shell bypass 403
UnknownSec Shell
:
/
lib
/
update-notifier
/ [
drwxr-xr-x
]
upload
mass deface
mass delete
console
info server
name :
apt_check.py
#!/usr/bin/python3 # nice apt-get -s -o Debug::NoLocking=true upgrade | grep ^Inst import apt import apt_pkg import os import sys from optparse import OptionParser import re import gettext import distro_info SYNAPTIC_PINFILE = "/var/lib/synaptic/preferences" OS_RELEASE_PATH = "/etc/os-release" PRO_ESM_CACHE_DIR = "/var/lib/ubuntu-advantage/apt-esm/" def _get_info_from_os_release(key): " get info directly from os-release file " if os.path.exists(OS_RELEASE_PATH): with open(OS_RELEASE_PATH) as f: search_res = re.search( r"{}=(?P<name>.*)".format(key), f.read() ) if search_res: return search_res.group("name") else: raise Exception( "Could not find {} in {}".format( key, OS_RELEASE_PATH ) ) else: raise Exception( "File {} was not found on the system".format( OS_RELEASE_PATH ) ) def get_distro(): " get distro name " return _get_info_from_os_release(key="UBUNTU_CODENAME") DISTRO = get_distro() ESM_INFRA_ORIGIN = "UbuntuESM" ESM_APPS_ORIGIN = "UbuntuESMApps" ESM_ORIGINS = (ESM_INFRA_ORIGIN, ESM_APPS_ORIGIN) def _(msg): return gettext.dgettext("update-notifier", msg) def _handleException(type, value, tb): sys.stderr.write("E: " + _("Unknown Error: '%s' (%s)") % (type, value)) sys.exit(-1) def get_distro_version(): " get distro version " return _get_info_from_os_release(key="VERSION_ID").replace('"', "") def clean(cache, depcache): " unmark (clean) all changes from the given depcache " # mvo: looping is too inefficient with the new auto-mark code # for pkg in cache.Packages: # depcache.MarkKeep(pkg) depcache.init() def saveDistUpgrade(cache, depcache): """ this function mimics a upgrade but will never remove anything """ depcache.upgrade(True) if depcache.del_count > 0: clean(cache, depcache) depcache.upgrade() def isSecurityUpgrade(ver): " check if the given version is a security update (or masks one) " security_pockets = [("Ubuntu", "%s-security" % DISTRO), (ESM_INFRA_ORIGIN, "%s-infra-security" % DISTRO), (ESM_APPS_ORIGIN, "%s-apps-security" % DISTRO), ("gNewSense", "%s-security" % DISTRO), ("Debian", "%s-updates" % DISTRO)] for (file, index) in ver.file_list: for origin, archive in security_pockets: if (file.archive == archive and file.origin == origin): return True return False def _isESMUpgrade(ver, esm_origin): " check if the given version is a security update (or masks one) " for (file, index) in ver.file_list: if file.origin == esm_origin and file.archive.startswith(DISTRO): return True return False def isESMAppsUpgrade(ver): " check if the given version is an ESM Apps upgrade " return _isESMUpgrade(ver, esm_origin=ESM_APPS_ORIGIN) def isESMInfraUpgrade(ver): " check if the given version is an ESM Infra upgrade " return _isESMUpgrade(ver, esm_origin=ESM_INFRA_ORIGIN) def write_package_names(outstream, cache, depcache): " write out package names that change to outstream " pkgs = [pkg for pkg in cache.packages if depcache.marked_install(pkg) or depcache.marked_upgrade(pkg)] outstream.write("\n".join([p.name for p in pkgs])) def is_esm_distro(): " check if the current distro is ESM or not " ubuntu_distro = distro_info.UbuntuDistroInfo() is_esm_supported = bool( DISTRO in ubuntu_distro.supported_esm() ) is_not_currently_supported = bool( DISTRO in ubuntu_distro.unsupported() ) return is_esm_supported and is_not_currently_supported def is_lts_distro(): " check if the current distro is LTS or not" return distro_info.UbuntuDistroInfo().is_lts(DISTRO) def _output_esm_package_count(outstream, service_type, esm_pkg_count): " output the number of packages upgrades related to esm service " if esm_pkg_count > 0: outstream.write("\n") outstream.write(gettext.dngettext("update-notifier", "%d of these updates " "is an ESM %s " "security update.", "%d of these updates " "are ESM %s " "security updates.", esm_pkg_count) % (esm_pkg_count, service_type)) def _output_esm_package_alert( outstream, service_type, disabled_pkg_count, is_esm=False ): " output the number of upgradable packages if esm service was enabled " outstream.write("\n") if disabled_pkg_count > 0: outstream.write("\n") if is_esm: distro_version = get_distro_version() esm_info_url = "https://ubuntu.com/{}".format( distro_version.replace(".", "-") ) learn_msg_suffix = "for Ubuntu {} at\n{}".format( distro_version, esm_info_url) else: learn_msg_suffix = "at https://ubuntu.com/esm" outstream.write(gettext.dngettext("update-notifier", "%i additional security " "update can be applied " "with ESM %s.\nLearn " "more about enabling ESM %s " "service %s", "%i additional security " "updates can be applied " "with ESM %s.\nLearn " "more about enabling " "ESM %s service %s", disabled_pkg_count) % (disabled_pkg_count, service_type, service_type, learn_msg_suffix)) else: outstream.write("\n") outstream.write(gettext.dgettext("update-notifier", "Enable ESM %s to " "receive additional future " "security updates.") % service_type) outstream.write("\n") outstream.write( gettext.dgettext("update-notifier", "See https://ubuntu.com/esm " "or run: sudo pro status") ) def _output_esm_service_status(outstream, have_esm_service, service_type): if have_esm_service: outstream.write(gettext.dgettext("update-notifier", "Expanded Security Maintenance for " "%s is enabled.") % service_type) else: outstream.write(gettext.dgettext("update-notifier", "Expanded Security Maintenance for " "%s is not enabled.") % service_type) outstream.write("\n\n") def write_human_readable_summary(outstream, upgrades, security_updates, esm_infra_updates, esm_apps_updates, have_esm_infra, have_esm_apps, disabled_esm_infra_updates, disabled_esm_apps_updates, hide_esm_messages=False): " write out human summary summary to outstream " esm_distro = is_esm_distro() lts_distro = is_lts_distro() if not hide_esm_messages: if have_esm_infra is not None and esm_distro: _output_esm_service_status( outstream, have_esm_infra, service_type="Infrastructure" ) if have_esm_apps is not None and lts_distro and not esm_distro: _output_esm_service_status( outstream, have_esm_apps, service_type="Applications" ) outstream.write( gettext.dngettext("update-notifier", "%i update can be applied immediately.", "%i updates can be applied immediately.", upgrades) % upgrades ) if not hide_esm_messages: _output_esm_package_count( outstream, service_type="Infra", esm_pkg_count=esm_infra_updates) _output_esm_package_count( outstream, service_type="Apps", esm_pkg_count=esm_apps_updates) if security_updates > 0: outstream.write("\n") outstream.write(gettext.dngettext("update-notifier", "%i of these updates is a " "standard security update.", "%i of these updates are " "standard security updates.", security_updates) % security_updates) if any([upgrades, security_updates, esm_infra_updates, esm_apps_updates]): outstream.write("\n") outstream.write(gettext.dgettext("update-notifier", "To see these additional updates " "run: apt list --upgradable")) if all( [ have_esm_apps is not None, not have_esm_apps, lts_distro, not esm_distro, not hide_esm_messages, ] ): _output_esm_package_alert( outstream, service_type="Apps", disabled_pkg_count=disabled_esm_apps_updates) if all( [ have_esm_infra is not None, not have_esm_infra, esm_distro, not hide_esm_messages, ] ): _output_esm_package_alert( outstream, service_type="Infra", disabled_pkg_count=disabled_esm_infra_updates, is_esm=True ) outstream.write("\n") def has_disabled_esm_security_update(esm_cache, pkg, esm_origin): " check if we have a disabled ESM security update " inst_ver = pkg.current_ver if not inst_ver: return False if pkg.name not in esm_cache: return False esm_update = esm_cache[pkg.name] for version in esm_update.version_list: for (file, index) in version.file_list: if file.origin == esm_origin: return True return False def has_disabled_esm_apps_security_update(esm_cache, pkg): " check if we have a disabled ESM Apps security update " return has_disabled_esm_security_update(esm_cache, pkg, ESM_APPS_ORIGIN) def has_disabled_esm_infra_security_update(esm_cache, pkg): " check if we have a disabled ESM Infra security update " return has_disabled_esm_security_update(esm_cache, pkg, ESM_INFRA_ORIGIN) def has_esm_service(cache, esm_origin): " check if we have an enabled ESM service in the machine " for file in cache.file_list: origin = file.origin if origin == esm_origin and file.archive.startswith(DISTRO): return True return False def get_apt_pkg_esm_cache(): """Get an apt_pkg cache with the ubuntu-advantage-tools esm data. Set the configuration to get the u-a-t cache, then set it back to an empty configuration state and init again so other calls to Cache work as expected. """ for key in apt_pkg.config.keys(): if re.match(r"^Acquire", key) is None: apt_pkg.config.clear(key) apt_pkg.config.set("Dir", PRO_ESM_CACHE_DIR) apt_pkg.init() try: esm_cache = apt_pkg.Cache(progress=None) except apt_pkg.Error: esm_cache = None for key in apt_pkg.config.keys(): apt_pkg.config.clear(key) apt_pkg.init() return esm_cache def init(): " init the system, be nice " # FIXME: do a ionice here too? os.nice(19) apt_pkg.init() def run(options=None): # we are run in "are security updates installed automatically?" # question mode if options.security_updates_unattended: res = apt_pkg.config.find_i("APT::Periodic::Unattended-Upgrade", 0) # print(res) sys.exit(res) # get caches try: cache = apt_pkg.Cache(apt.progress.base.OpProgress()) except SystemError as e: sys.stderr.write("E: " + _("Error: Opening the cache (%s)") % e) sys.exit(-1) depcache = apt_pkg.DepCache(cache) # read the synaptic pins too if os.path.exists(SYNAPTIC_PINFILE): depcache.read_pinfile(SYNAPTIC_PINFILE) depcache.init() if depcache.broken_count > 0: sys.stderr.write("E: " + _("Error: BrokenCount > 0")) sys.exit(-1) # do the upgrade (not dist-upgrade!) try: saveDistUpgrade(cache, depcache) except SystemError as e: sys.stderr.write("E: " + _("Error: Marking the upgrade (%s)") % e) sys.exit(-1) esm_cache = get_apt_pkg_esm_cache() # Check if we have ESM enabled or disabled; and if it exists in the # first place. have_esm_infra = has_esm_service(cache, esm_origin=ESM_INFRA_ORIGIN) have_esm_apps = has_esm_service(cache, esm_origin=ESM_APPS_ORIGIN) # analyze the ugprade upgrades = 0 security_updates = 0 esm_apps_updates = 0 esm_infra_updates = 0 disabled_esm_apps_updates = 0 disabled_esm_infra_updates = 0 # we need another cache that has more pkg details with apt.Cache() as aptcache: for pkg in cache.packages: if esm_cache: if has_disabled_esm_apps_security_update(esm_cache, pkg): disabled_esm_apps_updates += 1 if has_disabled_esm_infra_security_update(esm_cache, pkg): disabled_esm_infra_updates += 1 # skip packages that are not marked upgraded/installed if not (depcache.marked_install(pkg) or depcache.marked_upgrade(pkg)): continue # check if this is really a upgrade or a false positive # (workaround for ubuntu #7907) inst_ver = pkg.current_ver cand_ver = depcache.get_candidate_ver(pkg) if cand_ver == inst_ver: continue # check for security upgrades if isSecurityUpgrade(cand_ver): if have_esm_apps and isESMAppsUpgrade(cand_ver): esm_apps_updates += 1 elif have_esm_infra and isESMInfraUpgrade(cand_ver): esm_infra_updates += 1 else: security_updates += 1 upgrades += 1 continue # check to see if the update is a phased one try: from UpdateManager.Core.UpdateList import UpdateList ul = UpdateList(None) ignored = ul._is_ignored_phased_update( aptcache[pkg.get_fullname()]) if ignored: depcache.mark_keep(pkg) continue except ImportError: pass upgrades = upgrades + 1 # now check for security updates that are masked by a # candidate version from another repo (-proposed or -updates) for ver in pkg.version_list: if (inst_ver and apt_pkg.version_compare(ver.ver_str, inst_ver.ver_str) <= 0): continue if have_esm_apps and isESMAppsUpgrade(cand_ver): esm_apps_updates += 1 elif have_esm_infra and isESMInfraUpgrade(cand_ver): esm_infra_updates += 1 elif isSecurityUpgrade(ver): security_updates += 1 break # print the number of upgrades if options and options.show_package_names: write_package_names(sys.stderr, cache, depcache) elif options and options.readable_output: write_human_readable_summary(sys.stdout, upgrades, security_updates, esm_infra_updates, esm_apps_updates, have_esm_infra, have_esm_apps, disabled_esm_infra_updates, disabled_esm_apps_updates, options.hide_esm_messages) else: # print the number of regular upgrades and the number of # security upgrades sys.stderr.write("%s;%s" % (upgrades, security_updates)) # return the number of upgrades (if its used as a module) return (upgrades, security_updates) if __name__ == "__main__": # setup a exception handler to make sure that uncaught stuff goes # to the notifier sys.excepthook = _handleException # gettext APP = "update-notifier" DIR = "/usr/share/locale" gettext.bindtextdomain(APP, DIR) gettext.textdomain(APP) # check arguments parser = OptionParser() parser.add_option("-p", "--package-names", action="store_true", dest="show_package_names", help=_("Show the packages that are " "going to be installed/upgraded")) parser.add_option("", "--human-readable", action="store_true", dest="readable_output", help=_("Show human readable output on stdout")) parser.add_option("", "--no-esm-messages", action="store_true", dest="hide_esm_messages", help=_("Do not show esm related messages in human " "readable output")) parser.add_option("", "--security-updates-unattended", action="store_true", help=_("Return the time in days when security updates " "are installed unattended (0 means disabled)")) (options, args) = parser.parse_args() # run it init() run(options)
© 2026 UnknownSec