477 lines
16 KiB
Python
477 lines
16 KiB
Python
|
#
|
||
|
|
# Copyright (C) 2019 Red Hat, Inc.
|
||
|
|
#
|
||
|
|
# This copyrighted material is made available to anyone wishing to use,
|
||
|
|
# modify, copy, or redistribute it subject to the terms and conditions of
|
||
|
|
# the GNU General Public License v.2, or (at your option) any later version.
|
||
|
|
# This program is distributed in the hope that it will be useful, but WITHOUT
|
||
|
|
# ANY WARRANTY expressed or implied, including the implied warranties of
|
||
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
|
||
|
|
# Public License for more details. You should have received a copy of the
|
||
|
|
# GNU General Public License along with this program; if not, write to the
|
||
|
|
# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||
|
|
# 02110-1301, USA. Any Red Hat trademarks that are incorporated in the
|
||
|
|
# source code or documentation are not subject to the GNU General Public
|
||
|
|
# License and may only be used or replicated with the express permission of
|
||
|
|
# Red Hat, Inc.
|
||
|
|
#
|
||
|
|
import os
|
||
|
|
import copy
|
||
|
|
import shutil
|
||
|
|
|
||
|
|
from pyanaconda.anaconda_loggers import get_module_logger
|
||
|
|
from pyanaconda.core import util
|
||
|
|
from pyanaconda.core.configuration.anaconda import conf
|
||
|
|
from pyanaconda.core.constants import PAYLOAD_TYPE_DNF
|
||
|
|
from pyanaconda.core.path import make_directories, join_paths
|
||
|
|
from pyanaconda.modules.common.errors.installation import SecurityInstallationError
|
||
|
|
from pyanaconda.modules.common.task import Task
|
||
|
|
from pyanaconda.modules.security.constants import SELinuxMode
|
||
|
|
|
||
|
|
log = get_module_logger(__name__)
|
||
|
|
|
||
|
|
REALM_TOOL_NAME = "realm"
|
||
|
|
AUTHSELECT_TOOL_PATH = "/usr/bin/authselect"
|
||
|
|
PAM_SO_PATH = "/lib/security/pam_fprintd.so"
|
||
|
|
PAM_SO_64_PATH = "/lib64/security/pam_fprintd.so"
|
||
|
|
|
||
|
|
|
||
|
|
class PreconfigureFIPSTask(Task):
|
||
|
|
"""Installation task that sets up FIPS for the payload installation."""
|
||
|
|
|
||
|
|
def __init__(self, fips_enabled, payload_type, sysroot):
|
||
|
|
"""Create a new task.
|
||
|
|
|
||
|
|
:param fips_enabled: True if FIPS is enabled, otherwise False
|
||
|
|
:param payload_type: a type of the payload
|
||
|
|
:param sysroot: a path to the system root
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._fips_enabled = fips_enabled
|
||
|
|
self._payload_type = payload_type
|
||
|
|
self._sysroot = sysroot
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Set up FIPS for the payload installation"
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
"""Set up FIPS for the payload installation.
|
||
|
|
|
||
|
|
Copy the crypto policy from the installation environment
|
||
|
|
to the target system before package installation. The RPM
|
||
|
|
scriptlets need to be executed in the FIPS mode if there
|
||
|
|
is fips=1 on the kernel cmdline.
|
||
|
|
"""
|
||
|
|
if not self._fips_enabled:
|
||
|
|
log.debug("FIPS is not enabled. Skipping.")
|
||
|
|
return
|
||
|
|
|
||
|
|
if self._payload_type != PAYLOAD_TYPE_DNF:
|
||
|
|
log.debug("Don't set up FIPS for the %s payload.", self._payload_type)
|
||
|
|
return
|
||
|
|
|
||
|
|
if not self._check_fips():
|
||
|
|
raise SecurityInstallationError(
|
||
|
|
"FIPS is not correctly set up "
|
||
|
|
"in the installation environment."
|
||
|
|
)
|
||
|
|
|
||
|
|
self._set_up_fips()
|
||
|
|
|
||
|
|
def _check_fips(self):
|
||
|
|
"""Check FIPS in the installation environment."""
|
||
|
|
# Check the config file.
|
||
|
|
config_path = "/etc/crypto-policies/config"
|
||
|
|
|
||
|
|
if not os.path.exists(config_path):
|
||
|
|
log.error("File '%s' doesn't exist.", config_path)
|
||
|
|
return False
|
||
|
|
|
||
|
|
with open(config_path) as f:
|
||
|
|
if f.read().strip() != "FIPS":
|
||
|
|
log.error("The crypto policy is not set to FIPS.")
|
||
|
|
return False
|
||
|
|
|
||
|
|
# Check one of the back-end symlinks.
|
||
|
|
symlink_path = "/etc/crypto-policies/back-ends/opensshserver.config"
|
||
|
|
|
||
|
|
if "FIPS" not in os.path.realpath(symlink_path):
|
||
|
|
log.error("The back ends are not set to FIPS.")
|
||
|
|
return False
|
||
|
|
|
||
|
|
return True
|
||
|
|
|
||
|
|
def _set_up_fips(self):
|
||
|
|
"""Set up FIPS in the target system."""
|
||
|
|
log.debug("Copying the crypto policy.")
|
||
|
|
|
||
|
|
# Create /etc/crypto-policies.
|
||
|
|
src = "/etc/crypto-policies/"
|
||
|
|
dst = join_paths(self._sysroot, src)
|
||
|
|
make_directories(dst)
|
||
|
|
|
||
|
|
# Copy the config file.
|
||
|
|
src = "/etc/crypto-policies/config"
|
||
|
|
dst = join_paths(self._sysroot, src)
|
||
|
|
shutil.copyfile(src, dst)
|
||
|
|
|
||
|
|
# Log the file content on the target system.
|
||
|
|
util.execWithRedirect("/bin/cat", [dst])
|
||
|
|
|
||
|
|
# Copy the back-ends.
|
||
|
|
src = "/etc/crypto-policies/back-ends/"
|
||
|
|
dst = join_paths(self._sysroot, src)
|
||
|
|
shutil.copytree(src, dst, symlinks=True)
|
||
|
|
|
||
|
|
# Log the directory content on the target system.
|
||
|
|
util.execWithRedirect("/bin/ls", ["-l", dst])
|
||
|
|
|
||
|
|
|
||
|
|
class ConfigureFIPSTask(Task):
|
||
|
|
"""Installation task that configures FIPS on the installed system."""
|
||
|
|
|
||
|
|
def __init__(self, fips_enabled, sysroot):
|
||
|
|
"""Create a new task.
|
||
|
|
|
||
|
|
:param fips_enabled: True if FIPS is enabled, otherwise False
|
||
|
|
:param sysroot: a path to the system root
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._fips_enabled = fips_enabled
|
||
|
|
self._sysroot = sysroot
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Configure FIPS"
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
"""Configure FIPS on the installed system.
|
||
|
|
|
||
|
|
If the installation is running in fips mode then make sure
|
||
|
|
fips is also correctly enabled in the installed system.
|
||
|
|
"""
|
||
|
|
if not self._fips_enabled:
|
||
|
|
log.debug("FIPS is not enabled. Skipping.")
|
||
|
|
return
|
||
|
|
|
||
|
|
if not conf.target.is_hardware:
|
||
|
|
log.debug("Don't set up FIPS on %s.", conf.target.type.value)
|
||
|
|
return
|
||
|
|
|
||
|
|
# We use the --no-bootcfg option as we don't want fips-mode-setup
|
||
|
|
# to modify the bootloader configuration. Anaconda already does
|
||
|
|
# everything needed & it would require grubby to be available on
|
||
|
|
# the system.
|
||
|
|
util.execWithRedirect(
|
||
|
|
"fips-mode-setup",
|
||
|
|
["--enable", "--no-bootcfg"],
|
||
|
|
root=self._sysroot
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
class ConfigureSELinuxTask(Task):
|
||
|
|
"""Installation task for Initial Setup configuration."""
|
||
|
|
|
||
|
|
SELINUX_CONFIG_PATH = "/etc/selinux/config"
|
||
|
|
|
||
|
|
SELINUX_STATES = {
|
||
|
|
SELinuxMode.DISABLED: "disabled",
|
||
|
|
SELinuxMode.ENFORCING: "enforcing",
|
||
|
|
SELinuxMode.PERMISSIVE: "permissive"
|
||
|
|
}
|
||
|
|
|
||
|
|
def __init__(self, sysroot, selinux_mode):
|
||
|
|
"""Create a new task.
|
||
|
|
|
||
|
|
:param str sysroot: a path to the root of the target system
|
||
|
|
:param SELinuxMode selinux_mode: a SELinux mode
|
||
|
|
|
||
|
|
States are defined by the SELinuxMode enum as distinct integers.
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._sysroot = sysroot
|
||
|
|
self._selinux_mode = selinux_mode
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Configure SELinux"
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
"""Run the task."""
|
||
|
|
if self._selinux_mode == SELinuxMode.DEFAULT:
|
||
|
|
log.debug("Use SELinux default configuration.")
|
||
|
|
return
|
||
|
|
|
||
|
|
if self._selinux_mode not in self.SELINUX_STATES:
|
||
|
|
log.error("Unknown SELinux state for %s.", self._selinux_mode)
|
||
|
|
return
|
||
|
|
|
||
|
|
try:
|
||
|
|
# Read the SELinux configuration file.
|
||
|
|
path = join_paths(self._sysroot, self.SELINUX_CONFIG_PATH)
|
||
|
|
log.debug("Modifying the configuration at %s.", path)
|
||
|
|
|
||
|
|
with open(path, "r") as f:
|
||
|
|
lines = f.readlines()
|
||
|
|
|
||
|
|
# Modify the SELinux configuration.
|
||
|
|
lines = list(map(self._process_line, lines))
|
||
|
|
|
||
|
|
# Write the modified configuration.
|
||
|
|
with open(path, "w") as f:
|
||
|
|
f.writelines(lines)
|
||
|
|
|
||
|
|
except OSError as msg:
|
||
|
|
log.error("SELinux configuration failed: %s", msg)
|
||
|
|
|
||
|
|
@property
|
||
|
|
def _selinux_state(self):
|
||
|
|
"""The string representation of the SELinux mode."""
|
||
|
|
return self.SELINUX_STATES[self._selinux_mode]
|
||
|
|
|
||
|
|
def _process_line(self, line):
|
||
|
|
"""Process a line from the SELinux configuration file."""
|
||
|
|
if line.strip().startswith("SELINUX="):
|
||
|
|
log.debug("Found '%s'.", line.strip())
|
||
|
|
line = "SELINUX={}\n".format(self._selinux_state)
|
||
|
|
log.debug("Setting '%s'.", line.strip())
|
||
|
|
return line
|
||
|
|
|
||
|
|
return line
|
||
|
|
|
||
|
|
|
||
|
|
class RealmDiscoverTask(Task):
|
||
|
|
"""Task for discovering information about a realm we intend to join (if any).
|
||
|
|
|
||
|
|
Based on results from this task we might attempt to join the realm via a separate
|
||
|
|
task later on.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def __init__(self, sysroot, realm_data):
|
||
|
|
"""Create a new realm discovery task.
|
||
|
|
|
||
|
|
:param str sysroot: a path to the root of the target system
|
||
|
|
:param realm_data: realm data holder
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._sysroot = sysroot
|
||
|
|
self._realm_data = realm_data
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Discover information about a realm"
|
||
|
|
|
||
|
|
def _parse_realm_data(self, output):
|
||
|
|
"""Parse data from realm tool output.
|
||
|
|
|
||
|
|
First line is the realm name, and following lines are data
|
||
|
|
formatted as a simple key value store:
|
||
|
|
|
||
|
|
"name: value"
|
||
|
|
|
||
|
|
We only care about the keys called "required-package"
|
||
|
|
and ignore the rest.
|
||
|
|
|
||
|
|
:param str output: output of the realm tool
|
||
|
|
:return: a tuple reporting discovery success and package requirements
|
||
|
|
:rtype: (bool, list(str))
|
||
|
|
"""
|
||
|
|
required_packages = ["realmd"]
|
||
|
|
discovered_realm_data = None
|
||
|
|
|
||
|
|
lines = output.split("\n")
|
||
|
|
if lines:
|
||
|
|
discovered_realm_data = lines.pop(0).strip()
|
||
|
|
log.info("Realm discovered: %s", discovered_realm_data)
|
||
|
|
for line in lines:
|
||
|
|
parts = line.split(":", 1)
|
||
|
|
if len(parts) == 2 and parts[0].strip() == "required-package":
|
||
|
|
package_spec = parts[1].strip()
|
||
|
|
# "" is not a valid package specification
|
||
|
|
if package_spec:
|
||
|
|
required_packages.append(package_spec)
|
||
|
|
|
||
|
|
log.info("Realm %s needs packages %s",
|
||
|
|
discovered_realm_data, ", ".join(required_packages))
|
||
|
|
return bool(discovered_realm_data), required_packages
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
if not self._realm_data.name:
|
||
|
|
log.debug("No realm name set, skipping realm discovery.")
|
||
|
|
return self._realm_data
|
||
|
|
|
||
|
|
output = ""
|
||
|
|
|
||
|
|
try:
|
||
|
|
argv = ["discover", "--verbose"] + self._realm_data.discover_options \
|
||
|
|
+ [self._realm_data.name]
|
||
|
|
output = util.execWithCapture(REALM_TOOL_NAME, argv, filter_stderr=True)
|
||
|
|
except OSError:
|
||
|
|
# TODO: A lousy way of propagating what will usually be
|
||
|
|
# 'no such realm'
|
||
|
|
# The error message is logged by util
|
||
|
|
return self._realm_data
|
||
|
|
|
||
|
|
realm_discovered, required_packages = self._parse_realm_data(output)
|
||
|
|
|
||
|
|
# set the result in the realm data holder and return it
|
||
|
|
self._realm_data.discovered = realm_discovered
|
||
|
|
self._realm_data.required_packages = required_packages
|
||
|
|
return self._realm_data
|
||
|
|
|
||
|
|
|
||
|
|
class RealmJoinTask(Task):
|
||
|
|
"""Task for joining a realm we have discovered (if any)."""
|
||
|
|
|
||
|
|
def __init__(self, sysroot, realm_data):
|
||
|
|
"""Create a new realm discovery task.
|
||
|
|
|
||
|
|
:param str sysroot: a path to the root of the target system
|
||
|
|
:param realm_data: realm data holder
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._sysroot = sysroot
|
||
|
|
# We do a deep copy of the realm data holder to avoid
|
||
|
|
# changes to the data in the Task from changing the backing
|
||
|
|
# data structure in the module, without triggering the changed signal.
|
||
|
|
# This also works the other way around, preventing changes
|
||
|
|
# to the data structure in the module influencing the task after
|
||
|
|
# it has been instantiated.
|
||
|
|
self._realm_data = copy.deepcopy(realm_data)
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Join a realm"
|
||
|
|
|
||
|
|
def set_realm_data(self, realm_data):
|
||
|
|
"""Set a new version of realm data to the task."""
|
||
|
|
log.debug("Setting new realm data for realm join task: %s", realm_data)
|
||
|
|
self._realm_data = realm_data
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
if not self._realm_data.discovered:
|
||
|
|
log.debug("No realm has been discovered, so not joining any realm.")
|
||
|
|
return
|
||
|
|
|
||
|
|
for arg in self._realm_data.join_options:
|
||
|
|
if arg.startswith("--no-password") or arg.startswith("--one-time-password"):
|
||
|
|
pw_args = []
|
||
|
|
break
|
||
|
|
else:
|
||
|
|
# no explicit password argument, using implicit --no-password
|
||
|
|
pw_args = ["--no-password"]
|
||
|
|
|
||
|
|
argv = ["join", "--install", self._sysroot, "--verbose"] \
|
||
|
|
+ pw_args + self._realm_data.join_options
|
||
|
|
rc = -1
|
||
|
|
try:
|
||
|
|
rc = util.execWithRedirect(REALM_TOOL_NAME, argv)
|
||
|
|
except OSError:
|
||
|
|
log.exception("Realm %s join failed with exception.", self._realm_data.name)
|
||
|
|
pass
|
||
|
|
|
||
|
|
if rc == 0:
|
||
|
|
log.info("Joined realm %s", self._realm_data.name)
|
||
|
|
else:
|
||
|
|
log.info("Joining realm %s failed", self._realm_data.name)
|
||
|
|
|
||
|
|
|
||
|
|
def run_auth_tool(cmd, args, root, required=True):
|
||
|
|
"""Run an authentication related tool.
|
||
|
|
|
||
|
|
This generally means authselect.
|
||
|
|
:param str cmd: path to the tool to be run
|
||
|
|
:param list(str) args: list of arguments passed to the tool
|
||
|
|
:param str root: a path to the root in which the tool should be run
|
||
|
|
:param bool required: require the tool to be present and run
|
||
|
|
(False makes the function pass if the tool is not available)
|
||
|
|
:raises: SecurityInstallationError if the tool which is required is not found
|
||
|
|
:raises: RuntimeError if the run of the tool fails
|
||
|
|
"""
|
||
|
|
if not os.path.lexists(root + cmd):
|
||
|
|
msg = "{} is missing. Cannot setup authentication.".format(cmd)
|
||
|
|
if required:
|
||
|
|
raise SecurityInstallationError(msg)
|
||
|
|
else:
|
||
|
|
log.error(msg)
|
||
|
|
return
|
||
|
|
try:
|
||
|
|
log.debug("Configuring authentication: %s %s", cmd, args)
|
||
|
|
util.execWithRedirect(cmd, args, root=root)
|
||
|
|
except RuntimeError as msg:
|
||
|
|
log.error("Error running %s %s: %s", cmd, args, msg)
|
||
|
|
|
||
|
|
|
||
|
|
class ConfigureFingerprintAuthTask(Task):
|
||
|
|
"""Installation task for fingerprint authentication setup."""
|
||
|
|
|
||
|
|
def __init__(self, sysroot, fingerprint_auth_enabled):
|
||
|
|
"""Create a new Authselect configuration task.
|
||
|
|
|
||
|
|
:param str sysroot: a path to the root of the target system
|
||
|
|
:param bool fingerprint_auth_enabled: True if fingerprint authentication
|
||
|
|
should be enabled if possible,
|
||
|
|
False otherwise
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._sysroot = sysroot
|
||
|
|
self._fingerprint_auth_enabled = fingerprint_auth_enabled
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Configure fingerprint authentication"
|
||
|
|
|
||
|
|
def _is_fingerprint_configuration_supported(self):
|
||
|
|
"""Is the fingerprint configuration supported?"""
|
||
|
|
return (os.path.exists(self._sysroot + PAM_SO_64_PATH) or
|
||
|
|
os.path.exists(self._sysroot + PAM_SO_PATH))
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
"""Run the task."""
|
||
|
|
if not self._fingerprint_auth_enabled:
|
||
|
|
log.debug("Fingerprint configuration is not enabled. Skipping.")
|
||
|
|
return
|
||
|
|
|
||
|
|
if not self._is_fingerprint_configuration_supported():
|
||
|
|
log.debug("Fingerprint configuration is not supported on target system. Skipping.")
|
||
|
|
return
|
||
|
|
|
||
|
|
log.debug("Enabling fingerprint authentication.")
|
||
|
|
run_auth_tool(
|
||
|
|
AUTHSELECT_TOOL_PATH,
|
||
|
|
["enable-feature", "with-fingerprint"],
|
||
|
|
self._sysroot,
|
||
|
|
required=False
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
class ConfigureAuthselectTask(Task):
|
||
|
|
"""Installation task for Authselect configuration."""
|
||
|
|
|
||
|
|
def __init__(self, sysroot, authselect_options):
|
||
|
|
"""Create a new Authselect configuration task.
|
||
|
|
|
||
|
|
:param str sysroot: a path to the root of the target system
|
||
|
|
:param list authselect_options: options for authselect
|
||
|
|
"""
|
||
|
|
super().__init__()
|
||
|
|
self._sysroot = sysroot
|
||
|
|
self._authselect_options = authselect_options
|
||
|
|
|
||
|
|
@property
|
||
|
|
def name(self):
|
||
|
|
return "Authselect configuration"
|
||
|
|
|
||
|
|
def run(self):
|
||
|
|
"""Run the task."""
|
||
|
|
if not self._authselect_options:
|
||
|
|
log.debug("Authselect is not configured. Skipping.")
|
||
|
|
return
|
||
|
|
|
||
|
|
run_auth_tool(
|
||
|
|
AUTHSELECT_TOOL_PATH,
|
||
|
|
self._authselect_options + ["--force"],
|
||
|
|
self._sysroot
|
||
|
|
)
|