Added Cyg-Win

Agent-Windows/OGP64/bin/update-crypto-policies

@@ -0,0 +1,144 @@
+#!/bin/bash
+
+umask 022
+
+: ${profile_dir=/usr/share/crypto-policies}
+: ${base_dir=/etc/crypto-policies}
+local_dir="$base_dir/local.d"
+backend_config_dir="$base_dir/back-ends"
+state_dir="$base_dir/state"
+errcode=0
+nocheck=0
+noreload=0
+profile=''
+
+while test $# -ge 1; do
+	case "$1" in
+		--set)
+			profile="$2"
+			shift
+			# If there is no argument to --set, this shift will be ignored
+			shift
+			;;
+		--no-check)
+			nocheck=1
+			shift
+			;;
+		--no-reload)
+			noreload=1
+			shift
+			;;
+		--show)
+			cat $base_dir/config|grep -v "^#"|sed '/^$/d'
+			exit 0
+			;;
+		--is-applied)
+			time1=$(stat -c %Y $state_dir/current)
+			time2=$(stat -c %Y $base_dir/config)
+			if test -z "$time1" || test -z "$time2";then
+				exit 77
+			fi
+			if test $time1 -ge $time2;then
+				echo "The configured policy is applied"
+				exit 0
+			else
+				echo "The configured policy is NOT applied"
+				exit 1
+			fi
+			;;
+		*)
+			echo "usage: $0 --set [POLICY]"
+			echo "usage: $0 --show"
+			echo "usage: $0 --is-applied"
+			echo "usage: $0"
+			exit 2
+			;;
+	esac
+done
+
+mkdir -p $backend_config_dir >/dev/null 2>&1
+mkdir -p $state_dir >/dev/null 2>&1
+
+set_config=0
+if test -z "$profile";then
+	profile=$(cat $base_dir/config|grep -v ^#)
+else
+	profile=$(echo -n $profile|tr '[:lower:]' '[:upper:]')
+	set_config=1
+	# FIPS profile is a special case
+	if test "$profile" = "FIPS" ; then
+		echo "Warning: Using 'update-crypto-policies --set FIPS' is not sufficient for" 1>&2
+		echo "         FIPS compliance." 1>&2
+		echo "         Use 'fips-mode-setup --enable' command instead." 1>&2
+	else
+		fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
+		if test "$fips_enabled" = 1 ; then
+			echo "Warning: Using 'update-crypto-policies --set' in FIPS mode will make the system" 1>&2
+			echo "         non-compliant with FIPS." 1>&2
+			echo "         It can also break the ssh access to the system." 1>&2
+			echo "         Use 'fips-mode-setup --disable' to disable the system FIPS mode." 1>&2
+		fi
+	fi
+fi
+
+# remove any legacy profile options
+profile=$(echo -n $profile|sed -e 's/@F..//')
+
+if test -z "$profile";then
+	#try the OS-installed profile
+	profile=$(cat /usr/share/crypto-policies/default-config|grep -v ^#)
+	if test -z "$profile";then
+		echo "Couldn't read current profile"
+		exit 1
+	fi
+fi
+
+if ! test -d "$profile_dir/$profile";then
+	echo "Unknown profile: $profile"
+	exit 1
+fi
+
+echo "Setting system policy to $profile"
+for i in "$profile_dir/$profile/"*;do
+	basefile=$(basename "$i")
+	file=$(echo -n "$basefile"|sed 's/\.txt/\.config/')
+	basefile=$(echo -n "$basefile"|sed 's/\.txt//')
+	matches=$(ls "$local_dir/$basefile"-*.config 2>/dev/null)
+
+	if test -z "$matches"; then
+		rm -f "$backend_config_dir/$file"
+		ln -sf $i "$backend_config_dir/$file"
+		if test $? != 0;then
+			echo "Failed updating policies, are you root?"
+			exit 1
+		fi
+	else
+		rm -f "$backend_config_dir/$file"
+		cat $i > "$backend_config_dir/$file"
+		if test $? != 0;then
+			echo "Failed updating policies, are you root?"
+			exit 1
+		fi
+
+		cat $local_dir/$basefile-*.config >> "$backend_config_dir/$file"
+	fi
+done
+
+echo $profile > $state_dir/current
+
+if test $set_config = 1;then
+	echo $profile > $base_dir/config
+fi
+
+if ! test $noreload = 1; then
+	. $profile_dir/reload-cmds.sh
+fi
+
+echo "Note: System-wide crypto policies are applied on application start-up."
+echo "It is recommended to restart the system for the change of policies"
+echo "to fully take place."
+
+# Old versions seemed to install that file. We no longer use it
+rm -f $base_dir/current
+
+exit $errcode