Sid Gifari From Gifari Industries - BD Cyber Security Team
Home
/
opt
/
cloudlinux
/
venv
/
lib
/
python3.11
/
site-packages
/
lve_utils
/
__pycache__
/
✏️
Editing: ipc_isolation.cpython-311.opt-1.pyc
� �@�jz � �� � d Z ddlZddlZddlZddlZddlmZmZmZ ddl m Z ddlmZ ddl mZ ddlmZ dZd Zd ZdZ ej e� � Zdefd �Zdedefd�Zdedee fd�Ze fdedee fd�Ze fdee dedefd�Zefdedee fd�Zdededdfd�Z dededeeef fd�Z!dZ"e efdededefd�Z#e efdededefd�Z$dee de%fd�Z&dS )a� Keep kernel.lve_ipc_isolation in step with the lve-ipc-isolation feature flag. The decision point of this feature is inside kmod-lve: the module reads the sysctl when it sets up a per-user LVE, so it cannot ask clflags.is_enabled() itself. This module asks on its behalf and writes the answer where the module reads it: - persisted in /etc/sysctl.d/90-cloudlinux.conf, which lve.service re-applies right after it loads the module - so the value is in place before the first LVE of every boot is created; - live in /proc/sys/kernel/lve_ipc_isolation, while the module is loaded. The feature ships off, and "off" means the kernel default: the line is dropped from the config rather than pinned to 0, so a server that never opted in carries no setting for a key its kernel may not have. Only that one line and that one /proc key are ever written. clcommon's SysCtlConf is deliberately not used here: its set() and remove() run `sysctl --system`, which re-applies every sysctl file on the server, and this helper runs whenever the flag changes - at runtime, not only at install - so it must not undo settings an administrator changed by hand. Run by lve-ipc-isolation.service - at boot after lve.service, whenever lve-ipc-isolation.path sees one of the feature's own flag files change, and every five minutes from lve-ipc-isolation.timer as a safety net for a change the path unit missed - and by the lve-utils install scriptlets. Idempotent: nothing that already matches is touched. � N)�List�Optional�Tuple)�SYSCTL_CL_CONF_FILE)�get_file_lines)� is_enabled)�init_lve_utils_sentry_client�lve-ipc-isolationzkernel.lve_ipc_isolationz"/proc/sys/kernel/lve_ipc_isolationF�returnc �8 � t t t �� � S )zRWhether the flag switches the feature on for this server; asked afresh every time.)�default)r �FEATURE�SHIPS_ON� � �py/lve_utils/ipc_isolation.py�wantedr ; s � ��g�x�0�0�0�0r �linec �� � | � � � }|� d� � sd|vrdS |� d� � \ }}}|� � � t k S )zUWhether a sysctl config line sets SYSCTL_NAME (comments and other keys are not ours).�#�=F)�strip� startswith� partition�SYSCTL_NAME)r �stripped�key�_s r �_is_our_liner @ s` � ��z�z�|�|�H����3��� �3�h�#6�#6��u��"�"�3�'�'�I�C��A��9�9�;�;�+�%�%r �config_filec �| � t j � | � � sg S t t | � � � � S )N)�os�path�isfile�listr )r s r �_read_linesr&