23s2s

✏️ Editing: wpos_req_scanner.py

# clwposcron Utility to scan domains for Cloudlinux WPOS requirements by cron
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2021 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

import json
import logging
import os
import subprocess
import time

from clwpos.clsop_repair import repair_clsop_copies_if_needed
from clwpos.logsetup import setup_logging

class CloudlinuxWposReqScanner:
    """
    Class for run clwposcron functionality
    """

TIMEOUT_24H_SECONDS = 24 * 3600
    # Bounded wait for `clwpos-admin generate-report`. The command forks the scan
    # and returns immediately, so a well-behaved run finishes in seconds; this cap
    # keeps a misbehaving/blocked child from wedging the flock-guarded cron.
    GENERATE_REPORT_TIMEOUT_SECONDS = 300
    _CRON_LOG_FILE = '/var/log/clwpos/req_cron.log'

def __init__(self):
        self._file_flag_force_check = '/var/lve/clwpos/cl_wpos_scan_req_force'
        self._scan_req_scan_last_ts = '/var/lve/clwpos/cl_wpos_scan_req_last_ts'
        self._logger = setup_logging(
            caller_name='clwpos_req_cron',
            # Uncomment this for console debug
            # console_level=logging.DEBUG,
            file_level=logging.INFO,
            logfile_path=self._CRON_LOG_FILE,
        )

def _get_last_start_time(self) -> float:
        """
        Get last time start time from file
        :return: Last start time as UNIX timestamp
        """
        try:
            with open(self._scan_req_scan_last_ts, 'r') as f:
                s_last_ts = f.read()
            last_ts = float(s_last_ts)
        except (OSError, ValueError):
            last_ts = 0.0
        return last_ts

def _save_last_start_time(self, last_time: float):
        """
        Save last time to file
        :param last_time: Last time (UNIX timestamp) to save
        """
        with open(self._scan_req_scan_last_ts, 'w') as f:
            f.write(str(last_time))

def _is_24h_passed(self, ts_now: float) -> bool:
        """
        Check is 24h interval passed
        :param ts_now: 'now' UNIX timestamp
        :return: True - passed, False - not passed
        """
        last_ts = self._get_last_start_time()
        # 24h not passed yet when the last run is inside the window
        return not (last_ts != 0.0 and ts_now - last_ts < self.TIMEOUT_24H_SECONDS)

def run(self):
        """
        Run command action
        """
        self._logger.debug("CL AWP requirements cron script started")

# One pass per machine over the plugin copy inside each site (CLOS-7040), before the gates
        # below: the 24h timer and the force flag belong to the scan, and a repair held behind them
        # could wait a day while the sites it fixes are down. It costs one stat once it is done, and
        # never raises, so the scan that follows is unaffected.
        repair_clsop_copies_if_needed()

try:
            if not os.path.exists(self._file_flag_force_check):
                # force start flag file absent, check 24h timeout
                ts_now = time.time()
                is_24h_passed = self._is_24h_passed(ts_now)
                if not is_24h_passed:
                    # 24h not passed from last run this script - do nothing
                    self._logger.debug("24 hours not passed - do nothing")
                    return 0
                # timestamp file old/absent, create it
                self._save_last_start_time(ts_now)
            else:
                self._logger.info("Force start")
                # Force start
                try:
                    os.remove(self._file_flag_force_check)
                except OSError:
                    self._logger.exception('%s remove error', self._file_flag_force_check)
            # Run file generation
            try:
                # /usr/bin/clwpos-admin generate-report --all
                proc = subprocess.Popen(
                    ['/usr/bin/clwpos-admin', 'generate-report', '--all'],
                    shell=False,
                    stdout=subprocess.PIPE,
                    stderr=subprocess.PIPE,
                    text=True,
                )
                try:
                    stdout, stderr = proc.communicate(timeout=self.GENERATE_REPORT_TIMEOUT_SECONDS)
                except subprocess.TimeoutExpired:
                    # Do not let a stuck child hold the cron's flock indefinitely:
                    # kill and reap it, log, and bail out for this tick.
                    proc.kill()
                    proc.communicate()
                    self._logger.warning(
                        '/usr/bin/clwpos-admin generate-report timed out after %ds - killed',
                        self.GENERATE_REPORT_TIMEOUT_SECONDS,
                    )
                    return 0
                if proc.returncode != 0:
                    self._logger.warning(
                        '/usr/bin/clwpos-admin generate-report start error: retcode=%d\nstdout: %s\nstderr: %s',
                        proc.returncode,
                        stdout,
                        stderr,
                    )
                result_dict = json.loads(stdout)
                if result_dict['result'] != 'success':
                    self._logger.info('/usr/bin/clwpos-admin generate-report result: %s', stdout)
                    self._logger.warning('/usr/bin/clwpos-admin generate-report error')
            except (OSError, json.JSONDecodeError, KeyError):
                self._logger.exception('/usr/bin/clwpos-admin generate-report start exception')
        except Exception:
            self._logger.exception('CL AWP requirements cron script general error')
        return 0

Sid Gifari From Gifari Industries - BD Cyber Security Team