← Back
Editing: filesystem.cpython-38.pyc
U �]9_ � @ s` d Z ddlmZ ddlZddlZddlZz<ddlZddlZddlZddl Z ddl Z ddl Z ddl Z W n e k r| dZY nX dZddlmZmZmZ dd� Zd d � Zd d � Zd d� Zdd� Zd8dd�Zd9dd�Zd:dd�Zdd� Zdd� Z d d � Z d d � Z d d!� Z d"d#� Z d$d%� Z!d&d'� Z"d(d)� Z#d*d+� Z$d,d-� Z%d.d/� Z&d0d1� Z'd2d3� Z(d4d5� Z)d6d7� Z*dS );z;Compat module to handle files security on Windows and Linux� )�absolute_importNTF)�List�Union�Tuplec C s t rt�| |� n t| |� dS )a^ Apply a POSIX mode on given file_path: * for Linux, the POSIX mode will be directly applied using chmod, * for Windows, the POSIX mode will be translated into a Windows DACL that make sense for Certbot context, and applied to the file using kernel calls. The definition of the Windows DACL that correspond to a POSIX mode, in the context of Certbot, is explained at https://github.com/certbot/certbot/issues/6356 and is implemented by the method _generate_windows_flags(). :param str file_path: Path of the file :param int mode: POSIX mode to apply N)� POSIX_MODE�os�chmod�_apply_win_mode�� file_path�mode� r �;/usr/lib/python3/dist-packages/certbot/compat/filesystem.pyr s r c C sV t r:t�| �}|r|jnd}|r&|jnd}t�|||� n|rHt| |� t||� dS )a� Copy ownership (user and optionally group on Linux) from the source to the destination, then apply given mode in compatible way for Linux and Windows. This replaces the os.chown command. :param str src: Path of the source file :param str dst: Path of the destination file :param int mode: Permission mode to apply on the destination file :param bool copy_user: Copy user if `True` :param bool copy_group: Copy group if `True` on Linux (has no effect on Windows) ���N)r r �stat�st_uid�st_gid�chown�_copy_win_ownershipr )�src�dstr Z copy_userZ copy_groupZstatsZuser_idZgroup_idr r r � copy_ownership_and_apply_mode8 s r c C s$ t rt�t�| �j�|kS t| |�S )a` Check if the given mode matches the permissions of the given file. On Linux, will make a direct comparison, on Windows, mode will be compared against the security model. :param str file_path: Path of the file :param int mode: POSIX mode to test :rtype: bool :return: True if the POSIX mode matches the file permissions )r r �S_IMODEr �st_mode�_check_win_moder r r r � check_modeP s r c C s8 t rt�| �jt�� kS t�| tj�}|�� }t � |kS )z� Check if given file is owned by current user. :param str file_path: File path to check :rtype: bool :return: True if given file is owned by current user, False otherwise. ) r r r r �getuid� win32security�GetFileSecurity�OWNER_SECURITY_INFORMATION�GetSecurityDescriptorOwner�_get_current_user)r �security�userr r r � check_ownera s r$ c C s t | �ot| |�S )z� Check if given file has the given mode and is owned by current user. :param str file_path: File path to check :param int mode: POSIX mode to check :rtype: bool :return: True if file has correct mode and owner, False otherwise. )r$ r r r r r �check_permissionst s r% � c C s: t rt�| ||�S |tj@ �r |tj@ r.tjntj}t� � }|j }t � }t ||�}|� |d� |�d|d� d}z�z$t�| tjtjtj@ ||dd�}W n\ tjk r� } z<| jtjkr�ttj| j ��| jtj kr�ttj | j ��| �W 5 d} ~ X Y nX W 5 |�r|�� X t�| |tjA tjA �S t�| |�}t | |� |S )az Wrapper of original os.open function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int flags: Flags to apply on file while opened :param int mode: POSIX mode to apply on file when opened, Python defaults will be applied if ``None`` :returns: the file descriptor to the opened file :rtype: int :raise: OSError(errno.EEXIST) if the file already exists and os.O_CREAT & os.O_EXCL are set, OSError(errno.EACCES) on Windows if the file already exists and is a directory, and os.O_CREAT is set. r � N) r r �open�O_CREAT�O_EXCL�win32conZ CREATE_NEWZ CREATE_ALWAYSr �SECURITY_ATTRIBUTES�SECURITY_DESCRIPTORr! �_generate_dacl�SetSecurityDescriptorOwner�SetSecurityDescriptorDaclZClose� win32fileZ CreateFileZ GENERIC_READZFILE_SHARE_READZFILE_SHARE_WRITE� pywintypes�error�winerrorZERROR_FILE_EXISTS�OSError�errno�EEXIST�strerrorZERROR_SHARING_VIOLATIONZEACCESr ) r �flagsr Z disposition� attributesr" r# �daclZhandle�errr r r r( � s> � r( c C s: t rt�| |�S tj}ztt_t�| |�W �S |t_X dS )a3 Rewrite of original os.makedirs function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int mode: POSIX mode to apply on leaf directory when created, Python defaults will be applied if ``None`` N)r r �makedirs�mkdir)r r Z orig_mkdir_fnr r r r= � s r= c C s� t rt�| |�S t�� }|j}t� }t||�}|�|d� |� d|d� zt � | |� W nH t j k r� } z(|jtjkr�ttj|j| |j��|�W 5 d}~X Y nX dS )a+ Rewrite of original os.mkdir function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int mode: POSIX mode to apply on directory when created, Python defaults will be applied if ``None`` Fr' r N)r r r> r r, r- r! r. r/ r0 r1 ZCreateDirectoryr2 r3 r4 ZERROR_ALREADY_EXISTSr5 r6 r7 r8 )r r r: r" r# r; r< r r r r> � s r> c C s, t td�r ttd�| |� n t�| |� dS )z� Rename a file to a destination path and handles situations where the destination exists. :param str src: The current file path. :param str dst: The new file path. �replaceN)�hasattrr �getattr�rename)r r r r r r? � s r? c C s� | }t r2tj�| �}tj�|�r.td�|���|S g }tj�| �r�| }t�| �} tj�| �srtj� tj� |�| �} | |kr�td�|���|� | � q6tj� | �S )z� Find the real path for the given path. This method resolves symlinks, including recursive symlinks, and is protected against symlinks that creates an infinite loop. zError, link {0} is a loop!) r r �path�realpath�islink� RuntimeError�format�readlink�isabs�join�dirname�append�abspath)r Z original_pathrC Zinspected_pathsZ link_pathr r r rD s rD c C s& t r tj�| �o t�| tj�S t| �S )z� Is path an executable file? :param str path: path to test :return: True if path is an executable file :rtype: bool )r r rC �isfile�access�X_OK�_win_is_executable)rC r r r � is_executable/ s rR c C sV t r tt�t�| �j�tj@ �S t�| tj �}|� � }t|� tj tj t�d�d���S )z� Check if everybody/world has any right (read/write/execute) on a file given its path :param str path: path to test :return: True if everybody/world has any right to the file :rtype: bool �S-1-1-0�Z TrusteeFormZ TrusteeTypeZ Identifier)r �boolr r r r �S_IRWXOr r �DACL_SECURITY_INFORMATION�GetSecurityDescriptorDacl�GetEffectiveRightsFromAcl�TRUSTEE_IS_SID�TRUSTEE_IS_USER�ConvertStringSidToSid)rC r" r; r r r �has_world_permissions= s �r] c C s: t r6t�t�| �j�tjtjB tjB tjB @ }||B S |S )a Calculate the POSIX mode to apply to a private key given the previous private key :param str old_key: path to the previous private key :param int base_mode: the minimum modes to apply to a private key :return: the POSIX mode to apply :rtype: int ) r r r r r �S_IRGRP�S_IWGRP�S_IXGRP�S_IROTH)Zold_keyZ base_modeZold_moder r r �compute_private_key_modeR s �rb c C sd t r0t�| �}t�|�}|j|jf|j|jfkS t�| tj�}|�� }t�|tj�}|�� }||kS )ar Return True if the ownership of two files given their respective path is the same. On Windows, ownership is checked against owner only, since files do not have a group owner. :param str path1: path to the first file :param str path2: path to the second file :return: True if both files have the same ownership, False otherwise :rtype: bool ) r r r r r r r r r )Zpath1Zpath2Zstats1Zstats2Z security1Zuser1Z security2Zuser2r r r �has_same_ownershipg s rc c C s� t r t�| �j}|||B kS t| �} t�| tjtjB �}|� � }|� � }t ||�}t |� � �D ]F}|�|�}|d } |d }|�tjtj|d��} | | | B kr^ dS q^dS )a� Check if a file given its path has at least the permissions defined by the given minimal mode. On Windows, group permissions are ignored since files do not have a group owner. :param str path: path to the file to check :param int min_mode: the minimal permissions expected :return: True if the file matches the minimal permissions expectations, False otherwise :rtype: bool r' � rT FT)r r r r rD r r r rW r rX r. �range� GetAceCount�GetAcerY rZ r[ ) rC Zmin_moder r" r# r; Zmin_dacl�indexZmin_ace�maskZeffective_maskr r r �has_min_permissions� s. � � rj c C sN t j�| �sdS t�| tj�}|�� }|�tjtj t � d��}|t j @ t j kS )NFrT ) r rC rN r r rW rX rY rZ r[ r! � ntsecuritycon�FILE_GENERIC_EXECUTE)rC r" r; r r r r rQ � s �rQ c C sJ t | �} t�| tj�}|�� }t||�}|�d|d� t�| tj|� dS )z� This function converts the given POSIX mode into a Windows ACL list, and applies it to the file given its path. If the given path is a symbolic link, it will resolved to apply the mode on the targeted file. r' r N) rD r r r r r. r0 �SetFileSecurityrW )r r r" r# r; r r r r � s r c C s� t |�}t�d�}t�d�}t�d�}t�� }| ||fkrZt|d �}|rZ|�tj|| � t|d �}|rz|�tj||� tdddd��} |�tj| |� |�tj| |� |S )NzS-1-5-18z S-1-5-32-544rS r# �allT��read�write�execute)� _analyze_moder r\ ZACL�_generate_windows_flagsZAddAccessAllowedAceZ ACL_REVISION) Zuser_sidr Zanalysis�systemZadminsZeveryoner; Z user_flagsZeverybody_flagsZfull_permissionsr r r r. � s r. c C s> | t j@ | t j@ | t j@ d�| t j@ | t j@ | t j@ d�d�S )Nro )r# rn )r �S_IRUSR�S_IWUSR�S_IXUSRra �S_IWOTH�S_IXOTH)r r r r rs � s ���rs c C sD t �| t j�}|�� }t �|t j�}|�|d� t �|t j|� d S �NF)r r r r r/ rm )r r Z security_srcZuser_srcZ security_dstr r r r s r c C sJ d}| d r|t jB }| d r4|t jt jA t jA B }| d rF|t jB }|S )Nr rp rq rr )rk ZFILE_GENERIC_READZFILE_ALL_ACCESSrl )Z rights_desc�flagr r r rt s �� rt c C sH t | �} t�| tjtjB �}|�� }|�� }|s4dS t||�}t||�S r{ ) rD r r r rW rX r r. �_compare_dacls)r r r" r; r# Zref_daclr r r r , s � r c s4 � fdd�t � �� �D ��fdd�t ��� �D �kS )z� This method compare the two given DACLs to check if they are identical. Identical means here that they contains the same set of ACEs in the same order. c s g | ]}� � |��qS r �rg ��.0rh )�dacl1r r � <listcomp>G s z"_compare_dacls.<locals>.<listcomp>c s g | ]}� � |��qS r r~ r )�dacl2r r r� H s )re rf �r� r� r r� r r} B s �r} c C s t �t j�} t�d| �d S )z= Return the pySID corresponding to the current user. Nr )�win32apiZ GetUserNameExZNameSamCompatibler ZLookupAccountName)Z account_namer r r r! K s r! )r& )r& )r& )+�__doc__Z __future__r r6 r r rk r r+ r� r1 r2 r4 � ImportErrorr Zacme.magic_typingr r r r r r r$ r% r( r= r> r? rD rR r] rb rc rj rQ r r. rs r rt r r} r! r r r r �<module> sP E %-"
Save File
Cancel