Wj"' d Z ddlZddlmZ ddlmZ ddlmZ ddlm Z
ddl m Z dd l
mZ dd
lmZmZ dd lmZ dd lmZmZ d
dlmZ G d de ZdS )zZ
This module contains classes implementing X-Ray Manager behaviour
for custom integration
N)ChainMap)ClassVar) PublicApi)gettext)
phpinfo_utils )is_allowed_ini_path)XRayManagerErrorXRayMissingDomain)
DomainInfo)user_mode_verificationwith_fpm_reload_restricted ) BaseManagerc e Zd ZU dZdddddddddddddddZee ed< fdZde fdZ
e d Z defd Z
eed
edefd Zd edefd
Zdededz fdZdededefdZd edefdZd edef fd Z xZS )
CustomManagerz0
Manager supporting integration scripts
N)5455567071727374808182838485VERSIONS_CUSTOMc t j |i | t | _ | j r| | _ d S t t d )Nz.X-Ray is not supported by control panel vendor) super__init__r apiis_xray_integratedget_all_domains all_domainsr
_)selfargskwargs __class__s J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/manager/custom.pyr$ zCustomManager.__init__1 sg $)&))) ;; " X # 3 3 5 5D "1%U#V#VWW W returnc 6 t | j | j S )za
Get supported PHP versions
:return: dict with custom supported versions
)r VERSIONSr! r* s r. supported_versionsz CustomManager.supported_versions: s
t';<<
##%%. 4||FE***r/ c 8 | j d S )z9
Collect domains from integration script
T)with_php)r% domainsr3 s r. r' z CustomManager.get_all_domainsM s x ...r/ domain_namec j | j | }n;# t $ r. | j dd|i t | w xY w| j r]t
j |j ||j j
}t || d |j
d|j |j S | |j j |j }t ||j |j j
|j j |j j | }| j d ||j |j |S )
z<
Retrieve PHP setting for given domain_name
z#Domain does not exist on the serverr? )extra)domaintrusted_php_version T)namepanel_php_versionphp_ini_scan_diris_selector_applieduser panel_fpm)rE rI rF rJ is_nativeini_pathz@Retrieved domain info: domain %s owned by %s uses php version %s)r( KeyErrorloggerwarningr phpinfo_moder get_php_configurationownerphpversionr get_full_php_versionabsolute_ini_scan_dir
is_php_fpm_validate_ini_pathrL fpmrK inforI rF )r* r? domain_confconfigrL domain_infos r. get_domain_infoz CustomManager.get_domain_infoS si 1 *;7KK 1 1 1 K Em]hMi j j j#K00 0 1 ! "8!" %0O$;
F "("="=b"A"A!'!= %) & +
..{/GIZ[[H$ &"-/"9%/-%/3!
K
N )
s
8Ar] c |j o|j S )z
Check if selector is enabled specifically for custom panels
Required to be implemented by child classes
:param domain_info: a DomainInfo object
:return: True if yes, False otherwise
)rK rJ r* r] s r. panel_specific_selector_enabledz-CustomManager.panel_specific_selector_enabled s $B[-B)BBr/ dom_infoc |j S )z+
Retrieve FPM service name
)rJ )r* rb s r. fpm_service_namez CustomManager.fpm_service_name s
!!r/ rL rR c |s|S t j | }t | s:| j d| t
t d |z t j || st j
|| r|S t j t j | st j
| r:| j d| t
t d |z t j | j }n# t $ r |cY S w xY w|dk r|S | j d|| t
t d |z )u Owner-bind the vendor-supplied ini_path before it steers a root write.
In non-phpinfo mode the custom integration reports ini_path verbatim and
the only downstream guard is the broad is_allowed_ini_path prefix
allowlist, which admits serverwide (/etc/php.d) and per-tenant
(/var/cagefs/..., the per-domain ini roots) trees. Without owner-binding an
allowlisted-but-foreign path would let the root xray.ini write land in
another tenant's jail. Accept the path only when it is the owner's own
subtree or an operator-controlled root-owned INI directory; reject a path
that resolves outside the allowlist, into a foreign tenant's per-user
tree, or onto a dir owned by a different unprivileged user.
Returns the CANONICAL (realpath'd) directory, not the raw vendor string.
The write-time owner binding (Task._ini_dir_validator / unified_write)
classifies ini_location as per-tenant vs global from this value and then
re-checks the PINNED inode against it, so it must be canonical here — a
raw symlink path would misclassify and either over-reject a legitimate
own-subtree symlink or fail to bind a per-tenant location.
z.Rejected custom ini_path outside allowlist: %sz&ini_location outside allowed paths: %sz6Rejected custom ini_path bound to a foreign tenant: %sr z7Rejected custom ini_path owned by uid %s (not root): %s)ospathrealpathr rN rO r
r) r _is_own_cagefs_subtree_is_own_per_domain_ini_dir
_is_within _CAGEFS_ROOT _is_under_per_domain_ini_rootstatst_uidOSError)r* rL rR resolvedro s r. rX z CustomManager._validate_ini_path s ( O7##H--"8,, [ K PRZ [ [ ["1%M#N#NQY#YZZ Z /x @ @ MDl 8E
E
O # &
[
8
B
B [
K XZb c c c"1%M#N#NQY#YZZ Z WX&&-FF OOO Q;;O UW]_ghhh q!I J JX UVVVs D! ! D0/D0c |j S )zL
Path to additional .ini files specific custom panel getter
)rL r` s r. _ini_pathzCustomManager._ini_path s
##r/ c j |j r|j S t | }| d rm|j d sS|j }d|j |_ |j p|}n# t $ r Y nw xY w||_ | j d| |S )a
Resolve a path to directory for additional ini file.
It depends on version set for domain and on selector
NOTE:
This method is overrided to manage php.d.location=selector resolving.
In custom integration we do not know if PHP version is alt or not,
it is set as just two digits.
Thus, we only could rely on resolved path -- if it is '/opt/alt'.
:param domain_info: a DomainInfo object
:return: path to directory for ini files
z/opt/altzalt-phpzIni path re-resolved as %s) rG r# get_ini_path
startswithrF phpd_location_ini_path
ValueErrorrN rZ )r* r] rL saved_panel_phpr- s r. ru zCustomManager.get_ini_path s ' 0 / / 77'' 44 z * * E;3P3[3[\e3f3f E ) ;O,Uk6S,U,UK )
&=I
-r s
4 4 4 4 4 4 ' ' ' ' ' ' 4 4 4 4 4 4 E E E E E E E E ' ' ' ' ' ' [ [ [ [ [ [ [ [ V V V V VK V V V V Vr/