{1XH T d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z m Z d dl
mZmZ d dl
mZ d dlmZ d dlmZ d d lmZ d
d lmZ d
d lmZ d
d
l m Z m Z m Z d
dl m!Z! d
dl"m#Z# d
dl$m%Z% d
dl&m'Z'm(Z( d
dl)m*Z*m+Z+ d Z,d Z-de.dz fdZ/de.de0fdZ1d Z2dZ3dZ4d gZ5d d d Z6d Z7d! Z8d" Z9de.fd#Z: e j; d
$ d% Zd( Z?d) Z@d* ZAd+ ZBd,e.fd-ZCd,e.fd.ZDd,e.fd/ZEd0 ZFd1e.fd2ZGd3 ZHdeIfd4ZJde.fd5ZKdeIfd6ZLd7 ZMd8 ZNd:de.d1e.dz fd9ZOdS ); N) defaultdict)Path)setup_mount_dir_cagefsCAGEFSCTL_TOOL)cpusersis_panel_feature_supported)docroot)Feature)NoDomain)PyLve ) user_exists)UserNotFoundError) admin_configconfig
jail_utils)DOCROOTS_ISOLATED_BASE)write_jail_mounts_config) reload_processes_with_docroots)start_monitoring_servicestop_monitoring_service) trigger_xray_ini_regeneration trigger_ssa_ini_regenerationc T t j t j S N)ospathisfiler WEBSITE_ISOLATION_MARKER Fopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/domain.py(is_website_isolation_allowed_server_wider# % s
7>>,? @ @@r! c T t j t j S r )r r r r "WEBSITE_ISOLATION_AVAILABLE_MARKERr r! r" &is_website_isolation_feature_availabler& ) s
7>>,I J JJr! returnc . t j t j } t j t j }| r8|r6t
j d t j t j d dS | rdS |rdS dS )u Return the current user mode for website isolation.
Returns:
``"allow_all"`` – all users allowed, denied dir lists exceptions.
``"deny_all"`` – no users allowed, allowed dir lists exceptions.
``None`` – not initialised yet.
zBoth site-isolation.users.allowed and site-isolation.users.denied directories exist. Removing allowed directory, treating as allow_all mode.T
ignore_errors allow_alldeny_allN)
r r isdirr ISOLATION_DENIED_DIRISOLATION_ALLOWED_DIRloggingwarningshutilrmtree)
has_denied has_alloweds r" get_isolation_user_moder6 - s | @AAJ'-- BCCK k
Y
l8MMMM{ { z 4r! userc t j t j sdS t }|dk r t j t j | S |dk r t j t j | S dS )u Check whether *user* is allowed to use website isolation.
Combines the global marker with the two-mode user model:
* **allow_all** – allowed unless the user is in the denied directory.
* **deny_all** – denied unless the user is in the allowed directory.
Fr+ r, ) r r r r r r6 user_in_dirr. r/ )r7 modes r" %is_website_isolation_allowed_for_userr; F sw 7>>,? @ @ u " $ $D { +L,MtTTTT z' (JDQQQ 5r! c j t j t j st t
t ddd t t j } | j
dd | t j
g ddd dS dS ) zCSet up mount directories and the global marker if not already done.*TF)prefixremount_cagefsremount_in_background)parentsexist_ok)z/usr/bin/systemctlz try-restartzclwpos_monitoring.service)capture_outputtextN)r r r r r r strr r parentmkdirtouch
subprocessrun) marker_paths r" "_ensure_isolation_mount_and_markerrL W s
7>>,? @ @
& ' ' u
<@AA === N N N
r! z/etc/cagefs/proxy.commandsz> w~~f%% 7++D11 tOGc&&F&&&& E>r! c d}| D ]e\ }| vr
t j | r*| d }fd|D }d | } d}f| |fS )zRemove proxy entries whose binaries no longer exist on disk.
Returns the (possibly updated) content string and a bool indicating
whether any entries were removed.
FT)keependsc D g | ] }| d | S )rQ )
startswith).0lrX s r"
z)_remove_proxy_entries.. s0 AAAq iii)@)@AAAAr! )rR r r rS
splitlinesjoin)rU rV removedrY linesrX s @r" _remove_proxy_entriesrg s G }} V g
7>>& ! ! ""D"11AAAAEAAA''%.. G r! c t t dd 5 } | }ddd n # 1 swxY w Y n# t $ r d}Y nw xY wd}d|vrEt j dt |r| d s|d z
}|t d z z
}d
}t |t \ }}|r t j d t d
}t |t \ }}|r t j d t d
}|sdS t j
t }t j |d
t j |d \ }} t j |dd 5 } | | ddd n # 1 swxY w Y t j |t n## t( $ r t j | w xY wd t. d z }t3 j t6 ddg|t2 j t2 j d t3 j t6 dgt2 j t2 j d dS )a Register the ``cagefsctl-user`` proxyexec alias if not already present.
Appends the ``CAGEFSCTL_USER`` entry to ``/etc/cagefs/proxy.commands``
and runs ``cagefsctl --update-list`` to pull the required binaries into
the CageFS skeleton. This is a no-op when the entry already exists.
Also registers/unregisters the LVD helper binaries
(``lvd-registry-helper``, ``lvd-limits-helper``) depending on whether
they are present on disk.
rzutf-8)encodingNrb FCAGEFSCTL_USERz Registering cagefsctl-user in %srP Tz Registering LVD helpers in %sz"Removing stale LVD helpers from %s)rB z.proxy.commands.)dirr> wz --wait-lockz
--update-list)inputstdoutstderrcheckz--update-wrappers)ro rp rq ) openPROXY_COMMANDS_PATHreadFileNotFoundErrorr0 inforT CAGEFSCTL_USER_PROXY_ENTRYrZ LVD_PROXY_ENTRIESrg r r dirnamemakedirstempfilemkstempfdopenwritereplace
BaseExceptionunlinkrd CAGEFSCTL_USER_BINARIESencoderI rJ r DEVNULL) frU changedrW re proxy_dirfdtmp_path update_lists r" ensure_proxyexec_commandr s
%sW
=
=
= ffhhG Gw&& 79LMMM 7++D11 tOG-44'1BCCNGU 46IJJJ,W6GHHGW 9;NOOO 344IK D))))# :LMMMLB
Yr3
1
1
1 Q
GGG
8 01111
(
99 455<DDFFKN 8!! N ,-!! s^ A : A >A >A AA'G >F G F$$G 'F$( G G&c t t } | dk rNd}t j t j t j d t j t j d nMd}t j t j t j d t j t j d |S )u Flip the isolation user mode without modifying any per-user state.
Unlike :func:`allow_website_isolation_server_wide` and
:func:`deny_website_isolation_server_wide`, this function only flips
the mode indicator directories. It does **not** clean up existing
user isolation or alter the per-user exception lists.
* ``allow_all`` → ``deny_all``
* ``deny_all`` → ``allow_all``
* not initialised → ``allow_all``
Returns:
The new mode after toggling (``"allow_all"`` or ``"deny_all"``).
r+ r, Tr: rB r) )
rL r6 r rz r r/ DIR_MODEr2 r3 r. )currentnew_modes r" toggle_isolation_user_moder s '(((%''G+
L6\=R]abbbb
l7tLLLLL
L5Lz+_cleanup_user_isolation.. s0 '( " " r! )r ) user_configfilter_by_docrootsz|Unable to detect document root for domain %s, configuration cleanup failed. Contact CloudLinux support if the error repeats.)r r load_user_configenabled_websitessave_user_configr r listvaluesrR r0 errorr remove_website_token_directory)r user_cfgdomain_docroot_mapr r s r" r r s" x &x00H $ ,4,E HT2222 X48888"T*<*C*C*E*E%F%F )..00 E E
7 ? M(
1(GDDDD E Er! c t t D ]7} t | # t $ r t j d| Y 4w xY wt }|st
dS dS )z9Remove domain isolation state for every user that has it.z:Unable to disable website isolation for user %s, skipping.N)r #users_with_enabled_domain_isolationr Exceptionr0 r r )r
users_lefts r" r r s <>>?? #H - - - - L
566J " !!!!!" "s / AAr c ^ t | d S # t t f$ r Y d S w xY w)Nr )get_domain_docrootr
IndexError)r s r" r r sA !&))!,, j ! tts ,,c t sdS t j | }n# t $ r Y dS w xY wt j | S )NF)r# r get_jail_config_pathr r r rS )r7 domains_config_paths r" is_isolation_enabledr se 3 5 5 u ( =d C C uu
7>>- . ..s '
55c p d t D } i }| D ]}t | }|r|||< |S )Nc N g | ]"}t | t | |#S r )r r )r_ us r" ra z7users_with_enabled_domain_isolation.. s1 P P P1[^^ P8LQ8O8O PQ P P Pr! )r #get_websites_with_enabled_isolation)usersuser_domain_pairsr7 domains_with_isolations r" r r sV P P P P PE = =!DT!J!J ! =&< d # r! c t | st j d| g S t j | j S )Nz=User %s not found, cannot get websites with enabled isolation)r r0 r1 r r r )r7 s r" r r sG t KT S S S "4 ( ( 99r! c t } t t }| D ]S\ }}|D ]K} t | d }n# t
t f$ r Y ,w xY w|| | LT|S )z
Returns pairs user: set(docroots) for all users with website isolation enabled
Used by monitoring service to watch docroots changes to load actual list of docroot paths
instead of stale storage
r )r r setrR r r r add)users_with_isolationpairsr7 domainsr drs r" !get_docroots_of_isolated_websitesr s ?@@ E-3355
g F
'//2 j)
$KOOB Ls AA+*A+c t t | st j d| d S t j | }||j vr|j | t | d }t j | | t j
| | t j | | t j
ddd|gd t | | t | t! | g t# t% | | t' | t) | | d S ) Nz2User %s not found, cannot enable website isolationr cagefsctlz--rebuild-alt-php-iniz--domainT)rq r )r r0 r1 r r r appendr r create_website_token_directory create_overlay_storage_directoryr rI rJ r r r r r r r )r7 r r
document_roots r" enable_website_isolationr sK t @$ H H H)$//K
[111$++F333
'v..q1M -dMBBB/mDDD
D+... NK!8*fMUYZZZZ T;///"4=QRX=Y=Y t RTX Z Z Z)$//K T;///N . ,V44
OK
m,,, 5dM J J J 7m L L L L MTV\^_ ` ` ` HHHH #4NKKKKKKs *B>>
C(C##C(c t | st j d| d S t j | }d }g }|-t |j }d |j D }g |_ n6||j v r-|g}t | g}|j | t j | | t | | |r.t | | |D ]}|t j
| | |D ]D} t | | # t j t" f$ r t j d| Y Aw xY wt' }|st) d S d S )Nz3User %s not found, cannot disable website isolationc , g | ]}t | S r r )r_ websites r" ra z-disable_website_isolation..@ s.
.5 ) )
r! r z1Failed to unregister domain LVE for %s, skipping.)r r0 r1 r r r r r remover r r r r r rI r r r r r )r7 r r reload_docrootsdomains_to_unregisterr r r s r" disable_website_isolationr 5 s t A4 I I I)$//KO
~ $[%A B B
9D9U
(* $$ ;/ / /!' /778$++F333
D+... T;/// K&tPPPP , K KM $ 5dM J J J J
" H H H "4 + + + +-w7 H H H CQ
H
H
H
H
H H
?@@ " !!!!!" "s >D+D=<D=r )P functoolsr0 r r2 rI r{ collectionsr pathlibr clcommon.clcagefsr r clcommon.cpapir r r r clcommon.constr
clcommon.cpapi.cpapiexceptionsr lve_utils.pylve_wrapperr fsr
exceptionsr webisolationr r r webisolation.configr webisolation.jail_config_builderr webisolation.phpr webisolation.servicer r webisolation.triggersr r r# r& rE r6 boolr; rL rs rw r rx rZ rg r r lru_cacher r r r r r r r r r r r r dictr r r r r r r r! r" r s8
# # # # # # D D D D D D D D > > > > > > > > 8 8 8 8 8 8 " " " " " " 3 3 3 3 3 3 ) ) ) ) ) ) ) ) ) ) ) ) : : : : : : : : : : 7 7 7 7 7 7 F F F F F F < < < < < < S S S S S S S S ^ ^ ^ ^ ^ ^ ^ ^A A AK K Kt 2 "
$ 3 [
FA * &@ @ @FC : Q
"
"
"4 4 44 4 4 ,I I I4#s # # # #."c " " " "&Ec E E E E8 " " " / / / T :c : : : :4 $ ' ' 'F L L L>'" '"C '"t '" '" '" '" '" '"r!