jz d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl
mZmZmZmZ d dlmZ d dlmZ d dlZd d
lmZ d d lmZ d d lm Z m Z d d
l m Z d dl m!Z! d dlm"Z" d dl#m$Z$ d dl%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+ d dl,m-Z- d dl.m/Z/ d dl0m1Z1m2Z2m3Z3 d dl4m5Z5 n # e6$ r Y nw xY w d dl7m8Z8 d dl9m:Z: n# e6$ r d Z8dZ:Y nw xY w G d de Z;dS ) )print_function)absolute_import)divisionN) configparser)S_IRUSRS_IWUSRS_IRGRPS_IROTH) iteritems)Path )ClSelect)ClSelectExcept)ClPwd clcaptain)clprint)utils)clcagefs)ExternalProgramFailed)docroot domain_owner userdomains)NoDomain NoPanelUser)BASEDIR)get_user_prefix)is_ea4_enabledread_cpanel_ea4_php_confconfigure_alt_php)da_change_user_php_ini)get_website_id)load_user_configc d S N )_s L/opt/cloudlinux/venv/lib64/python3.11/site-packages/clselect/cluserselect.pyr( - s t c e Zd ZdZdZ ej rendZdZdZ d.dZ
e d/d Z d
Z
d0d Zd1dZd Zd Zd Zd Zd Z d2dZd2dZdedefdZd3dZd Zd Zd Z d Z d Z d4d Z d5d Z e e Z d! Z!d" Z"d# Z#d.d$Z$d% Z%d& Z& e e& Z&d' Z'd( Z( e e( Z(d6d)Z)d* Z*d+ Z+ e e+ Z+d, Z,d- Z-dS )7 ClUserSelectz /var/cagefsz
/usr/selectorz'/usr/share/cagefs-skeleton/usr/selectorz/etc/cagefs/excludez.cl.selector/selector.pathNc \ t j s!t j d sdS |D ]}| j | }t j |j d }t j | s| | } t j | n.# t t f$ r}t j || d}~ww xY w t | # t | w xY wdS )z
Creates flags mod_lsapi_reset_me in users' home directories in order
to recreate CRIU images when php version/extensions/options have changed
For details see LVEMAN-1210
:param users: list of usernames (strings)
z /var/run/mod_lsapi/criu.enabledNmod_lsapi_reset_me)r in_cagefsospathisfile_clpwdget_pw_by_namejoinpw_dir _change_uidr writeOSErrorr r UnableToSaveDatar+ _restore_uid)selfusersuserpwr0 previous_user_dataes r' clean_crui_imagesz ClUserSelect.clean_crui_images8 s: !## BGNN;\,],] F
B
BD++D11B7<< +?@@D7>>$''
B%)%5%5d%;%;"B OD)))) !67 C C C(9$BBBC * !--.@AAAAL--.@AAAA
B
B
Bs* -CD C-C((C--D D(Tc R t j t s;t j s(t
d |rt j d ndS |rut rgt }|rW |d }| d s(t
d |rt j d ndS n# t $ r Y nw xY wt || |dt j dk | }|r|rt j d |st t! t |j j } t' |j } n# t( $ r g } Y nw xY w| D ]4\ }
} |
|vr
t || | dt j dk | 5|S )
z
Switch symlink for alt php.
Create .cagefs directory if not created
Rerurn True if error has occured
ERROR: CageFS not installed.r
Tdefaultzea-phpzlERROR: system default PHP version is alt-php. PHP Selector is disabled. Use cPanel MultiPHP manager instead.Fr ) write_log drop_permconfigure_multiphp)r/ r0 isdirr r r. printsysexitr r
startswithKeyErrorr geteuidr" setpw_nameenabled_websitesr r ) versionr>
document_root
exit_on_errorrG conf default_phperrorisolated_domainstarget_domainsdomaindomain_docroots r' switch_symlink_for_alt_phpz'ClUserSelect.switch_symlink_for_alt_phpP s w}}W%% h.@.B.B 0 1 1 1
t ."2"2 +--D
"&y/K&11(;; ( ] ) ( HQKKKK#'4 D " z||q( 1
] HQKKK !1!= "#3BJ#?#?#P Q Q
$!,RZ!8!8
$
$
$!#
$ +9
&!111 ! # !z||q 0'9 s% AC
CC E E-,E-c | j r#t d t j d t j dk r#t d t j d | }t | D ]M\ }}t d| | j | }t ||dd Nd S )NzPERROR: this option does not work in "single user" mode (when CageFS is disabled)r
r z ERROR: root privileges requiredzProcessing userF)rT rG ) without_cagefsrI rJ rK r/ rN get_user_version_mapr r2 r3 r+ r\ )r; users_vers_dictr= rR r> s r' apply_symlinks_rulesz!ClUserSelect.apply_symlinks_rules s d e e e HQKKK
:<<1 3 4 4 4 HQKKK 3355 & 7 7 p pMD' #T * * *++D11B 3 3GRuin 3 o o o o p pr) phpc t j | | t | _ t | _ |r || _ d S g | _ d S r$ )r __init__r r2 rO _user_excludesexclude_pid_list)r; itemrf s r' rd zClUserSelect.__init__ sP $%%%gg !ee '$4D ! ! !$&D ! ! !r) Fc L
| | }|r_t | d } || }t j | s | } | }t j | s|S t j | j }t j
| s|S t j |
j r9 j
s j
j
j k r|S t j
j k r|S t# t%
fdt# d }| | d | d j fS # t( t* f$ r |cY S w xY w)zl
Returns alternative version for a user
@param user: string
@return: string
r c > | d j k S )Ndata)_item)i alternativeslink_dstr; s r' r( z*ClUserSelect.get_version.. s ,q/&"9$*"E"Q r) rR rj )_check_user_in_cagefs_compose_user_alt_pathr r/ r0 rH _compose_native_infoget_all_alternatives_datar4 rk islinkreadlinkr^ _native_contents_load_native_contentsdirname
SELECTOR_PATHlistfilterkeys
IndexErrorrM ) r; r= rZ show_native_versionalt_pathrS native full_pathrR rm rn s ` @@r' get_versionzClUserSelect.get_version s
""4(((..t44 = #FOOA .M224 GGH7==**
= 66t<<**+>??w}}X&& M5577 GLL4:66 w~~i(( M;y)) (
7**4:66640<<<
7??8 $ $(: : :M QQQQQQTXYeYjYjYlYlTmTmnn G \' 29 =|G?TU[?\]a]g?hi iH% MMM s A.H
H#"H#c n t j | s| | } t j | n.# t t f$ r}t j || d }~ww xY w t | d S # t | w xY wd S r$ ) r/ r0 rH r6 r mkdirr8 r r r9 r+ r: )r; r0 r= r? r@ s r'
create_dirzClUserSelect.create_dir s w}}T"" >!%!1!1$!7!7
>%%%% 23
?
?
?$5dA>>>
? & ))*<===== ))*<==== > >s) A
B A6 A11A66B B2c p | j | }t j || j }| | }| || | d|dz d | d|dz d | | dS )z\
Creates additional directory and symlinks for use in "without CageFS" mode
z
../php-cliz/phpT)check_existencez../phpz/php-cgiN)
r2 get_homedirr/ r0 r4
SELECTOR2_DIRr6 r _create_symlinkr: )r; r= homedir path_in_homecur_users r' create_selector_symlinksz%ClUserSelect.create_selector_symlinks s +))$//w||GT-?@@ ##D)) d+++ \<&+@RV WWW X|j'@RV WWW (#####r) c t j t j rD | j d| j S # t j t t f$ r Y dS w xY wdS )Nversionsr ) r/ r0 r1 r
DEFAULTS_PATH_dhgetrk ConfigParserErrorIOErrorrM )r; s r' get_default_versionz ClUserSelect.get_default_version si
7>>(0 1 1
x||J
;;; &:
xx
xs A A+*A+c J t j | j | dd }t j | s*| || d S | | }| || d| j
d S # t j t t f$ r<}t dt! | t# j d Y d }~d S d }~ww xY w)N .cl.selector defaults.cfgr z*Error while restoring settings from backupr
)r/ r0 r4 r2 r r1 set_versionr _get_default_config_handlerr rk r r r rM rI strrJ rK )r; r= user_backup_pathdhr@ s r' set_version_from_backupz$ClUserSelect.set_version_from_backup s 7<< (?(?(E(E~Weffw~~ .// T4#;#;#=#= > > > > >
556FGG rvvj$*'E'EFFFFF &:
BCFFKKK
s AC
D"&1D D"c R | j | j |d sdS dS )aL "
Checks if version is enabled,
a version is considered "enabled" if there is no "state" option in the config.
The presence of the "state" option always means it is disabled, regardless of its value.
@param version: string
@return: bool - True if version is enabled, False otherwise
stateTF)r
has_optionrk )r; rR s r' _version_enabledz ClUserSelect._version_enabled s3 x""TZZ#A7KK 45r) c
( t j dk r+| | x}rt j | | | st j d|z |rC t
| }n# t $ r d}Y nw xY w||k rt j d|d| t j
| j | j
| j | t j ||||| } |r| S dS )zz
Sets alternative version for a users with the same uid
@param user: string
@return: None
r z'Version %s is disabled by administratorNzDomain z does not belong to user )r/ rN "get_version_selection_disabled_msgr VersionModificationBlockedr r r SelectorExceptionr apply_for_at_least_one_user _set_versionr2 get_namesget_uidNoUserSelector)
r; r= rR rZ return_summaryr} rT messageownerrj s
r' r zClUserSelect.set_version sG :<<1 T-T-TUY-Z-Z"Z' ;GDD D $$W-- q ; rg native_pathininew_ini_created new_ini_pathsrcdstfilenamer0 s r' r zClUserSelect._set_version* s 8!%!1!1$!7!7 ""4(((
/ #FOOA .M..t]CCw}}X&& :"
:f
:$////$3D9995577 , & &7h+>+> 9'BB B ''111
[
'
'
-
- h "
B, ;..tz:::)243H)I)I \ \%D+((hnt6KTSZ[[[[\ "' !w||8H8H8H,JC P P 7>>,// + ',,x$2D'DcJJC ',,x55C((c4AAA&*O "
4+; < < B BHz11 ((00 !_ ! ',,x::C ',,t'98DDC((c4AAAAB ( W(=f(E F F
X
X
d$$T27<<$+G+GwWWWW 3 % %&8 9 9 9 9 3 3GRBOBO
4
Q
Q
Q
# #D' 2 2 2 t$$$ d### ?##D*=>> > ? ?r) usernamereturnc n | j | }t d| d }| sdS | d 5 }t j | }| dd cddd S # 1 swxY w Y dS # t t f$ r Y dS w xY w)a
Returns a message indicating that the selection of the PHP version
is disabled for the user, based on the configuration file.
Args:
username (str): The username for which to check the configuration.
Returns:
str: The message indicating that version selection is disabled,
or an empty string if the configuration file does not exist
or does not contain the message.
z!/var/cloudlinux/cl.selector/uids/z /version_selection_conf.jsonr zutf-8)encoding version_selection_disabled_msgN)
r2 r r r openjsonloadr r8
ValueError)r; r uid config_filef config_datas r' r z/ClUserSelect.get_version_selection_disabled_msgi s# k!!(++`s```aa !!## 2 !!7!33
Mq "ill "'GLL
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M $ 22 s6 B *B B BB BB B43B4c | | | }| | }dddddi}t | }| d | | d }|D ]?}||vri ||< | | || d< d|| d< d|| d< @ | j d | j
} n## t j t j
f$ r d} Y nw xY w d|| d< d|| d< n"# t $ r t j | w xY w| d ||d < | d | |d g }
t' | D ]z\ } } t) || d || d || d f s<|
| || d || d || d ff {t+ |
S )
a'
Returns a summary of available alternative versions for the given user.
Only versions that are enabled, default, or selected are included.
The label for the "native" version is replaced if show_native_version is True.
@param user: str - Username inside CageFS.
@param show_native_version: bool - Whether to replace the 'native' version label.
@return: tuple of (str, (bool, bool, bool)) - Each entry contains the version name and a tuple with flags:
(enabled, default, selected).
r TF)enabledrD selectedr r rD r r )ro rr rq sortedr{ appendr r r r rk r NoSectionError
NoOptionErrorrM r r popremove enumerateanytuple)
r; r= r} rm native_infosummary alt_versionsselected_versionrR default_versionresultidxvs
r' r zClUserSelect.get_summary s
""4(((5577 //0CDD %U S ST l / / 1 122 H%%% ++D11!4# 1 1Gg%%#% *.*?*?*H*HGG Y '*/GG Y '+0GG Z ( ( ' "hll:tz B BOO +\-GH ' ' ' &OOO ' K26GO $Y /48G$ %j 1 1 K K K 9/JJ J K")++h"7"7 A H%%%KN+++ -- g gFC
9-wqz)/DgajQ[F\]^^
MM1wqz) 4gaj6KWUVZXbMc de f f f fV}} s C< < D D D7 7 Ec | | }|D ]W} | ||d # t $ r/}t j ddt | d Y d}~Pd}~ww xY w| | dS )z
Changes users of a supplied version to specified_version
@param version: string
@param current_version: string
F)rT textERROR)statusr N)
list_usersr Exceptionr
print_diagr rA )r; new_versioncurrent_versionr< r= r@ s r' change_to_versionz ClUserSelect.change_to_version s 00 D
{% HHHH
"6g#a&&+Q+QRRR
u%%%%%s 4
A-%A((A-c F | }||v r|| S g S )z8
Returns users of a certain alternative
)get_version_user_map)r; rR rj s r' r zClUserSelect.list_users s- ((** d??= r) c | j rddlm} | gS t | | S )zF
Returns all valid system users
@return: list
r
)get_cpanel_user)r^ clselectctlphpr ry _get_system_users
difference_get_user_excludes)r; r s r' list_all_userszClUserSelect.list_all_users sf
' 7 7 7 7 7 7#O%%& &D**,,778O8O8Q8QRRSSSr) c t }d|d< d|d< d|d< d}t j | dd l}n3# t
$ r& t
d t j d Y nw xY wt j t t | |d }t j |d z r"t j |d
z s|
|| d S d S ) Nr initreinitverbose/usr/share/cagefsrC r
etcz /cl.selectorz /cl.php.d)dictrJ r0 r cagefsctl ImportErrorrI rK r/ r4 r r r cpetc_for_user)r; r= configLIBDIRr cagefs_etc_paths r' cagefs_copy_etcz ClUserSelect.cagefs_copy_etc s v x y$ 0 1 1 1 HQKKKKK ',,w0E0EtUSSw~~o >?? 3rw~~VehsVsGtGt 3 $ $T6 2 2 2 2 2 3 3s A -A54A5c | }i }|D ]7} | |d d ||< ## t j $ r Y 4w xY w|S )zH
Returns user version map as dict
@return: dict
Fr )r r r
NotCageFSUser)r; actual_usersrj r= s r' r_ z!ClUserSelect.get_user_version_map sv
**,, D
! - -dE : :1 =T
!/
s <A
Ac |p| }i }|D ]Y} | ||d d }||vrg ||< || | E# t j $ r Y Vw xY w|S )zH
Returns users grouped by version
@return: dict
Fr )r r r r r )r;
user_namesrZ r rj r= rR s r' r z!ClUserSelect.get_version_user_map s
":T%8%8%:%: D
**4??B $$&DMW
$$T****!/
s AA A21A2c
|rbt j | r/t j | | k rt j | ndS t j | t j | | dS # t $ r=}||t j ||| t j d| d|d|d d}~ww xY w)z
Creates symlink from src to dst
@param src: string
@param dst: string
@param user: string
@param version: string
@param check_existence: bool
@return: None
NzCannot create symlink from z to z ())
r/ r0 rs rt unlinkr remove_file_or_dirr symlinkr r UnableToSetAlternativer )r r r= rR r r@ s r' r z ClUserSelect._create_symlink s
o
27>>#&& 2{3''3.. # ,S111 c3 ' ' ' ' ' o o o G$7$;D'1MMM 22adadadfififiklklkl3mnn n os AA= )A= =
C8B??Cc | j r| j S t j | j st S t j | j D ]}t j | j | }| j t t d t j | | j S )zE
Returns list of user excludes
@return: list
c * | S r$ )strip)xs r' r( z1ClUserSelect._get_user_excludes... s 17799 r) )
re r/ r0 rH CAGEFS_EXCLUDErO r r4 updatemapr read_file_as_string
splitlines)r; rg full_item_paths r' r z ClUserSelect._get_user_excludes" s
'& &w}}T 011 55LJt 233 D W\\$*=t D DN & &C,,u/H /X/X/c/c/e/effgg
""r) c | j rdS t j rdS d}t j | ddl}n3# t $ r& t d t j d Y nw xY w |
| st j | dS # t $ r' t d t j d Y dS w xY w)z4
Check that cagefs enabled for user
Nr r rC r
z;ERROR: CageFS version is unsupported. Please update CageFS.)r^ r r. rJ r0 r r r rI rK is_user_enabledr r AttributeError)r; r= r r s r' ro z"ClUserSelect._check_user_in_cagefs2 s F F$ 0 1 1 1 HQKKKKK ,,T22
9$24888
9
9 O P P P HQKKKKKK s$ A -A65A6:)B% %-CCc t j | D ]`}| j |vr t j || }t j | sLt j | adS )zg
Removes all symlinks from directory
@param path: string
@return: None
N)r/ r rk r0 r4 rs r )r; r0 r r s r' r z'ClUserSelect._remove_alternatives_linksJ sx
4(( ! !Hz)) T844I7>>),,
Ii
! !r) c | j r | j | }|dz S t | j | }d}|r|rt | nd}t
j s0t j
| j |dd |dd nd}|r t j
|| n|S )zz
Composes and returns user alternative directory path
@param user: string
@return: string
z
/.cl.selectorr Nr z cl.selectorz/etc/cl.selector) r^ r2 r r r r! r r. r/ r0 r4 CAGEFS_PATH)r; r= rS r r document_root_idbases r' rp z#ClUserSelect._compose_user_alt_pathX s -k--d33G_, ,$+%%d++,, V@M U~m < < >) $ $ l
l )$$$$$
l
l
l$5iAjkkk
l l ls 7 Ac | j | }|j }|j }t j }t j }||k r||fS t j | t j | t j
||fS # t $ r}t j
|| d}~ww xY w)z
Changes to another uid and returns tuple of previous euid and egid
@param user: string
@return: tuple
N)r2 r3 pw_uidpw_gidr/ rN getegidsetegidseteuidsecureioset_capabilityr8 r UnableToChangeToAnotherUser)r; r= entrynew_uidnew_gidcur_euidcur_egidr@ s r' r6 zClUserSelect._change_uid s **400,,:<<:<< w X% % F Jw Jw # % % %X% % F F F B
B=#B88B=c L | d t j k rt j d t j | d t j | d dS # t $ r-}t j t | d | d}~ww xY wdS )zw
Restores changed uid and gid to original ones
@param uid_and_gid: tuple
@return: None
r T)clearr
N)
r/ rN r1 r2 r/ r0 r8 r r3 r ) uid_and_gidr@ s r' r: zClUserSelect._restore_uid s q>RZ\\ ) ) #$ / / / /
Y
;q>***
;q>*****
Y
Y
Y$@[QR^ATATVWXXX
Y * )s 4A* *
B!4(B B!c | | } |s;F =E>>F FFc g } t | }|D ]I}| d r2|d| d }| | J| n# t
t f$ r Y nw xY w|S )zH
Get extension names from user extensions file comments
z;--- z---)r rL rfindr closer8 r )r0
extensionsr lineexts r' _skim_over_extensionsz"ClUserSelect._skim_over_extensions s
t**C
+
+??6** + q4::e#4#4 45C %%c*** IIKKKK! D s A/A4 4BBc | | g }| | }t j t j | d }| }t j | j | d }t j | s|
| } t j | nH# t t f$ r4}t | t# j || d}~ww xY wt | t j |d } t j | r(d| j d| | d d}
n d| j d }
| |
t- | D ]} | j r |d
z | d d z d
z } n8t j |d| d d d } | | }
| d| j | dd t- |
d | |d | | dS )zk
Scans all user settings and backups'em in homedir as INI file
@param user: string
zcl.php.dr Nr z [versions]
z = r r= z
= native
z/alt_php.r r zalt-phpz alt_php.ini[z ]
modules = ,) ro rp r/ r0 r4 rw rr r2 r rH r6 r r r8 r r+ r: r r9 rk r r r r{ r^ replacerd rG )r; r= backup_contents
user_alt_path
user_ext_pathrm r r? r@ user_backup_filerR alt
curr_ext_pathra s r' r z ClUserSelect._backup_settings s
""4((( 33D99
RW__]%C%CZPP
5577 7<< (?(?(E(E~VVw}} -.. :!%!1!1$!7!7
K 01111 23
K
K
K ))*<===$56FJJJ
K
% %&8 9 9 9 7<<(8.II
7== ' ' B B15T=M=Md=S=STU=V=V=VWGG B 6:ZZZAG w''',++--.. o oC"
t -
:S[[b=Q=Q QTZ Z
" ]]CKKX[]_L`L`L`NOOOOOs +D E/E Ec 8 | j rd S t || d S r$ )r^ r )r; r= rR s r' r z ClUserSelect._switch_php_da_isp" s( F tW-----r) r$ )NTT)rb N)NF)NFFT)F)NN)NNF)T).__name__
__module__ __qualname__r" rx r r. r r r rA staticmethodr\ ra rd r r r r r r r r r r r r r r r r_ r r r ro r rp r r* r6 r: rG r rd r r r% r) r' r+ r+ 1 s K#M#58#5#7#7f--=fK*N0MB B B B0 A A A \AF p p p' ' ' '" " " "H> > >
$
$
$
ae" " " "H=? =? =? =?~3 3 2/ / / / b
&
&
& T T T3 3 3$ "o o o o2 #l?33O# # # 0 ! ! ! R R R R*& & &l l l & &899F F F* Y Y Y < --L": ": ": ":H" " "H )L)> ? ? P P PD. . . . .r) r+ )<
__future__r r r r r/ rJ r> rY r1 future.movesr r statr r r r
future.utilsr pathlibr rK clselectr clselectexceptr clcommonr r
clselectprintr r r r clcommon.utilsr clcommon.cpapir r r clcommon.cpapi.cpapiexceptionsr r clcagefslib.constr clcagefslib.fsr clcagefslib.selector.configurer r r clcagefslib.selector.panel.dar r #clcagefslib.webisolation.jail_utilsr! clcagefslib.webisolation.configr" r+ r% r) r' r s & % % % % % & & & & & &
5 5 5 5 5 5 3 3 3 3 3 3 3 3 3 3 3 3 " " " " " "
* * * * * * % % % % % % % % " " " " " " 0 0 0 0 0 0 = = = = = = = = = = @ @ @ @ @ @ @ @ ))))))......jjjjjjjjjjDDDDDDD D BBBBBB@@@@@@@ #^N
t . t . t . t . t .8 t . t . t . t . t .s$ B) )B10B15 C
CC