jE d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z m Z ddl
mZ ddlmZ ej ZdZd Zd
Zd Zd Zd
Z ej d ZdZdZ dZ dZ dZ dZ dZ!dZ"dZ# e$ Z%dZ& G d de$ Z'efdZ(efdZ)d Z*d'dZ+d Z,d Z-d Z.d(d Z/ d)d!Z0d" Z1e d# Z2d$ Z3d% Z4d*d&Z5dS )+a Root-side orchestration of the install-time delivery.
Design: docs/design/nodejs-bun-delivery.md.
Same shape as the pnpm delivery hook: `cloudlinux-selector install-modules
--user ` is invoked by the panel as root and would normally re-exec the
whole selector inside the account's CageFS. The delivery replaces that
single descent with three steps driven from the root side that is already
there:
1. cagefs_enter_user -> bun_user_phase resolve (user, no package code)
2. root -> cloudlinux-bun-delivery (stage as root; rebuild
through CageFS as user;
commit or roll back)
There is no user->root bridge: inside a cage there is not even a sudo
binary. A qualifying enabled request reports a failed delivery if any phase
fails; it does not silently proceed with the ordinary npm path.
N)contextmanager)_terminate_process_grouprun_process_in_cagefs)clselectctlnodejsuser )node_modules_storagez/opt/cl-bun/bunz-/usr/share/l.v.e-manager/utils/bun_user_phasez9/usr/share/l.v.e-manager/utils/cloudlinux-bun-delivery.pyz /usr/sbin/cloudlinux-selectorx i z ^[0-9]{1,3}$ z!cl-bun:unsupported-npm-shrinkwrapzcl-bun:unsupported-manifest)patchedDependencies
workspacessymlinkz cl-bun:legacy-package-lock-v1zcl-bun:no-dependencieszPShared node_modules Store unavailable: cannot determine Node.js Selector supportc e Zd Zd Zd ZeZdS )_UserPhaseResultc 0 || _ || _ || _ d S N)failed
returncodeoutput)selfr r r s S/opt/cloudlinux/venv/lib64/python3.11/site-packages/clselector/bun_delivery_hook.py__init__z_UserPhaseResult.__init__F s $ c | j S r )r )r s r __bool__z_UserPhaseResult.__bool__K s ; r N)__name__
__module__ __qualname__r r __nonzero__ r r r r E s3
KKKr r c ` t j | }|d ot j S )zBThe global administrator switch fails closed on bad configuration.enabled)r read_confignodejs_selector_supported) config_pathconfigs r
is_enabledr& Q s2
!
-k
:
:F 9
A$>@@Br c | ||k rdS | d sdS | d s| d rdS | d }|r-|t j | d pg v rdS | d r| d sdS dS ) am Only a bare `install-modules` for a Node.js application qualifies.
Named modules and requirements files change package.json first, which
is the plain npm path's job. An account outside the administrator's
include/exclude lists takes that path too -- a policy narrowing, not a
failure, so it is silent by design where a failed delivery is loud.
Fzinstall-modulesz --modulesz--requirements-file--userexcluded_users
--app-rootT)getr r" )opts interpreternodejs_interpreterr$ users r is_deliverabler0 X s (((u 88% & & u xx )> ? ? u 88H D
-9 -..5246 6u 88H TXXl%;%; u 4r c ddl m} | | | }n# t $ r Y dS w xY wt |t
sdS | d }t |t sdS | d d }t
| rt | ndS )a The Node.js major the selector recorded for this application, or
None when there is no usable record.
This is the authority on which `~/nodevenv//` an install
belongs to. A version change creates the new venv beside the old one
and never removes the old (`selectorlib._change_version`), so a
directory listing has two answers for any application whose version was
ever changed; the record has one. The selector already reads this file
as root through `secureio`, so nothing new crosses the boundary here.
Imported lazily: the storage module is imported inside every cage on
each `npm install`, and the apps manager pulls in the panel API.
r )ApplicationsManagerNnodejs_version.) $clselect.clselectnodejs.apps_managerr2 get_app_config Exception
isinstancedictr+ strsplit
_ASCII_DIGITSmatchint)r/ app_rootr2 r% versionmajors r recorded_node_majorrB s s IHHHHH$$&&55dHEE tt fd # # tjj)**G gs # # t
MM# q !E&,,U33 =3u:::=s '
55c t j | j }n!# t $ r t ddd cY S w xY w||g}|"| t
| t | t |d|it }t |d |
d |
dd S ) zRun one account-side phase in the cage. `major` names the venv when
the selector has a record; npm_wrapper's path carries the same fact in
`CL_VIRTUAL_ENV`, which this path does not have.TN HOME)env_varstimeoutr r r ) pwdgetpwnampw_dirKeyErrorr appendr: r USER_PHASE_BINUSER_PHASE_TIMEOUTr+ )r/ phaser? rA homeargsresults r _user_phaserS s 0|D!!( 0 0 0 dB/////0 8 D CJJ
" ndfd^"$ $ $F F8 ,fjj .F.F "JJx 4 4 6 6 6s :: c t dd| d|g}|$| dt | g |$| dt | g t j |t j t j |dn|f }n # t t j f$ r Y d S w xY w|j
d
d }|j
|r|d nd
fS )zv(returncode, last stdout line) of the privileged delivery, or
(None, '') when the subprocess could not run at all.deliverr( r* Nz --node-majorz --lock-fdr )stdoutstderrpass_fds)NrD zutf-8replacerD ) DELIVERY_CLIextendr:
subprocessrunPIPESTDOUTOSErrorSubprocessErrorrY decodestrip
splitlinesr )r/ r? rA lock_fdcommandprocliness r _root_phaserm s
HdL(S NNNCJJ7 8 8 8 NNKW 6 7 7 7 ~ ?:+<"?RR
< < <
Z/ 0 xx K w 2 2 8 8 : : E E G GE ? 6E"IIB 66s B
B
B'&B'Fc * d fd}|rt S t j }t j | }n!# t $ r t Y dS w xY w|d t j k rt S t j |d |d |t j dd||| n/# t $ r" s | n# t $ r Y nw xY wY dS w xY wdS )z>Run the same restart and pre/post health check as npm install.Fc J dt st d dS )NTzselector restart failed)_selector_restart RuntimeError)r? restart_attemptedr/ s r restartz%_restart_application..restart s/ x00 : 899 9tr
app_statusdomainapp_uriT) ru aliasactionrequest_timeoutretry_on_timeout
strict_statusbaselinepost_action_observationspost_action_interval) rp nodejs_userr2 utilsget_using_realpath_keysget_user_config_datar7 APP_STARTED_CONSTcheck_response_from_webappWEBAPP_REQUEST_TIMEOUTrq )
r/ r? skip_web_checkhealth_baseliner} r~ rs appsr% rr s
`` @r _restart_applicationr s 1 x000 .00 ":: (D 5 5d ; ;= = $)))uu l{ <<< x000.(#6)+ !$%=!5
7 7 7 7 7
!
uu
4sH AA( (BB03C$ $ D1
C<;D<
D DD DDc v t j t ddddd| d|g t j t j d }n# t
$ r Y d S w xY w | t
nE# t j $ r t | Y d S t j
$ r t | Y d S w xY w|j d k S ) zERestart through the selector so its established path validation runs.rs z--jsonz
--interpreternodejsr( r* T)rY rZ start_new_sessionF)rG r ) r` Popen SELECTOR_BINrb rc rd communicateRESTART_TIMEOUTTimeoutExpiredr re r )r/ r? rk s r rp rp s
9h
t\8
5 ?:+< " $ $ $
uu 1111 $ &&&uu % &&&uu ?a s' :=
A
A A+ + B- B-,B-c # R K |r| d ng }|r8t j | st d |D rt d t
j | }t j |j t j
t j z t j z } dg|z D ]}t j |t j
t j z t j z | }t j
| j |j k r#t j | t d t j | |}d}d} t j d t j t j z | }n# t
$ r} | j t$ j k r t j d t j t j z t j z t j z d
| }d }t j ||j |j d}n[# t
$ rN}
|
j t$ j k r t j d t j t j z | }Y d}
~
nd}
~
ww xY wY d} ~ nd} ~ ww xY wt j
| } t3 j | j r| j |j k rt d t9 j |t8 j t8 j z nJ# t@ $ r= |9|rtC |d | t j | n# t
$ r Y nw xY w w xY w |V t j | n# t j | w xY w t j | dS # t j | w xY w)
z@Open the selector lock with no symlink traversal for all phases./c 3 K | ]}|d v V dS ))rD r4 z..Nr ).0parts r z"_panel_app_lock.. s' ==t4?*======r z application lock path is invalidnodevenvdir_fdz*application directory is not account-ownedNFz.locki Tz%application lock is not account-owned)"r; ospathisabsanyrd rH rI openrJ O_RDONLY O_DIRECTORY
O_NOFOLLOWfstatst_uidpw_uidcloseO_RDWRerrnoENOENTO_CREATO_EXCLfchownpw_gidEEXISTstatS_ISREGst_modefcntlflockLOCK_EXLOCK_NBr7 _unlink_same_inode) r/ r? partsaccountcurrentnamechildri createdexc
create_excinfos r _panel_app_lockr s $, 3HNN3 E :RW]]8,, :==u=====:8999l4 GggnbkBN&BR]&RSSG2 L5( DGD"+"> "N#*, , ,Ex% 77 JKKK HW GG
Z ''29r}+DWUUU
Z
Z
Z9 ,, Z ggry2:/E /QTVTa/a&+G = = =G "GIgw~w~FFF $GG Z Z Z!'5<77 ggry2=/HQX Y Y YGGGGGGZ
Z 8G$$D< --
G1N1N EFFF K !> ? ? ? ? " B&wAAAHW%%%% D MMM HW BHW
s 8B#N .F K<
J I;-A-HI;
I3%AI.)I;.I33I;6K< ;J A;K< ;N < M L10M1
L>;M=L>>MN M N M66N N&c t j | }t j || d }|j |j f|j |j fk rt j || dS dS # t $ r Y dS w xY w)zCBest-effort removal of exactly the entry created by this operation.F)r follow_symlinksr N)r r r st_devst_inounlinkrd ) parent_fdr fdpinnedr s r r r B s
" '$y%HHH M6= )gngn-M M M Id9 - - - - - - N M
s A A% %
A32A3c t | dd t k rdS t | dd }t | dk s|d t k rdS |d t
v r|d ndS )zThe manifest field the account phase refused, or None.
Only a known field name is repeated: the rest of that phase's stdout is
account-controlled text and must not reach the panel message.
r Nr rD r r )getattrUNSUPPORTED_MANIFEST_RCr; len UNSUPPORTED_MANIFEST_SENTINELUNSUPPORTED_MANIFEST_FIELDS)resolvedr s r _unsupported_manifest_fieldr M s~ x t,,0GGGt Hh + + 1 1 3 3E
5zzQ%(&CCCt Qx#>>>588DHr c B t j s t j S t | | } t | | 5 }t | d|| }|st
|dd t k r-t
|dd t k rt cddd S t
|dd t k r-t
|dd t k rt cddd S t
|dd t k r-t
|dd t k rt cddd S t | t cddd S ddd dS t | ||| \ }}|t k r|rd|z cddd S |t" k r|rd|z cddd S |t$ k r ddd dS |d k r ddd d
S ddd n # 1 swxY w Y n# t& t( f$ r Y d S w xY wt+ | || sd
S dS )a[ Run the phases. Returns None on success, or a message naming the
phase that failed.
The caller reports the message and fails the install rather than quietly
running npm. The
privileged phase retains the previous tree until the account-side rebuild
and marker commit succeed. Any failure restores that exact previous tree.
resolver Nr rD z(bun delivery failed in the resolve phasezbun delivery refused: %sz@bun delivery failed in the rebuild phase; previous tree restoredr zUbun delivery failed in the privileged phase; see /var/log/cloudlinux/bun-delivery.logz2bun delivery failed acquiring the application lock)r z(bun delivery failed in the restart phase)r engine_availableENGINE_UNAVAILABLErB r rS r LEGACY_PACKAGE_LOCK_RC LEGACY_PACKAGE_LOCK_SENTINELCLASSIC_NPM_FALLBACKSHRINKWRAP_UNSUPPORTED_RC SHRINKWRAP_UNSUPPORTED_SENTINELNO_DEPENDENCIES_RCNO_DEPENDENCIES_SENTINELr rm REGISTRY_REFUSED_RCUNSUPPORTED_SOURCE_RCREBUILD_FAILED_RCrd rK r )r/ r? r rA ri r r details r deliver_modulesr [ s 0 2 2 7#66 h / /E(D
T8
,
, % @"4HeDDH
BHlD99=SSS #Hh ; ;7 8 8/
% @ % @ % @ % @ % @ % @ % @ % @ HlD99=VVV #Hh ; ;: ; ;
0% @ % @ % @ % @ % @ % @ % @ % @ HlD99=OOO #Hh ; ;3 4 4 0+% @ % @ % @ % @ % @ % @ % @ % @, /x88D 05% @ % @ % @ % @ % @ % @ % @ % @6 B7% @ % @ % @ % @ % @ % @ % @ % @8 "-T8UG!L!L J 000V01F:=% @ % @ % @ % @ % @ % @ % @ % @> 222v21F:A% @ % @ % @ % @ % @ % @ % @ % @B ...YE% @ % @ % @ % @ % @ % @ % @ % @F Q?I% @ % @ % @ % @ % @ % @ % @ % @F G% @ % @ % @ % @ % @ % @ % @ % @ % @ % @ % @ % @ % @ % @ % @L
X D D DCCCD
h~ N N N :99 4s G3 AG' G3 :G' G3 %:G' G3 ,G' G3 G' G3 &G' G3 G' G3 - G'9 G3 G'
G3 G3 'G++G3 .G+/G3 3HHr )NN)FNr r )F)6__doc__r rH rer` r r r
contextlibr clselect.utilsr r clselectr r rD r CONFIG_PATHBUN_BINrM r^ r r rN compiler< r r r r r r r r r objectr CAPABILITY_UNAVAILABLEr r& r0 rB rS r r r rm r rp r r r r r r r r sa (
% % % % % % J J J J J J J J 9 9 9 9 9 9 " " " " " "".
@J .
?++
"E = O > 3 vxx ? v ' B B B B GR 6> > ><6 6 6 6( 7 7 7 7* 9>HI./- - - -` * : : :z
I I I : : : : : :r