Attachment 152255 Details for Bug 234646 – yum security plugin python file

yum security plugin python file

yum-security-plugin.py (text/plain), 10.24 KB, created by James Antill on 2007-04-11 07:49:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: James Antill

Created: 2007-04-11 07:49:06 UTC

Size: 10.24 KB

patch

obsolete

># This program is free software; you can redistribute it and/or modify
># it under the terms of the GNU General Public License as published by
># the Free Software Foundation; either version 2 of the License, or
># (at your option) any later version.
>#
># This program is distributed in the hope that it will be useful,
># but WITHOUT ANY WARRANTY; without even the implied warranty of
># MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
># GNU Library General Public License for more details.
>#
># You should have received a copy of the GNU General Public License
># along with this program; if not, write to the Free Software
># Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
>#
>#
># Copyright Red Hat Inc. 2007
>#
># Author: James Antill <james.antill@redhat.com>
>#
># Examples:
>#
>#  yum --security list updates
>#  yum --security update
>
>import yum
>import time
>from yum.plugins import TYPE_INTERACTIVE
>from yum.update_md import UpdateMetadata
>from rpmUtils.miscutils import compareEVR
>import logging # for commands
>from yum import logginglevels
>
>requires_api_version = '2.5'
>plugin_type = (TYPE_INTERACTIVE,)
>
>def ysp_gen_metadata(conduit):
>    """ Generate the info. from the updateinfo.xml files. """
>    md_info = UpdateMetadata()
>    for repo in conduit.getRepos().listEnabled():
>        if not repo.enabled:
>            continue
>        
>        try: # attempt to grab the updateinfo.xml.gz from the repodata
>            md_info.add(repo)
>        except yum.Errors.RepoMDError:
>            continue # No metadata found for this repo
>    return md_info
>
>def ysp_should_show_pkg(pkg, md, rname=None):
>    """ Do we want to show this package in sec-list. """
>    
>    md = md.get_notice((pkg.name, pkg.ver, pkg.rel))
>    if not md:
>        return None
>    md = md.get_metadata()
>
>    if not rname and md['references'] or md['type'] == 'security':
>        return md
>    if rname:
>        for ref in md['references']:
>            if ref['type'] != rname:
>                continue
>            return md
>
>    return None
>
>class SecurityListCommands:
>    def getNames(self):
>        return ['sec-list']
>
>    def getUsage(self):
>        return 'sec-list'
>
>    def doCheck(self, base, basecmd, extcmds):
>        pass
>
>    def getRepos(self): # so we can act as a "conduit"
>        return self.repos
>
>    def doCommand(self, base, basecmd, extcmds):
>        ygh = base.doPackageLists('updates')
>        self.repos = base.repos
>        md_info = ysp_gen_metadata(self)
>        done = False
>        logger = logging.getLogger("yum.verbose.main")
>        def msg(x):
>            logger.log(logginglevels.INFO_2, x)
>
>        def show_pkg(pkg, md):
>                msg(pkg)
>                msg('\t ID      ' + md['update_id'])
>                msg('\t Type    ' + md['type'])
>                msg('\t Issued  ' + md['issued'])
>                if md['issued'] != md['updated']:
>                    msg('\t Updated ' + md['updated'])
>                if md['references']:
>                    msg('\t References')
>                    for ref in md['references']:
>                        if ref['type'] == 'cve':
>                            msg("\t  CVE " + ref['id'])
>                        elif ref['type'] == 'bugzilla':
>                            msg("\t  BZ  " + ref['id'])
>                        else:
>                            msg("\t *" + ref['type'])
>                msg('')
>            
>        if not extcmds:
>            for pkg in ygh.updates:
>                md = ysp_should_show_pkg(pkg, md_info)
>                if not md:
>                    continue
>                show_pkg(pkg, md)
>        elif len(extcmds) == 1 and (extcmds[0] == "bugzillas" or \
>                                    extcmds[0] == "bzs"):
>            done = False
>            for pkg in ygh.updates:
>                md = ysp_should_show_pkg(pkg, md_info, "bugzilla")
>                if not md:
>                    continue
>                if not done:
>                    msg(" ---- Bugzillas ----")
>                    done = True
>                show_pkg(pkg, md)
>        elif len(extcmds) == 1 and extcmds[0] == "cves":
>            done = False
>            for pkg in ygh.updates:
>                md = ysp_should_show_pkg(pkg, md_info, "cve")
>                if not md:
>                    continue
>                if not done:
>                    msg(" ---- CVEs ----")
>                    done = True
>                show_pkg(pkg, md)
>        else:
>            return 1, [str(PluginYumExit('Bad sec-list commands'))]
>        return 0, ['sec-list done']
>            
>def config_hook(conduit):
>    '''
>    Yum Plugin Config Hook: 
>    Setup the option parser with the '--security' command line option
>    '''
>
>    parser = conduit.getOptParser()
>    if not parser:
>        return
>
>    conduit.registerCommand(SecurityListCommands())
>    parser.values.advisory = []
>    parser.values.cve      = []
>    parser.values.bz       = []
>    parser.values.security = False
>    def osec(opt, key, val, parser):
>        if parser.values.advisory or parser.values.cve or parser.values.bz:
>            raise OptionValueError("can't use %s after --cve, --bz or" +
>                                   " --advisory" % key)
>        parser.values.security = True
>    def ocve(opt, key, val, parser):
>        if parser.values.security:
>            raise OptionValueError("can't use %s after --security" % key)
>        parser.values.cve.append(val)
>    def obz(opt, key, val, parser):
>        if parser.values.security:
>            raise OptionValueError("can't use %s after --security" % key)
>        parser.values.bz.append(str(val))
>    def oadv(opt, key, val, parser):
>        if parser.values.security:
>            raise OptionValueError("can't use %s after --security" % key)
>        parser.values.advisory.append(val)
>            
>    parser.add_option('--security', action="callback",
>                      callback=osec, dest='security', default=False,
>                      help='Limit packages to security relevant ones')
>    parser.add_option('--cve', action="callback", type="string",
>                      callback=ocve, dest='cve', default=[],
>                      help='Limit packages to those need to fix CVE')
>    parser.add_option('--bz', action="callback",
>                      callback=obz, dest='bz', default=[], type="int",
>                      help='Limit packages to those needed to fix BZ')
>    parser.add_option('--advisory', action="callback",
>                      callback=oadv, dest='advisory', default=[], type="string",
>                      help='Limit packages to those needed to fix advisories')
>
>#  You might think we'd just use the exclude_hook, and call delPackage
># and indeed that works for list updates etc.
>#
># __but__ that doesn't work for dependancies on real updates
>#
>#  So to fix deps. we need to do it at the preresolve stage and take the
># "transaction package list" and then remove packages from that.
>#
># __but__ that doesn't work for lists ... so we do it two ways
>#
>def ysp_should_keep_pkg(opts, pkg, md):
>    """ Do we want to keep this package to satisfy the security limits. """
>    
>    def has_id(refs, ref_type, ref_ids):
>        ''' Check if the given ID is a match. '''
>        for ref in refs:
>            if ref['type'] != ref_type:
>                continue
>            if ref['id'] not in ref_ids:
>                continue
>            return ref
>        return None
>
>    md = md.get_notice((pkg.name, pkg.ver, pkg.rel))
>    if not md:
>        return False
>    md = md.get_metadata()
>    
>    if opts.advisory and md['update_id'] in opts.advisory:
>        return True
>    elif opts.cve and has_id(md['references'], "cve", opts.cve):
>        return True
>    elif opts.bz and has_id(md['references'], "bugzilla", opts.bz):
>        return True
>    elif opts.security:
>        return md['type'] == 'security'
>    else:
>        return False
>
>def ysp_check_func_enter(conduit):
>    """ Stuff we need to do in both list and update modes. """
>    
>    opts, args = conduit.getCmdLine()
>
>    if not (opts.security or opts.advisory or opts.bz or opts.cve):
>        return (opts, True, False)
>
>    skip = False
>    list_cmd = False
>    if len(args) == 2:
>        if ((args[0] != "list") and (args[0] != "info")):
>            skip = True
>        elif args[1] != "updates":
>            skip = True
>        else:
>            list_cmd = True
>    elif (len(args) == 1) and (args[0] == "check-update"):
>        list_cmd = True
>    elif (len(args) == 1) and (args[0] == "update"):
>        list_cmd = False
>    else:
>        skip = True
>
>    return (opts, skip, list_cmd)
>
>def exclude_hook(conduit):
>    '''
>    Yum Plugin Exclude Hook:
>    Check and remove packages that don\'t align with the security config.
>    '''
>    
>    opts, skip, list_cmd = ysp_check_func_enter(conduit)
>    if skip:
>        conduit.info(2,'Skipping security plugin, non list/info/update command')
>        return
>
>    if not list_cmd:
>        return
>    
>    conduit.info(2, 'Limiting package lists to security relevant ones')
>    
>    md_info = ysp_gen_metadata(conduit)
>
>    def ysp_del_pkg(pkg):
>        """ Deletes a package from all trees that yum knows about """
>        conduit.info(3," --> %s from %s excluded (non-security)" %
>                     (pkg,pkg.repoid))
>        conduit.delPackage(pkg)
>    
>    for pkg in conduit.getPackages():
>        if not ysp_should_keep_pkg(opts, pkg, md_info):
>            ysp_del_pkg(pkg)
>
>
>def preresolve_hook(conduit):
>    '''
>    Yum Plugin PreResolve Hook:
>    Check and remove packages that don\'t align with the security config.
>    '''
>
>    opts, skip, list_cmd = ysp_check_func_enter(conduit)
>    if skip:
>        conduit.info(2,'Skipping security plugin, non list/info/update command')
>        return
>
>    if list_cmd: # Note ... shouldn't be called?!
>        return
>    
>    conduit.info(2, 'Limiting packages to security relevant ones')
>
>    md_info = ysp_gen_metadata(conduit)
>
>    def ysp_del_pkg(tspkg):
>        """ Deletes a package within a transaction. """
>        conduit.info(3," --> %s from %s excluded (non-security)" %
>                     (tspkg.po,tspkg.po.repoid))
>        tsinfo.remove(tspkg.pkgtup)
>
>    cnt = 0
>    tsinfo = conduit.getTsInfo()
>    tspkgs = tsinfo.getMembers()
>    for tspkg in tspkgs:
>        if not ysp_should_keep_pkg(opts, tspkg.po, md_info):
>            ysp_del_pkg(tspkg)
>        else:
>            cnt += 1
>        
>    conduit.info(2, 'Needed %d packages, for security' % (cnt))

Actions: View

Attachments on bug 234646: 152255