomainNameZ GetUserNamer- ZLookupAccountName)Z account_namer r r r1 � s r1 )TT)r6 )r6 )r6 )N)0r Z
__future__r rF r r rU Zacme.magic_typingr r� r- r; r� rA rB rD � ImportErrorr r r r r r% r( r+ r4 r5 r8 rM rN rO rX r\ rk rv r{ r| r� rj r r> r� r r' r� r* r� r1 r r r r �<module> s^
!
F
!
##.
$