---

cc_ca_certs.py

# Author: Mike Milner <mike.milner@canonical.com> # # This file is part of cloud-init. See LICENSE file for license information. """CA Certs: Add ca certificates.""" import logging import os from cloudinit import lifecycle, subp, util from cloudinit.cloud import Cloud from cloudinit.config import Config from cloudinit.config.schema import MetaSchema from cloudinit.settings import PER_INSTANCE LOG = logging.getLogger(__name__) DEFAULT_CONFIG = { "ca_cert_path": None, "ca_cert_local_path": "/usr/local/share/ca-certificates/", "ca_cert_filename": "cloud-init-ca-cert-{cert_index}.crt", "ca_cert_config": "/etc/ca-certificates.conf", "ca_cert_update_cmd": ["update-ca-certificates"], } DISTRO_OVERRIDES = { "aosc": { "ca_cert_path": "/etc/ssl/certs/", "ca_cert_local_path": "/etc/ssl/certs/", "ca_cert_filename": "cloud-init-ca-cert-{cert_index}.pem", "ca_cert_config": "/etc/ca-certificates/conf.d/cloud-init.conf", "ca_cert_update_cmd": ["update-ca-bundle"], }, "fedora": { "ca_cert_path": "/etc/pki/ca-trust/", "ca_cert_local_path": "/usr/share/pki/ca-trust-source/", "ca_cert_filename": "anchors/cloud-init-ca-cert-{cert_index}.crt", "ca_cert_config": None, "ca_cert_update_cmd": ["update-ca-trust"], }, "rhel": { "ca_cert_path": "/etc/pki/ca-trust/", "ca_cert_local_path": "/usr/share/pki/ca-trust-source/", "ca_cert_filename": "anchors/cloud-init-ca-cert-{cert_index}.crt", "ca_cert_config": None, "ca_cert_update_cmd": ["update-ca-trust"], }, "opensuse": { "ca_cert_path": "/etc/pki/trust/", "ca_cert_local_path": "/usr/share/pki/trust/", "ca_cert_filename": "anchors/cloud-init-ca-cert-{cert_index}.crt", "ca_cert_config": None, "ca_cert_update_cmd": ["update-ca-certificates"], }, "photon": { "ca_cert_path": "/etc/pki/tls/certs/", "ca_cert_local_path": "/etc/ssl/certs/", "ca_cert_filename": "cloud-init-ca-cert-{cert_index}.pem", "ca_cert_config": None, "ca_cert_update_cmd": ["rehash_ca_certificates.sh"], }, } for distro in ( "opensuse-microos", "opensuse-tumbleweed", "opensuse-leap", "sle_hpc", "sle-micro", "sles", ): DISTRO_OVERRIDES[distro] = DISTRO_OVERRIDES["opensuse"] for distro in ( "almalinux", "cloudlinux", ): DISTRO_OVERRIDES[distro] = DISTRO_OVERRIDES["rhel"] distros = [ "almalinux", "aosc", "cloudlinux", "alpine", "debian", "fedora", "rhel", "opensuse", "opensuse-microos", "opensuse-tumbleweed", "opensuse-leap", "sle_hpc", "sle-micro", "sles", "ubuntu", "photon", ] meta: MetaSchema = { "id": "cc_ca_certs", "distros": distros, "frequency": PER_INSTANCE, "activate_by_schema_keys": ["ca_certs", "ca-certs"], } def _distro_ca_certs_configs(distro_name): """Return a distro-specific ca_certs config dictionary @param distro_name: String providing the distro class name. @returns: Dict of distro configurations for ca_cert. """ cfg = DISTRO_OVERRIDES.get(distro_name, DEFAULT_CONFIG) cfg["ca_cert_full_path"] = os.path.join( cfg["ca_cert_local_path"], cfg["ca_cert_filename"] ) return cfg def update_ca_certs(distro_cfg): """ Updates the CA certificate cache on the current machine. @param distro_cfg: A hash providing _distro_ca_certs_configs function. """ subp.subp(distro_cfg["ca_cert_update_cmd"], capture=False) def add_ca_certs(distro_cfg, certs): """ Adds certificates to the system. To actually apply the new certificates you must also call the appropriate distro-specific utility such as L{update_ca_certs}. @param distro_cfg: A hash providing _distro_ca_certs_configs function. @param certs: A list of certificate strings. """ if not certs: return # Write each certificate to a separate file. for cert_index, c in enumerate(certs, 1): # First ensure they are strings... cert_file_contents = str(c) cert_file_name = distro_cfg["ca_cert_full_path"].format( cert_index=cert_index ) util.write_file(cert_file_name, cert_file_contents, mode=0o644) def disable_default_ca_certs(distro_name, distro_cfg): """ Disables all default trusted CA certificates. For Alpine, Debian and Ubuntu to actually apply the changes you must also call L{update_ca_certs}. @param distro_name: String providing the distro class name. @param distro_cfg: A hash providing _distro_ca_certs_configs function. """ if distro_name in ["rhel", "photon"]: remove_default_ca_certs(distro_cfg) elif distro_name in ["alpine", "aosc", "debian", "ubuntu"]: disable_system_ca_certs(distro_cfg) if distro_name in ["debian", "ubuntu"]: debconf_sel = ( "ca-certificates ca-certificates/trust_new_crts " + "select no" ) subp.subp(("debconf-set-selections", "-"), data=debconf_sel) def disable_system_ca_certs(distro_cfg): """ For every entry in the CA_CERT_CONFIG file prefix the entry with a "!" in order to disable it. @param distro_cfg: A hash providing _distro_ca_certs_configs function. """ ca_cert_cfg_fn = distro_cfg["ca_cert_config"] if not ca_cert_cfg_fn or not os.path.exists(ca_cert_cfg_fn): return header_comment = ( "# Modified by cloud-init to deselect certs due to user-data" ) added_header = False if os.stat(ca_cert_cfg_fn).st_size: orig = util.load_text_file(ca_cert_cfg_fn) out_lines = [] for line in orig.splitlines(): if line == header_comment: added_header = True out_lines.append(line) elif line == "" or line[0] in ("#", "!"): out_lines.append(line) else: if not added_header: out_lines.append(header_comment) added_header = True out_lines.append("!" + line) util.write_file( ca_cert_cfg_fn, "\n".join(out_lines) + "\n", omode="wb" ) def remove_default_ca_certs(distro_cfg): """ Removes all default trusted CA certificates from the system. @param distro_cfg: A hash providing _distro_ca_certs_configs function. """ if distro_cfg["ca_cert_path"] is None: return LOG.debug("Deleting system CA certificates") util.delete_dir_contents(distro_cfg["ca_cert_path"]) util.delete_dir_contents(distro_cfg["ca_cert_local_path"]) def handle(name: str, cfg: Config, cloud: Cloud, args: list) -> None: """ Call to handle ca_cert sections in cloud-config file. @param name: The module name "ca_cert" from cloud.cfg @param cfg: A nested dict containing the entire cloud config contents. @param cloud: The L{CloudInit} object in use. @param log: Pre-initialized Python logger object to use for logging. @param args: Any module arguments from cloud.cfg """ if "ca-certs" in cfg: lifecycle.deprecate( deprecated="Key 'ca-certs'", deprecated_version="22.1", extra_message="Use 'ca_certs' instead.", ) elif "ca_certs" not in cfg: LOG.debug( "Skipping module named %s, no 'ca_certs' key in configuration", name, ) return if "ca-certs" in cfg and "ca_certs" in cfg: LOG.warning( "Found both ca-certs (deprecated) and ca_certs config keys." " Ignoring ca-certs." ) ca_cert_cfg = cfg.get("ca_certs", cfg.get("ca-certs")) distro_cfg = _distro_ca_certs_configs(cloud.distro.name) # If there is a remove_defaults option set to true, disable the system # default trusted CA certs first. if "remove-defaults" in ca_cert_cfg: lifecycle.deprecate( deprecated="Key 'remove-defaults'", deprecated_version="22.1", extra_message="Use 'remove_defaults' instead.", ) if ca_cert_cfg.get( "remove_defaults", ca_cert_cfg.get("remove-defaults", False) ): LOG.debug("Disabling/removing default certificates") disable_default_ca_certs(cloud.distro.name, distro_cfg) # If we are given any new trusted CA certs to add, add them. if "trusted" in ca_cert_cfg: trusted_certs = util.get_cfg_option_list(ca_cert_cfg, "trusted") if trusted_certs: LOG.debug("Adding %d certificates", len(trusted_certs)) add_ca_certs(distro_cfg, trusted_certs) # Update the system with the new cert configuration. LOG.debug("Updating certificates") update_ca_certs(distro_cfg)

---

docroot: /home/induvedam/public_html

---

curdir: /lib/python3.9/site-packages/cloudinit/config

	.		4096
	..		4096
X	__init__.py		40
	__pycache__		8192
X	cc_ansible.py		7862
X	cc_apk_configure.py		4331
X	cc_apt_configure.py		38993
X	cc_apt_pipelining.py		1890
X	cc_bootcmd.py		1690
X	cc_byobu.py		2791
X	cc_ca_certs.py		8877
X	cc_chef.py		12479
X	cc_disable_ec2_metadata.py		1642
X	cc_disk_setup.py		30316
X	cc_fan.py		1997
X	cc_final_message.py		2571
X	cc_growpart.py		18809
X	cc_grub_dpkg.py		5549
X	cc_install_hotplug.py		3267
X	cc_keyboard.py		1527
X	cc_keys_to_console.py		2138
X	cc_landscape.py		3131
X	cc_locale.py		1221
X	cc_lxd.py		13798
X	cc_mcollective.py		4207
X	cc_mounts.py		18598
X	cc_ntp.py		19426
X	cc_package_update_upgrade_install.py		3881
X	cc_phone_home.py		3839
X	cc_power_state_change.py		6065
X	cc_puppet.py		10976
X	cc_reset_rmc.py		4432
X	cc_resizefs.py		10890
X	cc_resolv_conf.py		3249
X	cc_rh_subscription.py		15577
X	cc_rsyslog.py		11823
X	cc_runcmd.py		1640
X	cc_salt_minion.py		4053
X	cc_scripts_per_boot.py		1298
X	cc_scripts_per_instance.py		1295
X	cc_scripts_per_once.py		1271
X	cc_scripts_user.py		1282
X	cc_scripts_vendor.py		1292
X	cc_seed_random.py		3068
X	cc_set_hostname.py		3481
X	cc_set_passwords.py		10566
X	cc_snap.py		3436
X	cc_spacewalk.py		2708
X	cc_ssh.py		11266
X	cc_ssh_authkey_fingerprints.py		3850
X	cc_ssh_import_id.py		5562
X	cc_timezone.py		1167
X	cc_ubuntu_autoinstall.py		3058
X	cc_ubuntu_drivers.py		4174
X	cc_ubuntu_pro.py		13973
X	cc_update_etc_hosts.py		2522
X	cc_update_hostname.py		2230
X	cc_users_groups.py		2930
X	cc_wireguard.py		6825
X	cc_write_files.py		6140
X	cc_write_files_deferred.py		1308
X	cc_yum_add_repo.py		4641
X	cc_zypper_add_repo.py		5052
X	modules.py		13543
X	schema.py		51463
	schemas		4096