@jz d Z ddlZddlZddlZddlZddlmZmZmZ ddl m
Z
ddl m Z ddl
mZ ddlmZ dZd Zd
Zd Z ej e Zd efd
Zded efdZded ee fdZ e
fded ee fdZ e
fdee ded efdZ efded ee fdZ deded dfdZ deded eeef fdZ!dZ"e
efdeded efdZ#e
efdeded efdZ$d ee d e%fd Z&dS ) a Keep kernel.lve_ipc_isolation in step with the lve-ipc-isolation feature flag.
The decision point of this feature is inside kmod-lve: the module reads the
sysctl when it sets up a per-user LVE, so it cannot ask clflags.is_enabled()
itself. This module asks on its behalf and writes the answer where the module
reads it:
- persisted in /etc/sysctl.d/90-cloudlinux.conf, which lve.service re-applies
right after it loads the module - so the value is in place before the first
LVE of every boot is created;
- live in /proc/sys/kernel/lve_ipc_isolation, while the module is loaded.
The feature ships off, and "off" means the kernel default: the line is dropped
from the config rather than pinned to 0, so a server that never opted in
carries no setting for a key its kernel may not have.
Only that one line and that one /proc key are ever written. clcommon's
SysCtlConf is deliberately not used here: its set() and remove() run
`sysctl --system`, which re-applies every sysctl file on the server, and this
helper runs whenever the flag changes - at runtime, not only at install - so
it must not undo settings an administrator changed by hand.
Run by lve-ipc-isolation.service - at boot after lve.service, whenever
lve-ipc-isolation.path sees one of the feature's own flag files change, and
every five minutes from lve-ipc-isolation.timer as a safety net for a change
the path unit missed - and by the lve-utils install scriptlets. Idempotent:
nothing that already matches is touched.
N)ListOptionalTuple)SYSCTL_CL_CONF_FILE)get_file_lines)
is_enabled) init_lve_utils_sentry_clientlve-ipc-isolationzkernel.lve_ipc_isolationz"/proc/sys/kernel/lve_ipc_isolationFreturnc 8 t t t S )zRWhether the flag switches the feature on for this server; asked afresh every time.)default)r FEATURESHIPS_ON py/lve_utils/ipc_isolation.pywantedr ; s gx 0 0 00r linec | }| d sd|vrdS | d \ }}}| t k S )zUWhether a sysctl config line sets SYSCTL_NAME (comments and other keys are not ours).#=F)strip
startswith partition SYSCTL_NAME)r strippedkey_s r _is_our_liner @ s` zz||H3 3h#6#6u""3''ICA 99;;+ %%r config_filec | t j | sg S t t | S )N)ospathisfilelistr )r s r _read_linesr& I s3
7>>+ & & {++ , ,,r c d}t | D ]P}t | r?| d d }Q|S )z_The value the CloudLinux sysctl config carries for the key, or None when it has no line for it.Nr )r& r r r )r valuer s r persisted_valuer* O s` EK(( ; ; ;JJLL**3//288::E Lr r) c t | }d |D }|r+|d d s|dxx dz
cc< | | t d| d ||k rdS t j | pd}t j | r t j | j dz nd }t j d
| \ }} t j |d d
5 }|
| | t j | ddd n # 1 swxY w Y t j || t j || n5# t& $ r( t j | n# t* $ r Y nw xY w w xY wdS )a
Set (value) or drop (None) the key's line in config_file, leaving every other line as it is.
Written atomically (temp file in the same directory, then rename), so
lve.service never sees a half-written file at boot. Returns whether the
file changed.
c 0 g | ]}t | |S r )r ).0r s r
zpersist..a s% = = =T,t*<*< =D = = =r
Nz = F.i i z.90-cloudlinux.)prefixdirwutf-8encodingT)r& endswithappendr r" r# dirnamer$ statst_modetempfilemkstempfdopen
writelinesflushfsyncfilenochmodreplace
BaseExceptionunlinkOSError) r) r lineskept directorymodefdtmp_pathtmps r persistrP Y s
$ $E = =U = = =D DH%%d++ RD {00u000111 u}}u ,,3I357>>+3N3N Y27; '% / /TYD#+<)LLLLB
Yr3
1
1
1 #S NN4 IIKKK HSZZ\\ " " " # # # # # # # # # # # # # # # 4
8[)))) Ih D
4sU +F AE F E""F %E"&-F
G F43G4
G>G GG proc_pathc t | d 5 }| cddd S # 1 swxY w Y dS # t $ r Y dS w xY w)zLThe value the loaded module runs with, or None while kmod-lve is not loaded.r5 r6 N)openreadr FileNotFoundError)rQ proc_files r
live_valuerW | s
)g
.
.
. ,) >>##))++ , , , , , , , , , , , , , , , , , , tts3 A &A A A
A
A
A
A! A!c t |dd 5 }| | d d d d S # 1 swxY w Y d S )Nr4 r5 r6 )rS write)r) rQ rV s r _set_liverZ s
iw / / / 9 s 6::c t }|rdnd}d}t |rdnd| rS|r(t dt t
| n't dt t
| d}t
| }|'t dt t
n@||k r:t || t d t t
|| d}||fS )
zOne pass: read the flag, bring both copies of the sysctl in line with it.
Returns (the flag state that was applied, whether anything had to change).
10FNz %s is on: %s = 1 persisted in %sz %s is off: %s dropped from %sTz6%s: kmod-lve is not loaded, %s takes effect once it isz=%s: %s set to %s (was %s); LVEs created from now on follow it)r rP loggerinfor r rW rZ )r rQ onr) changedlives r _apply_oncerc s
B CC3EGb"ssdK00
\ KK:G[R] ^ ^ ^ ^ KK7+{ [ [ [ i D | LgWbcccc
%### KWVachjn
w;r c d}t t D ]-}t | | \ }}|p|}t |k r n.|S )aG Bring the persisted and the live sysctl in line with the flag.
The flag can change while a pass runs - the path unit does not start the
service again for an event that arrives during a run - so the pass is
repeated until the flag reads the same before and after it. Returns
whether anything had to change.
F)range
SETTLE_PASSESrc r )r rQ ra r applied pass_changeds r applyrj s\ G
=
!
! +K C C )\ 88w E Nr c t | }t | }d t dt rdnd t
d||nd t
d||nd f S )
zIA short report of the flag and of both copies of the sysctl, for support.r0 z: r` offz persisted: Nz(not set, kernel default 0)z live: z(kmod-lve not loaded))r* rW joinr r r )r rQ persistedrb s r statusro s ,,I i D 99 7 7&((5$$ 7 7 o oY5J Pm o o Z Z4+;44AX Z Z
r argvc t j ddt dt d }| ddd | | }t
j t j d
|j r t t d S t d t n?# t $ r2}t d
t t | Y d }~dS d }~ww xY wd S )Nr
z
Apply the z feature flag to r1 )prog descriptionz--status
store_truez8report the flag and the sysctl without changing anything)actionhelpz %(message)s)levelformatr z%s: could not apply %s: %s )argparseArgumentParserr r add_argument
parse_argslogging basicConfigINFOro printr rj rH r^ error)rp parserargserrs r mainr s
$
III;III F
G
T " "D gl=AAAA {
fhhq !4555
17KMMMqqqqq
1s )B8 8
C4'C//C4)'__doc__rz r~ r" r= typingr r r clcommon.sysctlr clcommon.utilsr clflagsr lve_utils.sentryr r r PROC_PATHr getLogger__name__r^ boolr strr r& r* rP rW rZ rc rg rj ro intr r r r r s : ( ( ( ( ( ( ( ( ( ( / / / / / / ) ) ) ) ) ) 9 9 9 9 9 9
( 0 8 $ $1 1 1 1 1
&s &t & & & &-S -T#Y - - - - (; x} 6I 8C= s T F !* # hsm S S T
S S U4:5F <
19 s S QU " 2I
c
RU
tCy
S
r