@jng ` d Z ddlZddlmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl m
Z
mZ ddlmZmZ ddlmZ ddlmZmZ ddlmZmZ dd lm Z d
d l m Z d
d l m Z d
d
l m!Z!m"Z" ej# e$ Z%dZ&dZ'd
Z(dZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0dZ1d Z2d Z3d Z4e
G d d Z5e
G d d Z6e
G d d! Z7ed" Z8d# Z9d$ Z:d% Z;d& Zd) Z?d* Z@ejA d+ ZBed,eCfd- ZDd. ZEd/ ZFd0 ZGd1 ZHd2 ZIdS )4z9Per-user domain config persistence (~/.lve/domains.json). N)cache) dataclassfield)ListOptional)
disable_quota)ClPwddrop_privileges) userdomainsdocroot)CPAPIException )domain_lve_sentry_extra) id_registry) ErrorCodeLvdErrorz.lvez domains.jsong $@g?i i )cpupmemionprociopsepvmemi ii )r r c l | t v r t t z t t z fS t t fS )zEReturn the inclusive (min, max) a stored *field_name* value may take.)
_BYTES_FIELDS
_INT32_MIN PAGE_SIZE
_INT32_MAX)
field_names py/websiteisolation/config.py
_limit_boundsr! I s- ]""I%zI'=== z !! c
^ t | }nS# t t t f$ r9}t d| dt | j t j dd}~ww xY wt | \ }}||cxk r|k s)n t d| d| d| d| t j |S )a2 Coerce *value* to int and bound it to what *field_name* can carry.
The single definition of "a usable limit value", shared by the reader and
the writer. They disagreed once, and a value that could be written but not
read back made the whole account's configuration unreadable (CLOS-7494).
limit 'z' must be an integer, got codeNz' out of range [z, z], got )
int TypeError
ValueError
OverflowErrorr type__name__r
INVALID_VALUEr! )r valueivelowhighs r _validate_limitr3 P s
4
ZZ z= 1 4 4 4
*j
*
*;;'
*
*(* * * 04 4 4 j))IC " Jj J J# J J J Jb J J(* * * * Is A"4A A"c | t v r?d|cxk r t k r/n dS t d| dt d| t j dS dS )a_ Refuse a memory limit smaller than one page, other than 0.
The kernel takes memory limits in pages, so a value below PAGE_SIZE
reaches it as 0 -- unlimited -- while the caller is told it was set
(CLOS-7520). Checked on write only: a stored record with such a value
still reads back, so the account's other records stay reachable.
r r$ z$' must be 0 (unlimited) or at least z bytes, got r% N)r r r r r- )r r. s r _reject_sub_pager5 m s ]""q5'<'<'<'<9'<'<'<'<'<'<
.j
.
.
.
.&+
.
.(* * * * #"'<'z(DomainLimits.to_dict.. s HHHA!-1---r" )__dict__itemsselfs r to_dictzDomainLimits.to_dict s$ HH !4!4!6!6HHHHr" c |s
| S t |t s$t dt | j d | D } | di |S )Nz limits must be an object, got c H i | ] \ }}|t v |t || S r; LIMIT_FIELDSr3 r< s r r@ z*DomainLimits.from_dict.. s? A A Aaa<.?.? _Q**.?.?.?r" r; )
isinstancedictr r+ r, rB )clsdatavaluess r from_dictzDomainLimits.from_dict s 355L$%% SQDJJ. s> = = =$!Q\))am 1--.;mmr" N)rB r5 setattr)rD kwargs validatedr> r? s r updatezDomainLimits.update s = =&,,.. = = = OO%% # #DAq Q " " " " OO%% DAq D!Q r" c b t d | j D S )Nc 3 K | ]}|d uV d S r: r; )r= r? s r z(DomainLimits.__bool__.. s& AAQ1D=AAAAAAr" )anyrA rN rC s r __bool__zDomainLimits.__bool__ s- AA$-*>*>*@*@AAAAAAr" )r,
__module__ __qualname__r r r' __annotations__r r r r r r rE classmethodrO rU rZ r; r" r r7 r7 | s C# D(3- B
E8C= D(3- B
D(3- I I I [ &B B B B Br" r7 c \ e Zd ZU dZeed< ee Zeed< d Z e
d Z dS ) DomainEntry namedefault_factorylimitsc D | j | j dS )Nrb re )rb re rE rC s r rE zDomainEntry.to_dict s' Ik))++
r" c t |t s$t dt | j | dd }t |t s$t dt | j | |t | d S )Nz$domain entry must be an object, got rb ra z$domain 'name' must be a string, got re rg ) rJ rK r r+ r, getstrr7 rO )rL rM rb s r rO zDomainEntry.from_dict s $%% YW$t**BUWWXX X xx##$$$ YW$t**BUWWXX Xs ))$((8*<*<==
r" N) r, r[ r\ rb rj r] r r7 re rE r^ rO r; r" r r` r` sj D#NNN 5 >>>FL>>>
[
r" r` c t e Zd ZU eZeed< ee Z e
e ed< eddd Z e
e ed< eddd Zeed< ed Zd
Zd Zd Zd
Zd Zedd Zedd ZddZee j dd Z ed Z ed Z d Z!dS ) LvdConfigversionrc domainsNF)defaultreprcompare_lve_id _degradedc | j S )a True when this config stands in for a file that could not be read.
It is empty like a fresh config, but the two mean opposite things: a
fresh config says the account has no records, this one says its records
could not be reached. Anything that would present it as the account's
configuration, or write it back, has to tell them apart (CLOS-7494).
)rs rC s r
unreadablezLvdConfig.unreadable s ~ r" c 8 | j D ]}|j |k r|c S dS )z5Find domain entry by name. Returns None if not found.N)rn rb )rD rb ds r find_domainzLvdConfig.find_domain s1 Av~~ tr" c 8 fd| j D | _ dS )z Remove domain entry by name.c * g | ]}|j k
|S r; rb )r= rw rb s r
z+LvdConfig.remove_domain.. s BBBa16T>>>>>r" N)rn )rD rb s `r
remove_domainzLvdConfig.remove_domain s$ BBBB4<BBB r" c
t | j | }|rS| | @| j t | | dS dS dS # t $ rO}t d| j |dt dt | j Y d}~dS d}~ww xY w)zEResolve domain name from *docroot* and add it to the config.
Nr{ z(add_domain_by_docroot: uid=%s docroot=%sTzadd-domain-by-docrootexc_infoextra)
_resolve_domain_for_docrootrr rx rn appendr` saver logerrorr r+ r, rD r domain_nameexcs r add_domain_by_docrootz LvdConfig.add_domain_by_docroot s
b5dlGLLK
t / / < < D ##K[$A$A$ABBB
D D b b b
II@lGd 34KTRUYYM_ ` `
b
b
b
b
b
b
b
b
b
bs A(A0 0
C :ACC c
r t | j | }|r@| | -| | | dS dS dS # t
$ rO}t d| j |dt dt | j
Y d}~dS d}~ww xY w)zJResolve domain name from *docroot* and remove it from the config.
Nz+remove_domain_by_docroot: uid=%s docroot=%sTzremove-domain-by-docrootr ) r rr rx r} r r r r r r+ r, r s r remove_domain_by_docrootz"LvdConfig.remove_domain_by_docroot s
e5dlGLLK
t / / < < H"";///
H H e e e
IIClGd 34NPTUXPYPYPb c c
e
e
e
e
e
e
e
e
e es AA
B6'AB11B6c 4 | j d | j D dS )Nc 6 g | ]}| S r; )rE r= rw s r r| z%LvdConfig.to_dict.. s ::: :::r" rm rn r rC s r rE zLvdConfig.to_dict s) |::T\:::
r" c * t |t s$t dt | j d|vrt d |d }t |t
s$t dt | j t
| t k r>t d|t
| t |d t } | |
dt d |D | S ) Nz config must be an object, got rn zconfig has no 'domains' keyz 'domains' must be a list, got z8domains.json for lve_id %s has %d domains; capping at %drm c B g | ] }t | S r; )r` rO r s r r| z'LvdConfig.from_dict..+ s& ???![**1--???r" )rm rn rr ) rJ rK r r+ r, listlen MAX_DOMAINSr warningri LVD_CONFIG_VERSION)rL rM lve_idrn s r rO zLvdConfig.from_dict s $%% HFd1DFFH H
H D 899 9y/'4(( VTDMM>c 4 | j t d | j r1t dt | j dt j | | j | 5 | ddd dS # 1 swxY w Y dS )zWrite domains.json for this user (acquires flock for the write).
*lock_timeout* overrides _LOCK_TIMEOUT for this call only. See _flock.
Nz,cannot save: config has no associated lve_idzrefusing to overwrite zy: its current contents could not be read, so this write would discard every record in it. Repair or remove the file firstr% r )rr r rs config_pathr CONFIG_UNREADABLEr _write)rD r s r r zLvdConfig.save: s
< IJJ J >
2 OT\)B)B O O O 0 2 2 2
2
[[ |[
<
< KKMMM s +B
BBc # K |t n|}t | 5 t | }t j |d }t j |t j t j z d } t j
|z } t j |t j
t j z n# t $ r}}|j t j t j fvr t j
|k r#t' d| d| dt( j |t j t. Y d}~nd}~ww xY wdV t j |t j t j | n8# t j |t j t j | w xY w ddd dS # 1 swxY w Y dS ) a Exclusive flock on a per-user sidecar file.
*timeout* defaults to _LOCK_TIMEOUT, which is sized for operations
where skipping a tenant has a cost (`lvectl apply all` leaving its
limits stale). A caller that only *reads* to count, and would rather
skip this account than spend the budget, passes a shorter one: at the
10s default a handful of tenants holding their own lock can consume a
whole batch's time budget and starve every account behind them
(CLOS-7026).
Nz
.domains.locki Tztimed out after zs acquiring domain lock z; another process holds itr% )
_LOCK_TIMEOUT user_contextensure_config_dirospathjoinopenO_CREATO_RDWRtime monotonicfcntlflockLOCK_EXLOCK_NBOSErrorerrnoEAGAIN EWOULDBLOCKr r BACKEND_UNAVAILABLEsleep_LOCK_RETRY_INTERVALLOCK_UNclose)r r budget
config_dir lock_pathfddeadliner s r r zLvdConfig._flockQ s #*/ w
&
!
! *622J Z AAIBJ$:EBBB
>++f4
9 9 B
(EFFF " 9 9 9 9U\5;L,MMM ! >++x77"*!U6 !U !U/8!U !U !U%.%B# # # $' '
#788888888 9
9 B
... B
... / sU A G ;F,C ?F
E
A3E=FEF4G 5F88G G
G
c | |d S )a The safe default for a file that exists but could not be used.
Empty so a root batch carries on for every other tenant, but flagged so
it is never mistaken for "this account has no records" -- see
LvdConfig.unreadable and save().
T)rr rs r; )rL r s r _unreadablezLvdConfig._unreadablex s s6T2222r" c B t | }t j | s | | S t j |t j t j z t j z } t j | }t j
|j sKt
d| | | |dk rt j | S S t j |d 5 }d}| t$ dz }t' | t$ k r]t
d|t$ | | cd d d |dk rt j | S S t) j | }d d d n # 1 swxY w Y |dk rt j | n # |dk rt j | w w xY wnU# t, t. t0 f$ r;}t
d|| | | cY d }~S d }~ww xY w | || S # t4 t6 t, t8 t: f$ r}t= |t4 rt? | ntA | j! } t
d
|| t " d || | | cY d }~S d }~ww xY w) N)rr z ignoring non-regular config %sr rbr z)ignoring oversized config %s (> %d bytes)z failed to read config %s: %sr z!malformed config %s, ignoring: %szmalformed config %s: %r)#r r r existsr O_RDONLY
O_NOFOLLOW
O_NONBLOCKfstatstatS_ISREGst_moder r r r fdopenreadMAX_CONFIG_BYTESr jsonloadsr) r RecursionErrorrO r r( AttributeErrorKeyErrorrJ rj r+ r, debug)
rL r r r stfrawrM r0 reasons
r r zLvdConfig._read s: 6""w~~d## ' 3v&&& &! + r{R] :R] JKKB
!Xb\\|BJ// 3KK @$GGG ??622 77HRLLLL Yr4(( +AB
&&!1A!566C3xx"222 $O$(*:< < < "v 6 6 + + + + + + + 77HRLLLL :c??D + + + + + + + + + + + + + + + 77HRLLL 77HRLLLL G^4 + + +
KK6a @ @ @??6** * * * * * * +
+==f=55 5)Z J + + +
*!X 6 6LSVVVDGG2 C+ >BC+ BC+ C
C$#C$+"D5D#"D5#
D0-D5/D00D5c # K t j dk rct | }t | 5 t 5 dV ddd n # 1 swxY w Y ddd dS # 1 swxY w Y dS dV dS )u Drop privileges to the target user if running as root.
CLOS-4370: when invoked as root we pair drop_privileges with
secureio.disable_quota — creating ~/.lve/ and the lockfile / writing
domains.json must succeed even when the user is over disk quota,
otherwise OSError(EDQUOT) inside this block aborts batch operations
like `lvectl apply all` and leaves the rest of the users with stale
limits. disable_quota raises CAP_SYS_RESOURCE in the effective set
r N)r r r r
r )r r s r r r # s
z||q ''
X
&
&
EEE s5 A0A A0A A0 A A00A47A4returnc t j } t j | sdS g }t j | D ]5} | t | &# t $ r Y 2w xY wt | S )u@ Cached scan of the LVD id-registry directory (CLOS-6868).
A tuple, not a list, so the cached value cannot be mutated by a caller.
`lvectl apply all` calls this roughly twice per account — 7,739 directory
scans on a 3,868-account host — for a directory that cannot change while
the command runs.
r; )
r LVD_IDS_DIRr r r listdirr r' r) tuple)ids_dirresultrb s r _isolated_lve_idsr" 6 s %G
7== ! ! r
F
7## MM#d)) $ $ $ $ H ==s "A**
A76A7c 8 t t S )a Return list of LVE IDs (UIDs) that have domain isolation configured.
Scans the id_registry directory for per-user registry files.
Users only appear here after ``lvdctl set`` or ``lvdctl apply``
has been called at least once for one of their domains.
Returns a fresh list each call, as before, so existing callers may mutate
the result without disturbing the cache behind it.
)r r" r; r" r find_all_lve_ids_with_configr$ K s !## $ $$r" c 8 t dS )zHDrop the cached isolated-uid list after a domain is enabled or disabled.N)r" r r; r" r invalidate_isolated_ids_cacher& X s !!#####r" c 6 t | S )z2Load the domain isolation config for a given user.)rl r r s r load_configr( ] s >>& ! !!r" c t | d S # t $ r%}t d| dt j |d}~ww xY w)z8Resolve domain name to document root path via panel API.r z&failed to resolve docroot for domain ''r% N)
cpapi_docroot Exceptionr r r )r r s r resolve_docrootr- b sm D [))!,, D D DN NNN % 9; ; ;@C DDs
A AAc
0 t | }t | pg D ]\ }}||k r|c S nc# t t t f$ rI}t
d| |dt dt | j Y d}~nd}~ww xY wdS )zBReturn domain name whose document root matches *docroot*, or None.z4Cannot resolve domain for docroot: uid=%s docroot=%sTzresolve-domain-for-docrootr N)
r r r r
r r r r r+ r, )r r r r drr s r r r k s c $$ +H 5 5 ; # #OKW}}"""" #
ng . c c c
H#w /0LdSViiN`aa c c c c c c c c c 4s .3 3 B
?BB)NN)J__doc__r functoolsr r r r loggingr r r r dataclassesr r typingr r secureior clcommon.clpwdr r
clcommon.cpapir r r+ clcommon.cpapi.cpapiexceptionsr
ra r r
exceptionsr r getLoggerr, r r r r r r r r rI r r r r r! r3 r5 r7 r` rl r r r r r r r r r r r r r" r$ r& r( r- r r; r" r r; s @ ? ( ( ( ( ( ( ( ( ! ! ! ! ! ! ! ! " " " " " " 2 1 1 1 1 1 1 1 @ @ @ @ @ @ @ @ 9 9 9 9 9 9 % % % % % % + + + + + + + +g!!
C
" " " : * * * 0B 0B 0B 0B 0B 0B 0B 0Bf
< nI nI nI nI nI nI nI nIb B B B@ @ @C C C B B B $ $ 5 (
%
%
%$ $ $
" " "
D D D r"