jQ d Z ddlZddlZddlZddlZddlZddlmZ ej e Z
dZ d Z dZ
d Zd Zd Zd d
Zd ZdS )
z
CLI helper utilities for CageFS user commands.
Provides functions for:
- Re-entering CageFS environment
- Calling commands via proxyexec for privilege escalation
N)clcagefsz/var/.cagefs/.cagefs.tokenc t t d 5 } | cddd S # 1 swxY w Y dS # t t
f$ r Y dS w xY w)zv
Read the CageFS token from the token file.
Returns:
str: The CageFS token, or None if not found
rN)openCAGEFS_TOKEN_PATHreadstripIOErrorOSError)fs Copt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/cli.pyget_cagefs_tokenr s
#S
)
) $Q6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ W tts3 A &A
A
AA AA A,+A,/usr/sbin/proxyexecc t j } t j d| z }| d r|dt d }|t
k S # t t f$ r Y dS w xY w)z
Verify that the parent process is the proxyexec daemon
by checking /proc//exe (kernel-controlled, not spoofable).
Returns:
bool: True if parent process is the proxyexec daemon
z /proc/%d/exez
(deleted)NF)osgetppidreadlinkendswithlenPROXYEXEC_DAEMON_PATHr r
)ppid
parent_exes r
_is_parent_proxyexecr . s z||[ $!677
| , , 9#$7c,&7&7%7$78J 222 W uus A!A$ $A98A9c ` t j d dS t S )aG
Check if the script is running via proxyexec.
Verifies both that the PROXYEXEC_UID environment variable is set
and that the parent process is the proxyexec daemon binary.
This prevents spoofing via environment variable injection.
Returns:
bool: True if running via proxyexec, False otherwise
PROXYEXEC_UIDNF)r environgetr r
is_running_via_proxyexecr A s)
z~~o&&.u ! !!r c t }|s t d dS t j t j j }t j }t t j
}ddd||| |g|z }d|i}t j |t j t j t j | }| |j S )a,
Call a command via proxyexec to execute with root privileges.
Args:
alias: The proxyexec command alias (e.g., "CAGEFSCTL_USER_SITE_ISOLATION_LIST")
args_list: Additional arguments to pass
Returns:
int: Exit code from the proxyexec command, or None on error
zFailed to read CageFS tokenNr z-cz cagefs.sock CAGEFS_TOKENstdoutstderrstdinenv)r loggererrorpwdgetpwuidr getuidpw_namegetcwdstrgetpid
subprocessPopensysr$ r% r& communicate
returncode) alias args_listtokenusernamecwdpidcmdr' ps r
call_via_proxyexecr> Q s
E 2333t|BIKK((0H
)++C
bikk
C
m
C 5
!CSZ
#)Y\]]]AMMOOO <r c | t j } dg| z }t j |t j t j t j i }| |j S )z
Re-execute inside CageFS when running outside.
Args:
argv: Command line arguments to pass (defaults to sys.argv)
Returns:
int: Exit code from the re-executed command
Nz/bin/cagefs_enterr# ) r3 argvr1 r2 r$ r% r& r4 r5 )r@ r< r= s r
reenter_cagefsrA w sT |x
$
&CSZ
#)Y[\\\AMMOOO <r c ( t j S )zv
Check if currently running inside CageFS.
Returns:
bool: True if inside CageFS, False otherwise
)r in_cagefsr r r
rC rC s r )N)__doc__loggingr r* r1 r3 clcommonr getLogger__name__r( r r r r r r> rA rC r r r
rI s
8 $ $0 . &
"
"
" # # #L & r