@jddlZddlZddlZddlmZmZddlmZddlm Z ej e Z GddeeZ dS)N)ModifyDomainHookModifyUserHook)lve_supported_or_exit)registry_path_by_usernameczeZdZdZdZe ddZedZedZe d dZ dS) DomainLimitsHookz Keep the LVD on-disk state (domains.json + binary id-registry) in sync with control-panel domain and user events so that per-domain limits keep working. z/usr/sbin/lvectlNc Nt|sdS|p|}|jdd|d|g} |r| d|gz } |r| d|gz } tj| dd} | jd krNt d | j| jd  dSdS) Nregenerate-domains --usernamez--domainz --old-domainz --old-docrootTFcapture_outputcheckrz%regenerate-domains failed (rc=%d): %sreplaceerrors rLVECTL subprocessrun returncodelogwarningstderrdecodestrip) selfusernamedomain new_domaininclude_subdomains old_docroot new_docrootkwargscurrent_domaincmdresults (py/lve_utils/hooks/domain_limits_hook.pypost_modify_domainz#DomainLimitsHook.post_modify_domains )22  F#-v K- (    , NF+ +C  2 O[1 1CDFFF   ! ! KK7! $$I$66<<>>      " !c "t|sdS|jdd|d|g}tj|dd}|jdkrNt d |j|jd  dSdS) aDrop the registrations the deleted domain leaves behind. Nothing else does: the registry entry is written by root, the panel never learns of it, and the single-domain regenerate path needs a docroot the panel can still resolve. Left alone the entry, its domains.json record and its kernel LVE outlive the domain, and every later `lvectl apply` reports the account as holding a registration the panel no longer lists (CLOS-7467). Nr r z--deleted-domainTFr rz;regenerate-domains after domain deletion failed (rc=%d): %srrr)rrrr#r%r&s r'post_delete_domainz#DomainLimitsHook.post_delete_domain8s)22  F K- (   DFFF   ! ! KKM! $$I$66<<>>      " !r)c t|sdStj|j}|jd|g|jdt |gfD]w}t j|dd}|jdkrSt d|d |j|j d  xdS) a[Tear down the per-domain state of an account being deleted. Runs before deletion because the marker is keyed by uid, which no longer resolves once the account is gone. Left alone, the marker, lvp and the domain LVEs outlive the account, and the marker keeps counting a dead uid as allowed (CLOS-7502). deny-domain-limits ends with an apply that recreates lve, and listener order is not fixed, so LveLifecycleHook may already have destroyed it; destroy it again here so this hook does not itself leave lve behind. Nzdeny-domain-limitsdestroyTFr rz*%s before user deletion failed (rc=%d): %srr)rpwdgetpwnampw_uidrstrrrrrrrrr)rrr#uidr%r&s r'pre_delete_userz DomainLimitsHook.pre_delete_userSs)22  Fl8$$+["6A[)SXX68  C^CEJJJF A%% @F%M(( (::@@BB   r)c &|dSt|sdS|jdd|g}tj|dd}|jdkrNt d|j|jd  dSdS) Nr r TFr rz7regenerate-domains after user rename failed (rc=%d): %srrr)rrnew_name new_ownerr#r%r&s r'post_modify_userz!DomainLimitsHook.post_modify_userps   F(22  F K- ( DFFF   ! ! KKI! $$I$66<<>>      " !r))NNNN)NN) __name__ __module__ __qualname____doc__rrr(r+r4r8r)r'rrs  F15*.84826#'r)r)loggingr/rclcommon.public_hooks.librrclcommon.lib.cleditionrwebsiteisolation.id_registryr getLoggerr9rrr=r)r'rCs FFFFFFFF888888BBBBBBg!!ppppp'pppppr)