File: //lib/python3.9/site-packages/certbot/compat/__pycache__/filesystem.cpython-39.pyc
a
}|�gxt � @ s d Z ddlmZ ddlmZ ddlZddlZddlZddlm Z ddlm
Z
ddlm Z ddlm Z z<ddl
Z
ddlZddlZddlZddlZddlZddlZW n ey� d ZY n0 d
ZG d d � d �Ze� Zeedd
�dd�Zeed�dd�Zeee d d�dd��Z eeee e dd�dd�Z dZeee e dd�dd�Z eee d
�d d �Z ee d �d d �Z!eee d
�d!d"�Z"d[eeeed$�d%d&�Z#d\eedd
�d'd(�Z$d]eedd
�d)d*�Z%eedd+�d,d-�Z&eed �d.d/�Z'eed0�d1d2�Z(ee d3�d4d5�Z)ee d3�d6d7�Z*eeed8�d9d:�Z+eee d;�d<d=�Z,eee d>�d?d@�Z-ee d3�dAdB�Z.eedd
�dCdD�Z/d^e ee e e dE�dFdG�Z0ee
ee
eef f dH�dIdJ�Z1eedd+�dKdL�Z2eedd+�dMdN�Z3e
eef edO�dPdQ�Z4eee d
�dRdS�Z5e e e dT�dUdV�Z6e dW�dXdY�Z7dS )_z;Compat module to handle files security on Windows and Linux� )�absolute_import)�contextmanagerN)�Any)�Dict)� Generator)�OptionalTFc @ s e Zd ZdZdd�dd�ZdS )�
_WindowsUmaskz+Store the current umask to apply on WindowsN��returnc C s
d| _ d S )N� )�mask)�self� r �=/usr/lib/python3.9/site-packages/certbot/compat/filesystem.py�__init__" s z_WindowsUmask.__init__)�__name__�
__module__� __qualname__�__doc__r r r r r r s r )� file_path�moder
c C s t rt�| |� n
t| |� dS )a[
Apply a POSIX mode on given file_path:
- for Linux, the POSIX mode will be directly applied using chmod,
- for Windows, the POSIX mode will be translated into a Windows DACL that make sense for
Certbot context, and applied to the file using kernel calls.
The definition of the Windows DACL that correspond to a POSIX mode, in the context of Certbot,
is explained at https://github.com/certbot/certbot/issues/6356 and is implemented by the
method `_generate_windows_flags()`.
:param str file_path: Path of the file
:param int mode: POSIX mode to apply
N)�
POSIX_MODE�os�chmod�_apply_win_mode�r r r r r r ) s r )r r
c C s t rt�| �S tj}| t_|S )a$
Set the current numeric umask and return the previous umask. On Linux, the built-in umask
method is used. On Windows, our Certbot-side implementation is used.
:param int mask: The user file-creation mode mask to apply.
:rtype: int
:return: The previous umask value.
)r r �umask�_WINDOWS_UMASKr )r Zprevious_umaskr r r r > s
r )NNNc c s> d}z"t | �}dV W |dur:t |� n|dur8t |� 0 dS )z�
Apply a umask temporarily, meant to be used in a `with` block. Uses the Certbot
implementation of umask.
:param int mask: The user file-creation mode mask to apply temporarily
N)r )r Z old_umaskr r r �
temp_umaskO s
�r )�src�dstr � copy_user�
copy_groupr
c C sV t r:t�| �}|r|jnd}|r&|jnd}t�|||� n|rHt| |� t||� dS )a�
Copy ownership (user and optionally group on Linux) from the source to the
destination, then apply given mode in compatible way for Linux and Windows.
This replaces the os.chown command.
:param str src: Path of the source file
:param str dst: Path of the destination file
:param int mode: Permission mode to apply on the destination file
:param bool copy_user: Copy user if `True`
:param bool copy_group: Copy group if `True` on Linux (has no effect on Windows)
���N)r r �stat�st_uid�st_gid�chown�_copy_win_ownershipr )r r r r! r" �stats�user_id�group_idr r r � copy_ownership_and_apply_modei s
r, )r r r! r" r
c C sb t rFt�| �}|r|jnd}|r&|jnd}t�|||� t||j� n|rTt| |� t | |� dS )aU
Copy ownership (user and optionally group on Linux) and mode/DACL
from the source to the destination.
:param str src: Path of the source file
:param str dst: Path of the destination file
:param bool copy_user: Copy user if `True`
:param bool copy_group: Copy group if `True` on Linux (has no effect on Windows)
r# N)
r r r$ r% r& r' r �st_moder( �_copy_win_mode)r r r! r" r) r* r+ r r r �copy_ownership_and_mode� s
r/ c C s$ t rt�t�| �j�|kS t| |�S )aa
Check if the given mode matches the permissions of the given file.
On Linux, will make a direct comparison, on Windows, mode will be compared against
the security model.
:param str file_path: Path of the file
:param int mode: POSIX mode to test
:rtype: bool
:return: True if the POSIX mode matches the file permissions
)r r$ �S_IMODEr r- �_check_win_moder r r r �
check_mode� s r2 )r r
c C s8 t rt�| �jt�� kS t�| tj�}|�� }t � |kS )z�
Check if given file is owned by current user.
:param str file_path: File path to check
:rtype: bool
:return: True if given file is owned by current user, False otherwise.
)
r r r$ r% �getuid�
win32security�GetFileSecurity�OWNER_SECURITY_INFORMATION�GetSecurityDescriptorOwner�_get_current_user)r �security�userr r r � check_owner� s
r; c C s t | �ot| |�S )z�
Check if given file has the given mode and is owned by current user.
:param str file_path: File path to check
:param int mode: POSIX mode to check
:rtype: bool
:return: True if file has correct mode and owner, False otherwise.
)r; r2 r r r r �check_permissions� s r< � )r �flagsr r
c
C sN t rt�| ||�S |tj@ �r4|tj@ r.tjntj}t� � }|j
}t � }t ||t
j�}|�|d� |�d|d� d}z�z$t�| tjtjtj@ ||dd�}W n^ tjy� } zD| jtjkr�ttj | j ��| jtj kr�ttj | j ��| �W Y d} ~ n
d} ~ 0 0 W |�r |� � n|�r|� � 0 t�| |tjA tjA �S t�| |�}
t!| |� |
S )aw
Wrapper of original os.open function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int flags: Flags to apply on file while opened
:param int mode: POSIX mode to apply on file when opened,
Python defaults will be applied if ``None``
:returns: the file descriptor to the opened file
:rtype: int
:raise: OSError(errno.EEXIST) if the file already exists and os.O_CREAT & os.O_EXCL are set,
OSError(errno.EACCES) on Windows if the file already exists and is a directory, and
os.O_CREAT is set.
r � N)"r r �open�O_CREAT�O_EXCL�win32conZ
CREATE_NEWZ
CREATE_ALWAYSr4 �SECURITY_ATTRIBUTES�SECURITY_DESCRIPTORr8 �_generate_daclr r �SetSecurityDescriptorOwner�SetSecurityDescriptorDacl� win32fileZ
CreateFileZ GENERIC_READZFILE_SHARE_READZFILE_SHARE_WRITE�
pywintypes�error�winerrorZERROR_FILE_EXISTS�OSError�errno�EEXIST�strerrorZERROR_SHARING_VIOLATIONZEACCESZCloser ) r r> r Z disposition�
attributesr9 r: �daclZhandle�err�fdr r r r@ � s<
�
�
r@ c C s� t d�}zjt |d|A B � tr4t�| |�W t |� S tj}z$tt_t�| |�W |t_W t |� S |t_0 W t |� n
t |� 0 dS )a4
Rewrite of original os.makedirs function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on leaf directory when created, Python defaults
will be applied if ``None``
r r= N)r r r �makedirs�mkdir)r r Z
current_umaskZ
orig_mkdir_fnr r r rU s" � ��
rU c
C s� t rt�| |�S t�� }|j}t� }t||tj �}|�
|d� |� d|d� zt �
| |� W nJ tjy� } z0|jtjkr�ttj|j| |j��|�W Y d}~n
d}~0 0 dS )a,
Rewrite of original os.mkdir function, that will ensure on Windows that given mode
is correctly applied.
:param str file_path: The file path to open
:param int mode: POSIX mode to apply on directory when created, Python defaults
will be applied if ``None``
Fr? r N)r r rV r4 rD rE r8 rF r r rG rH rI ZCreateDirectoryrJ rK rL ZERROR_ALREADY_EXISTSrM rN rO rP )r r rQ r9 r: rR rS r r r rV 8 s rV )r r r
c C s, t td�r ttd�| |� n t�| |� dS )z�
Rename a file to a destination path and handles situations where the destination exists.
:param str src: The current file path.
:param str dst: The new file path.
�replaceN)�hasattrr �getattr�rename)r r r r r rW W s
rW c C s. | }t j�| �}t j�|�r*td�|���|S )a
Find the real path for the given path. This method resolves symlinks, including
recursive symlinks, and is protected against symlinks that creates an infinite loop.
:param str file_path: The path to resolve
:returns: The real path for the given path
:rtype: str
zError, link {0} is a loop!)r �path�realpath�islink� RuntimeError�format)r Z
original_pathr[ r r r r\ h s
r\ )� link_pathr
c C s6 t �| �}tr|S t|�dk r*|dd� S td��dS )a
Return a string representing the path to which the symbolic link points.
:param str link_path: The symlink path to resolve
:return: The path the symlink points to
:returns: str
:raise: ValueError if a long path (260> characters) is encountered on Windows
i � Nz3Long paths are not supported by Certbot on Windows.)r �readlinkr �len�
ValueError)r` r[ r r r rb } s
rb )r[ r
c C s& t r tj�| �o t�| tj�S t| �S )z�
Is path an executable file?
:param str path: path to test
:return: True if path is an executable file
:rtype: bool
)r r r[ �isfile�access�X_OK�_win_is_executable)r[ r r r �
is_executable� s ri c C sV t r tt�t�| �j�tj@ �S t�| tj �}|�
� }t|� tj tj
t�d�d���S )z�
Check if everybody/world has any right (read/write/execute) on a file given its path.
:param str path: path to test
:return: True if everybody/world has any right to the file
:rtype: bool
�S-1-1-0�Z TrusteeFormZ TrusteeTypeZ
Identifier)r �boolr$ r0 r r- �S_IRWXOr4 r5 �DACL_SECURITY_INFORMATION�GetSecurityDescriptorDacl�GetEffectiveRightsFromAcl�TRUSTEE_IS_SID�TRUSTEE_IS_USER�ConvertStringSidToSid)r[ r9 rR r r r �has_world_permissions� s �rt )�old_key� base_moder
c C s: t r6t�t�| �j�tjtjB tjB tjB @ }||B S |S )a
Calculate the POSIX mode to apply to a private key given the previous private key.
:param str old_key: path to the previous private key
:param int base_mode: the minimum modes to apply to a private key
:return: the POSIX mode to apply
:rtype: int
) r r$ r0 r r- �S_IRGRP�S_IWGRP�S_IXGRP�S_IROTH)ru rv Zold_moder r r �compute_private_key_mode� s �r{ )�path1�path2r
c C sd t r0t�| �}t�|�}|j|jf|j|jfkS t�| tj�}|�� }t�|tj�}|�� }||kS )as
Return True if the ownership of two files given their respective path is the same.
On Windows, ownership is checked against owner only, since files do not have a group owner.
:param str path1: path to the first file
:param str path2: path to the second file
:return: True if both files have the same ownership, False otherwise
:rtype: bool
) r r r$ r% r& r4 r5 r6 r7 )r| r} Zstats1Zstats2Z security1Zuser1Z security2Zuser2r r r �has_same_ownership� s
r~ )r[ �min_moder
c C s� t r t�| �j}|||B kS t| �} t�| tjtjB �}|� � }|�
� }t ||�}t |�
� �D ]F}|�|�}|d } |d }|�tjtj|d��}
|
|
| B kr^ dS q^dS )a�
Check if a file given its path has at least the permissions defined by the given minimal mode.
On Windows, group permissions are ignored since files do not have a group owner.
:param str path: path to the file to check
:param int min_mode: the minimal permissions expected
:return: True if the file matches the minimal permissions expectations, False otherwise
:rtype: bool
r? � rk FT)r r r$ r- r\ r4 r5 r6 rn r7 ro rF �range� GetAceCount�GetAcerp rq rr ) r[ r r- r9 r: rR Zmin_dacl�indexZmin_acer Zeffective_maskr r r �has_min_permissions� s,
�
� r� c C sN t j�| �sdS t�| tj�}|�� }|�tjtj t
� d��}|t j @ t j kS )NFrk )
r r[ re r4 r5 rn ro rp rq rr r8 �
ntsecuritycon�FILE_GENERIC_EXECUTE)r[ r9 rR r r r r rh s �rh c C sJ t | �} t�| tj�}|�� }t||�}|�d|d� t�| tj|� dS )z�
This function converts the given POSIX mode into a Windows ACL list, and applies it to the
file given its path. If the given path is a symbolic link, it will resolved to apply the
mode on the targeted file.
r? r N) r\ r4 r5 r6 r7 rF rH �SetFileSecurityrn )r r r9 r: rR r r r r - s
r )�user_sidr r r
c C s� |r|d| @ }t |�}t�d�}t�d�}t�d�}t�� }| ||fvrjt|d �}|rj|�tj|| � t|d �} | r�|�tj| |� tdddd��}
|�tj|
|� |�tj|
|� |S ) Nr= zS-1-5-18z S-1-5-32-544rj r: �allT��read�write�execute)�
_analyze_moder4 rs ZACL�_generate_windows_flagsZAddAccessAllowedAceZ ACL_REVISION) r� r r Zanalysis�systemZadminsZeveryonerR Z
user_flagsZeverybody_flagsZfull_permissionsr r r rF @ s$
rF )r r
c C s> | t j@ | t j@ | t j@ d�| t j@ | t j@ | t j@ d�d�S )Nr� )r: r� )r$ �S_IRUSR�S_IWUSR�S_IXUSRrz �S_IWOTH�S_IXOTH)r r r r r� d s ���r� c C sL t | �} t�| tj�}|�� }t�|tj�}|�|d� t�|tj|� d S �NF)r\ r4 r5 r6 r7 rG r� )r r � security_srcZuser_src� security_dstr r r r( s s r( c C sN t | �} t�| tj�}|�� }t�|tj�}|�d|d� t�|tj|� d S )Nr? r )r\ r4 r5 rn ro rH r� )r r r� rR r� r r r r. � s r. )� rights_descr
c C sJ d}| d r|t jB }| d r4|t jt jA t jA B }| d rF|t jB }|S )Nr r� r� r� )r� ZFILE_GENERIC_READZFILE_ALL_ACCESSr� )r� �flagr r r r� � s
��
r� c C sH t | �} t�| tjtjB �}|�� }|�� }|s4dS t||�}t||�S r� ) r\ r4 r5 r6 rn ro r7 rF �_compare_dacls)r r r9 rR r: Zref_daclr r r r1 � s
�
r1 )�dacl1�dacl2r
c s4 � fdd�t � �� �D ��fdd�t ��� �D �kS )z�
This method compare the two given DACLs to check if they are identical.
Identical means here that they contains the same set of ACEs in the same order.
c s g | ]}� � |��qS r �r� ��.0r� )r� r r �
<listcomp>� � z"_compare_dacls.<locals>.<listcomp>c s g | ]}� � |��qS r r� r� )r� r r r� � r� )r� r� �r� r� r r� r r� � s �r� r c C s$ d� t�� t�� �} t�d| �d S )z=
Return the pySID corresponding to the current user.
z{0}\{1}Nr )r_ �win32apiZ
GetDomainNameZ GetUserNamer4 ZLookupAccountName)Z account_namer r r r8 � s r8 )TT)r= )r= )r= )N)8r Z
__future__r �
contextlibr rN r r$ �typingr r r r r� rJ r� rC rI r4 rL � ImportErrorr r r �str�intr r r rl r, r/ r2 r; r< r@ rU rV rW r\ rb ri rt r{ r~ r� rh r rF r� r( r. r� r1 r� r8 r r r r �<module> sr
� " �� E "-$