OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	05/26/2025 10:13:33 PM	rwxr-xr-x
📄 __init__.py	40 bytes	01/15/2025 03:24:11 PM	rw-r--r--
📁 __pycache__	-	05/26/2025 10:13:33 PM	rwxr-xr-x
📄 cc_ansible.py	7.74 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_apk_configure.py	4.23 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_apt_configure.py	38.08 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_apt_pipelining.py	1.85 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_bootcmd.py	1.75 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_byobu.py	2.73 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ca_certs.py	8.67 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_chef.py	12.19 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_disable_ec2_metadata.py	1.6 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_disk_setup.py	29.61 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_fan.py	1.95 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_final_message.py	2.51 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_growpart.py	18.37 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_grub_dpkg.py	5.39 KB	03/13/2025 04:28:57 PM	rw-r--r--
📄 cc_install_hotplug.py	3.19 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_keyboard.py	1.49 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_keys_to_console.py	2.09 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_landscape.py	3.06 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_locale.py	1.19 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_lxd.py	13.44 KB	03/13/2025 04:28:57 PM	rw-r--r--
📄 cc_mcollective.py	4.11 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_mounts.py	18.16 KB	03/13/2025 04:28:57 PM	rw-r--r--
📄 cc_ntp.py	18.97 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_package_update_upgrade_install.py	3.99 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_phone_home.py	3.75 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_power_state_change.py	6.09 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_puppet.py	10.72 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_reset_rmc.py	4.33 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_resizefs.py	10.63 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_resolv_conf.py	3.13 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_rh_subscription.py	15.21 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_rsyslog.py	11.55 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_runcmd.py	1.6 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_salt_minion.py	3.96 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_scripts_per_boot.py	1.27 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_scripts_per_instance.py	1.26 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_scripts_per_once.py	1.24 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_scripts_user.py	1.25 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_scripts_vendor.py	1.26 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_seed_random.py	3 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_set_hostname.py	3.4 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_set_passwords.py	9.36 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_snap.py	3.32 KB	03/13/2025 04:28:57 PM	rw-r--r--
📄 cc_spacewalk.py	2.64 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ssh.py	11 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ssh_authkey_fingerprints.py	3.76 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ssh_import_id.py	5.43 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_timezone.py	1.14 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ubuntu_autoinstall.py	2.95 KB	03/13/2025 04:28:57 PM	rw-r--r--
📄 cc_ubuntu_drivers.py	4.08 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_ubuntu_pro.py	13.65 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_update_etc_hosts.py	2.46 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_update_hostname.py	2.18 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_users_groups.py	2.86 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_wireguard.py	6.67 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_write_files.py	6 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_write_files_deferred.py	1.28 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_yum_add_repo.py	4.53 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 cc_zypper_add_repo.py	4.93 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 modules.py	13.23 KB	01/15/2025 03:24:11 PM	rw-r--r--
📄 schema.py	50.86 KB	01/15/2025 03:24:11 PM	rw-r--r--
📁 schemas	-	05/26/2025 10:13:33 PM	rwxr-xr-x

Editing: cc_grub_dpkg.py

# Copyright (C) 2009-2010, 2020 Canonical Ltd.
# Copyright (C) 2012 Hewlett-Packard Development Company, L.P.
#
# Author: Scott Moser <scott.moser@canonical.com>
# Author: Juerg Haefliger <juerg.haefliger@hp.com>
# Author: Matthew Ruffell <matthew.ruffell@canonical.com>
#
# This file is part of cloud-init. See LICENSE file for license information.
"""Grub Dpkg: Configure grub debconf installation device"""

import logging
import os

from cloudinit import subp, util
from cloudinit.cloud import Cloud
from cloudinit.config import Config
from cloudinit.config.schema import MetaSchema
from cloudinit.settings import PER_INSTANCE
from cloudinit.subp import ProcessExecutionError

meta: MetaSchema = {
    "id": "cc_grub_dpkg",
    "distros": ["ubuntu", "debian"],
    "frequency": PER_INSTANCE,
    "activate_by_schema_keys": [],
}

LOG = logging.getLogger(__name__)

def fetch_idevs():
    """
    Fetches the /dev/disk/by-id device grub is installed to.
    Falls back to plain disk name if no by-id entry is present.
    """
    disk = ""
    devices = []

# BIOS mode systems use /boot and the disk path,
    # EFI mode systems use /boot/efi and the partition path.
    probe_target = "disk"
    probe_mount = "/boot"
    if is_efi_booted():
        probe_target = "device"
        probe_mount = "/boot/efi"

try:
        # get the root disk where the /boot directory resides.
        disk = subp.subp(
            ["grub-probe", "-t", probe_target, probe_mount], capture=True
        ).stdout.strip()
    except ProcessExecutionError as e:
        # grub-common may not be installed, especially on containers
        # FileNotFoundError is a nested exception of ProcessExecutionError
        if isinstance(e.reason, FileNotFoundError):
            LOG.debug("'grub-probe' not found in $PATH")
        # disks from the container host are present in /proc and /sys
        # which is where grub-probe determines where /boot is.
        # it then checks for existence in /dev, which fails as host disks
        # are not exposed to the container.
        elif "failed to get canonical path" in e.stderr:
            LOG.debug("grub-probe 'failed to get canonical path'")
        else:
            # something bad has happened, continue to log the error
            raise
    except Exception:
        util.logexc(LOG, "grub-probe failed to execute for grub_dpkg")

if not disk or not os.path.exists(disk):
        # If we failed to detect a disk, we can return early
        return ""

try:
        # check if disk exists and use udevadm to fetch symlinks
        devices = (
            subp.subp(
                ["udevadm", "info", "--root", "--query=symlink", disk],
                capture=True,
            )
            .stdout.strip()
            .split()
        )
    except Exception:
        util.logexc(
            LOG, "udevadm DEVLINKS symlink query failed for disk='%s'", disk
        )

LOG.debug("considering these device symlinks: %s", ",".join(devices))
    # filter symlinks for /dev/disk/by-id entries
    devices = [dev for dev in devices if "disk/by-id" in dev]
    LOG.debug("filtered to these disk/by-id symlinks: %s", ",".join(devices))
    # select first device if there is one, else fall back to plain name
    idevs = sorted(devices)[0] if devices else disk
    LOG.debug("selected %s", idevs)

return idevs

def is_efi_booted() -> bool:
    """
    Check if the system is booted in EFI mode.
    """
    try:
        return os.path.exists("/sys/firmware/efi")
    except OSError as e:
        LOG.error("Failed to determine if system is booted in EFI mode: %s", e)
        # If we can't determine if we're booted in EFI mode, assume we're not.
        return False

def handle(name: str, cfg: Config, cloud: Cloud, args: list) -> None:
    mycfg = cfg.get("grub_dpkg", cfg.get("grub-dpkg", {}))
    if not mycfg:
        mycfg = {}

enabled = mycfg.get("enabled", True)
    if util.is_false(enabled):
        LOG.debug("%s disabled by config grub_dpkg/enabled=%s", name, enabled)
        return

dconf_sel = get_debconf_config(mycfg)
    LOG.debug("Setting grub debconf-set-selections with '%s'", dconf_sel)

try:
        subp.subp(["debconf-set-selections"], data=dconf_sel)
    except Exception as e:
        util.logexc(
            LOG, "Failed to run debconf-set-selections for grub_dpkg: %s", e
        )

def get_debconf_config(mycfg: Config) -> str:
    """
    Returns the debconf config for grub-pc or
    grub-efi depending on the systems boot mode.
    """
    if is_efi_booted():
        idevs = util.get_cfg_option_str(
            mycfg, "grub-efi/install_devices", None
        )

if idevs is None:
            idevs = fetch_idevs()

return "grub-pc grub-efi/install_devices string %s\n" % idevs
    else:
        idevs = util.get_cfg_option_str(mycfg, "grub-pc/install_devices", None)
        if idevs is None:
            idevs = fetch_idevs()

idevs_empty = mycfg.get("grub-pc/install_devices_empty")
        if idevs_empty is None:
            idevs_empty = not idevs
        elif not isinstance(idevs_empty, bool):
            idevs_empty = util.translate_bool(idevs_empty)
        idevs_empty = str(idevs_empty).lower()

# now idevs and idevs_empty are set to determined values
        # or, those set by user
        return (
            "grub-pc grub-pc/install_devices string %s\n"
            "grub-pc grub-pc/install_devices_empty boolean %s\n"
            % (idevs, idevs_empty)
        )