Your IP : 216.73.216.172
U
�]9_ � @ s` d Z ddlmZ ddlZddlZddlZz<ddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z W n e
k
r| dZY nX dZddlmZmZmZ dd� Zd d
� Zd d � Zd
d� Zdd� Zd8dd�Zd9dd�Zd:dd�Zdd� Zdd� Z d d � Z d d � Z d d!� Z d"d#� Z d$d%� Z!d&d'� Z"d(d)� Z#d*d+� Z$d,d-� Z%d.d/� Z&d0d1� Z'd2d3� Z(d4d5� Z)d6d7� Z*dS );z;Compat module to handle files security on Windows and Linux� )�absolute_importNTF)�List�Union�Tuplec C s t rt�| |� n
t| |� dS )a^
Apply a POSIX mode on given file_path:
* for Linux, the POSIX mode will be directly applied using chmod,
* for Windows, the POSIX mode will be translated into a Windows DACL that make sense for
Certbot context, and applied to the file using kernel calls.
The definition of the Windows DACL that correspond to a POSIX mode, in the context of Certbot,
is explained at https://github.com/certbot/certbot/issues/6356 and is implemented by the
method _generate_windows_flags().
:param str file_path: Path of the file
:param int mode: POSIX mode to apply
N)�
POSIX_MODE�os�chmod�_apply_win_mode�� file_path�mode� r
�;/usr/lib/python3/dist-packages/certbot/compat/filesystem.pyr s r c C sV t r:t�| �}|r|jnd}|r&|jnd}t�|||� n|rHt| |� t||� dS )a�
Copy ownership (user and optionally group on Linux) from the source to the
destination, then apply given mode in compatible way for Linux and Windows.
This replaces the os.chown command.
:param str src: Path of the source file
:param str dst: Path of the destination file
:param int mode: Permission mode to apply on the destination file
:param bool copy_user: Copy user if `True`
:param bool copy_group: Copy group if `True` on Linux (has no effect on Windows)
���N)r r �stat�st_uid�st_gid�chown�_copy_win_ownershipr )�src�dstr Z copy_userZ
copy_groupZstatsZuser_idZgroup_idr
r
r � copy_ownership_and_apply_mode8 s
r c C s$ t rt�t�| �j�|kS t| |�S )a`
Check if the given mode matches the permissions of the given file.
On Linux, will make a direct comparison, on Windows, mode will be compared against
the security model.
:param str file_path: Path of the file
:param int mode: POSIX mode to test
:rtype: bool
:return: True if the POSIX mode matches the file permissions
)r r �S_IMODEr �st_mode�_check_win_moder
r
r
r �
check_modeP s r c C s8 t rt�| �jt�� kS t�| tj�}|�� }t � |kS )z�
Check if given file is owned by current user.
:param str file_path: File path to check
:rtype: bool
:return: True if given file is owned by current user, False otherwise.
)
r r r r �getuid�
win32security�GetFileSecurity�OWNER_SECURITY_INFORMATION�GetSecurityDescriptorOwner�_get_current_user)r �security�userr
r
r � check_ownera s
r$ c C s t | �ot| |�S )z�
Check if given file has the given mode and is owned by current user.
:param str file_path: File path to check
:param int mode: POSIX mode to check
:rtype: bool
:return: True if file has correct mode and owner, False otherwise.
)r$ r r
r
r
r �check_permissionst s r% � c
C s: t rt�| ||�S |tj@ �r |tj@ r.tjntj}t� � }|j
}t � }t ||�}|�
|d� |�d|d� d}z�z$t�| tjtjtj@ ||dd�}W n\ tjk
r� } z<| jtjkr�ttj| j ��| jtj kr�ttj | j ��| �W 5 d} ~ X Y nX W 5 |�r|�� X t�| |tjA tjA �S t�| |�}t | |� |S )az
Wrapper of original os.open function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int flags: Flags to apply on file while opened
:param int mode: POSIX mode to apply on file when opened,
Python defaults will be applied if ``None``
:returns: the file descriptor to the opened file
:rtype: int
:raise: OSError(errno.EEXIST) if the file already exists and os.O_CREAT & os.O_EXCL are set,
OSError(errno.EACCES) on Windows if the file already exists and is a directory, and
os.O_CREAT is set.
r � N) r r �open�O_CREAT�O_EXCL�win32conZ
CREATE_NEWZ
CREATE_ALWAYSr �SECURITY_ATTRIBUTES�SECURITY_DESCRIPTORr! �_generate_dacl�SetSecurityDescriptorOwner�SetSecurityDescriptorDaclZClose� win32fileZ
CreateFileZ GENERIC_READZFILE_SHARE_READZFILE_SHARE_WRITE�
pywintypes�error�winerrorZERROR_FILE_EXISTS�OSError�errno�EEXIST�strerrorZERROR_SHARING_VIOLATIONZEACCESr )
r �flagsr Z disposition�
attributesr" r# �daclZhandle�errr
r
r r( � s>
�
r( c C s: t rt�| |�S tj}ztt_t�| |�W �S |t_X dS )a3
Rewrite of original os.makedirs function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on leaf directory when created, Python defaults
will be applied if ``None``
N)r r �makedirs�mkdir)r r Z
orig_mkdir_fnr
r
r r= � s r= c
C s� t rt�| |�S t�� }|j}t� }t||�}|�|d� |� d|d� zt
� | |� W nH t j
k
r� } z(|jtjkr�ttj|j| |j��|�W 5 d}~X Y nX dS )a+
Rewrite of original os.mkdir function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on directory when created, Python defaults
will be applied if ``None``
Fr' r N)r r r> r r, r- r! r. r/ r0 r1 ZCreateDirectoryr2 r3 r4 ZERROR_ALREADY_EXISTSr5 r6 r7 r8 )r r r: r" r# r; r< r
r
r r> � s
r> c C s, t td�r ttd�| |� n t�| |� dS )z�
Rename a file to a destination path and handles situations where the destination exists.
:param str src: The current file path.
:param str dst: The new file path.
�replaceN)�hasattrr �getattr�rename)r r r
r
r r? � s
r? c C s� | }t r2tj�| �}tj�|�r.td�|���|S g }tj�| �r�| }t�| �} tj�| �srtj� tj�
|�| �} | |kr�td�|���|� | � q6tj� | �S )z�
Find the real path for the given path. This method resolves symlinks, including
recursive symlinks, and is protected against symlinks that creates an infinite loop.
zError, link {0} is a loop!)
r r �path�realpath�islink� RuntimeError�format�readlink�isabs�join�dirname�append�abspath)r Z
original_pathrC Zinspected_pathsZ link_pathr
r
r rD
s
rD c C s& t r tj�| �o t�| tj�S t| �S )z�
Is path an executable file?
:param str path: path to test
:return: True if path is an executable file
:rtype: bool
)r r rC �isfile�access�X_OK�_win_is_executable)rC r
r
r �
is_executable/ s rR c C sV t r tt�t�| �j�tj@ �S t�| tj �}|�
� }t|� tj tj
t�d�d���S )z�
Check if everybody/world has any right (read/write/execute) on a file given its path
:param str path: path to test
:return: True if everybody/world has any right to the file
:rtype: bool
�S-1-1-0�Z TrusteeFormZ TrusteeTypeZ
Identifier)r �boolr r r r �S_IRWXOr r �DACL_SECURITY_INFORMATION�GetSecurityDescriptorDacl�GetEffectiveRightsFromAcl�TRUSTEE_IS_SID�TRUSTEE_IS_USER�ConvertStringSidToSid)rC r" r; r
r
r �has_world_permissions= s �r] c C s: t r6t�t�| �j�tjtjB tjB tjB @ }||B S |S )a
Calculate the POSIX mode to apply to a private key given the previous private key
:param str old_key: path to the previous private key
:param int base_mode: the minimum modes to apply to a private key
:return: the POSIX mode to apply
:rtype: int
) r r r r r �S_IRGRP�S_IWGRP�S_IXGRP�S_IROTH)Zold_keyZ base_modeZold_moder
r
r �compute_private_key_modeR s �rb c C sd t r0t�| �}t�|�}|j|jf|j|jfkS t�| tj�}|�� }t�|tj�}|�� }||kS )ar
Return True if the ownership of two files given their respective path is the same.
On Windows, ownership is checked against owner only, since files do not have a group owner.
:param str path1: path to the first file
:param str path2: path to the second file
:return: True if both files have the same ownership, False otherwise
:rtype: bool
) r r r r r r r r r )Zpath1Zpath2Zstats1Zstats2Z security1Zuser1Z security2Zuser2r
r
r �has_same_ownershipg s
rc c C s� t r t�| �j}|||B kS t| �} t�| tjtjB �}|� � }|�
� }t ||�}t |�
� �D ]F}|�|�}|d } |d }|�tjtj|d��}
|
|
| B kr^ dS q^dS )a�
Check if a file given its path has at least the permissions defined by the given minimal mode.
On Windows, group permissions are ignored since files do not have a group owner.
:param str path: path to the file to check
:param int min_mode: the minimal permissions expected
:return: True if the file matches the minimal permissions expectations, False otherwise
:rtype: bool
r' � rT FT)r r r r rD r r r rW r rX r. �range� GetAceCount�GetAcerY rZ r[ ) rC Zmin_moder r" r# r; Zmin_dacl�indexZmin_ace�maskZeffective_maskr
r
r �has_min_permissions� s.
�
� rj c C sN t j�| �sdS t�| tj�}|�� }|�tjtj t
� d��}|t j @ t j kS )NFrT )
r rC rN r r rW rX rY rZ r[ r! �
ntsecuritycon�FILE_GENERIC_EXECUTE)rC r" r; r r
r
r rQ � s �rQ c C sJ t | �} t�| tj�}|�� }t||�}|�d|d� t�| tj|� dS )z�
This function converts the given POSIX mode into a Windows ACL list, and applies it to the
file given its path. If the given path is a symbolic link, it will resolved to apply the
mode on the targeted file.
r' r N) rD r r r r r. r0 �SetFileSecurityrW )r r r" r# r; r
r
r r � s
r c
C s� t |�}t�d�}t�d�}t�d�}t�� }| ||fkrZt|d �}|rZ|�tj|| � t|d �}|rz|�tj||� tdddd��} |�tj| |� |�tj| |� |S )NzS-1-5-18z S-1-5-32-544rS r# �allT��read�write�execute)�
_analyze_moder r\ ZACL�_generate_windows_flagsZAddAccessAllowedAceZ ACL_REVISION)
Zuser_sidr Zanalysis�systemZadminsZeveryoner; Z
user_flagsZeverybody_flagsZfull_permissionsr
r
r r. � s
r. c C s> | t j@ | t j@ | t j@ d�| t j@ | t j@ | t j@ d�d�S )Nro )r# rn )r �S_IRUSR�S_IWUSR�S_IXUSRra �S_IWOTH�S_IXOTH)r r
r
r rs � s ���rs c C sD t �| t j�}|�� }t �|t j�}|�|d� t �|t j|� d S �NF)r r r r r/ rm )r r Z security_srcZuser_srcZ security_dstr
r
r r s
r c C sJ d}| d r|t jB }| d r4|t jt jA t jA B }| d rF|t jB }|S )Nr rp rq rr )rk ZFILE_GENERIC_READZFILE_ALL_ACCESSrl )Z rights_desc�flagr
r
r rt
s
��
rt c C sH t | �} t�| tjtjB �}|�� }|�� }|s4dS t||�}t||�S r{ ) rD r r r rW rX r r. �_compare_dacls)r r r" r; r# Zref_daclr
r
r r , s
�
r c s4 � fdd�t � �� �D ��fdd�t ��� �D �kS )z�
This method compare the two given DACLs to check if they are identical.
Identical means here that they contains the same set of ACEs in the same order.
c s g | ]}� � |��qS r
�rg ��.0rh )�dacl1r
r �
<listcomp>G s z"_compare_dacls.<locals>.<listcomp>c s g | ]}� � |��qS r
r~ r )�dacl2r
r r� H s )re rf �r� r� r
r� r r} B s �r} c C s t �t j�} t�d| �d S )z=
Return the pySID corresponding to the current user.
Nr )�win32apiZ
GetUserNameExZNameSamCompatibler ZLookupAccountName)Z account_namer
r
r r! K s r! )r& )r& )r& )+�__doc__Z
__future__r r6 r r rk r r+ r� r1 r2 r4 � ImportErrorr Zacme.magic_typingr r r r r r r$ r% r( r= r> r? rD rR r] rb rc rj rQ r r. rs r rt r r} r! r
r
r
r �<module> sP
E
%-"