@jI d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z m
Z
G d d Z e
e Z d Z
d Zd
d
Zd Zd ZdS ) N) remount_proc)SYSCTL_CL_CONF_FILE
SysCtlConfc 0 e Zd Zg dZdZdZd Zd Zd ZdS )
KernelVersion)1r 95 Tc R t j ddgt j t j 5 }| \ }}|j dk r#t d t
j d | d dk r{| d d d d d d
d
| _ t | j nd | _ d d d d S # 1 swxY w Y d S ) Nz/usr/bin/unamez-r)stdoutstderrr z?error: subprocess call error. Cant't get current kernel version lveel.F)
subprocessPopenPIPE communicate
returncodeprintsysexitfindsplitstrip_system_kernel
_cl_kernel)selfprocout_s py/clsetuplib.py__init__zKernelVersion.__init__& sN
t $ ? ?
( %%''FC!##XYYY xx"$$&)ii&6&6q&9&?&?&E&Ea&H"&M&S&S&U&U&[&[\_&`&`#d)****"'
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(s C!D D #D c | j r/| j | j k o t j d S t
d t j d d S )Nz/proc/sys/fs/symlinkown_gidz1error: Feature is not supported on non CL kernel.r ) r r _SECURELINKS_MIN_KERNELospathisfiler r r r s r$ securelinks_kernel_requirementz,KernelVersion.securelinks_kernel_requirement7 sY ? #t'CC BGNN#@AA
ABBB c < dd | j z S )Nr r )joinr' r+ s r$ get_securelinks_min_kernelz(KernelVersion.get_securelinks_min_kernelB s sxx <====r- N) __name__
__module__ __qualname__r' r r r% r, r0 r- r$ r r ! sU ,nnNJ( ( (" > > > > >r- r ) config_filec @ d}t || dS )zn
Change /etc/sysctl.conf for apache gid
:param apache_gid: id of apache's group
:return: None
zfs.symlinkown_gidN)sysctlset)
apache_gidsymlink_commands r$ set_securelinks_gidr; I s# *O
JJ
+++++r- c d} t t | }n# t $ r d}Y nw xY w t j | j n# t $ r d}Y nw xY w|dk rOd}t j dd|gd t j
| j }t || t j dd d
t | | gd d S ) a
Add user to the group specified by fs.proc_super_gid.
If fs.proc_super_gid is 0 (means undefined) or group doesn't really exists
then create "clsupergid" group, configure it as fs.proc_super_gid and
add user to this group
CLOS-4594/F-54: this creates-or-reuses the proc-super group, whose members get
the hidepid /proc bypass. lve-utils cannot validate the group's members here
(clsupergid is intentionally populated with regular-uid panel admins, which are
indistinguishable from tenants by uid alone). Membership integrity -- evicting any
tenant that slipped into a reused pre-existing group -- is owned by lvemanager, which
knows the authoritative cpapi admin/user sets: see cpanel-lvemanager
commons/lib/lvemanager/sudoers.py::_remove_tenants_from_group. NOTE: that eviction runs
only on hosts lvemanager manages; on an lve-utils-only host it does not run, so a
pre-existing externally-populated group is not reconciled (pre-seeding it requires root).
zfs.proc_super_gidr
clsupergidz/usr/sbin/groupaddz-fF)checkz/usr/sbin/usermodz-az-GN)intr7 get
ValueErrorgrpgetgrgidgr_nameKeyErrorr rungetgrnamgr_gidr8 str)usersgid_keyproc_super_gid sgid_names r$ _add_to_super_gidrN T s, " #H VZZ 1 122 ^$$,,, ,dI> " $ $ $ $ i007
8^,,, N'tS 5H5H$O s ', ;;A A('A(Tc r t j sdS t d | rt dS dS )z:
Add nagios to configured fs.proc_super_gid group
Nnagios) cldetectlib
get_nagiosrN r do_remount_procs r$ setup_nagiosrU sI ! # # h r- c t j d sdS t j d n# t
$ r Y dS w xY wt
d dS )z@
Detect "mailman" and add it to fs.proc_super_gid group
z"/usr/local/cpanel/3rdparty/mailmanNmailman)r( r) isdirpwdgetpwnamrE rN r4 r- r$
setup_mailmanr[ sp 7=== > > Y i s 8
AAc ^ t d t t dS )z
Configure "special" users to be in fs.proc_super_gid group, if it's
necessary.
If this GID was undefined(0) then create and setup special clsupergid group
FrS N)rU r[ r r4 r- r$ setup_supergidsr] s- ''''OOO NNNNNr- )T)rB r( rY r r rQ cl_proc_hidepidr clcommon.sysctlr r r r7 r; rN rU r[ r] r4 r- r$ r` s *
( ( ( ( ( ( ; ; ; ; ; ; ; ;"> "> "> "> "> "> "> ">J
3 4 4 4, , ,* * * Z ! ! !
r-