Sid Gifari From Gifari Industries - BD Cyber Security Team
Home
/
opt
/
cloudlinux
/
venv
/
lib
/
python3.11
/
site-packages
/
ssa
/
__pycache__
/
✏️
Editing: website_isolation.cpython-311.pyc
� ūj�N � �b � d Z ddlZddlZddlZddlZddlmZ ddlZddlm Z ddl mZ ddlm Z mZmZmZmZ ddlmZmZ n# e$ r d � Zd � ZY nw xY w ej e� � Zdd�Zd � Zddeddfd�Zdd�Zdefd�ZdZdZ d� Z!d� Z" ej# d� � Z$defd�Z%de&ddfd�Z'dde&deddfd�Z(dS )z� Website isolation support for SSA (clos_ssa.ini) files. This module provides functions to manage clos_ssa.ini files in per-website directories when CageFS website isolation is enabled. � N)�iglob)�drop_privileges)� disable_quota� )� INI_FILE_NAME�INI_USER_LOCATIONS_BASE�$INI_USER_LOCATIONS_WEBSITE_ISOLATION�extract_php_version�is_excluded_path)�is_isolation_enabled�(is_website_isolation_allowed_server_widec � � dS �NF� r � �L/opt/cloudlinux/venv/lib64/python3.11/site-packages/ssa/website_isolation.pyr r + � � ��ur c � � dS r r )�users r r r . r r �returnc �` � |||� � 5 t � � 5 t j | t j t j z t j z t j z t j z d� � }t j |d� � 5 }t j t j |� � � � � j � � st d� � �|� |� � ddd� � n# 1 swxY w Y ddd� � n# 1 swxY w Y ddd� � dS # 1 swxY w Y dS )a� Write content into a per-website clos_ssa.ini under the tenant context. O_NOFOLLOW refuses a tenant-planted symlink at the ini path (raises OSError ELOOP on a final-component symlink). O_NONBLOCK stops a tenant-planted FIFO from blocking the shared regen thread forever on open() (a reader-less O_WRONLY FIFO open fails ENXIO instead of hanging). The fstat check then refuses any non-regular target (FIFO/device/socket) by raising OSError, so it is skipped rather than written (and, like the O_NOFOLLOW/O_NONBLOCK refusals, is never counted by callers as a created ini). O_NONBLOCK has no effect on regular-file writes. Callers handle the raised OSError per-target. i� �wz=refusing to write non-regular ini target (not a regular file)N)r �os�open�O_WRONLY�O_CREAT�O_TRUNC� O_NOFOLLOW� O_NONBLOCK�fdopen�stat�S_ISREG�fstat�fileno�st_mode�OSError�write)�ini_file�content�uid�gid�user_context_func�fd�fs r �_write_isolation_inir/ 5 s� � � � �3�� $� $� � �m�o�o� � � �W�X�r�{�R�Z�7�"�*�D�r�}�T�WY�Wd�d�fk� l� l�� �Y�r�3� � � �1��<�������� 4� 4� <�=�=� _� �]�^�^�^� �G�G�G���� � � � � � � � � � � ���� � � � � � � � � � � � � � � ���� � � � � � � � � � � � � � � � ���� � � � � � sZ �D#�A*D�A"C4�(D�4C8�8D�;C8�<D�?D#�D �D#�D �D#�#D'�*D'c �> � |||� � 5 t j | t j t j z t j z � � }t j |� � 5 }t j t j |� � � � � j � � s4t � d| � � ddd� � ddd� � dS |� � � cddd� � cddd� � S # 1 swxY w Y ddd� � dS # 1 swxY w Y dS )a� Read a base clos_ssa.ini under the tenant context, refusing non-regular sources. The base ini path is tenant-controlled, so the same hardening as the write helper applies: O_NOFOLLOW refuses a final-component symlink (ELOOP), and O_NONBLOCK makes an O_RDONLY open of a tenant-planted FIFO return immediately instead of blocking the shared regen thread forever waiting for a writer. The fstat check on the opened fd then refuses any non-regular source (FIFO/device/ socket): it is skipped rather than read. Returns the file content, or None if the source is non-regular. Callers handle the raised OSError per-source. z#Refusing to read non-regular ini %sN)r r �O_RDONLYr r r r! r"