IP d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZmZmZmZmZmZ d dlmZ d dlmZ d Zd Z ed d
Zer
e Ze Z e Z G d d e Z ee Z d
Z d Z!d Z"d Z#d Z$d Z% ed d Z&er
e& Z'd Z(d Z)d Z*d Z+d Z,da-dZ.dZ/d Z0d Z1d Z2d Z3d Z4d9d!Z5d9d"Z6d9d#Z7d:d$Z8d;d%Z9dd+Z=d>d,Z>d- Z?d. Z@daAd/ ZB ee/0 ZCd1 ZDdaEd?d2ZFd3 ZGd@d4ZHd5 ZId6 ZJejK d7 ZLejK d8 ZMdS )A N) lru_cache)
TYPE_CHECKING)
cdllc_long Structurec_ushortc_ubytec_charPOINTERc_intc_void_pc_char_p)ClPwd)drop_user_privilegesc | dk rt S | dk rt S t dt d| )Nlibcliblvezmodule z has no attribute )
_load_libc _load_liblveAttributeError__name__)names /builddir/build/BUILDROOT/alt-python27-cllib-3.4.36-1.el9.cloudlinux.x86_64/opt/cloudlinux/venv/lib/python3.11/site-packages/secureio.py __getattr__r sK v~~||
~~
E8EEtEE
F
FF c J ddgt S )Nr r )globalskeys r r __dir__r # s H 0wyy~~ / / 00r )maxsizec t j d } t t t g| j _ t | j _ t t g| j _ t | j _ t g| j _ t | j _ t g| j _ t | j _ t g| j _ d | j _ t g| j _ t | j _ | S )Nz libc.so.6)
r LoadLibraryr fchownargtypesrestypefchmod fdopendirr
readdir
DIRENTRY_P rewinddirclosedir)r s r r r ( s K ( (D !5%0DK DK !5>DK DK %gDN %DN &JDL%DL (jDN !DN 'ZDM !DM Kr c 6 e Zd Zdefdefdefdefdedz fgZdS )DIRENTRYd_inod_offd_reclend_typed_name N) r
__module__ __qualname__ino_toff_tr r r
_fields_r r r r. r. P sA % % X 7 6C< HHHr r. c H t | || S N)r r$ )fduidgids r r$ r$ ] s << r3 , ,,r c F t | | S r; )r r' )r< modes r r' r' a s << r4 ( ((r c D t | S r; )r fdopenr< s r rB rB e s << r " ""r c D t | S r; )r r) dirps r r) r) i s << % %%r c D t | S r; )r r+ rE s r r+ r+ m s << ! !$ ' ''r c D t | S r; )r r, rE s r r, r, q s << & &&r c ( t j d } n$# t $ r t j d } Y nw xY wt t g| j _ t | j _ t g| j _ d | j _ t g| j _ t | j _ t t t g| j
_ t | j
_ t t t t g| j _ t | j _ t t t t t g| j _ t | j _ t t t t t t g| j
_ t | j
_ t t t t t g| j _ t | j _ t t g| j _ t | j _ t t g| j _ t | j _ | S )Nzlibsecureio.so.0z liblve.so.0)r r# OSErrorr open_not_symlinkr% r r& closefd check_dirisdirset_perm_dir_secureset_owner_dir_securecreate_dir_securemakedirs_secureget_path_from_descriptor is_subdir)r s r r r v s 1!"455 1 1 1!-001 )1(';F$&+F# %gFN !FN
"'F $F &uh 7FL FL ,4UE8*LF ').F & -5eUE8+TF (*/F ' *25%x(XF %',F $ (0uh&OF#%*F"
16x/@F#,.6F#+ "*8 4F $F Ms 88c F t | | S r; )r rK )path parent_paths r _open_not_symlinkrX s >> * *4 = ==r c D t | S r; )r rM rC s r rM rM s >> # #B ' ''r c H t | || S r; )r rN )rV
descriptorrW s r rN rN s >> j+ > >>r c F t | | S r; )r rS )r< bufs r rS rS s >> 2 22s ; ;;r c F t | | S r; )r rT )dirsubdirs r rT rT s >> # #C 0 00r Tz/var/log/cagefs-update.logi Fc Z t j | t j t j z S r; )osopenO_RDONLY
O_NOFOLLOWrV s r rK rK s
74r}4 5 55r c F t j t | d S )Nr)rb rB rK rf s r open_file_not_symlinkri s
9%d++S 1 11r c 6 t j | }t | }|st d t | g } t | }|sn"|j }| |j 4t | t | |S )z:Returns list of entries of directory pointed by descriptorzfdopendir error)
rb dupr( RuntimeErrorr+ r) contentsappendr3 r, )r< fd2rF dirlistentrypentrys r flistdirrs s
&**C S>>D .,---
dOOOG% u|$$$ % dOOO TNNN Nr c Z | ( t j | d S # t $ r Y d S w xY wd S r; )rb closerJ rC s r rL rL sF ~ HRLLLLL DD ~s
((c |d}t | ||| }|dk r|S | |d| z dd dS )z{Sets permissions to directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredNr z.Error: failed to set permissions of directory FT)r rO encode)rV permrW r< loggers r rO rO sr
z
+ +DKKMM4[EWEWEYEY Z ZB Avv
?$FtTTT 4r c |d}t | |||| }|dk r|S | |d| z dd dS )zSets owner and group of directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredNrw r z(Error: failed to set owner of directory FT)r rP rx )rV r= r> rW r< rz s r rP rP $ st
z
, ,T[[]]Cb+J\J\J^J^ _ _B Avv
9D@%NNN 4r c |d}t | ||||| }|dk r|S | |d| z dd dS )zCreates directory if it does not exist, sets permissions/owner otherwise
Returns descriptor if successful
Returns None if error has occuredNrw r #Error : failed to create directory FT)r rQ rx )rV ry r= r> rW r< rz s r rQ rQ 2 sv
z
) )$++--sC[M_M_MaMa b bB Avv
4t;UDIII 4r c t | |||| }|r|r |d| z dd |S )zeRecursive directory creation function
Returns 0 if successful
Returns -1 if error has occuredr} FT)r rR rx )rV ry r= r> rW rz ress r rR rR @ sg ..
(
( c3 HZHZH\H\
]
]C
Jv J4t;UDIII Jr c ||||t d |duo|du}|rt || t | }| }| |rt |S # t t f$ r_}|rt t d| z dz t | z t d| |s t j d Y d}~dS d}~ww xY w)z read file not following symlinksNzEread_file_secure: uid and gid should be both null or be both not nullzError: failed to read : )
rl
set_user_permri readlinesru
set_root_permrJ IOErrorloggingstr SILENT_FLAGsysexit) filenamer= r>
exit_on_error write_log drop_perm file_objectcontentes r read_file_securer J s S_bcccD 7s$I c3
+H55 '')) OOO W OOO(83e;c!ffDkSTV_```
s AA< <C,
AC''C, c
T t j | }|rt || d}d} t j d| \ }} t j |d }
|
d | |s$|"| t ||| rt d t || rt d |
n+# t t f$ r} |
n# t $ r Y nw xY w t j | n# t $ r Y nw xY w t j | n# t $ r Y nw xY w|rt! t# d| d t% | d
d t( d | Y d} ~ d
S d} ~ wt $ rD} t# dt% | t( d t+ j d Y d} ~ nd} ~ ww xY wd} t j | | nl# t $ r_} d
} t# d|z d z t% | z t( d | t j | n# t $ r Y nw xY wY d} ~ nd} ~ ww xY w|rt! | S )z!Returns True if error has occuredNcagefs_)prefixr_ w z
fchown failedz
fchmod failedz Error: failed to write file r ErrnozErr coder TzError: Fz$Error: failed to rename tempfile to )rb rV dirnamer tempfilemkstemprB writejoinr$ rJ r' ru r Exceptionunlinkr r r replacer r r rename)
r ini_pathr= r> r ry r dirpathr< temp_pathr r errors
r write_file_securer c s0 gooh''G c3
BI" ( wGGG
IiC(( "'''**+++ /S_ b#s##
/ o... "d +/** * W D HRLLLL D Ii D OOO ]8 ] ]AwPZ8[8[ ] ]
ttttt "#a&&""K333
E
)X&&&& 6AEICPQFFRT_abdmnnn Ii D Ls B/C( (H:DF?
D F?D F? D54F?5
E?F?EF?EF?
E(%F?'E((AF??
H :H HH, ,
J6/J&I;:J;
JJJJJr
copy_ownerc |%t j }t |dd t j | }d\ } }
t j ||| \ } }
t j | dd 5 } | | ddd n # 1 swxY w Y nu# t t f$ ra | |
t j | n# t t f$ r Y nw xY w t j |
n# t t f$ r Y nw xY w w xY w t j
|
| |rSt j | r4t j | } t j |
| j | j t j |
| nI# t t t( f$ r/ t j |
n# t t f$ r Y nw xY w w xY w|ht j }
t j |
t j t j |
d
k rt j | dS dS dS ) a
Safely write string content to a file
:param content: str
:param dest_path: str -> path to a file
:param perm: int -> permissions for the file
:param prefix: str -> add to temporary file name
:param suffix: str -> add to temporary file name
:param as_user: str -> name of the user to drop privileges to
:param copy_owner: bool -> whether to copy original uid/gid to new file if original exists
NTF)effective_or_realset_envNN)r suffixr_ r surrogateescape)errorsr )rb getgroupsr rV r r r rB r r rJ ru r chmodisfilestatchownst_uidst_gidr TypeErrorgetuidseteuidsetegidgetgid setgroups)r dest_pathry r r as_userr
old_groupsr r< r f_tempstat_ruids r write_file_via_tempfiler s \^^
WeLLLLgooi((G MB ( f'; ; ;
I
Yr3'8
9
9
9 "V LL ! ! ! " " " " " " " " " " " " " " " W
:* HRLLLL! D Ii ! D
D!!! <"'..33 <GI&&E HY el ; ; ;
)Y'''' Wi ( Ii ! D
y{{
4
29;; 199 L $ $ $ $ $
9s
1B, >B B, B$$B, 'B$(B, ,D CD C,)D +C,,D 0DD DD DD "A?F" "G(:GG(G# G("G##G(c D t j | ng# t f$ rY}|rGt dt | z dz t | z t j d nY d }~dS Y d }~nd }~ww xY wt | | } t j | nS# t f$ rE}|r3t d|t | t j d nY d }~dS Y d }~nd }~ww xY w t j | ng# t f$ rY}|rGt dt | z dz t | z t j d nY d }~dS Y d }~nd }~ww xY w| dk rda
d S t d a
d S )
Nzfailed to set egid to z: r rw z'failed to set supplementary groups to :zfailed to set euid to r TF)
rb r rJ print_errorr r r
get_groupsr r root_flagr enable_quota_capability)r= r> r r groupss r r r s
3 : 03s88;dBSVVK L L L HQKKKK22222
KKKK S
!
!F
V : A63q66 R R R HQKKKK22222
KKKK
3 : 03s88;dBSVVK L L L HQKKKK22222
KKKK axx ..000 sF A;A A66A;B$ $ C4/5C//C48D
E1A E,,E1c t j d nR# t f$ rD}| r2t dt | t j d nY d }~dS Y d }~nd }~ww xY w t j d nR# t f$ rD}| r2t dt | t j d nY d }~dS Y d }~nd }~ww xY wt dd } t j | nS# t f$ rE}| r3t d|t | t j d nY d }~dS Y d }~nd }~ww xY wda
d S )Nr zfailed to set euid to 0 :r rw z Error: failed to set egid to 0 :z.Error: failed to set supplementary groups to :T) rb r rJ r r r r r r r r )r r r s r r r s
1
: 3SVV < < < HQKKKK22222
KKKK
1
: :CFF C C C HQKKKK22222
KKKK 1
F
V : H&RUVWRXRX Y Y Y HQKKKK22222
KKKK IIIsD A&4A!!A&*A? ? C
4C C"C7 7 E5EEc t ddt j | D ] }t |dt j t t j d S )NzError: )endfile)r )printr stderr)argsas r r r $ s[ (#*----
+ +
aSsz***** szr c V t }t }t }|D ]Y}|| j }|D ]G} || j }n# t
$ r Y w xY w|| k r | || j HZ| | t | S )z$Returns supplementary groups for uid) get_grp_dict get_pwd_dictsetgr_mempw_uidKeyErroraddgr_gidlist) r= r> grpwr groupmembersuser
member_uids r r r + s B B
UUF - -U)" - -D
X_
S
2e9+,,,
- JJsOOO <<s
A
A A c p t )i a t j } | D ]}|t |j < t S r; )grp_dictgrpgetgrallgr_name)r lines r r r @ s;
\^^ * *D%)HT\ " " Or )min_uidc 4 t S r; )clpwd
get_user_dictr r r r r M s r c X |s|rt | |rt }t s t \ }}t t >t j d }t t dd at j | t | t d nU# t t f$ rA}t dt t | t j d Y d }~nd }~ww xY w|st! || d S d S d S )N r r
z writing to )r r get_permr log_filerb umaskrc LOGFILEr rJ r r r r r r ) msgsilentverboser root_flag_savedr= r> umask_savedr s r r r T s/ #JJJ $# zzHC OOO
htnn a00%%% NN3 NN4 !
wA 7 7 7 HQKKKKKKKK $ #s # # # # ##$ $ $ $s A9B? ?D7D Dc t j } t j }nI# t f$ r;}t dt | t
j d Y d }~nd }~ww xY w| |fS )Nzfailed to get (euid,egid)r )rb geteuidgetegidrJ r r r r )r= r> r s r r r n sy jlljll : /Q888 8Os &) A/1A**A/c | r t n t S )z
Set CAP_SYS_RESOURCE capability
:param bool clear: Set on if it's true, set off otherwise
:return: 0 for success, -1 otherwise
:rtype: int
)r disable_quota_capabilityr )clears r set_capabilityr x s9 9> 6<>> 2 2 4 4 4
^^
3
3
5
56r c F t j | t S )a
Change effective uid of current process and set CAP_SYS_RESOURCE capbality
to prevent "Disk quota exceeded" error
:param int euid: User ID to set it as current effective UID
:return: 0 if capability was set successfuly, -1 otherwise
:rtype: int
)rb r r )r= s r
change_uidr s JsOOO r c | s"t dS t dS )zZ
Disable quota kernel check to allow us to write
more than user can by quota.
N)r r r enableds r _set_quota_checks_statusr sD
2..00000//11111r c # ~ K t d d V t d d S # t d w xY w)NFr T)r r r r
disable_quotar sT U++++/
...... .....s * <c # K t j | } d V t j | d S # t j | w xY wr; )rb r ) umask_value saved_umasks r set_umaskr sO (;''K
s 2 Ar r; )NNTT)Tr T)r r NF)T)FTT)F)Nr r r
contextlibrb functoolsr typingr ctypesr r r r r r
r r r
r clcommonr clcommon.clpwdr r r r r r7 r8 r. r* r$ r' rB r) r+ r, r r rX rM rN rS rT r r MIN_UIDr rK ri rs rL rO rP rQ rR r r boolr r r r r r r r r r r r r r r contextmanagerr r r r r r s
/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / /G G G1 1 1
4 > :< > >( ( (? ? ?< < <1 1 1
&
6 6 62 2 2 8 2; ; ; ;~ Z_7% 7%RV7% 7% 7% 7%t$ $ $ $N D $ g ! ! !
$ $ $ $4 6 6 6 6
2 2 2 / / / r