;j5 < d dl Zd dlZd dlZd dlZd dlZd dlmZ dZdZ dZ
dZ ej e
Z G d de Z G d d
e Z G d d Zd
Zd dZd dZd dZ d!dZd Zd Zd Zd"dZde de fdZ ede fd Z d Z dS )# N)cachez/etc/cagefs/cagefs.mpz/usr/sbin/cagefsctlz/usr/share/cagefs-skeletonz /var/.cagefsc e Zd Zd Zd ZdS )CagefsMpConflictc 2 d| dt d| d| _ d S )NzConflict in adding 'z' to z5 because of pre-existing alternative specification: '')CAGEFS_MP_FILENAME_msg)selfnew_item
existing_items /builddir/build/BUILDROOT/alt-python27-cllib-3.4.44-1.el8.cloudlinux.x86_64/opt/cloudlinux/venv/lib/python3.11/site-packages/clcommon/clcagefs.py__init__zCagefsMpConflict.__init__ sE
T8
T
T2D
T
TCP
T
T
T
c | j S N)r r
s r
__str__zCagefsMpConflict.__str__ s
yr N)__name__
__module__ __qualname__r r r r
r r s2
r r c e Zd ZdZd ZdS )CagefsNotSupportedErrorz Cagefs Not Supported Exceptionc < t | | d S r ) Exceptionr )r
messages r
r z CagefsNotSupportedError.__init__& s 4)))))r N)r r r __doc__r r r r
r r # s) ((* * * * *r r c e Zd ZdZdZdZd Zd Zd Ze d Z
d Z d Z d
Z
e d Ze d Ze d
Zd Zd ZdS ) CagefsMpItemz@!%* !c |dd dk r d| _ dS | dk r d| _ dS || _ dS )zConstructor
:param arg: Is either path to add to cagefs.mp or a raw line is read from cagefs.mp
:param prefix: The same as adding prefix '!' to arg before passing it to ctorN #r )
_path_specstrip)r
args r
r zCagefsMpItem.__init__/ sI rr7c>> "DOOO
YY[[B
"DOOO !DOOOr c ^ | dk r|| j d|d| _ | S )z%Specify mode as in fluent constructor@N,03o)prefixr% )r
modes r
r- zCagefsMpItem.mode< s; ;;==C D$4!% = =4 = = =DO r c | j S r r% r s r
r zCagefsMpItem.__str__D s
r c 8 | dk rdS | d dk r| dz S | S )Nr /r )paths r
_add_slashzCagefsMpItem._add_slashG s, 2::3 8s??#: r c d t | }| s| rdS t | }t | }| | S NF)r _adoptis_dummyr4 r3
startswith)r
anotheradopted this_pathtest_preexist_in_paths r
pre_exist_inzCagefsMpItem.pre_exist_inO s %%g.. ==?? g . . 0 0 5 ++DIIKK88 , 7 7 G G ##$9:::r c t | }| s| rdS | | k rdS t j t j gi}g }| | | | v S )NFT)r r7 r8 r, _PREFIX_MOUNT_RW_PREFIX_MOUNT_ROget)r
existingr; prefix_compatibility_map null_optionss r
is_compatible_by_prefix_withz)CagefsMpItem.is_compatible_by_prefix_withZ s %%h// ==?? g . . 0 0 5 ;;==GNN , , , ,4$0$ALDaCb#c {{}} 8 < rF r8 r7 rO rS r3 r, r r r
r r * s K " " " \ ; ; ;
]
]
] ' ' ' # # \# ' ' \' : : \:Y Y Y r r c J t j t S r )osr3 existsCAGEFSCTL_TOOLr r r
is_cagefs_presentr[ s
7>>. ) ))r r c dD ]F}|| v rt d| |||v rt d| ||v rt d| Gdgt j R D ]}|| v rt d| d S )N)
z"path contains forbidden character z&added_by contains forbidden character z$prefix contains forbidden character r* )
ValueErrorr rR )r3 added_byr, chs r
_reject_cagefs_mp_injectionrb s L L
:: H" H HII I B(NN Lb L LMM M
<< JB J JKK K .\-.. J J
:: H" H HII I J Jr c |d}|d} t j | t j t j z t j z }n]# t
$ rP t j | t j | t j t j z t j z }Y nw xY w |t j || t j ||| t j | d S # t j | w xY w)Nr2 )
rX openO_RDONLY O_DIRECTORY
O_NOFOLLOWFileNotFoundErrormkdirfchmodfchownclose)r3 r- owner_idgroup_iddir_fds r
_mk_mount_dir_setup_permrq s Mr{R^ ;bm KLL M M M
r{R^ ;bm KLLM Ifd # # #
&(H---
s 9A AB B "-C% %C;Fc
t sd S | t ddg}n
t d| g}|r-t j |t j t j d S t j |t j t j d d S )Nz --wait-lockz
--remount-allz --remount)stdoutstderrFrs rt check)r[ rZ
subprocessPopenDEVNULLrun)userremount_in_backgroundcommands r
_remount_cagefsr~ s |!=/B!;5
% %
% %
r c @ t | || t | ||| t sdS t j t s3t j t dgt j
t j
d t t t dd 5 }t || z | d |D } fd | D }
|
sb| d
d |&| }t# d ||
t# |
|rt% | n1 |
d st) |
d ddd dS # 1 swxY w Y dS )u
Add mount point to /etc/cagefs/cagefs.mp
:param path: Directory path to be added in cagefs.mp and mounted
from within setup_mount_dir_cagefs().
If this directory does not exist, then it is created.
:param added_by: package or component, mount dir relates to, or whatever will
stay in cagefs.mp with "# added by..." comment
:param mode: If is not None: Regardless of whether directory exists or not prior this call,
it's permissions will be set to mode.
:param owner_id: Regardless of whether directory exists or not prior this call,
it's owner id will be set to.
If None, the owner won't be changed.
:param group_id: Regardless of whether directory exists or not prior this call,
it's group id will be set to.
If None, the group won't be changed.
:param prefix: Mount point prefix. Default is mount as RW.
Pass '!' to add read-only mount point.
Refer CageFS section at http://docs.cloudlinux.com/ for more options.
:param remount_cagefs: If True, cagefs skeleton will be automatically
remounted to apply changes.
:param remount_in_background: If True, cagefs remount will be done in separate
background process, without waiting for completion
:returns: None
Propagates native EnvironmentError if no CageFS installed or something else goes wrong.
Raises CagefsMpConflict if path is already specified in cagefs.mp, but in a way which is opposite
to mount_as_readonly param.
Raises ValueError if `path`, `added_by`, or `prefix` contains a character
that would forge or inject a cagefs.mp record (newline, carriage return,
and — for `path` — the ',' mode separator or an '@!%*' prefix character).
Nz --create-mpFru zr+utf-8encodingc 3 > K | ]}| V d S r )rstrip).0 file_lines r
z)setup_mount_dir_cagefs.. s. >>y ((**>>>>>>r c > g | ]} | |S r )r> )r rJ r s r
z*setup_mount_dir_cagefs.. s, PPP!x7L7LQ7O7OPAPPPr r z# next line is added by )filer| r2 )rb rq r[ rX r3 rY r rw rz rZ ry add_new_line_to_cagefs_mpre r r- seekr& printr~ rF r ) r3 r` r- rn ro r, remount_cagefsr| f trim_nl_iterpre_exist_optionr s @r
setup_mount_dir_cagefsr s j h777 T48<<< 7>>, - -
] + % %
$ 9 9 9 CQ
..33D99>>A>>> PPPP|PPP
C
FF1aLLL##>>++0(CCCC ( # # # #
M 6KLLLL667G7KLL C"8-=b-ABB B'C C C C C C C C C C C C C C C C C Cs 1CFFFc t t dd 5 } | cd d d S # 1 swxY w Y d S )Nrr r )re r readlines)r s r
_get_cagefs_mp_linesr 1 s
# 8 8 8 A{{}} s
9= =c t t dd 5 }| | cd d d S # 1 swxY w Y d S )Nwr r )re r
writelines)linesr s r
_write_cagefs_mp_linesr 6 s
# 8 8 8 #A||E""# # # # # # # # # # # # # # # # # #s
:>>c t } | r?| d dk r5| d d dk r%| dxx dz
cc< t | dS dS dS dS )zR
Add new line to the end of /etc/cagefs/cagefs.mp file if it is not there
r r r2 r] N)r r )r s r
r r < ss
! " "E &qR E"IbMT$9$9
b T u%%%%%& & $9$9r c 8 t }t j dt j dt j | d fd|D }t
| t
| k rdS t | |rt | dS dS )af
Remove mount points matching given path from cagefs.mp file
:param str path: Path that should be removed from file.
:param bool remount_cagefs: Remount cagefs skeleton or not
:param remount_in_background: If True, cagefs remount will be done in separate
background process, without waiting for completion
:return: Nothing
z^[z]?z(,\d+)?$c > g | ]} | |S r )match)r liner s r
r z+remove_mount_dir_cagefs..S s( L L Laggdmm L L L Lr Nr ) r recompiler rR escapelenr r~ )r3 r r| r lines_with_excluded_pathr s @r
remove_mount_dir_cagefsr G s
! " "E
N 1NNRYt__NNNOOA L L L L L L L 5zzS122223444 E.CDDDDDDE Er r3 returnc t dd 5 }|D ]4}| d }|d }|| k r ddd dS 5 ddd n # 1 swxY w Y d S )
zACheck the fact that directory is mounted i.e. listed in mountinfoz/proc/self/mountinfor r )maxsplit NTF)re rL )r3 mountinfo_filer mountinfo_entry_parts mount_points r
_is_directory_mountedr ^ s
$w 7 7 7 >" D$(JJJ$:$: ! 02Kd"" # 5s *A AA Ac t t } | sDt j t r t
dt | S )a{ Recommended way to check whether process is running inside CageFS
Please avoid testing for /var/.cagefs existence.
Replace with this function call when possible.
Cached for the life of the process (CLOS-6868). Whether *this* process runs
inside CageFS is fixed at exec time and cannot change afterwards, so the
answer is stable; `in_cagefs.cache_clear()` is there for tests. Recomputing
it re-parsed the whole of /proc/self/mountinfo, which on a host with
thousands of CageFS users is a long file: `lvectl apply all` called this
7,350 times and spent 2.1 s of CPU doing nothing but re-reading it.
z+%s should not exist in the real file system)r CAGEFS_DIR_PATHrX r3 isdirloggerwarning)
in_cagefs_s r
in_cagefsr k sK '77J W"'--88 WDoVVV r c v t j dd }|dS t j | }|j | n # t t t f$ r Y dS w xY w | | sdS n"# t $ r}t d |d}~ww xY wdS )z,
Check that cagefs enabled for user
cagefsctlz /usr/share/cagefs/cagefsctl.pyNFz;ERROR: CageFS version is unsupported. Please update CageFS.T) importlibutilspec_from_file_locationmodule_from_specloader exec_module ImportErrorri OSErroris_user_enabledAttributeErrorr )r{ _specr es r
_is_cagefs_enabledr s 66 9
=5 N33E::
++++ *G 4 uul((.. 5 l l l%&cddjkkl 4s. "A 9A A;:A;?B
B6!B11B6)r )rc NNr6 )Nrc NNr FF)FF)!importlib.utilr loggingrX r rw functoolsr r rZ CAGEFS_SKELETON_PATHr getLoggerr r r r r r r[ rb rq r~ r r r r r strboolr r r r r r
r s# , &3 8 $ $ y * * * * *i * * *\ \ \ \ \ \ \ \~* * *J J J J( 2
2
]C ]C ]C ]C@
# # # & & &E E E E.
4 & r