Current File : //usr/lib/python2.7/site-packages/salt/utils/verify.pyc
�
���^c @@ s3 d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z y d d l Z Wn e
k
r� d d l Z n Xd d l m Z d d l m Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z e j e � Z e j! j" j# � rQd n d Z$ d d
d g Z% d � Z& d
� Z' d � Z( d � Z) d � Z* d � Z+ e, d e, e$ d � Z- d � Z. d � Z/ d e, d � Z0 d � Z1 d � Z2 d � Z3 d � Z4 e, d � Z5 d � Z6 d � Z7 d � Z8 e, d e, d � Z9 d S(! u3
A few checks to make sure the environment is sane
i ( t absolute_importt print_functiont unicode_literalsN( t is_console_configured( t
LOG_LEVELS( t SaltClientErrort SaltSystemExitt CommandExecutionErroru c:\saltu /u tcp://u udp://u file://c C@ s� y d d l } Wn t k
r$ t SX| j } t j d | � } | s� d j | � } t � rn t j | � n t
j j d j | � � t S| j
� \ } } } | j � r� t | � } n | j � r� t | � } n | r� | j � r� t | � } n | d k rw| d k rwd | k r^| r^d } t � rAt j | � n t
j j d
j | � � t S| r�| d k r�t Sn( | d k s�| d k r�| d k r�t St j d � d
t
j d k r�d } t � r�t j | � q�t
j j d j | � � n t S( u6
ZeroMQ python bindings >= 2.1.9 are required
i Nu ^(\d+)\.(\d+)(?:\.(\d+))?u1 Using untested zmq python bindings version: '{0}'u WARNING {0}
i i u devu6 Using dev zmq module, please report unexpected resultsu
WARNING: {0}
i u, ZeroMQ python bindings >= 2.1.9 are requiredu salt-masteru� The Salt Master is unstable using a ZeroMQ version lower than 2.1.11 and requires this fix: http://lists.zeromq.org/pipermail/zeromq-dev/2011-June/012094.htmlu
CRITICAL {0}
( t zmqt Exceptiont Truet __version__t ret matcht formatR t logt warningt syst stderrt writet groupst isdigitt intt criticalt argvt False( R t verR
t msgt majort minort point( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt zmq_version* sJ
$
c C@ si t j } yD t j | p d d t j t j � } | s: | S| d } | d SWn t j k
rd | SXd S( u�
Lookup a hostname and determine its address family. The first address returned
will be AF_INET6 if the system is IPv6-enabled, and AF_INET otherwise.
i N( t sockett AF_INETt getaddrinfot Nonet AF_UNSPECt SOCK_STREAMt gaierror( t hostnamet fallbackt hostnamest h( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
lookup_familyg s
c C@ s t | � } x | | f D]� } t j | t j � } z� y6 | j t j t j d � | j | t | � f � Wn� t k
r} d j | | � } | j
r� d j | t | � � } n d j | � } | d 7} t � r� t
j | � n t j j d j | � � t SXWd | j � Xq Wt S( uJ
Attempt to bind to the sockets to verify that they are available
i u Unable to bind socket {0}:{1}u {0}, error: {1}u! {0}, this might not be a problem.u' ; Is there another salt-master running?u
WARNING: {0}
N( R+ R R% t
setsockoptt
SOL_SOCKETt SO_REUSEADDRt bindR R R t argst strR R R R R R R t closeR
( t interfacet pub_portt ret_portt addr_familyt portt sockt excR ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
verify_socketz s&
c C@ sa g } xT | D]L } t } x' t D] } | j | � r t } Pq q W| r
| j | � q
q
W| S( N( R
t DEFAULT_SCHEMESt
startswithR t append( t filest to_verifyt filenamet verify_filet scheme( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt verify_logs_filter� s
c C@ s t t | � | � S( u�
Verify the log files exist and are owned by the named user. Filenames that
begin with tcp:// and udp:// will be filtered out. Filenames that begin
with file:// are handled correctly
( t verify_filesRC ( R> t user( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt verify_log_files� s c
C@ s0 t j j j � r t Sd d l } y | j | � } | d } WnF t k
r� d j | � } t j
j | � t j t j
j j � n Xx�| D]�} t j j | � } y� | r� y t j | � Wq� t k
r� } | j t j k r� � q� q� Xn t j j | � s&t j j j | d � � Wd QXn Wn� t k
r�} t j j | � rod j | | � } t d | � � n | j t j k r�� n d j | � } t d | � � n4 t k
r�} d j | | � } t d | � � n Xt j | � } | | j k r� y t j | | d
� Wq(t k
r$q(Xq� q� Wt S( uK
Verify that the named files exist and are owned by the named user
i Ni uP Failed to prepare the Salt environment for user {0}. The user is not available.
u wu) Failed to create path {0}, is {1} a file?R uD No permissions to access "{0}", are you running as the correct user?u! Failed to create path "{0}" - {1}i����( t saltt utilst platformt
is_windowsR
t pwdt getpwnamt KeyErrorR R R R t exitt defaultst exitcodest EX_NOUSERt ost patht dirnamet makedirst OSErrort errnot EEXISTt isfileR> t fopent IOErrorR t EACCESt statt st_uidt chown(
R> RE RK t pwnamt uidt errt fn_RT R t stats( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyRD � sR
u c
C@ s� t j j j � r+ t | | d | d | �Sd d l } yB | j | � } | d } | d } t j j j | d t �}
WnF t
k
r� d j | � } t j
j | � t j t j j j � n Xx�| D]�} | s� q� n t j j | � s�yU t j j j d � � t j | � Wd QXt j � d k rAt j | | | � n Wq�t k
r�} d
}
t j
j |
j | | � � t j | j � q�Xn t j | � } t j � d k r�t j | � } | j | k s�| j | k r | r�| j |
k r�q t j | | | � n x�g t j | � D] } d | k r | ^ q D]�} t j j! | | � } d j t j j" � | k rtq8n x[t j j j# | � D]D\ } } } x� | D]� } | j$ d
� r�q�n t j j! | | � } y t j | � } Wn t% t f k
r�n X| j | k s| j | k r�| r3| j |
k r3qIt j | | | � q�q�Wx~ | D]v } t j j! | | � } t j | � } | j | k s�| j | k rT| r�| j |
k r�q�t j | | | � qTqTWq�Wq8Wn | | k r� t j& | j' � } | d k r�| d k r�t j( | t j) � r7t j* | d � q�d }
|
j | � }
t+ � ret, j- |
� q�t j
j d j |
� � q�q� q� W| t k r�t. � n d S( uh
Verify that the named directories are in place and that the environment
can shake the salt
t
permissivet
skip_extrai Ni i t include_defaultuP Failed to prepare the Salt environment for user {0}. The user is not available.
i u, Failed to create directory path "{0}" - {1}
u jobsu {0}jobsu .i� i� u0 Unable to securely set the permissions of "{0}".u CRITICAL: {0}
(/ RG RH RI RJ t win_verify_envRK RL RE t get_gid_listR RM R R R R RN RO RP RQ RR RS t isdirR> t set_umaskRU t getuidR_ RV RW R] R^ t st_gidt listdirt joint sept os_walkR< R[ t S_IMODEt st_modet accesst W_OKt chmodR R R R ( t dirsRE Re t pki_dirRf t root_dirRK R` Ra t gidR Rb t dir_R t modet fmodet at subdirt fsubdirt rootR> t nameRS t smode( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
verify_env� s�
5%
%
# c C@ s� t j j j � r t S| t j j j � k r2 t Sd d l } yQ| j | � } y� t t
d � rx t
j | | j � n" t
j
t j j j | d t �� t
j | j � t
j | j � d t
j k r� | j t
j d <n d t
j k r� | j t
j d <n x0 d D]( } | t
j k r| j t
j | <qqWWnY t k
r�d } | j | � } t � rpt j | � n t j j d
j | � � t SXWnS t k
r�d j | � } t � r�t j | � n t j j d
j | � � t SXt S(
u0
Check user and assign process uid/gid.
i Nu
initgroupsRg u HOMEu SHELLu USERu LOGNAMEu: Salt configured to run as user "{0}" but unable to switch.u CRITICAL: {0}
u User not found: "{0}"( u USERu LOGNAME( RG RH RI RJ R
RE t get_userRK RL t hasattrRR t
initgroupst pw_gidt setgroupsRi R t setgidt setuidt pw_uidt environt pw_dirt pw_shellt pw_nameRV R R R R R R R RM ( RE RK t pwusert envvarR ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
check_userN sD "
c C@ s� | g } t j j | � \ } } | d k rQ | g } t j j | � \ } } n x< | | d k r� | j d | � t j j | � \ } } qT W| S( u�
Returns a full list of directories leading up to, and including, a path.
So list_path_traversal('/path/to/salt') would return:
['/', '/path', '/path/to', '/path/to/salt']
in that order.
This routine has been tested on Windows systems as well.
list_path_traversal('c:\path\to\salt') on Windows would return:
['c:\', 'c:\path', 'c:\path\to', 'c:\path\to\salt']
u i ( RR RS t splitt insert( RS t outt headt tail( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt list_path_traversal s u rootc C@ s� x� t | � D]� } t j | t j � s
d j | � } t j j | � sV | d 7} nG t j j j
� } | | k r� | d j | � 7} n | d j | � 7} | r� d St | � � q
q
Wd S( u
Walk from the root up to a directory and verify that the current
user has access to read each directory. This is used for making
sure a user can read all parent directories of the minion's key
before trying to go and generate a new key and raising an IOError
u Could not access {0}.u Path does not exist.u Try running as user {0}.u" Please give {0} read permissions.N( R� RR Rt t R_OKR RS t existsRG RH RE R� R ( RS RE t skip_perm_errorst tpathR t current_user( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt check_path_traversal� s
c C@ s� | j d d � } t j j d � r7 t j � } } n t j t j � \ } } t j
j | j d � d � } t t j
| � � } t j d | � t j } | d | k r� d Sd j | | � } | | k r� | d
7} t j } nT | d | k r� t j } n8 | d | k rt j } n | d | k r7t j } n | | k r]| d
j | | � 7} n | d 7} t j d | d | � d S( uI
Check the number of max allowed open files and adjust if needed
u max_open_filesi�� u winu pki_diru minionsu6 This salt-master instance has accepted %s minion keys.i Nuj The number of accepted minion keys({0}) should be lower than 1/4 of the max open files soft setting({1}). u$ salt-master will crash pretty soon! i i up According to the system's hard limit, there's still a margin of {0} to raise the salt's max_open_files setting. u# Please consider raising this value.t levelR ( t getR RI R< t win32filet _getmaxstdiot resourcet getrlimitt
RLIMIT_NOFILERR RS Ro t lenRn R t debugt loggingt INFOR t CRITICALt WARNING( t optst mof_ct mof_st mof_ht accepted_keys_dirt accepted_countR� R ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt check_max_open_files� s8
c C@ s� d } x� | j t j j � d D]� } | d k r� t j j t j j j | | g � � r� t j t j j j | | g � � } q� t j j t j j j | | g � � } q t j j t j j j | | g � � } q W| S( Nu i ( R� RR RS Rp t islinkRo t readlinkt abspath( RS t baset part( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt _realpath_darwin� s ''*+c C@ s� d } x� | j t j j � D]� } | d k r� y: t j t j j j | | g � � } t j j | � } Wq� t k
r� t j j t j j j | | g � � } q� Xq | } q W| S( Nu ( R� RR RS Rp R� Ro R� RV ( RS R� R� ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt _realpath_windows s $
.
c C@ s^ t j j j � r t | � St j j j � rN t j j j rG t | � S| Sn t
j j | � S( u�
Cross platform realpath method. On Windows when python 3, this method
uses the os.readlink method to resolve any filesystem links. On Windows
when python 2, this method is a no-op. All other platforms and version use
os.realpath
(
RG RH RI t is_darwinR� RJ t extt sixt PY3R� RR RS t realpath( RS ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt _realpath s
c C@ s� t | � } t j j | � s" d St j j | � sL t j j | | � } n t j j | � } t | � } | r� | j | � r� | Sn( t j j | � t j j | � k r� | Sd S( u�
Accepts the root the path needs to be under and verifies that the path is
under said root. Pass in subdir=True if the path can result in a
subdirectory of the root instead of having to reside directly in the root
u ( R� RR RS t isabsRo t normpathR< RT ( R� RS R t real_roott real_path( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
clean_path s $c @ so yJ t � f d � d d t d � f D� � r2 t St t | d � � � SWn t t t t f k
rj t SXd S( u+
Returns if the passed id is valid
c 3@ s | ] } | � k Vq d S( N( ( t .0t x( t id_( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pys <genexpr>: s u /u \u u pki_dirN( t anyR1 R t boolR� t AttributeErrorRM t TypeErrort UnicodeDecodeError( R� R� ( ( R� s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt valid_id5 s +c C@ s. d } x! | D] } | j | � r
t Sq
Wt S(
u�
Check a string to see if it has any potentially unsafe routines which
could be executed via python, this routine is used to improve the
safety of modules suct as virtualenv
u importu ;u
subprocessu evalu openu fileu execu input( u importu ;u
subprocessu evalu openu fileu execu input( t countR R
( t codet badst bad( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt safe_py_codeA s
c C@ sM t j t | j d � � j � t j � } | t j k rI t j d � n d S( uF
If an insecre logging configuration is found, show a warning
u log_leveluF Insecure logging configuration detected! Sensitive data may be logged.N( R R� R1 t lowerR� t NOTSETR� R R ( R� R� ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt
verify_logV s *c
C@ s� d d l } d d l } d d l } t j j d d � } d j | d g � } | j j j d | d | � s� t
d j | � � � n t j j | � s� t j
| � n | j j j � } | j j j | � ry | j j j | d
� WnR t
k
r;d j | � } t � r t j | � q<t j j d j | � � n X| syh | j j j � }
|
j d
d
d d � |
j d d
d d � |
j d d
d d � |
j | t � Wqt
k
r�d j | � } t � r�t j | � q�t j j d j | � � qXqn xp| D]h} | s q n t j j | � s�y t j
| � Wq�t k
r�} d } t j j | j | | � � t j | j � q�Xn | | k r y~ | j j j | d
� | j j j � }
|
j d
d
d d � |
j d d
d d � |
j d d
d d � |
j | t � Wqtt
k
rpd } | j | � } t � rTt j | � qqt j j d j | � � qtXq q W| t k r�t! � n d S( uh
Verify that the named directories are in place and that the environment
can shake the salt
i Nu
SystemRootu
C:\Windowsu \u TEMPRS t
allow_pathu3 `file_roots` set to a possibly unsafe location: {0}u S-1-5-32-544u* Unable to securely set the owner of "{0}".u CRITICAL: {0}
u grantu full_controlu this_folder_subfolders_filesu S-1-5-18u S-1-3-4u0 Unable to securely set the permissions of "{0}".u, Failed to create directory path "{0}" - {1}
(" t salt.utils.win_functionst salt.utils.win_daclt salt.utils.pathRR R� R� Ro RH RS t safe_pathR R Rj RU t
win_functionst get_current_usert is_admint win_daclt set_ownerR R R R R R t daclt add_acet saveR
RV RN RW R R (
RS Rw Re Rx Rf RG t system_rootR� R� R R� R{ Rb ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyRh ` s�
#
$ (: t __doc__t
__future__R R R RR R R R] RW R R� R� t ImportErrorR� t salt.logR t salt.log.setupR t salt.exceptionsR R R t salt.defaults.exitcodesRG t salt.utils.filesR� t salt.utils.platformt salt.utils.usert salt.ext.sixt getLoggert __name__R RH RI RJ t ROOT_DIRR; R R+ R: RC RF RD R R� R� R� R� R� R� R� R� R� R� R� R� Rh ( ( ( s5 /usr/lib/python2.7/site-packages/salt/utils/verify.pyt <module> s`
=
6 h 1 <
Mini Shell