# -*- coding: utf-8 -*- # Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2019 All Rights Reserved # # Licensed under CLOUD LINUX LICENSE AGREEMENT # http://cloudlinux.com/docs/LICENSE.TXT from __future__ import print_function from __future__ import division from __future__ import absolute_import import json import os import pwd from clselect.utils import check_call, list_dirs, run_command_full from .interpreters import Interpreter DEFAULT_PREFIX = 'nodevenv' NODEVENV_BIN = os.path.join(os.path.dirname(__file__), 'nodevenv.py') PYTHON_PATH = '/opt/cloudlinux/venv/bin/python3' APP_CONFIG = 'package.json' SHARED_NODE_MODULES_MARKER = '.cl-shared-node-modules.json' class Environment(object): def __init__(self, name, user=None, prefix=None): self.name = name if user: self.user = user else: self.user = pwd.getpwuid(os.getuid()).pw_name if prefix is None: self.prefix = DEFAULT_PREFIX else: self.prefix = prefix self.path = os.path.join(_abs_prefix(self.user, self.prefix), name) self._interpreter = None self._npm = None self.interpreter_name = 'node' + name def __repr__(self): return ("%s.%s(name='%s', user='%s', prefix='%s')" % ( self.__class__.__module__, self.__class__.__name__, self.name, self.user, self.prefix)) def _demote(self): user_pwd = pwd.getpwnam(self.user) def func(): # setgroups() needs CAP_SETGID regardless of argument, so it would # EPERM on user-initiated panel calls (cl-selector.cgi under cpanel) # that re-enter _demote() already running as the user. setgid/setuid # below succeed without the capability since the IDs are unchanged. if os.geteuid() == 0: os.setgroups([]) os.setgid(user_pwd.pw_gid) os.setuid(user_pwd.pw_uid) os.environ['USER'] = self.user os.environ['HOME'] = user_pwd.pw_dir return func def as_dict(self, key=None): e = { 'name': self.name, 'interpreter': self.interpreter(), } if key: del e[key] return {getattr(self, key): e} return e def as_deepdict(self, key=None): e = { 'name': self.name, 'interpreter': self.interpreter().as_dict(), } if key: del e[key] return {getattr(self, key): e} return e def create(self, interpreter, destroy_first=False): args = [ PYTHON_PATH, NODEVENV_BIN, '--node', interpreter.binary, ] if destroy_first: args.append('--recreate-bin') args.append(self.path) kwargs = {'preexec_fn': self._demote()} if os.getuid() == 0: args = ['/bin/cagefs_enter'] + args check_call(*args, **kwargs) def destroy(self): check_call('/bin/rm', '-r', '--interactive=never', self.path, preexec_fn=self._demote()) def exists(self): return os.path.exists(self.path) def interpreter(self): if not self._interpreter: self._interpreter = Interpreter(prefix=self.path) return self._interpreter def npm(self): if not self._npm: self._npm = os.path.join(self.path, 'bin', 'npm') return self._npm def _invalidate_shared_node_modules_marker(self): """Conservatively clear delivery telemetry before plain npm mutates.""" try: os.unlink(os.path.join(self.path, 'lib', 'node_modules', SHARED_NODE_MODULES_MARKER)) except OSError: pass def extension_install(self, extension='-', cwd=None, lock_fd=None): """ Install nodejs extension :param cwd: current working directory for npm (it's full path to app root by default) :param lock_fd: optional already-held Selector application lock passed only to npm_wrapper for continuous transaction ownership :param extension: name and version of extension :return: None """ # DiD (F-23, CLOS-5537): every reachable caller is # cloudlinux-selector's --install-modules / --uninstall-modules, # routed through commons/lib/clselector/cl_selector.py:205 # run_process_in_cagefs for root callers, so npm runs inside the # target user's CageFS namespace at their uid. Refuse root euid # here so any future refactor that reaches extension_install # without a caller-side cagefs_enter_user re-exec fails loud # instead of spawning npm outside the user's CageFS. if os.geteuid() == 0: raise PermissionError("Operation not permitted.") # git is need for npm install from git repositories # we didn't add git to cagefs, because we use git from cpanel command = (self.npm(), 'install') # extension is defined if extension != '-': command += (extension,) # npm takes list of extensions from package.json if extension is '-' else: config_path = os.path.join(cwd, APP_CONFIG) if not os.path.isfile(config_path): # package.json is absent return 0 # The venv npm wrapper clears the marker after its preflight and # unshare, immediately before classic npm mutates the tree. Keep it # intact here so a refused delivery preserves the existing state. # command sample # npm install @ ... process_kwargs = {'args': command, 'preexec_fn': self._demote(), 'cwd': cwd} if lock_fd is not None: process_kwargs['pass_fds'] = (lock_fd,) user_pwd = pwd.getpwnam(self.user) process_kwargs['env'] = dict(os.environ, CL_SELECTOR_APP_LOCK_FD=str(lock_fd), HOME=user_pwd.pw_dir, USER=self.user) check_call(**process_kwargs) def extension_install_single_call(self, extensions_list): """ Install nodejs extension :param extensions_list: name and version of extension :return: None """ if os.geteuid() == 0: raise PermissionError("Operation not permitted.") command = [self.npm(), 'install'] command.extend(extensions_list) # npm install @ @ ... ret_code, _, _ = run_command_full(command, preexec_fn=self._demote()) return ret_code def extension_install_for_version_change(self, extensions_list): """Install relocated dependencies without re-entering npm_wrapper. Version change already owns the Selector application transaction lock. Calling the venv's ``bin/npm`` from here would invoke npm_wrapper and attempt to take that lock again. This narrow internal operation uses the selected alt-node npm directly and confines the result to the new environment; ordinary panel npm calls continue through the wrapper. """ if os.geteuid() == 0: raise PermissionError("Operation not permitted.") self._invalidate_shared_node_modules_marker() command = [ '/opt/alt/alt-nodejs%s/root/usr/bin/npm' % self.name, 'install', '--no-save', '--package-lock=false', ] command.extend(extensions_list) lib = os.path.join(self.path, 'lib') os.makedirs(lib, exist_ok=True) command.append('--prefix=%s' % lib) # cagefs_enter_user intentionally starts the inner Selector with a # minimal environment. Dependency lifecycle executables commonly use # ``#!/usr/bin/env node``; point them at the selected alt-node rather # than an inaccessible or unrelated system binary. env_data = os.environ.copy() node_bin = '/opt/alt/alt-nodejs%s/root/usr/bin' % self.name env_data['PATH'] = node_bin + os.pathsep + env_data.get( 'PATH', '/usr/bin:/bin') ret_code, _, _ = run_command_full( command, env_data=env_data, preexec_fn=self._demote(), cwd=lib) return ret_code def extension_update(self, extension): raise NotImplementedError("It's not used for nodejs selector") def extension_uninstall(self, extension): raise NotImplementedError("It's not used for nodejs selector") def extensions(self): """ Retrieves extensions dictionary for this virtual environment :return: Extensions list. Example: [u'xpath@0.0.27', u'https://github.com/visionmedia/express'] """ # get path to current virtual nodejs environment cwd = os.path.split(os.path.split(self.npm())[0])[0] # npm list --json _, output, _ = run_command_full([self.npm(), 'list', '--json'], preexec_fn=self._demote(), cwd=cwd) if output.strip(): data = json.loads(output) else: data = {} extensions = data.get('dependencies', {}) # extensions example: # {u'express': {u'version': u'4.16.3', u'from': u'express@^4.15.3', .... }, # u'express_new': {u'version': u'4.16.3', u'from': u'git+https://github.com/visionmedia/express.git', ....}, # u'request': {u'required': u'^2.81.0', u'missing': True}, # u'body-parser': {u'required': u'^1.17.2', u'missing': True} # } result = [] for name, info in extensions.items(): # module is missing or has no needed attributes - pass it if info.get('missing', False) or not info.get('version'): continue source = info.get('from') if source is None: source = info.get('resolved', '') if source.startswith('git+'): # extension from git result.append(source) else: # extension from standard npm repo result.append('%s@%s' % (name, info['version'])) return result def _abs_prefix(user=None, prefix=None): if not prefix: prefix = DEFAULT_PREFIX if user: return os.path.join(pwd.getpwnam(user).pw_dir, prefix) else: return os.path.join(pwd.getpwuid(os.getuid()).pw_dir, prefix) def environments(user=None, prefix=None): venv_path = _abs_prefix(user, prefix) try: env_list = list_dirs(venv_path) except OSError: return [] envs = [] for env_name in env_list: envs.append(Environment(env_name, user, prefix)) return envs def environments_dict(key, user=None, prefix=None): return dict(list(e.as_dict(key=key).items()) for e in environments(user, prefix)) def environments_deepdict(key, user=None, prefix=None): return dict(list(e.as_deepdict(key=key).items()) for e in environments(user, prefix))