Rlj d Z ddlZddlZddlZddlmZ ddlmZ ej e Z
dZ ddl Z n
# e
$ r dZ Y nw xY wd Zd Zd Zd
Zd Zd Zd
Zd Zd Zd Zd ZdS )u
Thin Python wrapper around the _lvdmap C extension (backed by liblve).
Public interface is unchanged — callers (lveapi.py, lvectllib.py) continue
to import and use these functions exactly as before.
N )domain_lve_sentry_extra)LvdErrorz/etc/container/lvd_idsc 2 t t d d S )Nz$_lvdmap C extension is not installed)_lvdmapr S/opt/cloudlinux/venv/lib64/python3.11/site-packages/websiteisolation/id_registry.py_require_lvdmapr s =>>> r c t j | j }n# t $ r Y dS w xY wt j t t | }t j | sdS |S )zmReturn the registry file path for *username*, or None if the
user does not exist or has no registry file.N)
pwdgetpwnampw_uidKeyErrorospathjoin LVD_IDS_DIRstrexists)usernameuidr s r
registry_path_by_usernamer " sx l8$$+ tt
7<< SXX . .D
7>>$ t Ks
**c t j dk rt d t t j | | }t d||| |S )zzAssign a domain ID for a docroot. Returns existing ID if already
assigned, otherwise allocates the next sequential ID.r "domain ID assignment requires rootz0assigned domain_id %d to docroot '%s' for uid %d)r geteuidr r r assignloginfo)r docroot domain_ids r
assign_domain_idr" / sg
z||q;<<<sG,,IHH
?
& & & r c R t dS t j | | }|dk r|ndS )z;Look up domain ID by docroot. Returns None if not assigned.Nr )r lookup)r r rs r
get_domain_idr& ; s/ tsG$$AQ11D r c < t i S t j | S )z/Return dict of docroot -> domain_id for a user.)r get_all_entries)r s r
r( r( C s "3 ' ''r c R t t S t j S )z@Return the set of every assigned domain LVE ID across all users.)r setget_all_domain_idsr r r
r+ r+ J s uu % ' ''r c : t dS t j S )zReturn the minimum domain LVE ID.
Delegates to the C library which reads UID_MAX from /etc/login.defs
and returns max(UID_MAX, 60000). Falls back to 60000 if the C
extension is not available.
Ni` )r min_idr r r
r- r- Q s u > r c ^ t j dk rt d t t j | | }|-t d|| t d dS t j | | }t
d||||| |S )zMove a domain mapping from *old_docroot* to *new_docroot*.
Uses remove + assign via _lvdmap; the domain_id will be newly
allocated (the C API does not support specifying a target ID).
r z$domain ID reassignment requires rootNuU reassign_docroot: old_docroot '%s' not in registry for uid %d — nothing to reassignzreassign-missing-entry)extraz?reassigned docroot from '%s' (id=%d) to '%s' (id=%d) for uid %d) r r r r r remover errorr r r )r old_docroot new_docrootold_idnew_ids r
reassign_docrootr6 ] s
z||q=>>>
^C
-
-F
~ 78CS/0HII K K K t
^C
-
-FHH & VSJ J J Mr c t j dk rt d t t j | | }| t d||| |S )z?Remove a docroot from the registry. Returns the old ID or None.r domain ID removal requires rootNz,removed domain_id %d for docroot '%s' uid %d)r r r r r r0 r r )r r r4 s r
remove_domain_idr9 w sj z||q8999
^C
)
)F
?# ' ' ' Mr c t j dk rt d t t j | }|r)t d| t | |S )z@Remove all domain IDs for a user. Returns list of (docroot, id).r r8 z.removed all domain IDs for uid %d (%d entries)) r r r r r
remove_allr r len)r removeds r
remove_all_entriesr> so z||q8999 %%G $ Ac'll $ $ $ Nr c X t j dk rt d t j t dd t j t }|j dz dk rt j t d n# t $ r Y nw xY wt j
t t | }t j | sCt j
|t j t j z d }t j | dS dS ) a Mark *uid* as domain-isolated by touching its per-user file.
The file acts as a marker so that ``find_all_lve_ids_with_config()``
(which lists ``LVD_IDS_DIR``) can detect the user before any domains
are assigned. The C library's ``lvd_map_assign()`` will later
atomically replace this empty file with a proper hash-table via
rename(2), so the marker never interferes with real data.
r r i T)modeexist_oki i N)r r r makedirsr statst_modechmodOSErrorr r r r openO_CREATO_WRONLYclose)r stmarkerfds r
create_empty_registryrN s
z||q;<<<K %$7777
W[
!
!
: & & H[% ( ( (
W\\+s3xx
0
0F
7>>& ! !
WVRZ"+ 5u
=
=
s AB
BB)__doc__r
loggingr r
exceptionsr getLogger__name__r r r ImportErrorr r r" r& r( r+ r- r6 r9 r> rN r r r
rV sJ
% % % % % % g!!& NNNN GGG? ? ?
! ! !( ( (( ( ( 4 s 3 ==