Wj d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlmc mZ ddlmZ ddlmZ ddlmZm Z ddl m Z ddl m Z dd l m!Z!m"Z"m#Z#m Z ddl$Z$dd
l%m&Z& dd l'm(Z( dd l)m*Z*m+Z+m,Z,m-Z- dd
l.m/Z/ ddl0m1Z1 ddl2m3Z3 ddl4m5Z5 ddl6m7Z7 ddl8m9Z: ddl;mZ>m?Z?m@Z@mAZAmBZBmCZC ddlDmEZEmFZF ejG d ZHeIeJejK fZLdnd ZMdod!ZNdpdqd$ZOdrd'ZPdrd(ZQdrd)ZRdsd*ZSdtd,ZTdud.ZUdvd/ZVdwd2ZWdwd3ZXdvd4ZYe>fdxd7ZZdvd8Z[dyd:Z\eRdvd; Z]dzd>Z^d{d?Z_d|d@Z`eAfd}dBZa e jb dC Zcd~dEZdddHZeddKZfddNZgddPZhddRZiddSZjdpddTZkddVZlddWZmddXZnddZZodd[Zpdd\Zqdd]Zrdd^Zsd_ Zted|d` Zuedddd Zvedddf Zwe dddk Zxedl Zydm ZzdS )zB
This module contains helpful utility functions for X-Ray Manager
) annotationsN)Callable)contextmanager)date timedeltawraps)glob)AF_UNIX SOCK_STREAMfromfdsocket)drop_privileges)Feature)get_cp_description getCPNameis_panel_feature_supportedis_wp2_environment)get_cl_edition_readable)UIConfig)get_rhn_systemid_value)AtexitIntegration)LoggingIntegration)gettext)php_get_vhost_versions_user )
agent_filejwt_token_locationlocal_tasks_storage
logging_level
sentry_dsnuser_agent_sock) XRayErrorXRayManagerExitutilspathstrmodeintreturnNonec & t | | dS )a7 Set ``mode`` on a directory we just created, without following symlinks.
``mkdir``'s mode argument is masked by the ambient umask, so a directory
that must have an exact mode has to be chmod'ed after the fact. Doing that
with a path-based ``os.chmod`` is unsafe here: these call sites run as root
with no privilege drop, and ``os.chmod`` re-resolves the name at syscall
time. A tenant who controls the parent can win the mkdir -> chmod window,
replace the new directory with a symlink, and redirect the root chmod onto
a root-owned target.
Pin the inode instead. ``O_NOFOLLOW`` refuses a symlink swapped in for the
final component outright, and reading the fd back through ``/proc/self/fd``
catches an ancestor component that was swapped, because that changes the
canonical path. ``fchmod`` then acts on the pinned inode and never on a
re-resolved name -- the same idiom ``unified_write``/``unified_erase`` use
in ``xray.internal.types``.
Anything unexpected (the directory vanished, was replaced by a symlink,
moved) is logged and skipped rather than raised: the mode is a hardening
detail, not a precondition of the operation that created the directory.
Caller contract: ``path`` must be the CANONICAL path of the directory that
was just created -- i.e. already ``os.path.realpath``'d, and resolved before
the mkdir, not after. Passing a path that merely happens to reach the right
inode through a symlink is not an error, but the identity check below will
not match and the mode will be skipped.
N)_chmod_pinned_dir)r& r( s J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/utils.pychmod_created_dirr/ = s 8 dD!!!!! damaged_mode target_modec t j t j | j |k rdS n# t $ r Y dS w xY wt | || dS )a Upgrade a directory that an earlier release left at ``damaged_mode``.
The mode-pinning above only runs when a directory is CREATED, so it does
nothing for hosts whose directories were already created wrong -- and the
0.6-51/0.6-52 crons ran under umask 077 for weeks, so that is most affected
hosts rather than an edge case (ZD 290458). Unlike xray.so, xray.ini and the
skeleton ini -- which are rewritten wholesale on the next run and therefore
self-heal -- a directory is only ever created once.
The repair is deliberately narrow: it fires only when the current mode is
EXACTLY ``damaged_mode``, the signature the umask-077 runs produced. An
administrator's or tenant's deliberate 0750 (or anything else) is left
alone, so this cannot quietly loosen a directory nobody asked us to touch.
Same caller contract and same symlink handling as ``chmod_created_dir``.
N) only_if_mode)statS_IMODEosst_modeOSErrorr- )r& r1 r2 s r. repair_dir_moder: \ sn . <
- . ., > > F ? dKlCCCCCCs /4
AAr4
int | Nonec t j | t j t j z t j z t j z }nD# t $ r7}t d| t | d Y d}~dS d}~ww xY w t j
d| }|| k r6t d| |d t j | dS |t j
t j | j }||k r t j | dS t d| t# | t# | d t j || nC# t $ r6}t d
| t | d Y d}~nd}~ww xY wt j | dS # t j | w xY w) a Shared worker for the two functions above: chmod through a pinned fd.
``only_if_mode`` makes the chmod conditional on the pinned inode's CURRENT
mode, read via ``fstat`` on the same fd that ``fchmod`` acts on -- so the
check and the change cannot be separated by a race.
z Not setting mode on directory)r& errextraNz/proc/self/fd/z,Directory changed under us; not setting mode)r& pinnedz4Repairing directory mode left by the umask-077 crons)r& from_modeto_modez Failed to set mode on directory)r7 openO_RDONLY O_DIRECTORY
O_NOFOLLOW O_CLOEXECr9 loggerwarningr' readlinkcloser5 r6 fstatr8 infooctfchmod)r& r( r4 dir_fder@ currents r. r- r- { s r{R^ ;bm Kbl Z[[ 6tTWXYTZTZ>[>[\\\ 6f 6 677 T>> NN> #v66
#l28F#3#3#;< z'Failed to unlink ini in cagefs-skeleton)rV r= z0Refusing to copy over symlink in cagefs-skeletonrbi z'Failed to copy ini into cagefs-skeleton) r7 r& join ini_location
startswithr
realpathdirnameexistsmkdirr/ r: lexistsislinkrH rI unlinkr9 r' rC readO_WRONLYO_CREATO_TRUNCrF writerO rK )args original_ini skeleton_ini skeleton_dirrQ src src_bytesfds r. updatez skeleton_update..update s
w||DG$8*EE " "= 1 1 d;N6O6O 7<<(Ll[\[][]N^__LL
$
$\
2
2 t>,//
< &&& ",6666 eU;;;; Fw~~l++ ! w|,,
7>>,// NN#R[egsZtNuuuFIl+++++ NNAVbknopkqkqIrIr #
7>>,// NN#U^hjv]wNxxxF ,-- + #
I+ + + + + + + + + + + + + + +W\2;+Cbj+PSUS`+`bghh!HR+++
Ib%(((HRLLLLLBHRLLLL
=R^gjklgmgmEnEn
ss G- -
H.7,H))H.4=M 3M J$ M $J((M +J(,A
M 7*L7 !M 7M
M
N,N Nc " | i |} | |S
Wraps func
)rg kwargsresultrS rn s r. wrapperz skeleton_update..wrapper s)
t&v&&
r0 r )rS ru rn s ` @r. skeleton_updaterv sN B B BH 4[[ [ Nr0 c P d d t fd }|S )zs
Decorator aimed to update DBM storage with fake_id:real_id mapping
Applies to task.add nd task.remove
c | d }t t 5 }|j ||j < ddd dS # 1 swxY w Y dS )z-
Update DBM storage contents
r N) dbm_storager task_idfake_id)rg
task_instance task_storages r. rn z"dbm_storage_update..update s Q
,
-
- H 2?2GL . / H H H H H H H H H H H H H H H H H Hs
:>>c t t 5 } || d j = n# t $ r Y nw xY wddd dS # 1 swxY w Y dS )z.
Remove task from DBM storage
r N)ry r r{ encodeKeyError)rg r} s r. removez"dbm_storage_update..remove s ,
-
-
a !7!7!9!9::
s1 A 8A
AAAAA Ac Z j dk r | n.# t $ r!}t t | d}~ww xY w | i |}n # t $ r j dk r | w xY w j dk r | n.# t $ r!}t t | d}~ww xY w|S )rq addNr )__name__ RuntimeErrorr# r' Exception)rg rs rQ rt rS r rn s r. ru z#dbm_storage_update..wrapper s $}%%
$ $ $CFF## # $ T4*6**FF }%%
$}((
$ $ $CFF## # $
s4
? :?A A(,A= =
B( B##B(r )rS ru r rn s ` @@r. dbm_storage_updater sb H H H 4[[ [: Nr0 c F d t fd }|S )z5
Decorator aimed to validate given JWT token
c " t dS )z7
Check if retrieved JWT token is valid
N)is_xray_supportedrr r0 r. checkzcheck_jwt..check6 s r0 c , | i |} |S rp rr )rg rs tokenr rS s r. ru zcheck_jwt..wrapper< s)
d%f%%
r0 r )rS ru r s ` @r. check_jwtr 1 sJ
4[[ [ Nr0 c B t t j S )zJ
Get current epoch timestamp as int
:return: timestamp as int
)r) timerr r0 r. timestampr K s
ty{{ r0 r c J t j t d z
S )zC
Pick a yesterday date
:return: a datetime.date object
r )days)r todayr rr r0 r. prev_dater S s
:<<)+++ ++r0 tsc * t j | S )zy
Get the datetime.date object for given int timestamp
:param ts: timestamp
:return: datetime.date object
)r
fromtimestamp)r s r. date_of_timestampr [ s b ! !!r0 c D t d S )zj
Get a formatted representation of yesterday date
:return: str date in the form of dd/mm/YYYY
z%d/%m/%Y)r strftimerr r0 r. get_formatted_dater d s
;;
+ ++r0 links
list[dict]c f dd fdt | d D S )u
HTML formatted links.
Both the domain (interpolated into the visible body) and the
link (interpolated into the href attribute) are passed through
html.escape(..., quote=True) so HTML-special characters in either
slot cannot break attribute parsing or inject tags. The href is
also explicitly double-quoted — without quotes, whitespace in the
link value would let any subsequent token be parsed as a new
attribute (e.g. ``onmouseover=...``). Defense-in-depth: today the
sole caller (continuous.tracing.generate_mail) passes
url_split(task.url)[0] and task.shared_link, both of which are
derived from controlled sources, but the template must remain
safe for any future caller.
z+{num}) {domain}
c g | ]_\ }}| D ]E\ }} |t j |d t j |d F`S )T)quote)numlinkdomain)itemsformathtmlescape).0ilink_mapkv html_items r.
z,get_html_formatted_links..~ s
8 ((
1
Qd)C)C)CDKXYaeLfLfLf g g
r0 r rX enumerate)r r s @r. get_html_formatted_linksr l sP >I 99
( 2 2
r0 c f dd fdt | d D S )z
Formatted links
z{num}) {dom}: {link}r c z g | ]7\ }}| D ] \ }} ||| 8S ))r domr )r r )r r r r r text_items r. r z,get_text_formatted_links.. sS tttKAxckcqcqcscstt[_[\^_ aQQ / /ttttr0 r r )r r s @r. get_text_formatted_linksr sB 'I 99tttt9UTUCVCVttt r0 c t j d } | }| d j }t j 5 }| d| ddd n # 1 swxY w Y | d S # t t j
f$ r"}t t d |d}~ww xY w)ze
Obtain system ID from /etc/sysconfig/rhn/systemid
:return: system ID without ID- prefix
z/etc/sysconfig/rhn/systemidz(.//member[name='system_id']/value/string system_idNzID-z Failed to retrieve system_id)
ETparsegetrootfindtext
sentry_sdkconfigure_scopeset_taglstripr9
ParseErrorr# _)treerootwhole_idscoperQ s r. read_sys_idr s
Bx566||~~99 GHHM
'
)
) 1U MM+x 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1u%%% R] # B B B899::ABs< AB A:. B :A>>B A>B C0 C
Csys_idagent_system_id_pathc > t j |t j t j z t j z t j z d } t j || t j | dS # t j | w xY w)zH
Write system_id into file /usr/share/alt-php-xray/agent_sys_id
N) r7 rC rd rc re rF rf r rK )r r rm s r. write_sys_idr sr
%rzBK'?"*'Lr}'\^c d dB
V]]__%%%
s 'B B c L t t 5 } | cddd S # 1 swxY w Y dS # t $ rC}t
ddt | i t cY d}~S d}~ww xY w)zA
Read system_id saved by agent during its initialization
Nz8Failed to retrieve agent's system_id, returning real oner= r> ) rC r rb stripr9 rH rM r' r )agent_sysid_filerQ s r. read_agent_sys_idr s
*
3!1#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 NW\^abc^d^dVe fff}} s? A &A A A
A A
A
B# 8B B# B# bool | Nonec @ t t j } | st }t }t
dt | t | t t d
|| dS )z9Raise XRayError in case of detected non-supported editionzMCurrent CloudLinux edition: %s or Control Panel: %s is not supported by X-RayzMCurrent CloudLinux edition: {} or Control Panel: {} is not supported by X-RayT) r r XRAYr r rH rM r' r$ r r ) is_supportedcurrent_edition
current_panels r. r r s -gl;;L
133!
[
] ^ ^ e e
4r0 c * t t 5 } | cddd S # 1 swxY w Y dS # t $ r2 t t
d t t z w xY w)zT
Obtain jwt token from /etc/sysconfig/rhn/jwt.token
:return: token read
NzJWT file %s read error)rC r rb r r9 r# r r' )
token_files r. read_jwt_tokenr s O
$
%
% - ??$$**,, - - - - - - - - - - - - - - - - - - O O O233c:L6M6MMNNNOs- A &A A A
A A
A .add_info st g ~| <===
6k B Bm YYw++
nn]D99 1$/=E- r0 c
d t }|r| d nd }|r| d nd }t rdnd }d|fd|fd|fdt j fdt d fd
t
fd t d ff}|D ] } | j |
d S )
Nr nameWP2zControl Panel NamezControl Panel VersionzControl Panel ProductkernelzCloudLinux version
os_releasezCloudlinux edition Architecture architecture)r r r platformreleaser r r ) sentry_scopecp_description
cp_versioncp_name
cp_producttagstags r. set_tagsz sentry_init..set_tags
s +--6DN^'' 222$
0>H.$$V,,,D 0 2 2.nope s r0 )level event_levelzalt-php-xray@0.6-57.el8)callbacki' r )dsn before_sendr max_value_lengthr integrationsidz Failed to set Sentry tags: %sN)r r r r r* r r* r+ )r loggingINFOWARNINGr r r initr! r r userr rH debugr' )r r r sentry_loggingxray_ver
silent_atexitr rQ s r. sentry_initr s ,' ' '(
(glXXXN~~:!:H%t444MO +;77$m4
# % % B
(55
B HUOOOO B B B LL8#a&& A A A A A A A A B B B B B B B B B B B B B B B B B B Bs< D* B65D6
C2 (C-(D-C22DD Dlognamec H t j t j t j t j t j d}t
t j | g}|dk r&| t j t j
| |t j dd| n8# t $ r+ t j
t j
g Y dS w xY w t j | d n# t $ r Y nw xY w| S )
z[
Configure logging and Sentry
:param logname: path to log
:return: logpath
)r rM rI errorcritical)filenamer z1%(asctime)s [%(threadName)s:%(name)s] %(message)sz%m/%d/%Y %I:%M:%S %p)r r datefmthandlers)r! Nr )r DEBUGr r ERRORCRITICALr FileHandlerappend
StreamHandler basicConfigr r9 NullHandlerr7 chmodPermissionError)r r levelsr! s r. configure_loggingr- : s4 ? $ F MMM
'999: G OOG 1 3 3 4 4 4**UGL11F*
g&9&;&;%<====
%
Ns%
A8C 1C87C8<D
D D z"^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,31}$usernamec | st d t | st d| t j | dS # t
$ r t d| dw xY w)zValidate that username is a real system user.
Raises ValueError with a clear message if username is empty,
has an invalid format, or does not exist in the system user database.
zusername must not be emptyzInvalid username: z system user does not exist: N)
ValueError_safe_username_patternmatchpwdgetpwnamr )r. s r. validate_system_userr5 b s 75666 ! ' ' 1 1 <:h::;;;P X P P PDDDEE4OPs A A3 clwpos_argslistc t | t t j s-d |D }dd | z }dd| ddd|gS d | d
g|z S ) zBuild subprocess argv for /usr/bin/clwpos-user invocation.
Non-CageFS: wraps in sudo -u bash -c with shell-quoted args.
CageFS: passes args directly via cagefs_enter_user argv.
c P g | ]#}t j t | $S rr )shlexr r' )r as r. r z)build_clwpos_user_cmd..z s( ???aek#a&&))???r0 z/usr/bin/clwpos-user sudo-uz-sz /bin/bashz-cz/sbin/cagefs_enter_userz/usr/bin/clwpos-user)r5 r r CAGEFSrX )r. r6
safe_parts inner_cmds r. build_clwpos_user_cmdrB r sv """ %gn 5 5 [??;???
+chhz.B.BB hk4KK)85KL{ZZr0 rk dstc
t j | | dS # t $ rD}t t d | |t
| |d}~ww xY w)zZ
Move file with error catching
:param src: source
:param dst: destination
z Failed to move file {} to {}: {}N)shutilmover9 r# r r r' )rk rC rQ s r. safe_moverG sv _ C _ _ _<==DDS#sSTvvVVWW]^^_s
A'?A""A'
sock_locationr c t t j dd }|dk rt 5 t j | n# t $ r Y nw xY wt t }| | |
ddd n # 1 swxY w Y n/t dt t }|
|S )z
Create world-writable socket in given sock_location
or reuse existing one
:param sock_location: socket address
:return: socket object
LISTEN_FDS0r N )
r) r7 environr umask_0ra FileNotFoundErrorr r bindlistenr
r )rH
listen_fdssockobjs r.
create_socketrT s RZ^^L#6677JQ
YY
-(((($
WooG LL ' ' ' NN G[11 Ns7 B2AB2
A&#B2%A&&A B22B69B6lve_idc > t t j sdS d}d| d} t | 5 }|D ]}| | rut
d| t | | d c cddd S ddd n # 1 swxY w Y n@# t $ r3}t
d|t | Y d}~nd}~ww xY wdS ) zX
Retrieve current value of CPU throttled time.
Return 0 in case of failures
r throttled_timez /sys/fs/cgroup/cpu,cpuacct/lvez /cpu.statz%sNzFailed to open %s: %s)
r r LVErC rZ rH r r) r r r9 r r' )rU marker stat_file stat_valuesvaluerQ s r. get_current_cpu_throttling_timer^ s
&gk 2 2 q
FBBBBIA
)__ H $
H
H##F++ HLLu--- u{{}} 2 26 : :2 > D D F FGGGG H H H H H H H HH
H H H H H H H H H H H H H H H H
A A A ,iQ@@@@@@@@A 1sG C BC6 C C C CC CC
D')DD tuple | Nonec d}t j | sdS t j |d| dgddd }|j |j fS # t j $ r6}t
ddt | i Y d}~dS d}~wt $ r3}t
d
t | Y d}~dS d}~ww xY w) z
'selectorctl -u username --user-current' command
:param username: name of user
:return: tuple(stdout, stderr) or None if command fails
z/usr/bin/selectorctlNr> z--user-currentTcapture_outputr r z&Failed to get selectorctl user-currentr= r> z%selectorctl --user-current failed: %s)r7 r& isfile
subprocessrunstdoutr stderrCalledProcessErrorrH rI r' subprocess_errorsr )r. _selectorctlrt rQ s r. _selectorctl_get_versionrk s *L
7>>, ' ' tF
4+; z cagefsctl --getprefix failed: %s)
r7 r& rc rd re rf r rh rH rI r' ri r r.
_cagefsctlrt rQ s r. cagefsctl_get_prefixrp s 'J
7>>* % % tA ]H EVZaemqrrr}""$$$ ( P P P7s1vvOOOOOOOOO A A A 7Q@@@@@@@@@As# 3A C(+B
C&(CCc d}t j | sdS | |ddg}n|d| g} t j |dd t
d| dS # t j $ r6}t
d d
t | i Y d}~dS d}~wt $ r3}t
d t | Y d}~dS d}~ww xY w)
z
'cagefsctl --remount username' or 'cagefsctl --remount-all' command
:param username: name of user or None (for remount-all)
rm Nz --wait-lockz
--remount-allz --remountT)r rb z Remounted %szFailed to remount cagefsr= r> z cagefsctl --remount failed: %s) r7 r& rc rd re rH rM rh rI r' ri r )r. ro rg rQ s r. _cagefsctl_remountrr s
'J
7>>* % % M?;K2?t4==== NH----- ( J J J1%Q IIIIIIIII ? ? ? 5s1vv>>>>>>>>>?s# 2A& &C&5+B&&
C&3(C!!C&boolc 6 d}t j | sdS t j |d| gddd }d|j v S # t $ r3}t dt | Y d}~dS d}~ww xY w) z
'cagefsctl --user-status username' command
:param username: name of user
:return: True if user has Enabled status, False otherwise
rm Fz
--user-statusTra Enabledz"cagefsctl --user-status failed: %sN) r7 r& rc rd re rf r ri rH r r' rn s r. _is_cagefs_enabledrv s 'J
7>>* % % uC _h GX\cgotuuuFM / / 1 111 C C C 93q66BBBBBBBBBCs 5A
B%(BBc t d 5 } | }ddd n # 1 swxY w Y n# t $ r Y dS w xY wd|v S )z`
Check if there is php.d.location = selector
set in /etc/cl.selector/symlinks.rules
z /etc/cl.selector/symlinks.rulesNFselector)rC rb r9 )
rules_filecontentss r. _is_selector_phpd_location_setr{ s
3
4
4 )
!((H ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) uu !!s' > 2 > 6> 6>
A A c t t 5 } t | dk cddd S # 1 swxY w Y dS )z:Check if there are no active tasks (== empty task storage)r N)ry r lenkeys)r} s r. no_active_tasksr s ( ) ) -\<$$&&''1,- - - - - - - - - - - - - - - - - -s %AA A enabledc H t t j sdS t ddd 5 }| | rdnd ddd dS # 1 swxY w Y dS # t
$ r4}t d| t | Y d}~dS d}~ww xY w) zb
Switch on/off throttle statistics gathering by kmodlve
:param enabled: True or False
Nz!/proc/sys/kernel/sched_schedstatswbr )r( buffering 1 0z(Failed to set sched_schedstats to %s: %s) r r rY rC rf r9 rH rM r' )r frQ s r. switch_schedstatsr s
&gk 2 2 Q
5DA
N
N
N /RS
GGG-DD . . . / / / / / / / / / / / / / / / / / / Q Q Q >QPPPPPPPPPQs: A# A A# AA# A A# #
B!-)B B!c J t dd du S )zG
Check if end-users have access to X-Ray UI of End-User plugin
hideXrayApp
uiSettingsF)r get_paramrr r0 r. is_xray_app_availabler ( s# ::
| < < EEr0 c t t t 5 } | t n## t
t f$ r Y ddd dS w xY w ddd n # 1 swxY w Y dS )z Check if User Agent is listeningNFT)r r r connectr" ConnectionErrorr9 )ss r. is_xray_user_agent_activer / s % %
IIo & & & & )
'
4s1 A(8A(A A(AA((A,/A,c B t j d S )z2Check if SSA is disabled by its internal flag-filez /usr/share/clos_ssa/ssa_enabled)r7 r& rc rr r0 r. ssa_disabledr 9 s w~~ ?@@ @@r0 c ~ t t j | j z
dk S # t $ r Y dS w xY w)z.Check is file was modified during the last dayiQ F)r r7 r5 st_mtimer9 )r s r. is_file_recently_modifiedr > sJ {{RWX . . 77%?? uus +.
<<c p t | 5 t }d d d n # 1 swxY w Y |S r )r r )r rt s r. get_user_php_versionr G su / /,../ / / / / / / / / / / / / / / Ms +//c # K t d D ]} t j | t j t j z t
d| n# t $ rf}t
dt | |j t j
t j fvr t j
d Y d}~d}~ww xY wt t d d dV t j | t j t
d | dS # t j | t j t
d | w xY w)
uq
Context manager for locking given file object
:param fd: а file object providing a fileno() method
x zFile %s lockedzFailed to lock: %sg ?Nz%Failed to lock at all. Exiting threadrI )flagzFile %s unlocked)rangefcntlflockLOCK_EXLOCK_NBrH rM r9 r' errnoEAGAINEACCESr sleepr# r LOCK_UN)rm _attemptrQ s r. filelockr P sR #JJ T T KEMEM 9 : : : KK(" - - - E KK,c!ff 5 5 5wu|U\ ::: JsOOOOOOOO ABBSSSS,
B
&&& &+++++ B
&&& &++++s% AA
C(A C C0D0 0>D EEEHTNNNNNr0 r T
target_uid
target_gidc # K t j }t j }t d } t j | }n# t
$ r d}Y nw xY w| ||} n|j } | ||}n|j }|t j | } ||k rWt j | t d| |r&t j |k rt | || k rqt j | t d| |r@t j | k r)||k rt j | t | dV || k r/t j | t d| ||k r/t j | t d| |t j | dS dS # || k r/t j | t d| ||k r/t j | t d| |t j | w w xY w)aH
Context manager to drop privileges during some operation
and then restore them back.
If target_uid or target_gid are given, use input values.
Otherwise, stat target_uid and target_gid from given target_path.
If no target_path given, use current directory.
Use mask if given.
:param target_uid: uid to set
:param target_gid: gid to set
:param target_path: directory or file to stat for privileges,
default -- current directory
:param mask: umask to use
:param with_check: check the result of switching privileges
z6Unable to execute required operation: permission issueNzDropped GID privs to %szDropped UID privs to %szRestored UID privs to %szRestored GID privs to %s)r7 getuidgetgidr r5 r9 st_uidst_gidr setegidrH r getegidr# seteuidgeteuid)
r r target_pathr
with_checkprev_uidprev_gidpermission_issue_message stat_infor s
r. set_privilegesr s , y{{Hy{{H !Y Z Z GK(( !JJ")J !JJ")J x~~:
: .
;;; 6"*,,*44 455 5:
: .
;;; 6"*,,*44:%%
8$$$ 455 5
z ! ! Jx LL3X > > > z ! ! Jx LL3X > > > HTNNNNN z ! ! Jx LL3X > > > z ! ! Jx LL3X > > > HTNNNN s A A A 'G/ /BI2c # K t j | t j | dV t j d t j d dS # t j d t j d w xY w)z
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr )r7 r r )uidgids r. user_contextr sn
3
3
1
1
1
1
s ,A *Bc fd}|S )z:
Decorator to retry method on specific exceptions
c fd}|S )Nc R d}t t d t z }|k rq | i |S # t $ rM}|dz
}t dt | |}t
j d Y d }~nd }~ww xY w|k q|)Nr z0Request to website failed even after %s retries.r z'Retry to request website, exception: %s)r0 r r' tuplerH rI r r )rg rs retries exceptionrQ exceptions_to_retryrS max_retriess r. ru z7retry_on_exceptions..decorator..wrapper s G"1%W#X#X[^_j[k[k#kllIK''" 40000 011 " " "qLGNN#LcRSffUUU !IJqMMMMMMMM " K'' Os ? B ABB rr )rS ru r r s ` r. decoratorz&retry_on_exceptions..decorator s. r0 rr )r r r s `` r. retry_on_exceptionsr s*
r0 )r& r' r( r) r* r+ )r& r' r1 r) r2 r) r* r+ r )r& r' r( r) r4 r; r* r+ )rS r r* r )r* r) )r* r )r r) r* r )r* r' )r r r* r' )r r' r r' r* r+ )r* r )r r' r* r )r* r r )r r' r* r )r. r' r* r+ )r. r' r6 r7 r* r7 )rk r' rC r' r* r+ )rH r' r* r )rU r) r* r) )r. r' r* r_ )r. r' r* r )r. r r* r+ )r. r' r* rs )r* rs )r rs r* r+ )r r' r* rs )F)r r' r rs )r )r r) r* r+ )NNr NT)r r; r r; r r; r* r+ ){__doc__
__future__r r r r r r r7 r r3 rer r: rE r5 rd r xml.etree.ElementTreeetree ElementTreer collections.abcr
contextlibr datetimer r functoolsr r
r r r r
r clcommon.clpwdr clcommon.constr clcommon.cpapir r r r clcommon.lib.cleditionr clcommon.ui_configr clcommon.utilsr sentry_sdk.integrations.atexitr sentry_sdk.integrations.loggingr xrayr r !xray.internal.clwpos_safe_importsr constantsr r r r r! r"
exceptionsr# r$ getLoggerrH r9 r0 SubprocessErrorri r/ r: r- rv r r r r r r r r r r r r r r r r r- compiler1 r5 rB rG rT r^ rk rp rr rv r{ r r r r r r r r ry rN r r r rr r0 r. r s # " " " " "
" " " " " " " " " $ $ $ $ $ $ % % % % % % $ $ $ $ $ $ $ $ 7 7 7 7 7 7 7 7 7 7 7 7 * * * * * * " " " " " " h h h h h h h h h h h h : : : : : : ' ' ' ' ' ' 1 1 1 1 1 1 < < < < < < > > > > > > I I I I I I v v v v v v v v v v v v v v v v 2 2 2 2 2 2 2 2 7 # # j**DE " " " "> D D D D> LS S S Sl7 7 7 7t 4 , , , ," " " ", , , , 4
B
B
B
B ;E & O O O O7 7 7 7: : : :
OB OB OB OBd +8 " " " " "J $$IJJ
P
P
P
P [ [ [ [ _ _ _ _ 0
(F F F F(A A A A&? ? ? ? ?*
C
C
C
C
"
"
"
"- - - -
Q
Q
Q
Q F F F F A A A A
, , , ,: 1 1 1 1 1> ! ! M M M M M` $ r0