@jy < d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mc mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZm Z d dl Z d dl Z d dl Z d dl Z d dl!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+ d d l,m-Z- d d
l.m/Z/ d d l0m1Z1 d d l2m3Z3m4Z4 d d
l5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z;mm?Z?m@Z@ d dl mAZAmBZBmCZCmDZDmEZE d dlFmGZGmHZH d dlImJZK d dlImLZL d dlImMZN d dlOmPZP dZQdZRdZSdZTdZUd ZVd ZWd ZXd ZY e8d ZZ e[ej\ ] d!d Z^d"Z_ e&e"j` sdZadZbn eDe^# Za eBea$ Zb G d% d&e Zcd'ecfd(Zdd) Zed* Zfd+ Zgd, Zhd- Zid. Zjd/ Zkd0e+fd1Zldd2Zmd3 Znd4d5d4d6d d7d d8d9Zod7Zpd:d5d d d d d d d9Zqg d;Zrdad=ad=ad=ad? Zd@ ZdA ZdB ZddCZdD ZdE Z e p e ZddFZdG ZdH ZdI ZddJZdK Ze j dL ZdMecfdNZdO ZddPZdQ ZdR ZddSZdT ZdU ZdV ZdWe[dXefdYZdZ Zd[ Zd\eee[f fd]Zd^ Zdd`Zda ZddbZddcZdd Zde Zdf ZddgZddhZdi Zdj Zdk ZddlZdm Zi adnZdoZddpZdq Zdre[d'efdsZd'efdtZ G du dve Zdre[d'dfdwZ ddxZdy Zdz Zd{ Zd| Zdd~edede[d'efdZd Zd ZddddddddZddZ ddZedfdZddZd Zd Zd Zd ZddZd ZdedWe[d'dfdZd Zd'eeef fdZdddZd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd ZddZd ZddZddZdZded'dfdZddZdeded'ee[ fdZd Zd Zd Zd Zd ZddZd Zd Zd ZddZd Zd ZdÄ Zdadadada dadadĄ ZddƄZdDŽ ZddȄZdɄ Zdʄ Zd˄ Z d̄ Z
d̈́ Z d΄ Z dτ Z
dЄ Zdф Z dd҄Zdӄ ZdԄ ZdՄ ZdS ) N)range)partial)PAGESIZE)DictListOptionalTextTuple TypedDict)Feature)adminsget_main_username_by_uidis_panel_feature_supportedreseller_users userdomains)CPAPIException
EncodingError) acquire_lock)ExternalProgramFailed)detect_panelclass) reseller_limits_disabled_post reseller_limits_enabled_post) exec_utility)get_lvectl_child_loggerget_subprocess_logger)BadVeConfigExceptionget_xml_configsave_xml)LockFailedExceptionsetup_global_lock)LVP_XML_TAG_NAMELveNameMapPyLve
PyLveError)create_dir_securewrite_file_via_tempfile)config)domain_lve_sentry_extra) id_registry)LvdErrorz%/usr/bin/getcontrolpaneluserspackagesz
/proc/cpuinfoi'
VE_DEFAULTFz /bin/umountz"/etc/container/exclude_mounts.confmultisingle lvectllib PYLVE_DEBUGplesk_id)debug)pyc \ e Zd ZU eez ed< eed< eed< eed< eed< eed< eed< dS ) LiblveSettingsls_cpuls_cpusls_io ls_enters
ls_memory_phyls_nprocls_iopsN)__name__
__module__ __qualname__intstr__annotations__ py/lvectllib.pyr5 r5 V sY #I
LLL JJJNNNMMM
LLLLLrD r5 returnc D dddddddd}| | |S )Nr )r6 r7 r8 r9 r: r; r< )update)kwargsdefaultss rE create_liblve_settingsrK ` s< H
OOF OrD c t t r t j S g S )zRaw kernel LVP list (/proc/lve/resellers), including per-user
domain-isolation LVPs. Reserved for isolation-aware internals; reseller-
management code MUST iterate reseller_lvp_list() instead.)lvereseller_limit_supportedproc lvp_id_listrC rD rE lvp_listrQ n s1 ##%% &x##%%%
IrD c ` t t j t z
S )u Per-user domain-isolation LVP ids (lvp).
The kernel registers an LVP named lvp in /proc/lve/resellers for every
user that has per-domain isolation allowed/enabled (a marker in the
websiteisolation config), even when the user has 0 registered domains.
These are not resellers — they are maintained by the isolation feature —
so reseller-management code must never treat them as reseller LVPs.
This is the single source of truth for "is this kernel LVP an isolation
LVP"; it mirrors the same find_all_lve_ids_with_config() signal that
lveapi uses to build the nested LVP/LVE hierarchy. Note this is broader
than _is_domain_isolated_user(), which additionally requires >= 1 domain:
the kernel LVP exists on the marker alone (see CLOS-4513).
CLOS-5716: reseller UIDs are excluded even when they carry a marker. A
reseller LVP is never a per-user isolation LVP, but a bare lvd_ids marker
can be planted on a reseller UID too (lvectl allow-domain-limits
/ cagefsctl --isolates-allow-all). Without this exclusion such
a reseller wrongly matched is_isolation_lvp() and was skipped in
lve_apply_all(), leaving the reseller LVP zeroed and every sub-user under
it degraded to the kernel default on boot. This read-side exclusion is the
backstop; enable_domain_isolation() additionally refuses to plant the marker
on a reseller in the first place (write-side guard), so both ends are
covered.
Disk-only: callable from non-lvectl entrypoints (cloudlinux-packages,
clsummary) that do not initialize pylve, so this MUST NOT make a kernel
call. ws_config.find_all_lve_ids_with_config() reads /etc/container/lvd_ids
and returns [] when the directory is absent, which covers both "kernel
does not support domains" and "no isolation configured" without needing
lve_kapi_ver(). _reseller_lvp_ids() is likewise disk-only (reads ve.cfg).
) frozenset ws_config find_all_lve_ids_with_config_reseller_lvp_idsrC rD rE _isolation_lvp_idsrW w s( B Y;== > >ARATAT TTrD c t } | t | S # t j t t f$ r t cY S w xY w)u UIDs registered as in ve.cfg (disk-only).
Read via NameMap, which loads the reseller id/name pairs from ve.cfg
without any kernel call, so this stays usable from the same non-lvectl
entrypoints as _isolation_lvp_ids(). Any failure to read ve.cfg degrades
to excluding nothing (frozenset) rather than aborting the isolation lookup
that lve_apply_all()/clsummary/cloudlinux-packages depend on:
* NameMapConfigError — malformed ve.cfg,
* LockFailedException — ve.cfg lock held/unavailable,
* OSError — no /etc/container at all (the RPM %check mock
chroot) or a non-root reader that can't open the
lock file (FileNotFoundError/PermissionError).
Before CLOS-5716 this function did not exist and _isolation_lvp_ids() never
touched ve.cfg, so it could not fail on any of these; the broad fallback
preserves that resilience.
)r#
link_xml_noderS id_listlveapiNameMapConfigErrorr OSErrorname_maps rE rV rV sr &99 ))++,,, %':G D {{s AA *A21A2c " | t v S )zKTrue if lvp_id is a per-user domain-isolation LVP (see _isolation_lvp_ids).)rW lvp_ids rE is_isolation_lvprc s ')) ))rD c T t fdt D S )aG Kernel reseller LVPs, excluding per-user domain-isolation LVPs.
Use this everywhere reseller-management code enumerates resellers (destroy
all, apply all, remove absent resellers, list-reseller, package limits,
summaries). Centralizing the phantom-isolation-LVP filter here means a new
reseller command cannot reintroduce the CLOS-4370/4390/4419/4513 class of
bug as long as it iterates this function instead of the raw lvp_list().
Backward compatible: on kernels without domain support the isolation set is
empty, so the result equals lvp_list().
c g | ]}|v| S rC rC ).0rb isolations rE
z%reseller_lvp_list.. s# G G GvvY/F/FF/F/F/FrD )rW rQ )rg s @rE reseller_lvp_listri s. #$$I G G G G G G GGrD c n t } | | S )zf
Get list of resellers with activated reseller limits
:return: list of pairs (name, uid)
)r# rY load_from_noder^ s rE get_active_resellersrl s1 yyH " " $ $$rD c 6 | d t D v S )z]
Check whether giver reseller has activated reseller limits or not
:return: bool
c 3 K | ] \ }}|V
d S NrC )rf nameuids rE z,is_active_reseller_limits.. s& J JidCT J J J J J JrD )rl
reseller_names rE is_active_reseller_limitsru s%
J J3G3I3I J J J JJrD ec t j s| t r t ddt | g nt | t
j d dS )a"
Since cPanel user can corrupt config file for some user with wrong encodings,
we want to notify him that he should fix encoding problems with the link to documentation.
Print error message and exit with code 1 or raise given exception if it isn't cPanel.
:return: None
r- ERROR N) cldetectlib is_cpanelJSON json_formatrA printsysexitrv s rE raise_cpanel_encoding_errorr sg " " G c!ff% ' ' ' ' aHQKKKKKrD c h t | dS # t $ r t dd Y dS w xY w)az
~~~~~~~~~~~~~~~~~~
!!! DEPRECATED !!!
~~~~~~~~~~~~~~~~~~
Please, use setup_global_lock instead if possible
Wrapper over setup_global_lock. If lock cannot be set,
it will write message and close app
The only reason why it is here is legacy function
check_result_and_exit that we use in TWO places
:type write: bool
:return: Nothing
ry zcan`t get lockN)r r check_result_and_exit)writes rE get_global_lockr sP 3% 3 3 3 a!12222223s 11c | dt j fvrJt rt t dd| g nt d| t
j | d S d S )Nr rx zlvectl: zlvectl: Error: )errnoENOSYSr| r} MULTI_FORMATr~ r r )resultmessages rE r r st
a%, ''' / w0D70D0D&E F F F F -G-- . . . ('rD ry i )cpuncpuioepmempmemnprociopsd )r r r r r r r r falsec
| a d S ro )r| ) json_flags rE set_jsonr J s DDDrD c
| a d S ro )
BYTES_FLAG)
bytes_flags rE set_bytesr O s JJJrD c
| a dS )z--exact-limits: add LIMITS/INDIVIDUAL to paneluserslimits JSON rows.
Opt-in because existing readers match the row text as it is.
N) EXACT_LIMITS)exact_limits_flags rE set_exact_limitsr T s
%LLLrD c t rt dk rd} n t dk rd} nt dk rd} nd} g dg dg dg d d
| }t r1| d d z }|d | d
gz ||d z S |S )N noiops_88 64)IDSPEEDPMEMVMEMEPNPROCIO)r r r r r r r IOPS)r r r r r )r r r r r ry CPU)NOIOPS LVE_VERSIONr| index)versionfields speed_idxs rE
get_fieldsr ] s
+"" BBB
B
B
B
;
;
;
,
,
,
F CLL))A- z z"eW,vijj/AAB MrD c | 3t j } | d t d | d an| at }|st d t ad S )Nr zget_lve_version failedzinit_lve() failed.)clcommonget_lve_version RuntimeErrorr pylve
initializeliblve_settings lve_settings)lve_ver
lve_statuss rE initr s s} *,, 1: 788 8 aj !!##J 1/000((**LLLrD c t j d } | dS t j | S # t
t f$ r<}t dt | t j
d Y d}~dS d}~ww xY w)z-Get cpu information from environment veriableCPU_DATANz.Invalid environment variable 'CPU_DATA' formatry ) osenvirongetjsonloads TypeError
ValueErrorr~ rA r r )packed_cpu_datarv s rE _get_cpu_data_from_envr s jnnZ00O tz/*** z "
@#a&&III s 9 B
1BBc i } i }d} t t dd 5 }|D ]}| s|| d| < |dz }i }&t | d dk r\| d d || d d < d || d d < d
d
d
n # 1 swxY w Y n<# t
$ r/ t
d t d t j d Y nw xY w|| d
d gS )zF
Parse /proc/cpuinfo
return [NumProc, frequency in MHZ]
r rutf-8encodingrO ry : r Nzlvectl: Error: Can`t open .proc0zcpu MHz) openCPUINFOstriplensplitIOErrorr~ r r )cpuinfoprocinfonprocsflines rE get_cpu_datar s GH
F
'3
1
1
1 BQ
B
Bzz||
B/7GO6OO, #aZF !HH4::c??++q00?Czz#q?Q?W?W?Y?YC !3!9!9!;!;<\d+(?:\.\d+)?)(?Pmhz|ghz)+$NsuffixfreqGHZi ) rA r r@ r r compile
IGNORECASEr groupupperr r )r r r cpu_freqpatternr r r s rE convert_from_speed_hzr s t99DH x{ DXa[!!HjH"-XXG MM$ E X&&U[[(()) <<>>U " "$;D (T/ ! !d?D !88uTK /( :;;<< < 4rD c > t | pt | S )z}
Try converting cpu limit value from either SPEED limit format
(percentage of CORE or mhz/ghz) to kernel format.
)r r )r s rE convert_from_speedr s$ #4(( ' & &rD c z t | | }||S t | }||S t | }||S dS )z
Convert different variants of cpu limit to kmod ver 8 variant
:param data: Value in old CPU format or SPEED with % or mhz/ghz.
:param lncpu: Limit in old NCPU format.
:return: CPU limit in kmod ver 8+ format or None for bad format
N)r r r )r r from_cpufrom_speed_percent
from_speed_hzs rE convert_to_kernel_formatr
sV $D%00H3D99%!!)$//M 4rD c p t }t |d }t | } d| v rOdt t t t | d |z z S t t t t | |z S )zm
convert speed to old cpu format
args: cpu limit in speed value
return: old cpu limit format
r *)r r@ rA r lstrip)speedr r s rE speed_to_old_cpur s H E JJE
e||SU3u||C'8'8#9#9U#B C CDDEEEE s5Uu,--.. / //rD c # K t t } t || n2# t $ r% t j t
j d| d w xY w |V t | dS # t | w xY w)zF
Run subprocess in lve with pseudo-random id and given limits
z Unable to setup lve with id z-, something is wrong, check dmesg for detailsN)r r get_available_lve_id lve_setupr% syslog LOG_ALERT lve_destroy)settingslve_ids rE
temporary_lver % s
'
'
)
)F
))))
f& )Vv )V )V )V W W W
"
&!!!!!&!!!!s A /BB% % Cr c R t }t | d | d |_ | d |_ | d |_ | d |_ | d |_ t t j
d| d z t z |_ |S )
a
Just a nice user-friendly constructor of liblve_settings object
You can pass the following ls_cpu and ls_cpus values:
- in percents of one core (just ls_cpu='75%', ls_cpus will be ignored)
- in old 'CPU' format (two arguments, ls_cpu and ls_cpus required, both int)
r6 r7 r r8 r9 r; r< g ?r: )
r r r
r6 r8 r9 r; r< r@ mathceilr r: )r ss rE make_liblve_settingsr! : s A'(:(9BUVVVAHw AG;'AK*%AJ#AI$)B/)B$BX$MNNOOAO HrD c t | d }|s.| d }t j | j }t | S )Niduser)rA getAttributepwdgetpwnampw_uidr@ )ve_lve_elementuser_uid user_names rE get_ve_lve_user_uidr, M sV >..t4455H 2"//77 < **1 x==rD c dt |d i}| t k rt |d |d< || | t t j | dS )a
Print output in json as:
{"status": "ERROR/OK", "msg": "Some Message", "ext1": "foo", "ext2": "bar"}
where "status" and "msg" field are mandatory
:param str error_type: Either MULTI_ERROR or SINGLE_ERROR
:param list data: List with a status string and a message string
:param dict extensions: Some additional fields for the final json object
:return: None
statusr ry msgN)rA r rH r~ r dumps)
error_typer
extensionsr s rE r} r} U sl DG
%F\!!DG u
j!!! $*V
rD c t t | d d ||< d S # t t
t f$ rp || ||< | | }| dt || | j
| Y d S # t $ r Y Y d S w xY ww xY w)Nr limit) r@
ve_defaultgetElementsByTagNamer% r
IndexErrorr
createElement setAttributerA appendChild Exception)xml ve_defaultsve_cfgvaldefaultnodes rE check_def_valuerB h s z > >s C CA F S ST[ \ \]] C
I . "3< C##C(( '#gcl"3"3444 COD ! ! ! ! ! ! DDD
s+ AA A C(B;;
C
C C
Cc * fd| j D S )Nc ^ g | ])}t |t j |j k '|*S rC )
isinstancer< ElementtagName)rf _tags rE rh z"xml_filter_tag..v s7 Z Z Z!*Q *D*D ZVYIYIYAIYIYIYrD )
childNodes)rA rI s `rE xml_filter_tagrK u s Z Z Z Zt Z Z ZZrD c t | | D ]9}|| | s|| | |k r6|c S d S ro )rK hasAttributer% )rA rI attrattr_val
child_nodes rE xml_filter_firstrQ y sn $T3//
J$;$;D$A$A J$;$;D$A$AX$M$M rD c p t | || }|t | | S )N)rA rI rN )rQ r7 r% )rA rI rN filtered_child_nodes rE get_child_tag_atrrrT s; *#DIII"ll + +D 1 11rD c x t | | d }| |t | dS )z
Find in children nodes node with tag and setup attribute
insted el.getElementsByTagName not search recursiveli in tree
r N)rK r9 rA )rA rI rN r? first_child_nodes rE set_child_tag_atrrrW s;
&dC003!!$C11111rD c t \ aadS # t $ rg} t r%t t dt | g n t t | t j
d Y d} ~ dS d} ~ ww xY w)zLoad config from ve.cfgrx ry N) r r> ve_lveconfigr r| r} r rA r~ r r r s rE _load_config_wrapperrZ s
- / / wA&7 8 8 8 8 #a&&MMM s
BA BBrb lvp_defaultsc z da | s"t t d d at S |r!t
d at S t t t dt | }|r | d d anPt t d r t
t ant t d d at S # t $ r@ t r't! dddg t# j d nt' d
Y nw xY wt S ) zLoad default limits
:param int lvp_id: lvp id
:param bool lvp_defaults: load reseller's default limits instead of global
:return: dict with default limits
truerJ r r# cloneNoder- WARNINGz default section error in ve.cfgry z(warning: default section error in ve.cfg)ubcrK rY r5 LVE_DEFAULTr> r8 LVP_DEFAULTrQ r! rA r6 hasattrr^ r7 r| r} r r r~ )rb r[ defaults_root_nodes rE _load_default_limitsre s8 C> ' jAA!DJ --j99J -l > > > )-N!O P P P HQKKKK < = = = > s #C) "C) B C) )AD32D3c | t d t t t t t
t fD S )Nc 3 " K | ]
}|d k V dS )r NrC )rf xs rE rr z._all_config_elements_loaded.. s& jj1qBwjjjjjjrD )allve_lveve_lvp
ve_package ve_binaryve_enter_by_nameve_cfg_versionrC rD rE _all_config_elements_loadedrp s. jjYHXZh ijjj j jjrD c t d at d at t at j j t t d } t | dk r | d a n9t
d a t t t d at d }t | dk r t! |d j j ndadS ) z$Load all config elements from ve.cfgrM packagez
enter-by-namer binaryr ry N)rY r6 rj rl r! rk rM mapr_ rY r rn r> r8 r: rm r@
firstChild nodeValuero )enter_by_name_elemscfg_version_elemss rE _load_config_elementsry s
.
.u
5
5F 229==J
.
./?
@
@FG""<000&;;OLL
!##.q1!//@@ !1222 55h??I %99)DDGJK\G]G]`aGaGaS*1-8BCCCghNNNrD default_limitsc 0 i a t t t t t | } |d t d d d }t |t d t d< n# t t t f$ r t | d t d t d< t d }| dt | d t | n# t $ r Y nw xY wY nw xY w t! t d d d t d
< n# t t t f$ r | d
t d
< t d }| d t | d
t | n# t $ r Y nw xY wY nw xY w |d t" d k r
|d
n |d
d
t$ i |d |d |d t' dS )z~Create ve_defaults dict with default values for all limits
:param dict default_limits: default limits for lve or lvp
)r< r= r> r@ r )r? r r r4 r other
maxentryprocsr r r )r? r@ r r r N)r= r rB r5 r> r6 r% r
r r7 r r8 r9 rA r: r; r@ r MEM_DEFAULT_CL5_check_defaults_for_nones)rz
check_def_valr r r s rE _load_ve_defaultsr s K M Mf
//66q9FFwOO 5e;vCV W W W E
I . 5nU6KS^_eSf g g g E""5)) #nU&;"<"<=== " "3 ' ' ' ' D
? ? H H K X XYh i i j j D
I . *4 0 D
!
!'
*
*
^D-A)B)BCCC " "2 & & & & D
MdQ
%
%% )ABBBBMf Mg Mf so AB BED0/E0
D=:E<D==EEAF A*H);HH)
H# H)"H##H)(H)c t D ]^\ } }|d| d}t rt dd|g n"t j | d t j d _dS )z*Check that all default values are not NoneNzERROR: Incorrect z default valuer- rx
ry )r= itemsr| r} r stderrr r )keyvalueerr_msgs rE r r ( s "''))
U 9c999 - '7!3 4 4 4 4 J ^^^ , , , rD Tc t t | | }|st st t | dS )z
:param bool lvp_defaults: load reseller's default limits instead of global
:param int lvp_id: lvp id to load customise defaults
N)rZ re rp ry r )rb r[ load_config_elementsrz s rE get_XML_cfgr 8 sW )&,??N #>#@#@ n%%%%%rD c t t || d }||| < |S # t t t f$ r t || cY S w xY w)Nr4 rI rN )r@ rT r r7 r )r? elr=
setup_datar s rE check_valuer H sm %&rsAAABB
3
I . % % %;s#$$$$$%s %( ,AAc t j }| | | }t || dS )a5
This function is a pure workaround for our ugly globals-based API which
should be fixed partially with LU-496, because there is no clean way
to retrieve reseller's data from ve.cfg without touching globals
:param reseller: reseller name
:return: Nothing. It just updates some globals
r N)r[ r# rY get_idr )resellerxml_config_load_elementsr_ reseller_ids rE _load_resellers_xml_datar Q sN ~ H //(++K 2JKKKKKKrD c
t j t a Kt }|v r | v r fd}nt j r| t
j | }d|j d}t |d 5 }|
}ddd n # 1 swxY w Y n# t $ r d}Y nw xY wd|vr#t j t j
d | d
fd }t D ]n} || r]t d | t t }
t! t# t% | d
d |
} | t d
< n # t& t( t* f$ r Y nw xY wt d| t t t, dk r t d| t t n
dt d< t! t% | dd } | t d< n # t& t( t* f$ r Y nw xY wt d| t t t d| t t t d| t t ndS dS )a
Put limit values that will be applied later in a global variable `setup_ve`.
:param plan_id: package
:param reseller:
If reseller is None we only inherit from admin packages.
In that case we ignore all tags in ve.cfg with a "reseller" attribute.
Nc h | d k o| d k S Nr# r r% )r plan_idr s rE is_needed_planz*prepare_setup_data..is_needed_plans s1 t,,7cBOOJ.is_needed_plan s/ t,,7[PZ@[@[<[[rD r r r4 r r r r] r r r| r} r r r r )copyr= r get_reseller_packages_maprz is_dar& getpwuidpw_namer readr; r r rl r r@ r
rT r r7 r r` )
r r r res_pkg_dictr user_pwdfilenamer textr r r r s
`` rE prepare_setup_datar ` s. ;''J022 H $<$<LYaLbAbAb
d
d
d
d
d
d
d ""
v'9 "|F 3 3H `HDT ` ` `H h999 (Q vvxx( ( ( ( ( ( ( ( ( ( ( ( ( ( ( DDD
$4//M (tF t t t
\
\
\
\
\ A AB ~b!!
A#FB ZHH 67I"RW^e7f7f7fns t t tuuC(+Ju%%"J : DD"k:>>>6MM r;
CCCC()Ju% /o V V VWWB')Jt$$"J : DGRjAAAFB Z@@@FB Z@@@q H A AsZ 0B7
B+ B7 +B//B7 2B/3B7 7 CC(8E!!E;:E;
)G77HHc 6 t j t d| gt j t j 5 }| |j dk cd d d S # 1 swxY w Y d S # t $ r t ddt d| d Y d S w xY w)Nz-l)stdoutr r zfailed to run "z -l ")
subprocessPopenUMOUNTPIPE communicate
returncoder] r )pathrO s rE
umount_dirr s
I
T4 ? ?
( ?a'
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( I I I b"GF"G"G"G"G"GHHHHHHIs4 3A. A! A. !A%%A. (A%)A. .&BBc R t j t sdS g } t t dd 5 }|D ]?}| }|r'| t j | @ ddd n # 1 swxY w Y n(# t $ r t ddt Y nw xY w| sdS t j t j t ddd 5 }d |
D }ddd n # 1 swxY w Y n'# t t f$ r t dd Y nw xY wd
}t | D ]=}d }|D ]1} | D ],}
|
| } | rt# | p|} n-2|s dS >dS ) zy
Unmount all paths from /proc/mounts that match regular expressions from /etc/container/exclude_mounts.conf file
Nr r r r zfailed to read z /proc/mountsc B g | ] }| d S )ry )r )rf ms rE rh z"prepare_mounts.. s$ :::qaggiil:::rD z failed to parse /proc/mounts
F)r r isfileEXCLUDE_MOUNTS_CONFr r appendr r r r unshare CLONE_NEWNS readlinesr7 r searchr ) reg_exp_listconfr r r mountsATTEMPTSrH errormountreg_expr s rE prepare_mountsr s 7>>- . . LK
%sW
=
=
= =
=
='')) = ''
7(;(;<<<
= = = = = = = = = = = = = = = =
K K K b"I4G"I"IJJJJJK OG'(((B
.#
8
8
8 ;A::AKKMM:::F ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; B B B b"@AAAAABH
8__ E'
NN5)) &u - - 6EE EE sl B AB B BB BB "CC(D1 : D% D1 %D))D1 ,D)-D1 1!EEc d} t j | dd n # t $ r t d| Y nw xY wt t
d dS ) zI
Start LVE engine and initialize default mount namespace for LVE
z,/bin/mount --make-rprivate / >/dev/null 2>&1Tz /bin/bash)shell
executablezError: failed to executez Can`t init lve default settingsr N)r callr] r~ r r lve_start) MOUNT_CMDs rE r r s ?I5 +FFFFF 5 5 5
()444445 OO =O>>>>>s 99c H t | d| d| dS )zs
Create LVE container for given ID
:type lve_id: int
:type ignore_error: bool
:return: Nothing
z!lvectl: Can`t create lve with id ; error code {code}r ignore_errorN)r
lve_create)r r s rE r r s>
V ^ ^ ^ ^". 0 0 0 0 0rD c H t | d| d| dS )zs
Create LVP container for given ID
:type lvp_id: int
:type ignore_error: bool
:return: Nothing
z!lvectl: Can`t create lvp with id r r N)r lve_lvp_create)rb r s rE
lvp_creater s>
!bV!b!b!b&2 4 4 4 4 4rD c N t d } g }t D ]}t j | s| d| 9| d| t |d| d | | |S )Nr/ ra z=destroy_lvp_all: lvp %s n(cascaded with its parent), skippingz*destroy_lvp_all: destroying LVP with id %s"lvectl: Can`t destroy lvp with id r r ) r rQ rM rO exist_lvpr2 r lve_lvp_destroyr )loggerdestroyed_listrb s rE destroy_lvp_allr s
";
/
/FN ** & &x!!!00 LLXZ` a a a A6JJJ
f&h6&h&h&h j j j f%%%% rD c t d }| dk rt d S | d| t | d| d d S )Nr/ ri z&lvp_destroy: destroying LVP with id %sr r r )r r r2 r r )rb r s rE lvp_destroyr sz
";
/
/F
LL96BBB &"dv"d"d"d f f f f frD c t d }d| d}d| d}d}| dk rt rt t }t t
t j dk rVt j D ]6}| d | t
||
d }7nd }nt j | s=t j rTt j
| 5| d | t
| |
d }n!t j | sd }|r!t rt t d
g d S d S t rt t" d|g d S t% d| d S )Nr/ zCan't remove lve z from kernel - error code -3zCan`t destroy lve with id r Fri r z*lve_destroy all: destroying LVE with id %sr Tz&lve_destroy: destroying LVE with id %sOKWARNz warning: )r rM rN boolr r listrO lve_id_listr2 r check_inside_listresellers_supporteddetect_inside_lvpr| r}
SINGLE_FORMATr r~ )r r cant_remove_msgcant_destroy_msg destroyedid_s rE r r & s
";
/
/FO6OOOOQFQQQI
' ' ) ) 0 _ . .//I tCH((**++ , ,q 0 0x++--
!
! I3OOO-=>>>
!
II 8 % %f - - --// 47H4N4Nv4V4V4b LLA6 J J J OOF, $
lQ;;)) 6f^d6f6f * h h h h '' 6nQW6n6n6n ( p p p p1%%l3I61J 6I;;J JJc d}d}t }t d t }|a t |t rL || d }|sd}n# t $ r d}Y nw xY w || d }|sd}n# t $ r d}Y nw xY w||fS )z
Get pair of package, reseller for lve_id
:param lve_id: lve_id, UID with package, reseller
:return: tuple of (package, reseller); Both can be None
N
list-usersr rr )packages_usersGetControlPanelUsersrE dictKeyError)r rr r old_packages_users temp_packages rE "get_package_and_reseller_by_lve_idr p s GH' &&& "L'N,%% #F+J7H
HHH "6*95G
GGG H s# A
A A A3 3 BBz+/var/run/cloudlinux/effective-normal-limitsz;/opt/cloudlinux/flags/enabled-flags.d/burstable-limits.flagc t t j t sdS t j t
}t j | s2t j | }t |ddd| n(# t $ r}t d| d| d}~ww xY wt t
d }|5 | ri }n t j t
rDt t
dd 5 }t j | }ddd n # 1 swxY w Y ni }nZ# t j $ r }t d
t
d| d}~wt $ r }t d t
d| d}~ww xY w| t" t% t j | t
d n1# t $ r$}t d t
d| Y d}~nd}~ww xY wddd dS # 1 swxY w Y dS )
ai
Save calculated effective normal limits for an LVE to a cache file.
The cache file is stored in /var/run (tmpfs) for faster operations.
It disappears on reboot, but lvectl apply all runs in the lvectl systemd service anyway,
so the file will always reappear if the service functions normally.
If additional speed is desired, consider replacing the standard JSON lib
with a faster one like rapidjson or orjson.
:param reset: If True, recreate the cache file from scratch with data available in the dict,
instead of updating it, defaults to False
:type reset: bool, optional
Ni r z#Error: failed to create the folder : z.lockr utf8r z=Error: failed to parse the effective normal limit cache file z>4 5 5 (<==
w}}]++ G '//-88K mUAq+ F F F
HMHHQHHIII
(+?(F(F(FGG n n !
7>>"677 * 2C&III ?X+/9X+>+>(? ? ? ? ? ? ? ? ? ? ? ? ? ? ? (*$'
qVjqqnoqqrrr
pUippmnppqqq
7888 n #DJ/?$@$@BVX] ^ ^ ^ ^ n n n lQellijll m m m m m m m m n)n n n n n n n n n n n n n n n n n ns A5B
C(B>>C H-&;E!E6 EE E E
EH-F( E;;
F(F##F(( H-(G/.H-/
H 9HH-H H--H14H1c > t t t | < dS )a
Cache the calculated effective normal limits for an LVE to a dictionary.
setup_data is a global dict that contains the LVE configuration last applied.
Holds only one entry - during operations like lvectl apply all, we enter this
function repeatedly with setup_data containing info for one processed LVE each time.
These limits can be used by the Burstable Limits components
to set/reset burst or normal limits without having to go
through effective limit calculation or invoking lvectl as a middleman.
Comparing the cached limits to current active limits (in kernel)
also shows whether or not the LVE has burst limits active at the moment.
This function gets called in lve_apply, which means it also runs within:
* lvectl apply all
* lvectl apply-many
* lvectl set
* and others, that also call lve_apply
:param lve_id: LVE ID for which the limits are being saved.
:type lve_id: int
N)r r rA r s rE cache_effective_limitsr s 0 ,6CKK(((rD r c | dk s t j sdS | t t j vrdS t
t j | S )u0 Return True if the user has at least one isolated domain registered.
CLOS-4370: the per-domain branch in lve_apply only does meaningful work
when the user has at least one docroot in the lvd-map. A bare marker
file from ``lvectl allow-domain-limits`` (with no ``enable-domain-limits``
follow-up) or a 0-row hashtable left behind by ``lvd_map_remove`` after
the last ``disable-domain-limits`` both leave the per-uid file in place,
so existence alone is not enough — we must also check that the
hashtable actually has entries.
r F) rM r3 domains_supportedsetrT rU r ws_id_registryget_all_entriesr s rE _is_domain_isolated_userr s^ {{#&2244{u
S?AABBBBu .v66 7 77rD c t j st S t j S )u8 Collect all known domain LVE IDs from the on-disk registries.
Domain LVEs (created by lvdctl set) appear in /proc/lve/list at root
level, but lve_apply() must not process them as regular users — their
limits are managed by apply_domain_lve_limits() inside the
domain-isolated-user branch.
)rM r3 r r r get_all_domain_idsrC rD rE _get_all_domain_lve_idsr!
s2 6 # # % % uu , . ..rD c e Zd ZdZdS )DomainLveIdErrorz>Raised when lvectl set/delete/destroy targets a domain LVE ID.N)r= r> r? __doc__rC rD rE r# r# s HHHHrD r# c | dk s t j sdS t }|sdS t j }| |k s| |v rt
d| d| d dS )a Refuse to operate on domain LVE IDs from lvectl set/delete/destroy.
Domain LVEs are managed exclusively by lvdctl; lvectl operations
on them corrupt the domain configuration or create phantom entries
in ve.cfg.
The check only activates when at least one domain LVE is registered,
so existing customers without domain isolation see no change in
behaviour.
r NzLVE ID z is in the domain LVE range (>= zV) or is a registered domain LVE. Domain limits must be managed via lvdctl, not lvectl.)rM r3 r r! r min_idr# )r
domain_ids
min_domain_ids rE _reject_if_domain_lve_idr) s {{#&2244{(**J ")++M
&J"6"6
Ef
E
Em
E
E
E
#7"6rD c R t } dk rt d t |c}a t dk rt | d} ||} n1|rt nt
}
t
t fd|
d } |dk rR | d }n# t t f$ r d}Y nw xY w | d }n# t t f$ r d}Y nw xY w| t || t d
| t t } t t | d d
| t d < n # t t" t$ f$ r Y nw xY wt d t d t d < t d| t t t& dk r t d| t t n
dt d< t) t | dd
t d< n # t t" t$ f$ r Y nw xY wt d| t t t d| t t t d| t t n't || t& dk r
dt d< |st+ dk rtt- rd| t. j }t4 d t. } | k rt. j s| rVt. j | s6t4 d| t> | t4 d | t> ! | t. j r t. " | | |dk o tG v }
|
stI tI t. % }t. & || |
s%t> ' tP d t. ) | dS # tT tV tX f$ rN}t[ j- tZ j. d d!| t4 / d" |d#$ Y d}~dS d}~ww xY w dk rt. 0 rtc r| t. j }t. } |2 d | k r| dk s t. j | r`t4 d% |2 d | t. j3 4 | d& d'| d( | | < tI | dS dS ))u
Aplly limits to LVE lve_id
:param lve_id: lve id
:type lve_id: int
:param plan_id: package for user with lve_id. deprecated
:type plan_id: string
:param result: if True = don't apply limits. only create setup_data with actual limits
:type result: boolean
:param reseller: if True = plan_id is resellers plan. deprecated
:type reseller: boolean
:param out_node: node with limits for lve_id
:type out_node: xml_node
:param lvp_id: reseller container id; host container if 0
:param kernel_map: lve_id->lvp_id dict from /proc/lve/map, shared across a
batch. CLOS-6868: reading it here instead made `apply all` quadratic —
the file grows with domain count and was re-parsed twice per isolated
account (2,002 reads and 15.3 s of a 27.7 s profiled run at 5,000
domains). Passed in, it is read once per command. Mutations this
function performs are written back into the dict, so a later account
sees the true state; `_map_domain_lves` already updates it in place for
the same reason. Omitted, it is read on first use inside the branch that
needs it, preserving the behaviour of a standalone `lvectl apply `.
r useridr ra Nc , t | k S )Nr) r, )rA r s rE zlve_apply..` s 34 H H HF R rD rr r r r r r4 r r r r] r r| r} r r r r )r r r zDlve_apply: uid=%s is domain-isolated, applying the per-domain branchzFlve_apply: creating the missing reseller LVP lvp%s for isolated uid=%sz>lve_apply: creating isolation LVP lvp%s under lvp%s for uid=%s
domain_mapr r z1lve_apply: skipping per-domain isolation for uid=r ztlve_apply: per-domain isolation SKIPPED for uid=%s: %r -- the account keeps its user limits but its domains get noneT)exc_infozjlve_apply: uid=%s has an isolation marker but no enabled domain; un-nesting lve%s from lvp%s back to lvp%sCan`t move lve_id= to lvp_id=r )5r r r> r rk rj nextfilter NameErrorr r r r= r r
rT r r7 r r` r@ r r rM rO rt logr2 lve2lvpr infor r lve_lvp_create2
nest_user_lverV r _build_domain_map_map_domain_lvesr r apply_domain_lve_limitsr] r+ r% r LOG_WARNINGwarningrN rc r r3 lve_lvp_move)r r r r out_noderb
kernel_mapr new_packages_usersr node_listr
parent_lvpis_reseller_poolr2 excs ` rE lve_applyrK 6 s 8 (
{{ Xv...-;=O*N
||6""""
B
$0FF&
RRRRT] ^ ^
{{ (0;GG8$ GGG )&1*=HH8$ HHH
~7X6666 FB Z@@ 89KBTY`g9h9h9hpu v v vJu J 2 D e $ +E 2Ju D"k:666 &== r;
; ; ; ; !Ju "#5bgO#\#\#\ ] ]Jt J 2 D GRj999FB Z888FB Z8888 7XfEEEE '>> !Ju s- v&&& Q;;3F;;;! !X\\^^
II\
J V,,JV##CH,>,>f,>,M,M# 5ch&8&8
&8&K&K 5HH 34>H H H((444 &'-z6C C C%%fj999
x!!!00
B!!&*jAAA< &{ Lv9J9L9L/L #
1&0000 f
8 ! 2 26 : :
$$VZJ$OOO' d))&,2bZ`2b2b * d d d++Fz+JJJJJXz2
8
8
8
&WWWRUWW U "C$ 8 8 8 8 8 8 8 8 8
8. {{s ; ; = ={BRSYBZBZ{ %!$ J ![[ 0 0
>>&!,,
:: !OOsx'9'9'9'L'LOHH Q #VZ^^FA-F-F
T T T F''"F iV i i
i i i ( *4Jv& fV , , , , , ,gs- s-sb B B('B(,B; ;CC)D/ /E E ='G% %G?>G?'A:R# #T:ATTc h t | t | dz
g }t | dS )zt
Print data with the last column 30 symbols wide.
Useful for printing data that contains package names.
ry wide_indicesN_format_fieldsr r~ r formatted_strings rE _pprintrS I s9
&fCKK!O;LMMM
rD c t | t | dz
t | dz
g }t | dS )z
Print data with the two last columns 30 symbols wide.
Useful for printing full data of every user with package name
and reseller name.
r ry rM NrO rQ s rE _pprint_frU R sO &&kkAos6{{Q7
rD c H t | dg }t | dS )zb
Print data with the first column 30 symbols wide.
Useful for printing packages data.
r rM N)rP r~ rQ s rE _pprint_prW _ s.
&fA3???
rD c j t | dt | dz
g }t | dS )z
Print data with the first and last columns 30 symbols wide.
Useful for printing data with user names and package names.
r ry rM NrO rQ s rE _pprint_rrY h s;
&fAs6{{Q;OPPP
rD r rN widthc g }t | D ]J\ }}t | }||v r| |d| 3| |d Kd | S )aK
Helper function to format fields
based on specified indices for wide columns.
Args:
fields: The fields to format.
wide_indices: List of indices in the fields that should be wide.
width: The width of the wide columns.
Returns:
A formatted string with specified fields widened.
>z>8r ) enumeraterA r join)r rN r[ formatted_fieldsr field field_strs rE rP rP q s !&)) 7 7 uJJ L # #y$;5$;$;$; < < < < # #y$5$5 6 6 6 6
77# $ $$rD c t | } t | t o| d }| dd } | rt | } | dz } nd} |rd| n| } | S )z
Convert pmem or vmem limits to bytes value
:param value: pmem or vmem limits in kbytes value
:return: bytes value of limit
r r r )rA rE
startswithr r@ )r was_changeds rE _pmem_vmem_to_bytes_valuerg s
JJE UC((BU-=-=c-B-BK MM#r " "E E
& 1KKKKEE LrD c d}d}t | t r!| d r | dd } d} t | }n# t $ r Y dS w xY w|rd}|dz dz } | d k r| | d
}n
| |dz d }|S ) z
Convert amount of RAM to M format
:param string value: amount of memory in KB
:rtype: string
:return: amount of memory in MB like "1234M"
r Fr ry NTr r r MK)rE rA re r@ r )r r rf vs rE _mb_memrl s FK% %"2"23"7"7 abb JJ rr
ETME qyy$E$$$$AE$$$ Ms A
AA)r r )r r )vmemr )r r )r r )r r )r r )r r r r r r r c i }g }| D ]}|t vr t | \ }}| |d }|dk r9t | } |dv r| dz } | ||< |Ht | | t | k r| | ddi}
dt j |fi |
dt j |fi |
S ) a> Return the ',"LIMITS":{...},"INDIVIDUAL":[...]' tail of a JSON row.
The display fields keep their historical form -- SPEED in whole percent,
memory as "1024M", and a '*' on values that differ from the package --
because existing parsers read them as such. That form loses a fractional
CPU limit (0.29% is shown as 0) and needs de-starring to be read, so with
--exact-limits each row also carries plain integers (CLOS-7520): cpu in
hundredths of a percent, pmem/vmem in bytes (with or without --bytes), the
rest as the kernel counts them. INDIVIDUAL names the LIMITS keys the '*'
marks. Opt-in, because readers also match the row text itself: appending
keys to every row broke 28-reset-to-unlim-limits.sh, which greps it whole.
:param list fields: the row's output fields; LIMITS mirrors their limits
:param dict limits: effective limits in kernel format (cpu in hundredths
of a percent, memory in pages)
:param dict package_limits: the package's limits in the same format, or
None for a row that is a package itself
r )r rm rd N
separators),r z
,"LIMITS":z,"INDIVIDUAL":)_MACHINE_LIMIT_FIELDSr r@ rA r r r0 ) r limitspackage_limitsvalues
individualra r sourcerawr compacts rE _machine_limits_jsonry s
& FJ # # - - - +E2 Vjj$$ "99 C " " " TMEs %#n.@.@.H.H*I*ISQTXX*U*U c " " "Z(G h
655W55 h hTZPZEfEf^eEfEf h hhrD 0r@ c
t t r |r t t nd} d dz d< fd} |d dk rt |d nd}d }|t
|d t
| t
|d t
| |d t
| |d t
|d t
|d
t
|d t
|d |d
g } t }
||
|z
}
t r+d
fd|
D } d| | dg} n | |
|
fd|
D | S )z
Generate header and default package data either as print to stdout or as json string
*machine_limits* adds LIMITS/INDIVIDUAL to the JSON row, see _machine_limits_json.
r r r c 0 | d S )Nr r )r rJ s rE get_dataz _formatter..get_data s ||C$$$rD c L t rt | nt | S ro r rg rl r s rE convert_mem_limitsz&_formatter..convert_mem_limits s! 3=Q(///75>>QrD r r r r r r r ) r r r NCPUr r r r r r PACKAGENrp c 3 R K | ]!}d | d |d d V "dS )r ":"r Nr} rf r
fields_maps rE rr z _formatter.. sE KKq:A::*..B"7"7:::KKKKKKrD {}c < g | ]} |d S r r} r s rE rh z _formatter.. s' 888A*..B''888rD )r= r r| ry r r rA r_ )printer
default_iddefault_package more_fieldsmachine_limits machine_tailr~ _cpur resr r rJ r s @@rE
_formatterr s !!HCGbNb'
h???`bL uo,HUO% % % % % 1920E0E HHUOO , , ,2DR R R 3xx#7#74yy#hhv&6&6"7"7&&xx'7'788993GYGYZbZbchZiZiGjGjCkCk((4..!!C0A0A,B,B#hhW[nnJ]J]HHV$$%%/ J
C
\\F + :xxKKKKFKKKKK*D*,***+888888899 JrD c fd}|S )a
Generate inner function with closured fields names and printer function
:param list fields: List of strings that represent names of fields in final output
:param callable printer: Function to format and print data for every entry
:param bool machine_limits: add LIMITS/INDIVIDUAL to each JSON row,
see _machine_limits_json
:rtype: callable
:return: function to format data for every user
c dt | d }t | d }|dk rd}t dk rt |d n5|t |d nt d t || t j t t | ||d
t r
rt t nd}fd
}d }t | d< t |d d< t |d d< t | |d d< t | |d d< t |d d< t |d d< t |d d< t |d d< t rt | d< n|d< |t rdndd< n|d< dd v r?dt t d
d dz z d< nt d dz d< d d < t t d d< g }t r+d fd D }d | | d g}n fd! D |S )"z
:param string user: Find and format data for this User ID
:rtype: list
:return: List of given user's statistics data line or empty list
r rr r Nry r0 F)r r T)r r r )rs c t | t t | k r dt t | z nt | S )Nr )rA r )r r s rE
check_changedz7_user_formatter..wrapper..check_changedC sP 14T#Y 3zRUCWCW1W1W3Z_----]`aefiaj]k]k krD c L t rt | nt | S ro r r s rE r z<_user_formatter..wrapper..convert_mem_limitsF ! 7AU,U333wu~~ UrD r# r r r r rm r r r r N/Ar r r rp c 3 Z K | ]%}d | d| d V &dS )r r Nlowerrf r r s rE rr z3_user_formatter..wrapper..d sC IIQ 8 8 8d17799o 8 8 8IIIIIIrD r r c D g | ] }| S rC r r s rE rh z4_user_formatter..wrapper..g s% 666!d17799o666rD )r ro r r r r r rK r| ry rA _normalize_strr@ r r r_ ) r$ rr r r r r r r r r r r s @rE wrapperz _user_formatter..wrapper" sl &y1!$'
3 r>>H Q
w 6 6 6 6 6# )ERRRRR 7777 w : : : :y$$$(4HHHH ;$2;,VZPTUUUU8: l l l l l V V V YYT
--..//U ==0011V --mmF.C.CDDEEV --mmE.B.BCCDDV t,,--T
t,,--T
MM' 2 233W
==0011V & ,W 5 5DOO %DO (, 4uu"D 'D $u+ #c$u+*<*. s% III#,t,,3IIIrD c $ i | ] \ }}|v ||
S rC rC )rf r r uids_da_adminss rE
z(_filtering_da_admins.. s) ]]]*#u3nC\C\3C\C\C\rD )rz getCPNamer
r )ve_dictr s @rE _filtering_da_adminsr sV -//IIIII]]]]
]]] NrD c
t t t }| rHt j j
fdt D }n# t $ r i }Y nw xY w| du rt }t }n't }t j
| }i }|D ]}|d d|t | < |D ]}||vrd d d||< t | dk rjt! | }|D ]X}||vrd }n|| d }|| }t# | } t | dk r|| d d||< P|d d||< Y|S )Nc $ i | ] \ }}|v ||
S rC rC )rf krk cfg_lvp_id_lists rE r z&prepare_apply_data.. s) _ _ _1!J^J^q!J^J^J^rD Tra )rA r r- r rA )r r r rM rt r_ rZ r r; rk rQ rj rO r r, r r guess_reseller_by_package) rb packages_users_rG rZ r rA r rq pkg resellersr s @rE prepare_apply_datar s ~.. ` !g . 6 6 8 8O _ _ _ _0D0D0F0F _ _ _O ~~ ** (&&f&55 G _ _FJY]<^<^#488899 ? ? '+ > >GFO O !! 'w//" B BC'!! s|F+!#&C1#66I9~~!!)-IaL I I )-D A A Ns A,A0 0 A?>A?c t \ } }t t j }| D ]}| |d dk r| | 2||v r/t | | | t j
d 5 t || | d | | d d d d n # 1 swxY w Y t d t rt d }t t j }| D ]j}t | r| | (||v r/t | | | t% || t j | }t j }t* j | D ]} t1 j | j }||v r/t | | | | |d |k r)t j ||d| d | d
t || l|D ],}t | rt | -|D ] }t | d S )
Nr Tr rA r )rD r r r4 r5 r r )r r ) _get_lve_ve_dict_and_lvp_mapr rM rO r r r discardr r3 context_ignore_errorrK rN r rP rc r r &_create_if_necessary_and_configure_lvprt get_reseller_namer cpapir r& r' r( rC )
lve_ve_dict lve_lvp_mapremaning_alive_lvesr lvp_ve_dictremaining_alive_lvpsrb rt kernel_mappingr$ s
rE lve_destroy_and_recreate_allr s ; = = K ch 2 2 4 455 ""$$ ??61 % % * * ' ' / / / ( ( ( OOF # # # ' ' / / /
V
(
(d
(
;
; $V,V4$V,Z8
Q
##%% ,*(.. "38#7#7#9#9 : : "&&(( A AF ''
$,,V444---%%f---$,,V444 2; G G G G 5 5f = =M X\\^^N 55mDD
A
A d++2 000OOF+++'//777!%%fa00F::F'' eV e e e e e (
-@@@@@
A + * *F ''
! !& ) ) ) ) & s +D
D D rE c T fd| D D ]}| |= dS )a Drop every LVE mapped to *lvp_id* from a /proc/lve/map snapshot.
Call after destroying lvp: the kernel unlinks the LVP's whole child
list and deletes each child's map row, so the snapshot's rows for them no
longer describe kernel state. Dropping them (rather than re-reading the
file) keeps the dict identity that the batch shares, and costs one dict
scan on what is a rare repair path.
c & g | ]
\ }}|k |S rC rC )rf r mapped_torb s rE rh z(_forget_lvp_children..Q s) ]]] /fiV\I\I\6I\I\I\rD N)r )rE rb r s ` rE _forget_lvp_childrenr H sJ ^]]]:3C3C3E3E]]] v rD c t \ } }t }t j }t j d 5 | D ]L}||v r| |d dk r+t || | d | | d | M d d d n # 1 swxY w Y t d| t
sd S t d } | D ](}t | rt | || t j | }t j | D ]}t% j | j } t+ | r||k rt j | s t. || net j || sEt. | t. || t7 || | |d |k r.t j ||d
| d | d
|||< nH| |d |k r.t j ||d
| d | d
|||< t ||| x# t: t< t> f$ r3} tA j t@ j! d| d| d| Y d } ~ d } ~ ww xY w*d S )NTr r rA r )rD r rE )r rE )rE ra r4 r5 r r )r r rE z#lve_apply_all: failed to apply uid=z under lvp=r )"r r! rM rO rt r3 r r r rK rN r rc r r r r r r& r' r( r r r r< r r r rC r] r+ r% r LOG_ERR)
r r domain_lve_idsrE r lvp_id_rt r$ lve_id_rJ s
rE
lve_apply_allr V s 799G[,..N
J $ $$ $ 7 7 W W llnn W WF '' vq))Q..&76?6+B#*6?:#>:W W W W W W W W W W W W W W W W W W W W Q:.... ' ' ) ) &&G <<>> Q Q G $ $ .wJWWWW 11'::
N11-@@ C C Dl4((/G7
,G44 $6G9K9K 8--W-== B --gw???? X 7 7 I I B --g666 --gw??? -ZAAA "~~gq11W<<++ # #$k$k$kW$k$k$k ,
/6
7+ "~~gq11W<<++ # #$k$k$kW$k$k$k ,
/6
7+=ZXXXXXXz2
N2' 2 2!(2 2,/2 2
}C Q Qs, A"C
CC'ELM (MM c t t d t } t r&t t ni }| |fS )Nr )r r r rM rN r lve_id_lvp_id_pairs)r r s rE r r s_ MMM &&&$&&K585Q5Q5S5S[$s..00111Y[K ##rD c t |dd t || | d | | d || t |d t d|| d S )
NTF)rb r[ r rA r )r rD r rb rE )rb r r )r rb rE )r rK )r rb rE s rE r r s vDuMMMM
V vv. vz2# % % % % vE::::
Qv*======rD c ` t d t | t D ]}t | | k rt j | }t j | }t | D ]U} t j | j }n# t $ r Y )w xY wt | r||vr| | V|dd D ]}t d| t j | 3# t $ rQ t j | rt | | | Y w xY wt/ | |j | t5 t6 t d |D ]}t9 | t | dS | dk rdS | t; t= j v rdS t j | sdS t j | }|dd D ]}t d| t j | 3# t $ rQ t j | rt | | | Y w xY wt/ | t d |D ]}t9 | dS )u Remove reseller from ve.cfg and from procfs.
CLOS-4419: idempotent for orphan kernel LVPs. When no
block is present, the function falls through
to a recovery branch that distinguishes three states:
* domain-isolated user — kernel LVP is legitimately maintained by
_sync_map for the per-domain isolation feature; do not destroy.
* already clean — neither block nor kernel LVP exist; return True
so disable_reseller_limits reports OK instead of WARNING.
* true orphan — block missing but kernel LVP exists with no
isolation marker; destroy the LVP and re-parent any mapped
LVEs to the host LVP.
Tra r- Nr F)!r r rk r, rM rO map_lve_id_listrt r r r& r' r( r rc r r rC r r3
lve_existsr remover
parentNode removeChildr r> rK r rT rU r )rb r usersrt usernamerq r s rE _remove_resellerr so Dv 4 4 b 1 1 1V ; ;H,,V44E" G 5 5f = =M *= 9 9
&
& ,x007CC H #C(( &S-=-=LL%%% (
)
)""1f---)L(((( ) ) )v((00 0///LL((((()
M % %b ) ) ) V q ! ! ! !
"
"&!!!! v & & & &44g >>> u 8 V , , t
H $ $V , ,E( ! !
1f%%% ! L ! ! !v ((
(''' LL ! q & 4s8 B))
B65B6
D AE:9E:J AK87K8c 8 | t v r%t j d| d dS t j | t | }t d| | t j
| s8t d| | t
| | ns|rqt j
| | sQt d| | t | t
| | t j
}t | || g }t j | D ]L}| |d | k r0t | | | | M|r t d || dS dS )
a Enable per-domain LVE isolation for the given user.
Creates an empty id_registry file (marking the user as domain-isolated),
creates lvp (nested under the user's reseller LVP if any), and
moves lve under it. Analogous to set-reseller for reseller limits.
Any existing domain IDs in the registry are pre-mapped to lvp via
lve_lvp_map so that subsequent lve_setup calls will place domain LVEs
under the correct LVP automatically.
CLOS-5716: a registered reseller is never a per-user isolation LVP, so it
must not be marked here. Both marker-planting vectors reach this function
-- `lvectl allow-domain-limits ` directly, and
`cagefsctl --isolates-allow-all` which shells out to allow-domain-limits
for every panel user (resellers included). A bare lvd_ids marker on a
reseller UID makes is_isolation_lvp() true, and lve_apply_all() then skips
the reseller LVP on boot, zeroing it and degrading every sub-user under it.
The read-side filter in _isolation_lvp_ids() already excludes such markers
from the isolation set; skipping here stops them being planted at all. Skip
silently (the caller still exits 0) rather than raising: cagefs's per-user
path (allow_website_isolation_for_user) does not guard the lvectl subprocess
and would abort on a non-zero exit. Degrades to marking normally if ve.cfg
can't be read (_reseller_lvp_ids() returns an empty set), same as the
read-side filter.
z3lvectl: skipping domain isolation for reseller uid=z4 (a reseller LVP is never a per-user isolation LVP)
Nz-enable_domain_isolation: uid=%s parent_lvp=%sra zAenable_domain_isolation: creating isolation LVP lvp%s under lvp%szQenable_domain_isolation: lvp%s exists but is not under lvp%s; recreating it therer zMenable_domain_isolation: pre-registered existing domain LVE(s) %s under lvp%s)rV r r r r create_empty_registryrM r: r9 r; rO r r r< r r rt r= r rt r r r )r rH r pre_registered domain_ids rE enable_domain_isolationr W s 4 "$$$$
C&
C
C
C
(000V$$JHH
back to the parent LVP (reseller or root), destroys
domain LVEs, destroys lvp, and removes the id_registry file.
Analogous to remove-reseller for reseller limits.
ra zMdisable_domain_isolation: uid=%s has no isolation LVP, removing registry onlyNz?disable_domain_isolation: uid=%s, moving children back to lvp%sz:disable_domain_isolation: moving lve%s from lvp%s to lvp%sr zEdisable_domain_isolation: uid=%s destroyed domain LVE(s) %s and lvp%s)rM rO r r9 r; r remove_all_entriesr: r r2 r rC rt r r rt r r r r )r rH child_lver r r s rE disable_domain_isolationr s 8 V , , *+1 3 3 3)&111V$$JHH
N
Z! ! ! X--f55 2 2 NVZ 1 1 1
:y1111X\\^^N&!$$..
:v...
I#3F;;BBDD ( ( 8 % %i 0 0 ( OOI & & & Y ' ' 'HH
T
Y( ( ( %f-----rD c t j | | }t t j }| | | k r>t d|| | t j
| | n t d|| t j
| | dS )av Register a single domain LVE under the user's LVP.
Assigns a domain ID for *docroot* in the per-user registry, then
pre-maps it to *owner_uid*'s LVP so that lve_setup will place the
domain LVE under the correct LVP when it is first created.
Also records the domain name in ``~/.lve/domains.json`` so we can obtain list of
enabled domains for user.
z>enable_domain_lve: mapping domain LVE %s to lvp%s (docroot %r)z8enable_domain_lve: domain LVE %s already mapped to lvp%sN)r assign_domain_idr rM rO rt r r9 r; r3 r r2 rT LvdConfigr add_domain_by_docroot) owner_uiddocrootr proc_maps rE enable_domain_lver s / 7CCIMMMx||~~H||I )++ QIw 0 0 0 9i0000 LY ( ( (
Y''==gFFFFFrD c t j | | }t d| || |t t
j | rX t
| n<# t $ r/}t j
t j d| d| Y d}~nd}~ww xY wt j | | t j | | dS )zUnregister a single domain LVE and remove its registry entry.
Destroys the kernel LVE (if it exists) and removes *docroot* from
the per-user domain ID registry. Also removes the corresponding
domain from ``~/.lve/domains.json``.
z6disable_domain_lve: uid=%s docroot=%r domain_lve_id=%sNz*disable_domain_lve: failed to destroy lve r )r
get_domain_idr9 r; r rM r3 r r r% r rA remove_domain_idrT r r remove_domain_by_docroot)r r r rJ s rE disable_domain_lver s' ,Y@@IHH
E
, , ,
6 Y ' ' 9
9 ****
9
9
9
f 0 8%. 8 825 8 89 9 9 9 9 9 9 9
9 ' 7;;;
Y''@@IIIIIs #A> >
B7%B22B7c t j | }n# t $ r Y dS w xY w|j |j dz |j dz |j |j |j |j
dS )zThe limits the kernel holds for a domain LVE, or None if it has none.
Units match `paneluserslimits --json --exact-limits` LIMITS: cpu in hundredths of a
percent, memory in bytes, io in KB/s, the rest as the kernel counts them.
Nrd )r r rm r r r r ) rM r3 lve_infor] r6 r: r r9 r; r8 r< )r r s rE _kernel_domain_limitsr s 6??9-- tt &-"T) "n s "
00c
d t j | j }i }t | pg D ]K\ }}| t
j | g | Lg }t j
| }t | d D ]|\ }}t | }t | t
j | dg t D ] }| ||||du|d }|S )a Effective kernel limits of every registered domain of *owner_uid*.
Built for root-side readers (LVE Manager's admin view, CLOS-7520) that
must not take the tenant-writable ~/.lve/domains.json as the answer: the
domains come from the root-owned registry, the names from the panel, and
the limits from the kernel.
One row per panel domain name; a docroot the panel no longer attributes
to the account keeps its row with ``domain`` None, so the registration is
still visible. ``in_kernel`` False (``limits`` None) means the domain LVE
does not exist yet: it is created on the first request or limits set, and
until then the site runs within the account's own limits.
c | d S )Nry rC )entrys rE r/ z$list_domain_limits..
s
a rD )r N)domainr r in_kernelrr )r& r r r
setdefaultr r normpathr r r sortedr r r rA ) r r namesrp r rowsentriesr rr s rE list_domain_limitsr
sD |I&&.H E$X..4" E E
g
))'22B77>>tDDDD
D ,Y77G $W]]__:P:P Q Q Q &y11599RW%5%5g%>%>GGSQQQ D KK "# #4 /
KrD c t | rt j | dS t r+t ddd| g t j d dS t d| dS )z&Disable reseller limits and call hooksr0 r- r_ z no configuration found for LVP r z(warning: no configuration found for LVP N)r r throw_eventr| r} r r r~ )rt rb s rE disable_reseller_limitsr +
s G%1=IIIIII G )-Wv-W-W!X Y Y Y HRLLLLL EVEE F F F F FrD c t | t d t d}t D ]}t | | k rkd}t | t
| |j | t t t t | |sFt r+t ddd| g t j d d S t! d| d S d S ) NTFr- r- r_ z no configuration found for VE r z'warning: no configuration found for VE )r) r r rj r, r r r r r r> rK r| r} r r r~ )r Deletedr s rE
lve_deleter 8
s V$$$DMMMG b 1 1 1V ; ;G v M % %b ) ) ) V MMM f F F )-Vf-V-V!W X X X HRLLLLL DFDD E E E E E F FrD c t j d s?t rt dddg nt d t
j d d S d S )N/proc/lve/enterr- r_ zenter by name not supportedz$warning: enter by name not supportedr )r r r r| r} r~ r r rC rD rE lve_enter_checkr N
sd
7>>+ , , : )-J!K L L L L 8 9 9 9 rD c t | | z }t ddd 5 }| | d d d d S # 1 swxY w Y d S # t $ r Y d S w xY w)Nr wr r )r r r r r; )signrs r/ r s rE enter_applyr" W
s
V\\^^#
#S7
;
;
; q
GGCLLL
s4 )A) A A) A A) #A $A) )
A76A7c N t t rTd} d}t D ]2}| d }|r| d|z dz z
} d}'| d|z dz z
} 3| dz
} t | d S t d t D ]$}t | d %d S ) Nr Tr r Fz,"r Binaries)r r| rm r% r~ )r firstr r s rE
list_binariesr& a
s MMM + , ,B??6**D
,#*s** $+++$
f
j + +B "//&)) * * * * + +rD c | t t D ]%} t d| d &d S )N+r )r rm r" r% )r s rE
load_binariesr) u
sC MMM 2 2C 0011112 2rD c t t ddd 5 } | D ]}t d| d d d n # 1 swxY w Y t d S )Nr r r r -)r r r" r) )r r s rE reload_binariesr, {
s
w 7 7 7 #1 # #D T " " " " ## # # # # # # # # # # # # # # OOOOOs AA Ac t d t t d}t D ]i}| d | k rNd}t d| |j | t t t j|sEt rt ddd| g nt d| t j d d S d S )
NTFr r+ r- r_ zno configuration found for z$warning: no configuration found for r )r r r rm r% r" r r r r> r| r} r~ r r )rs deletedr s rE
del_binaryr/
s DMMMG
??6 " "f , ,G V $ $ $ M % %b ) ) ) V MMM C )-S6-S-S!T U U U U AAA B B B rD c t d t t D ] }| d | k r d S t d| t
d }| d| t | t t
t d S )NTr r( rs ) r r rm r% r" r> r8 r9 rn r: r )rs r bin_xmls rE
set_binaryr2
s DMMM
??6 " "f , , FF -V ""8,,G ((( ))) VMMMMMrD c R |rt }n|rt }nt } fd|D d }n# t $ r Y dS w xY w|rR d D ]G}|dk rt |dd }nt ||d }|r|j | HdS t t d z
}|D ]} | dk r\t |
d dk r6| vr1|
d d d | < dt |
| dk r5| vr1|
| d d | < |rt d dS t d dS )
a
Set given lve or package to default values for given parameters
:param dict set_data: Arguments of lvectl call
:param bool package_flag: Should we delete package or lve with given id
:param callable is_needed: Function that takes xml element and set_data dict and returns
whether current xml element contains info about needed ID from set_data
c , g | ]} | |S rC rC )rf rv is_neededset_datas rE rh z#lve_set_default..
s*
8
8
8A1h!7!7
8a
8
8
8rD r N set-defaultr r| r} r4 ve_id)rl rk rj r7 rQ r r r LIMITS_LIST_NAMEr r6 r% plan_deleter )
r6 package_flagr5 rb r r tag_nto_keepr4 s
` ` rE r r
s DD
DDD
8
8
8
8
8
8
8
8
;
]+ , ,Dt||$R/BB$Rw77
, ((+++"##h}&==G Z Z D==S!8!8!A!A B BQ F FH$$"$"9"9'"B"B1"E"R"RSb"c"c
((//
0
01
4
4H$$"$"9"9%"@"@"C"P"PQX"Y"Y &HW%&&&&&8G$%%%%%s 05
AAc |dv rdS t | }|dv rdS t | }n# t $ r g }Y nw xY w||v rdS dS )a
Checks is uid owned by reseller
:param uid: uid for check
:param reseller_name: Reseller name, None treats as root
:return: True - valid reseller/user pair, False - else
Special case:
if reseller_name is None (root) - always valid
)NrootT)r@ r F)r r r; )rq rt r reseller_users_lists rE _check_reseller_user_pairrB
s &&t (,,H?""u! ,] ; ; ! ! ! ! &&&t 5s - <<c
r |dk r!| d dk rt | d |dk r0| dd }| d }t || sdS t d |rN|| d k rBt j | rt |d ntt | nc|dk rMt r4t t j | d nt | t n# t $ r Y nw xY w t | d }t | }|r|d nd}t || n# t $ r
t aY nw xY w| d dk rd}d
}d | v rt# | d|| d
| v rt% | d
} n
t d
} d}
d| v r*t' | d | } | t d k rd}
|rt( } nt* } | D ]<}
||
| r,t, D ]+}|| v r# |dk rt/ |
dd| | nt/ |
|d| | A# t0 t2 t4 f$ r |dk r|
}nt | | | k }|s| d r|dk rDt6 d }| dt= | | nCt6 | }| dt= | | |
| Y 'w xY w-| dd stA t6 d}|rN|| d k rBt j | rt |d ntt | nc|dk rMt r4t t j | d nt | tC | d | <>|s| d r|rtD nd}t6 | }
|rZ|
dt= | |
d| d |
tF nr| d r4|
dtI j% | d j& n)|
dt= | d t, D ]}|| v r|dk r|
}nt | | | k }|s| d r|dk rDt6 d }| dt= | | nCt6 | }| dt= | | |
| d}tN D ] }|j( ) |
| d} |s t6 j* |
| dd stA t6 |rt j | }t |d tC | d | tV |tV , d t | t j- . | }t j- / | D ]3}t j0 1 || tC || 4|rte j3 | ngt r4t t j | d nt | tC | d nt, D ]}|| v r|dk rHtF 4 d d dt= | | TtF 4 | d dt= | | | dd stA t6 t | tC | d | dS )Nr r8 rt FT)rb r[ ra r r0 c 6 t | |d k S )Nr- r8 r. r r6 s rE is_needed_userz lve_set..is_needed_user' s &b999Xg=NN NrD r7 )r; r5 rb r r r r r| r} r4 savezskip-update-cfgrM r# r$ z
save-username)5r) r rB r rM rO r r rN r r r; r r r r= r r r@ r
rk rj r9 rW r r7 r r> r8 r9 rA r: r rK r! r5 r& r r rl r insertBefore lastChildr r rt r lvp_lve_id_listr3 rC r r r6 )r6 rb rt r rr r r has_verF r cpu_is_different
setted_cpuel_listr r is_differentrA el_nameaddedel2enables_reseller_limitsr s rE lve_setrT
s {{x(A-- '!2333
{{ _d;;
'"( ?? 5D
#&HW --- 8 f % % ' vD 9 9 9 9 9
v & & & & & 155773855hw6GHHIIIII 6""""
! !'!23-g66 #,49Q<<"7X66666 ! ! !
!A O O O H $ $ H5N[a b b b b X ())EE 'E H 1(5/5QQQJZ ...#( GG G - - B ~b(++ ,
+ 5 5Ch5 "d{{ 22wQYZ]Q^ _ _ _ _ 22sGXc] S S S *J B 5 5 5 "e||/? 0:#(3-/O + 5x/? 5#&$;;+1+?+?+H+HD$($5$5oc(SV-FXFX$Y$Y$Y$Y+1+?+?+D+DD$($5$5gc(3->P>P$Q$Q$Q "t 4 4 4 5
', ||$5u== % V$$$
/f(9 9 9x))&11 3#6EEEEE $622222q[[S%A%A%C%C[ sx'A'A(7BS'T'TUUUUU v....(7+F;;;;; ? -(7+ ? -*0;&&eG%%g..B
Bc&kk222(8999z****<<00 BOOFCL'9J,K,K,STTTTOOD#hw.?*@*@AAA'
-
-(??e||'7 (2#(3-'G # -x'7 - $;;#)#7#7#@#@D - -oc(3->P>P Q Q Q Q#)#7#7#<#>>>>* U0.is_needed_plan s= %%')::wrz?Z?Z^fgv^w?w
rD c l | d |d k o| d S )Nr# r8 r r rE s rE r z'package_set_ext..is_needed_plan s3 ??4((HW,==abooV`FaFaBa arD r7 )r; r5 r r| r r} r4 rt r rr r# r r r r r0 )r_ r r r rl r9 r6 r9 rA r r7 r r> r8 r: rz is_plesk_plesk_get_package_idr XML_PLESK_IDrI r copy_package_settings_to_cpanelr@ r= r
plan_apply) r6 rW has_packager r r rA r1 package_resellerr r s rE rX rX sR (7+,,,DMMMK b
b b b t~NNNN >"h ' ' '
-
-(?? - $;; 3 3G < - - - $;;#)#7#7#@#@D - -oc(3->P>P Q Q Q Q#)#7#7#<#.: s" adx 00DQqTW_ rD r N)r list_domain_packages_with_idr6 r7
StopIteration)r rr panelr packs `` rE rd rd 2 s
E1133HF D D D D D
Aw tts (A
A A c h t } t d t }| a |S )z
Retrives resellers to packages map from panel using /usr/bin/getcontrolpaneluserspackages
:return: Dictionary:
{ 'reseller1' -> ['pack1', 'pack2'], 'reseller2' -> ['pack'] }
r )r r r )packages_users_copyreseller_packages_maps rE r r B s6 )--//2333 *(N rD c | d }| d }t }||v r ||| v rt | d dS dS )z
Set reseller package limits
:param set_data: input data dictionary
:return: True - limits was set succesfully
False - supplied provider has no supplied package
rt r8 TrV F)r rX )r6 rt package_namerr s rE reseller_package_setru P s^ _-MG$L 5 7 7---,BWXeBf2f2fd3333t 5rD c | d }t j sdS t d| }t j t }t j | t j || k rt dt d| t j | sdS t |dd 5 }|
}ddd n # 1 swxY w Y |dd }i }|D ]}| d r|
d
} | d d d }
| d
dk r | d
||
< |
t v r| | | d rd|vr dS dD ]2}
|
|v r,t# j ||
} | p t& |
||
< 3t) || rdS t+ |t, } t D ](}
| |
}
d |
d
|
d}| | )t1 d | |d dS )zA
Copy package limits from ve.cfg to cpanel packages data
r8 Nr\ zPackage path escapes r r r r lve_=r r ry DEFAULT_PACKAGE_EXTENSIONSrM )r r rm r i )rz r{ CPANEL_PACKAGES_DIRr r realpathr_ r r r r re r r r r9 r r memory_to_pager= is_limits_equalscreate_cpanel_limitsrl r r' )r6 rr package_path real_baser cpanel_package_datanew_cpanel_package_dataold_cpanel_datar
line_parts
limit_namememory_page_value cpanel_data limit_value
limit_lines rE rf rf e s w G " " )55G55L !455I w %% i)I)IIIS1DSSSSTTT
7>>, ' '
lC' 2 2 2 ,a kkmm, , , , , , , , , , , , , , , 1!!! 4O $ ??6 " " 5 ++C00J#A ..vr::@@BBJ!} )).8m
+ ---'..t444 ??0 1 1 e46G6G FF- W W
( ( ( 7
8S T T *;*V{:?VOJ '22 'w
;;K& 3 3
!*- 8J88888
&&z2222BGG$; < .is_needed_package s. ??4((G3WBOOJ.is_needed_package s1 ??4((G3d
8S8SWd8d drD r r- r_ z no configuration found for plan r z)warning: no configuration found for plan )r r rl r r r r> r r r: r| r} r r r~ r )r rt r r r resellers_listr s `` rE r: r: s DMMMG X X X X X X e e e e e e R G M % %b ) ) ) V E
I 6w ? ?N>""a'' *!,#GX... I Hw H HI
HRLLLL GgGG H H HOOOOOrD c ( t | | d S )Nrs )r: )r rt s rE reseller_plan_deleter s }555555rD c t | | d d S # t t f$ r) |dk r
t
| nt
| dz dcY S w xY w)Nr r4 r r r )rA r6 r% r r7 r= )r r s rE
get_xml_limitr s S2**3//2??HHIII
# S S S#&%<<{3 C8HC8O5R5R5RRRRSs := 7A76A7c d }| dS t j d| i } ||dd }| d }||dz | S )z
Normalize string for JSON output.
Example:
- Input string: -_&[{}]'"`te\s/t
- Output string: -_&[{}]'"`te\\s/t\a
:param data_str: String for normalize
:return: Normalied string
c ^ d}t | D ]\ }}||k r|dz
}||k r|c S dS )z
Get the index of the specified occurrence of character in string
:param input_string: String
:param char_to_search: Character to search
:param ordinal: Required occurence number
:return: Char index
r ry r )r^ ) input_stringchar_to_searchordinalcountidxchs rE _get_char_indexz'_normalize_str.._get_char_index
sR .. GC^##
G## JJJrrD NrA r ry )r r0 rfind)data_strr json_strtrd_idxlast_idxs rE r r sl $ tz5(+,,H ohQ//G~~c""H GaK( ))rD c D nrt nt d fd }|S )a
Generate inner function with closured fields names, is_reseller flag and printer function
:param list fields: List of strings that represent names of fields in final output
:param boolean is_reseller: Format output with info about reseller or not
:param callable printer: Function to format and print data for every entry
:rtype: callable
:return: function to format data for every user
Nc
<
r4t t j t d< fd}n fd}t j t t rt n d< d } |d d< t
dk r |d d < t D ]^} || rOt |d
}|d k r|nt t d
d
< t t t |d t d
dz d< t t | d d d d< n# t t f$ r Y nw xY w |t |d d < |t |d d< t |d d< t |d d< t |d d< ` d d dz d< t t! d d < g }t r)d fd D }d| dg}n fd D |S ) a
:param string package_name: Find and format data for this package name
:param string reseller_name: reseller name, owner of supplied package
:rtype: list
:return: List of giver package's statistics data line or empty list
r c h | d k o| d k S r r )r rt rt s rE r z>_package_formatter..wrapper..is_needed_package=
s2 #rt'<'<<m Q[A\A\`mAmmrD c b | d k o| d S r r )r rt s rE r z>_package_formatter..wrapper..is_needed_packageA
s/ #rt'<'<<`R__U_E`E`A``rD r# c L t rt | nt | S ro r r s rE r z?_package_formatter..wrapper..convert_mem_limitsH
r rD r rm r r r r r r r r r| r r} r r r r Nrp c 3 v K | ]3}d | d | d d V 4dS )r r r Nr r r s rE rr z6_package_formatter..wrapper..g
sM TT C C Cdhhqwwyy%&@&@ C C CTTTTTTrD r r c ` g | ]*} | d +S r r r s rE rh z7_package_formatter..wrapper..j
s/ >>>!dhhqwwyy"-->>>rD )r r r= r| r r rl r rA r
r@ r6 r% r7 r r r r_ ) rt rt r r r r r r r r rW r s `` @rE r z#_package_formatter..wrapper/
s,
* $] 3 3 39[))D ,D
n
n
n
n
n
n
n
a
a
a
a
a 9[))D59K^L111|T
V V V *)$u+66V ??--d6l;;DL 9 9B $$
9%b&11(- uu[=P9Q9QV #$<!"e,,CV 4E4E%G %G %GJM%N ! !W
!$S//88;HH YY& & " "DJJ #J/ D 1 1-F2K2K L LV 1 1-E2J2J K KV *2t 4 4T
-b' : :W
,R 8 8V 88G $ K3 .DM*4=99::U @88TTTTVTTTTTD ===/CC G>>>>v>>> ? ?
s ;A FFFro )rY rW )r rW r r s ``` rE _package_formatterr "
sO !,gg{2Y))PYG< < < < < < < <z NrD c t t d t } t d t }t t
t }t t dt
}| D ]}| || z
}t dk r#t t dt
}|
D ]M\ }}t j r|dk r |D ]+}t dk r| ||| z
} | || z
},Nt r*t d d
| z d z d S d S ) Nr r r FrW r ry Tadminr rp r )r r r r r rW DEFAULT_PACKAGEr r ro r rz r r| r~ r_ )r reseller_packagesr r rr rt
packages_listreseller_packages rE get_packages_listr p
s MMM ))) ""$$H2333&++--
o
>
>
>F":<
>
>F"6t<<(> A A$
} - A A ii 0-@@ @FF A 5
kCHHV , ,,t3444445 5rD c V t t d t } t d t }dg}t |z }t t t | }t |dt }| D ]}| || z
}t |d }| D ]\ }}|D ]} | || | z
}t r*t d d
| z d z d S d S ) Nr r r )r r Fr TrV z
{"data": [rp r )
r r r r r r rY r r r r| r~ r_ )
r r r r r r rr rt r r s
rE get_all_packages_listr
sP MMM ))) ""$$H2333&++-- ,K
\\K
'F
o;
W
W
WF"6uiPPPI % %))G$$$"6t<<R+?+?u Q
X 'W&'3N'CI'N(4^(DZ(P) )&NN W W W&4"RT6U6U%VNNNW1-D-D^-T-T*M77! 1 1 1.00MGGG1 #1gS`2a2a!bt
y
,.F.F~W_.`.` aN4
&
& $+ -~ / / !7 !E!E'5$$ "64
0
0
0 )0!3!3!5!5,:)) ";4
|
#
#
# )z|| )N4
,
,
, %,80K0K&8&8&B&B# )<%"*!4 "74
z
!
! %!) +N4 ' ' '#A&&&&&&&&
5s
F
)A F
A40F
3A44F
8B F
BF
B
F
$F
:5F
1&F
F
91F
, F
F;F++
F;:F;c F t t t S )z2
Retrieves panel users count
:return:
)r r r rC rD rE get_panel_users_countr H s
~ rD c t d t d| | r/t | D ]#}t t | | | "d S d S )Nr rr r0 )r r rK r@ )r r rq s rE rg rg R sm &&&IwBBB <!'* < rY r5 rj r= rl r` rn r rC rD rE get_globalsr s( l$ [$S 0 2 2 2rD c * g }t }t d t }| a | D ]&\ }}|D ] }| |k r| |g '|S )Nr )r r r r extend)rr r
pkg_users_oldr rt r package_name_in_keys rE r r s H"''))M2333&++--"''))N ):(?(?(A(A 1 1$
}#0 1 1 --- 000 1 OrD c ~ t j t j dd }|rt j | rxt
|| \ }}|dk rad| }t rt dd|g d
S d| }t j
| d t j | d
S d
S d
S d
S ) z
Call Endurance's custom script
:param args: list of arguments for pass to Endurance's custom script
:return: None
ENDURANCE_CUSTOM_SCRIPTrx ) separatorr z0Error while executing Endurance's custom script
r- rx zerror: r N)
rz get_param_from_fileCL_CONFIG_FILEr r r r r| r} r r r r )argsendurance_custom_scriptret_codestd_outr err_messages rE call_endurance_custom_scriptr s * =k>X>WHK M M M
#27>>2I#J#J
# ()@$ G G' q==T7TTG
#Ggw%788888 1 1 1
K!3!3!3444"""""
#
#
#
# =rD c t r)t t | t j z S t | S )a
Convert page value to human-readable value or bytes, depending on BYTES_FLAG;
E.g.
>>> _page_to_memory_or_bytes(1233254) # BYTES_FLAG=False
'100M'
>>> _page_to_memory_or_bytes(1233254) # BYTES_FLAG=True
654321
:type value: int
:rtype: str | int
)r r@ r mmapr rl r s rE _page_to_memory_or_bytesr s5 15 .//000 5>>rD c g } t t j }t t D ]m} t j | }||vr| | <# t t t f$ r | | Y jw xY w| D ]}t | dS )zV
Remove from LVE all resellers, which are absent from panel
:return: None
N) r rM rt r r rQ r r r r] r r )reseller_id_list_for_deletecpapi_resellers_listlve_reseller_idlve_reseller_namereseller_id_for_deletes rE remove_absent_resellersr s #% 1 1 3 344MMM#:: @ @ @ # 9 9/ J J (<<<+22?CCC'7+ @ @ @ ' . . ? ? ? ? ? @ #> 1 1 /00001 1s
8B,B54B5c |t | | dS |t | dS |r~t j | 5 t j | }| | }|||_ | ddd n # 1 swxY w Y t j | }n# t $ r Y dS w xY wt j | }d} ||vr$|r"||v r || } t j
| || | t t j | | rt" | t j | | }
|
t j } | |
d | k rt" | |
t | } t | | dS dS dS dS )u Update LVD domain config, docroot-to-ID mapping, and kernel LVEs.
Called after a control-panel hook detects a domain rename,
document-root change, domain deletion, or user rename.
Three modes of operation:
**Deleted domain** (*deleted_domain* is given):
Drops every registration the panel no longer backs — see
_prune_domains_absent_from_panel(). Takes precedence over the
other two: after a deletion there is no domain left to resolve.
**Single-domain** (*domain* is given):
1. Rename domain in ~/.lve/domains.json (if *old_domain* given).
Uses privilege drop so files stay user-owned.
2. Ensure the current docroot has a domain_id in the registry.
If *old_docroot* is given, removes the old mapping and assigns
a new domain_id for the new docroot.
3. Destroy the old domain LVE in the kernel (if it existed).
4. Map the new domain_id to the user's LVP and re-apply limits
from domains.json so that per-domain limits keep working.
**All domains** (*domain* is ``None``):
Iterates every domain in the user's ``domains.json``, detects
stale registry entries whose docroot no longer matches (e.g.
after a user rename shifted the home directory), and performs
the single-domain reassignment for each one.
Args:
uid: numeric user ID.
domain: current (possibly renamed) domain name. When ``None``,
all domains from the user's config are checked.
old_domain: previous domain name if it was renamed.
old_docroot: previous document root path if it changed.
deleted_domain: domain the panel has just removed, if any.
Nrp ra r r1 ) _prune_domains_absent_from_panel_regenerate_all_domainsrT user_contextr r find_domainrp rG resolve_docrootr; r r reassign_docrootrM rO r r r r rt r r r> r@ )
rq r
old_domain old_docrootdeleted_domainr( r r registry
old_domain_id
new_domain_idr r2 s
rE regenerate_domainsr sR L !(n===
~ $$$
#C
(
( (--c22F&&J&77E #
+F33 -c22HMh G;(22 $[ 1M +Cg F F F S_ 8 % %mC % @ @ - m , , ,&4S'BB
$ X\\^^N !!-33s::!!#}555 ..s33J ' '
' C C C C C ! __
% $s$ AB B!$B!)B> >
C C c N t j | j }t t | pg nH# t
t t t f$ r(}t
d| || Y d}~dS d}~ww xY w s t
d| | dS t }g }t j | pi D ]\ }}||v r
t ;t j || rt& | t j | | nQ# t, t. t f$ r7}t d| |||t3 d Y d}~d}~ww xY w| ||f g } t7 j | 5 t6 j | } fd| j D }|D ]}
| |
|r| ! ddd n # 1 swxY w Y n;# t, t f$ r'}t
d | || Y d}~nd}~ww xY wt " d
| ||| dS ) aX Drop every per-domain registration the panel no longer backs.
Runs from the ``post_delete_domain`` hook. The domain record is gone
by then, so its docroot can no longer be resolved and the
single-domain path above has nothing to work from; the panel's
current docroot list is what tells which registrations outlived their
domain. Without this the entry, its ``domains.json`` record and its
kernel LVE stay behind for good, and every later apply re-reports the
account (CLOS-7467).
Removes only, never assigns. ``lvectl enable-domain-limits`` is the
root-only step that mints a registry entry, while reaching this code
takes no more than a panel user deleting one of their own domains --
so allocating here would let that deletion turn on per-domain limits
the administrator never enabled.
An empty panel answer means the panel could not be asked (no passwd
entry, or ``userdomains()`` came back empty), not that every domain
is gone, so it prunes nothing: the same reading ``_build_domain_map``
applies before it calls an entry orphaned.
zjregenerate-domains: cannot list the domains of uid %s after deletion of %r; every registration is kept: %sNzregenerate-domains: the panel lists no domain for uid %s, which is an unanswerable query rather than an empty account; every registration is kept after deletion of %rra zdregenerate-domains: uid=%s could not drop the registration of deleted docroot %r (domain LVE %s): %szprune-deleted-domain)extrac 0 g | ]}|j v |j S rC r )rf ddocroot_by_domains rE rh z4_prune_domains_absent_from_panel.. s( YYY!GX9X9Xqv9X9X9XrD zQregenerate-domains: uid=%s could not update domains.json after deletion of %r: %szpregenerate-domains: uid=%s domain %r deleted in the panel -- dropped registration(s) %s and config entry(ies) %s)#r& r r r r r r] r r r9 rB r rt r r r rM rO r r r r r+ r% r r) r rT r
r r domains
remove_domainrG r; ) rq r r rJ panel_docrootsremovedr r droppedr( rp r s @rE r r A s{ ,<$$, X!6!6!<" = = g~/D E <=@.RU W W W 347 I I I *113344NG - =c B B Hb O O Q Q - - n $ $ 38#=#=iPS#=#T#T!!),,, +C 9 9 9 9*g.
II ?7Is 34J K K
M
M
M
HHHH +,,,, G
D
#C
(
( (--c22FYYYYv~YYYG
+
+$$T****
g D D D )*-~s D D D D D D D D D HH ;
.'74 4 4 4 4sk 7; B A;;B 9AEF (-FF =I A#I 4 I II II J I??Jc t j | }|sdS t j | }nD# t
t f$ r0}t j t j d| d| Y d}~dS d}~ww xY w|j r5t j t j d| dt | d dS t }|j D ]p} |
t j |j 0# t
$ r4}t j t j d|j d| Y d}~id}~ww xY wt! | D ]a\ }}||v r
t$ ;t$ j || rt* | t j | | bd
}|D ]@} | |v rt j | | }t$ t* | | d }A|r?t$ :t$ | }
t$ | |
dS dS dS )
a Synchronise the domain-ID registry with current docroots.
Compares docroots currently reported by the control panel against
the docroots stored in the registry. Orphaned entries (docroots
no longer valid) are removed and their kernel LVEs destroyed;
missing entries (current docroots not yet registered) get a fresh
domain ID assigned and mapped to the user's LVP.
Nz6regenerate-domains: failed to load LVD config for uid r z+regenerate-domains: the LVD config for uid z could not be read; leaving its z< registration(s) alone rather than treating them as orphanedz7regenerate-domains: cannot resolve docroot for domain 'z': ra FTr1 ) r r rT r r r+ r] r rA
unreadabler r r addr rp r r rM rO r r r r r r r> r@ ) rq r r( rJ current_docrootsr old_drr changeddrr2 s rE r r s -c22H $))#.. g
f(.!$. .(+. . / / /
f(EC E E25h--E E E F F F uu ? ? ? !:5:!F!F G G G G ? ? ? M&,>).> >8;> >
?
?
?
?
?
?
?
? ?
"(.."2"2 3 3 5 5 % % % ?**9S*AA i ( ( ('V4444G
>> "3C<< ? c9 - - - @3?**3//
##CJ#?????@ @??s- : A; %A66A;,C??
D= *D88D=c 2 t } t j rt j } t j D ]\ }}|| v r
t j
| # t $ rz t | n[# t $ rN t j | t | n# t $ r Y nw xY wY nw xY wY w xY wdS )zM
Remove from LVE all users, which absent in system
:return: None
N)r rM r3 r r r rO rt r r& r r r r% r )r r rb s rE remove_absent_usersr' s. #uuN
v !! =':<< (,,....00 ^ # # L
''''
F%%f---OOF++++! D
sZ ;B
DB65D6
D9C;:D;
D DD D D
DDD)Fro )r )NN)r FT)T)NNN)NFNNr N)rZ )rz r@ NF)rF N)FN)r r N)NNNN(
contextlibr r r r r r r& r r r r r xml.dom.minidomdomminidomr< builtinsr functoolsr r typingr r r r r
r r r rz r[ clcommon.constr r r
r r r r clcommon.cpapi.cpapiexceptionsr r
clcommon.lockr clcommon.utilsr clcontrollibr cleventsr r cllimits.libr cllvectl.logr r clveconfig.ve_configr r r clveconfig.ve_lockr r r! r" r# r$ r% secureior& r' websiteisolationr( rT r) r* r websiteisolation.exceptionsr+ GET_CP_PACKAGE_SCRIPTr r r r r r r r r9 r@ r r IS_DEBUGre LVEr rM r5 rK rQ rW rV rc ri rl ru r r r ra r rb r9 r r| r r r r r r> rY r5 rj rk r= rl r` rn rm ro r r r r r r r r r r r r r
r contextmanagerr r! r, r} rB rK rQ rT rW rZ r re rp ry rA r r r r r r r r r r r r r r r r r r
r r r r r r! r; r# r) rK rS rU rW rY tupler rP rg rl rq ry r r r r r r r r r r r r r r r r r r r r r r r r r" r& r) r, r/ r2 r rB rT rZ r{ r_ rX rd r ru rf r~ r r: r r r r r r r r r r r r r r r r rg r r r r r r r r r r r r r' rC rD rE rA sR
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?
" " " " " "9 9 9 9 9 9 9 9 9 9 9 9 9 9 H H H H H H H H & & & & & & 0 0 0 0 0 0 * * * * * * P P P P P P P P % % % % % % G G G G G G G G O O O O O O O O O O E E E E E E E E D D D D D D D D D D D D D D ? ? ? ? ? ? ? ? 0 0 0 0 0 0 4 4 4 4 4 4 : : : : : : 0 0 0 0 0 0 @
:
k** 3rz~~mQ// 0 0 !!'+.. E
CC E ! ! !E
#---C Y !U !U !UH 6* * *
H
H
H % % %K K K= $3 3 3 3*
ONN
% % % ,+ + + +,
1 1 1D &%''9<<>> , $ * * 0 0 0 " " "(
>
& &
[ [ [ 2 2 22 2 2 & &D & & & &Rk k k"i "i "iJ3 d38n 3 3 3 3 l
&
&
&
& % % % L L L L EA EA EA EAP I I I ! ! !H
?
?
? 0 0 0 0 4 4 4 4 4 f f f!1 !1 !1J"p "p "p "pJ! ! ! N D Z >n >n >n >nB6 6 688S 8T 8 8 8 8$
/
/
/
/
/I I I I Iy I I I
S
T
6 XY P- P- P- P-f
% %5 % %S %# % % % %6 , :
#i #i #i #iL PT #% % % %P %,E R R R Rn5 5 5 56 $5 5 5( ". . . .bJ J J Z
T
3
4
o o od$eD$J&7 $ $ $ $> > > > >,n n nb?8 ?8 ?8D*. *. *.ZG G G.J J J. * D G G GF F F,
+ + +(2 2 2 *
+& +& +& +&\ F D5 5 5 5. -
?3
?4
?
?
?
? K5 K5 K5 K5\
C
#
(3-
! ! ! *1S 1S 1Sh <& & & &R6 6 6S S S$* $* $*NJ J J J\5 5 5:5 5 5&6 6 64 ! v v v vr < < < <
( S S S2 2 2$
"# # #2 "1 1 14 GK&*MD MD MD MD`Q4 Q4 Q4h>@ >@ >@B rD