1#@!#!123s

22527 1#@!#!123s
: / usr / bin /
Filename : ubuntu-security-status
back
#!/usr/bin/python3

import apt
import argparse
import distro_info
import json
import os
import sys
import gettext
import shutil
import subprocess

from UpdateManager.Core.utils import get_dist

from datetime import datetime
from textwrap import wrap
from urllib.error import URLError, HTTPError
from urllib.request import urlopen

# TODO make DEBUG an environmental variable
DEBUG = False
UA_STATUS_FILE = "/var/lib/ubuntu-advantage/status.json"


class PatchStats:
    """Tracks overall patch status

    The relationship between archives enabled and whether a patch is eligible
    for receiving updates is non-trivial. We track here all the important
    buckets a package can be in:

        - Whether it is set to expire with no ESM coverage
        - Whether it is in an archive covered by ESM
        - Whether it received LTS patches
        - whether it received ESM patches

    We also track the total packages covered and uncovered, and for the
    uncovered packages, we track where they originate from.

    The Ubuntu main archive receives patches for 5 years.
    Canonical-owned archives (excluding partner) receive patches for 10 years.
        patches for 10 years.
    """
    def __init__(self):
        # TODO no-update FIPS is never patched
        self.pkgs_uncovered_fips = set()

        # list of package names available in ESM
        self.pkgs_updated_in_esmi = set()
        self.pkgs_updated_in_esma = set()

        self.pkgs_mr = set()
        self.pkgs_um = set()
        self.pkgs_unavailable = set()
        self.pkgs_thirdparty = set()
        # the bin of unknowns
        self.pkgs_uncategorized = set()


def print_debug(s):
    if DEBUG:
        print(s)


def whats_in_esm(url):
    pkgs = set()
    # return a set of package names in an esm archive
    try:
        response = urlopen(url)
    except (URLError, HTTPError):
        print_debug('failed to load: %s' % url)
        return pkgs
    try:
        content = response.read().decode('utf-8')
    except IOError:
        print('failed to read data at: %s' % url)
        sys.exit(1)
    for line in content.split('\n'):
        if not line.startswith('Package:'):
            continue
        else:
            pkg = line.split(': ')[1]
            pkgs.add(pkg)
    return pkgs


def get_ua_status():
    """Return dict of active ua status information from ubuntu-advantage-tools

    Prefer to obtain status information from cache on disk to avoid costly
    roundtrips to contracts.canonical.com to check on available services.

    Fallback to call ua status --format=json.

    If there are errors running: ua status --format=json or if the status on
    disk is unparseable, return an empty dict.
    """
    if os.path.exists(UA_STATUS_FILE):
        with open(UA_STATUS_FILE, "r") as stream:
            status = stream.read()
    else:
        try:
            status = subprocess.check_output(
                ['ua', 'status', '--format=json']
            ).decode()
        except subprocess.CalledProcessError as e:
            print_debug('failed to run ua status: %s' % e)
            return {}
    try:
        return json.loads(status)
    except json.decoder.JSONDecodeError as e:
        print_debug('failed to parse JSON from ua status output: %s' % e)
        return {}


def is_ua_service_enabled(service_name: str) -> bool:
    """Check to see if named esm service is enabled.

    :return: True if UA status reports service as enabled.
    """
    status = get_ua_status()
    for service in status.get("services", []):
        if service["name"] == service_name:
            # Machines unattached to UA will not provide service 'status' key.
            return service.get("status") == "enabled"
    return False


def trim_archive(archive):
    return archive.split("-")[-1]


def trim_site(host):
    # *.ec2.archive.ubuntu.com -> archive.ubuntu.com
    if host.endswith("archive.ubuntu.com"):
        return "archive.ubuntu.com"
    return host


def mirror_list():
    m_file = '/usr/share/ubuntu-release-upgrader/mirrors.cfg'
    if not os.path.exists(m_file):
        print("Official mirror list not found.")
    with open(m_file) as f:
        items = [x.strip() for x in f]
    mirrors = [s.split('//')[1].split('/')[0] for s in items
               if not s.startswith("#") and not s == ""]
    # ddebs.ubuntu.com isn't in mirrors.cfg for every release
    mirrors.append('ddebs.ubuntu.com')
    return mirrors


def origins_for(ver: apt.package.Version) -> str:
    s = []
    for origin in ver.origins:
        if not origin.site:
            # When the package is installed, site is empty, archive/component
            # are "now/now"
            continue
        site = trim_site(origin.site)
        s.append("%s %s/%s" % (site, origin.archive, origin.component))
    return ",".join(s)


def print_wrapped(str):
    print("\n".join(wrap(str, break_on_hyphens=False)))


def print_thirdparty_count():
    print(gettext.dngettext("update-manager",
                            "%s package is from a third party",
                            "%s packages are from third parties",
                            len(pkgstats.pkgs_thirdparty)) %
          "{:>{width}}".format(len(pkgstats.pkgs_thirdparty), width=width))


def print_unavailable_count():
    print(gettext.dngettext("update-manager",
                            "%s package is no longer available for "
                            "download",
                            "%s packages are no longer available for "
                            "download",
                            len(pkgstats.pkgs_unavailable)) %
          "{:>{width}}".format(len(pkgstats.pkgs_unavailable), width=width))


def parse_options():
    '''Parse command line arguments.

    Return parser
    '''
    parser = argparse.ArgumentParser(
        description='Return information about security support for packages')
    parser.add_argument('--thirdparty', action='store_true')
    parser.add_argument('--unavailable', action='store_true')
    return parser


if __name__ == "__main__":
    # Prefer redirecting to 'pro security-status' if it exists
    if shutil.which("/usr/bin/pro"):
        print("This command has been replaced with 'pro security-status'.")
        subprocess.run(["/usr/bin/pro", "security-status"])
        sys.exit(0)

    # gettext
    APP = "update-manager"
    DIR = "/usr/share/locale"
    gettext.bindtextdomain(APP, DIR)
    gettext.textdomain(APP)

    parser = parse_options()
    args = parser.parse_args()

    esm_site = "esm.ubuntu.com"

    try:
        dpkg = subprocess.check_output(['dpkg', '--print-architecture'])
        arch = dpkg.decode().strip()
    except subprocess.CalledProcessError:
        print("failed getting dpkg architecture")
        sys.exit(1)

    cache = apt.Cache()
    pkgstats = PatchStats()
    codename = get_dist()
    di = distro_info.UbuntuDistroInfo()
    lts = di.is_lts(codename)
    release_expired = True
    if codename in di.supported():
        release_expired = False
    # distro-info-data in Ubuntu 16.04 LTS does not have eol-esm data
    if codename != 'xenial':
        eol_data = [(r.eol, r.eol_esm)
                    for r in di._releases if r.series == codename][0]
    elif codename == 'xenial':
        eol_data = (datetime.strptime('2021-04-21', '%Y-%m-%d'),
                    datetime.strptime('2024-04-21', '%Y-%m-%d'))
    eol = eol_data[0]
    eol_esm = eol_data[1]

    all_origins = set()
    origins_by_package = {}
    official_mirrors = mirror_list()

    # N.B. only the security pocket is checked because this tool displays
    # information about security updates
    esm_url = \
        'https://%s/%s/ubuntu/dists/%s-%s-%s/main/binary-%s/Packages'
    pkgs_in_esma = whats_in_esm(esm_url %
                                (esm_site, 'apps', codename, 'apps',
                                 'security', arch))
    pkgs_in_esmi = whats_in_esm(esm_url %
                                (esm_site, 'infra', codename, 'infra',
                                 'security', arch))

    for pkg in cache:
        pkgname = pkg.name

        downloadable = True
        if not pkg.is_installed:
            continue
        if not pkg.candidate or not pkg.candidate.downloadable:
            downloadable = False
        pkg_sites = []
        origins_by_package[pkgname] = set()

        for ver in pkg.versions:
            # Loop through origins and store all of them. The idea here is that
            # we don't care where the installed package comes from, provided
            # there is at least one repository we identify as being
            # security-assured under either LTS or ESM.
            for origin in ver.origins:
                # TODO: in order to handle FIPS and other archives which have
                # root-level path names, we'll need to loop over ver.uris
                # instead
                if not origin.site:
                    continue
                site = trim_site(origin.site)
                archive = origin.archive
                component = origin.component
                origin = origin.origin
                official_mirror = False
                thirdparty = True
                # thirdparty providers like dl.google.com don't set "Origin"
                if origin != "Ubuntu":
                    thirdparty = False
                if site in official_mirrors:
                    site = "official_mirror"
                if "MY_MIRROR" in os.environ:
                    if site in os.environ["MY_MIRROR"]:
                        site = "official_mirror"
                t = (site, archive, component, thirdparty)
                if not site:
                    continue
                all_origins.add(t)
                origins_by_package[pkgname].add(t)

            if DEBUG:
                pkg_sites.append("%s %s/%s" %
                                 (site, archive, component))

        print_debug("available versions for %s" % pkgname)
        print_debug(",".join(pkg_sites))

    # This tracks suites we care about. Sadly, it appears that the way apt
    # stores origins truncates away the path that comes after the
    # domainname in the site portion, or maybe I am just clueless, but
    # there's no way to tell FIPS apart from ESM, for instance.
    # See 00REPOS.txt for examples

    # 2020-03-18 ver.filename has the path so why is that no good?

    # TODO Need to handle:
    #   MAAS, lxd, juju PPAs
    #   other PPAs
    #   other repos

    # TODO handle partner.c.c

    # main and restricted from release, -updates, -proposed, or -security
    # pockets
    suite_main = ("official_mirror", codename, "main", True)
    suite_main_updates = ("official_mirror", codename + "-updates",
                          "main", True)
    suite_main_security = ("official_mirror", codename + "-security",
                           "main", True)
    suite_main_proposed = ("official_mirror", codename + "-proposed",
                           "main", True)

    suite_restricted = ("official_mirror", codename, "restricted",
                        True)
    suite_restricted_updates = ("official_mirror",
                                codename + "-updates",
                                "restricted", True)
    suite_restricted_security = ("official_mirror",
                                 codename + "-security",
                                 "restricted", True)
    suite_restricted_proposed = ("official_mirror",
                                 codename + "-proposed",
                                 "restricted", True)

    # universe and multiverse from release, -updates, -proposed, or -security
    # pockets
    suite_universe = ("official_mirror", codename, "universe", True)
    suite_universe_updates = ("official_mirror", codename + "-updates",
                              "universe", True)
    suite_universe_security = ("official_mirror",
                               codename + "-security",
                               "universe", True)
    suite_universe_proposed = ("official_mirror",
                               codename + "-proposed",
                               "universe", True)

    suite_multiverse = ("official_mirror", codename, "multiverse",
                        True)
    suite_multiverse_updates = ("official_mirror",
                                codename + "-updates",
                                "multiverse", True)
    suite_multiverse_security = ("official_mirror",
                                 codename + "-security",
                                 "multiverse", True)
    suite_multiverse_proposed = ("official_mirror",
                                 codename + "-proposed",
                                 "multiverse", True)

    # packages from the esm respositories
    # N.B. Origin: Ubuntu is not set for esm
    suite_esm_main = (esm_site, "%s-infra-updates" % codename,
                      "main")
    suite_esm_main_security = (esm_site,
                               "%s-infra-security" % codename, "main")
    suite_esm_universe = (esm_site,
                          "%s-apps-updates" % codename, "main")
    suite_esm_universe_security = (esm_site,
                                   "%s-apps-security" % codename,
                                   "main")

    esm_infra_enabled = is_ua_service_enabled("esm-infra")
    esm_apps_enabled = is_ua_service_enabled("esm-apps")
    ua_attached = get_ua_status().get("attached", False)

    # Now do the final loop through
    for pkg in cache:
        if not pkg.is_installed:
            continue
        if not pkg.candidate or not pkg.candidate.downloadable:
            pkgstats.pkgs_unavailable.add(pkg.name)
            continue
        pkgname = pkg.name
        pkg_origins = origins_by_package[pkgname]

        # This set of is_* booleans tracks specific situations we care about in
        # the logic below; for instance, if the package has a main origin, or
        # if the esm repos are enabled.

        # Some packages get added in -updates and don't exist in the release
        # pocket e.g. ubuntu-advantage-tools and libdrm-updates. To be safe all
        # pockets are allowed.
        is_mr_pkg_origin = (suite_main in pkg_origins) or \
                           (suite_main_updates in pkg_origins) or \
                           (suite_main_security in pkg_origins) or \
                           (suite_main_proposed in pkg_origins) or \
                           (suite_restricted in pkg_origins) or \
                           (suite_restricted_updates in pkg_origins) or \
                           (suite_restricted_security in pkg_origins) or \
                           (suite_restricted_proposed in pkg_origins)
        is_um_pkg_origin = (suite_universe in pkg_origins) or \
                           (suite_universe_updates in pkg_origins) or \
                           (suite_universe_security in pkg_origins) or \
                           (suite_universe_proposed in pkg_origins) or \
                           (suite_multiverse in pkg_origins) or \
                           (suite_multiverse_updates in pkg_origins) or \
                           (suite_multiverse_security in pkg_origins) or \
                           (suite_multiverse_proposed in pkg_origins)

        is_esm_infra_pkg_origin = (suite_esm_main in pkg_origins) or \
                                  (suite_esm_main_security in pkg_origins)
        is_esm_apps_pkg_origin = (suite_esm_universe in pkg_origins) or \
                                 (suite_esm_universe_security in pkg_origins)

        # A third party one won't appear in any of the above origins
        if not is_mr_pkg_origin and not is_um_pkg_origin \
                and not is_esm_infra_pkg_origin and not is_esm_apps_pkg_origin:
            pkgstats.pkgs_thirdparty.add(pkgname)

        if False:  # TODO package has ESM fips origin
            # TODO package has ESM fips-updates origin: OK
            # If user has enabled FIPS, but not updates, BAD, but need some
            # thought on how to display it, as it can't be patched at all
            pass
        elif is_mr_pkg_origin:
            pkgstats.pkgs_mr.add(pkgname)
        elif is_um_pkg_origin:
            pkgstats.pkgs_um.add(pkgname)
        else:
            # TODO print information about packages in this category if in
            # debugging mode
            pkgstats.pkgs_uncategorized.add(pkgname)

        # Check to see if the package is available in esm-infra or esm-apps
        # and add it to the right pkgstats category
        # NB: apps is ordered first for testing the hello package which is both
        # in esmi and esma
        if pkgname in pkgs_in_esma:
            pkgstats.pkgs_updated_in_esma.add(pkgname)
        elif pkgname in pkgs_in_esmi:
            pkgstats.pkgs_updated_in_esmi.add(pkgname)

    total_packages = (len(pkgstats.pkgs_mr) +
                      len(pkgstats.pkgs_um) +
                      len(pkgstats.pkgs_thirdparty) +
                      len(pkgstats.pkgs_unavailable))
    width = len(str(total_packages))
    print("%s packages installed, of which:" %
          "{:>{width}}".format(total_packages, width=width))

    # filters first as they provide less information
    if args.thirdparty:
        if pkgstats.pkgs_thirdparty:
            pkgs_thirdparty = sorted(p for p in pkgstats.pkgs_thirdparty)
            print_thirdparty_count()
            print_wrapped(' '.join(pkgs_thirdparty))
            msg = ("Packages from third parties are not provided by the "
                   "official Ubuntu archive, for example packages from "
                   "Personal Package Archives in Launchpad.")
            print("")
            print_wrapped(msg)
            print("")
            print_wrapped("Run 'apt-cache policy %s' to learn more about "
                          "that package." % pkgs_thirdparty[0])
            sys.exit(0)
        else:
            print_wrapped("You have no packages installed from a third party.")
            sys.exit(0)
    if args.unavailable:
        if pkgstats.pkgs_unavailable:
            pkgs_unavailable = sorted(p for p in pkgstats.pkgs_unavailable)
            print_unavailable_count()
            print_wrapped(' '.join(pkgs_unavailable))
            msg = ("Packages that are not available for download "
                   "may be left over from a previous release of "
                   "Ubuntu, may have been installed directly from "
                   "a .deb file, or are from a source which has "
                   "been disabled.")
            print("")
            print_wrapped(msg)
            print("")
            print_wrapped("Run 'apt-cache show %s' to learn more about "
                          "that package." % pkgs_unavailable[0])
            sys.exit(0)
        else:
            print_wrapped("You have no packages installed that are no longer "
                          "available.")
            sys.exit(0)
    # Only show LTS patches and expiration notices if the release is not
    # yet expired; showing LTS patches would give a false sense of
    # security.
    if not release_expired:
        print("%s receive package updates%s until %d/%d" %
              ("{:>{width}}".format(len(pkgstats.pkgs_mr),
                                    width=width),
               " with LTS" if lts else "",
               eol.month, eol.year))
    elif release_expired and lts:
        receive_text = "could receive"
        if esm_infra_enabled:
            if len(pkgstats.pkgs_mr) == 1:
                receive_text = "is receiving"
            else:
                receive_text = "are receiving"
        print("%s %s security updates with ESM Infra "
              "until %d/%d" %
              ("{:>{width}}".format(len(pkgstats.pkgs_mr),
                                    width=width),
               receive_text, eol_esm.month, eol_esm.year))
    if lts and pkgstats.pkgs_um and is_ua_service_enabled("esm-apps"):
        if len(pkgstats.pkgs_um) == 1:
            receive_text = "is receiving"
        else:
            receive_text = "are receiving"
        print("%s %s security updates with ESM Apps "
              "until %d/%d" %
              ("{:>{width}}".format(len(pkgstats.pkgs_um),
                                    width=width),
               receive_text, eol_esm.month, eol_esm.year))
    if pkgstats.pkgs_thirdparty:
        print_thirdparty_count()
    if pkgstats.pkgs_unavailable:
        print_unavailable_count()
    # print the detail messages after the count of packages
    if pkgstats.pkgs_thirdparty:
        msg = ("Packages from third parties are not provided by the "
               "official Ubuntu archive, for example packages from "
               "Personal Package Archives in Launchpad.")
        print("")
        print_wrapped(msg)
        action = ("For more information on the packages, run "
                  "'ubuntu-security-status --thirdparty'.")
        print_wrapped(action)
    if pkgstats.pkgs_unavailable:
        msg = ("Packages that are not available for download "
               "may be left over from a previous release of "
               "Ubuntu, may have been installed directly from "
               "a .deb file, or are from a source which has "
               "been disabled.")
        print("")
        print_wrapped(msg)
        action = ("For more information on the packages, run "
                  "'ubuntu-security-status --unavailable'.")
        print_wrapped(action)
    # print the ESM calls to action last
    if lts and not esm_infra_enabled:
        if release_expired and pkgstats.pkgs_mr:
            pkgs_updated_in_esmi = pkgstats.pkgs_updated_in_esmi
            print("")
            msg = gettext.dngettext(
                "update-manager",
                "Enable Extended Security "
                "Maintenance (ESM Infra) to "
                "get %i security update (so far) ",
                "Enable Extended Security "
                "Maintenance (ESM Infra) to "
                "get %i security updates (so far) ",
                len(pkgs_updated_in_esmi)) % len(pkgs_updated_in_esmi)
            msg += gettext.dngettext(
                "update-manager",
                "and enable coverage of %i "
                "package.",
                "and enable coverage of %i "
                "packages.",
                len(pkgstats.pkgs_mr)) % len(pkgstats.pkgs_mr)
            print_wrapped(msg)
            if ua_attached:
                print("\nEnable ESM Infra with: ua enable esm-infra")

    if lts and not ua_attached:
        print("\nThis machine is not attached to an Ubuntu Advantage "
              "subscription.\nSee https://ubuntu.com/advantage")