j&X d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
ddlmZmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlm Z m Z m Z ddl m Z m!Z!m"Z# G d d Z$ddZ%dS )zA
This module contains classes implementing SSA Manager behaviour
N)contextmanager)iglob)
disable_quota)Tuple )load_validated_parserload_configuration) flag_file)SSAManagerError) ssa_version)
AutoTracer)
DecisionMaker)
INI_FILE_NAMEINI_USER_LOCATIONS_BASEis_excluded_path)$copy_inis_to_website_isolation_paths(remove_inis_from_website_isolation_pathsregenerate_inis_for_userc " e Zd ZdZd Zd Zedefd Ze de
fd Z e de fd Z
e de fd Zd ede fd
Z d.d edej fd
ZdedefdZdefdZdefdZdefdZdefdZdefdZdede
fdZdededefdZ dedefdZ de e e e f ef fd Z e!d Z"d e d e dedd fd!Z#d/d"Z$de e e e f ef fd#Z%d/d$Z&d/d%Z'd/d&Z(defd'Z)d/d(Z*d/d)Z+defd*Z,d/d+Z-d,edd fd-Z.d S )0Managerz
SSA Manager class.
c t j d | _ t | _ ddg| _ ddg| _ d| _ d| _ t | _
t t t j f| _ d S )Nmanagerz!usr/lib64/php/modules/clos_ssa.soz0usr/lib/x86_64-linux-gnu/php/modules/clos_ssa.soz lib64/php/modules/clos_ssa.soz,lib/x86_64-linux-gnu/php/modules/clos_ssa.soz lib/php/extensions/*/clos_ssa.so)z /opt/alt/php[0-9][0-9]/link/confz+/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dz$/opt/plesk/php/[0-9].[0-9]/etc/php.dz'/usr/local/php[0-9][0-9]/lib/php.conf.dzM/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dzA/usr/share/cagefs-skeleton/usr/local/php[0-9][0-9]/lib/php.conf.d)logging getLoggerloggerr
ini_file_namemodule_patterns_with_usrmodule_patterns_no_usr module_glob_pattern_directadminwildcard_ini_locationsr wildcard_ini_user_locationsOSError
ValueError
subprocessSubprocessErrorsubprocess_errorsselfs B/opt/cloudlinux/venv/lib64/python3.11/site-packages/ssa/manager.py__init__zManager.__init__- sz ' 22 *
0 >)
%
, :'
# 0R,'
# ,C( Z!;"
c J t j } t j | j }n# t
$ r d}Y nw xY wd d | D }| j d||||| d S # t
$ r Y d S w xY w)Nz c 3 * K | ]\ }}|d |V dS )=N .0kvs r) z!Manager._audit..P sB $> $>%)Q111aa $> $> $> $> $> $>r+ z0[audit] operation=%s status=%s uid=%d user=%s %s)
osgetuidpwdgetpwuidpw_name Exceptionjoinitemsr info)r( operationstatusdetailsuidusername detail_partss r) _auditzManager._auditI s )++C
' <,,4
'
'
'&
' 88 $> $>-4]]__$> $> $> > >L K B63,
@
@
@
@
@ DD s- B 0 B ?B ?AB
B"!B"returnc ddi}| d | D t j | S )z@
Form a success json response with given kwargs
resultsuccessc i | ]\ }}|| S r0 r0 r1 s r)
z$Manager.response..^ s = = =daQ = = =r+ )updater= jsondumps)argskwargs raw_responses r) responsezManager.responseX sI
!), = =fllnn = = =>>>z,'''r+ c J t j t S )z
Is SSA enabled
)r6 pathisfiler
r' s r) _enabledzManager._enableda s
w~~i(((r+ c
ddhS )zK
Configuration settings required Request Processor restart
requests_duration ignore_listr0 r' s r) _restart_required_settingsz"Manager._restart_required_settingsh s
$]33r+ c
h dS )N> time correlationdomains_numberrequest_numbercorrelation_coefficientr0 r' s r) solo_filtered_settingsz Manager.solo_filtered_settingso s * * * *r+ settingsc 6 | j | S )z
SSA Agent requires restart in case of changing these configuration:
- requests_duration
- ignore_list
)rZ intersection)r( rb s r) _restart_requiredzManager._restart_requiredt s .;;HEEEr+ Fcommandc t j dd|gdd| }| j d| d n# t j $ r}| j dt
|j t
|j t
|j |j |j |j |j
d t d
|j d |j d |j p|j
d
}~w| j $ rS}| j dt
| dt
| i t d| d| d
}~ww xY w|S )z
Run /sbin/service utility to make given operation with SSA Agent service
:command: command to invoke
:check_retcode: whether to run with check or not
:return: subprocess info about completed process
z
/sbin/servicez ssa-agentT)capture_outputtextcheckz
ssa-agent z
succeededz$SSA Agent %s failed with code %s: %s)cmdretcodestdoutstderrextraz
SSA Agent z failed with code z: Nz&Failed to run %s command for SSA AgenterrzFailed to run z for SSA Agent: )
r$ runr r> CalledProcessErrorerrorstrrk
returncoderm rn r r& )r( rf
check_retcoderH es r) run_service_utilityzManager.run_service_utility| s ? ^_%0%,%. 48d*7 9 9 9F
K =' = = = > > > >, ^ ^ ^ K 6AE
AL!!AH
e !"QX? ?
@
@
@ "\QU\\al\\ahFZRSRZ\\^ ^
^% ? ? ? K FG %*CFFO
5
5
5!===!==? ?
? ?
s# 9= E B C((
E5AEErO c
t }fdt | D }| | nv# t
$ ri}| j ddt | i | dd|t | t d| d }~ww xY w| dd
| | r| d d
|
S )z
Change SSA config and restart it.
:args: dict to override current option values
:return: JSON encoded result of the action
c $ i | ] \ }}|v ||
S r0 r0 )r2 r3 r4 rO s r) rK z&Manager.set_config.. s/ ( ( (DAq $YY a &YYr+ z Failed to update SSA config filerq ro
set_configfailure)previous requestedrt z"Failed to update SSA config file: NrI )r~ newrestartTrw )r dictr= overridewrite_ssa_confr" r rt ru rE r re ry rR )r( rO configprevious_valuesrx s ` r) r| zManager.set_config s| '((( ( ( (D ,@,@,F,F,H,H ( ( ( L ! ! # # # # L L L K @%*CFFO
5
5
5 KK i!0D !!ff
&
&
& ""Jq"J"JKK K
L
L) ,$ 8 8 8 ! !$ ' ' D $ $Yd $ C C C}} s %A: :
C-A$C((C-c J t }| | S )zV
Get current SSA config.
:return: JSON encoded current config
)r )r rR )r( full_configs r)
get_configzManager.get_config s#
)** }}K}000r+ c D | j rdnd}| | S )zY
Get current status of SSA.
:return: JSON encoded current status
enableddisabled)
ssa_status)rV rR )r( r@ s r) get_ssa_statuszManager.get_ssa_status s(
#m;}}}///r+ c b | j }|sw | | | n9# t $ r,}| dddt
| d}~ww xY w| dd|rdnd | S ) a
Enable SSA:
- add clos_ssa extension for each PHP version on server
- add clos_ssa extension into cagefs for each user and each ver
- start SSA Agent (if it is not already started)
- restart Apache (etc.) and FPM, reset CRIU images
- create flag_file indicating that SSA is enabled successfully
:return: JSON encoded current status
enable_ssar} r previous_statert NrI r r )rV
generate_inisstart_ssa_agent create_flagr; rE ru r r( was_enabledrx s r) r zManager.enable_ssa s m
""$$$$$&&& """"
L)+5SVV E E E
L)0;#K99 M M M""$$$ 'A99A>c b | j }|rw | | | n9# t $ r,}| dddt
| d}~ww xY w| dd|rdnd | S ) a{
Disable SSA:
- remove clos_ssa extension for each PHP version on server
- remove clos_ssa extension from cagefs for each user and each ver
- stop SSA Agent
- restart Apache (etc.) and FPM, reset CRIU images
- remove flag_file indicating that SSA is enabled
:return: JSON encoded current status
disable_ssar} r r NrI r r )rV remove_clos_inisstop_ssa_agent remove_flagr; rE ru r r s r) r zManager.disable_ssa s m
%%'''##%%% """"
M9+4CFF D D D
M90;#K99 M M M""$$$r c d t D }| |t | j rdnd| t
S )z
Get SSA statistics.
Includes:
- config values
- version
- SSA status (enabled|disabled)
- SSA Agent status (active|inactive)
:return: JSON encoded current statistics
c X i | ]'\ }}|t | (S r0 )ru lower)r2 keyvalues r) rK z%Manager.get_stats.. s< 1 1 1zsE3E
((** 1 1 1r+ r r )r versionr@ agent_status autotracing)r r= rR r rV status_ssa_agentr
get_stats)r( _configs r) r zManager.get_stats s 1 1%''--//1 1 1}} MM $
=99: ..00" ..00
r+ dir_pathc t | S )z=
Check if directory path should be excluded.
)r )r( r s r) unused_dir_pathzManager.unused_dir_path s )))r+ php_rootpatternsc |D ]E}t j || }t j | r|c S F|r&t j ||d ndS )z
Search for clos_ssa.so module in php_root using a list of patterns.
Returns the first found module path, or the first pattern as expected path if none exist.
r )r6 rT r< exists)r( r r pattern module_paths r) _find_module_in_rootz Manager._find_module_in_root su
# #G ',,x99Kw~~k**
#""""
# 7?Frw||Hhqk222BFr+ ini_pathc | d r:d|v r6| d d }| || j S | d rPd|v rL| dd }| d d }| || j S | d r:d|v r6| d d }| || j S | d
r:d|v r6| d d }| || j S | d rjd |v rf| d d }t
t t j
|| j }|r|d S d
S | d rjd |v rf| d d }t
t t j
|| j }|r|d S d
S | d rXd|v rT| d d d d }d| }| || j S d
S )z
Determine the path to clos_ssa.so module based on ini_path.
Returns the expected module path, or empty string if not found.
z /opt/alt/phpz
/link/confr z4/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-phpz/root/etc/php.dz"/usr/share/cagefs/.cpanel.multiphpz/usr/share/cagefs-skeletonz
/etc/php.dz/opt/cpanel/ea-phpz/opt/plesk/php/z(/usr/share/cagefs-skeleton/usr/local/phpz/lib/php.conf.dr z/usr/local/phpz /var/cagefs/z/etc/cl.php.d/alt-phpr /z&/usr/share/cagefs-skeleton/opt/alt/php)
startswithsplitr r replacer listr r6 rT r< r )r( r r
skeleton_pathpossible_pathsphp_ver
skeleton_roots r) get_module_pathzManager.get_module_path s ~ . . V<83K3K ~~l33A6H,,Xt7TUU U U V V V[lpx[x[x $ , ,-QSo p pM$**<88;H,,Xt7TUU U 3 4 4 V9Jh9V9V ~~l33A6H,,Xt7TUU U 0 1 1 Tlh6N6N ~~l33A6H,,Xt7RSS S I J J O`dlOlOl ~~&788;H !% Xt?c(d(d"e"e f fN
)%a((2
/ 0 0 5F(5R5R ~~&788;H !% Xt?c(d(d"e"e f fN
)%a((2 ~ . . [3Jh3V3V nn%<==a@FFsKKANG NW N NM,,]D )r( locationr pw_records r) existing_pathszManager.existing_paths` s0 3 ' 'H !(OO
'
'''11 h&&&&&
'
8 I IH !(6"2 3 3
I
I''11 I 0 0 : :I %+Y-=>HHHHH
K$$ &56>@ @ @ H
I I Is 2B B5c # K t j | t j | dV t j d t j d dS # t j d t j d w xY w)z
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr )r6 setegidseteuid)r( rB gids r)
_user_contextzManager._user_contextz sn JsOOO JsOOO EEE JqMMM JqMMMMM
JqMMM JqMMMMs ,A *BrB r Nc T | | }|s | j d| dS t j | s| j d|| t j || j }t j | r | || 5 t j
| | j d| ddd n # 1 swxY w Y n@# t $ r3}| j d|t | Y d}~nd}~ww xY wdS t j || j }| || 5 t 5 t |d 5 }| j d| | d ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd dS # 1 swxY w Y dS ) zB
Enable SSA extension for single ini_path (given)
z r< r r unlinkr; ru r openwrite) r( rB r r r
ini_file_pathrx rT inis r) generate_single_inizManager.generate_single_ini s)
**844 K ^`h i i i Fw~~k** K WYdfn o o o GLL43E F FMw~~m,,
cc ++C55 b b -000 (()QS`aaab b b b b b b b b b b b b b b ! c c cK''(JM[^_`[a[abbbbbbbbc Fw||Hd&899
S
)
) 1 1 1 1T3 1#& K 4d ; ; ; II/ 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s 6D 0D< D D D D D
E )E EH H11G." H.G2 2H5G2 6H9 H H H H
H H!$H!c | j d | D ]\ \ }}} | ||| !# t $ r | j d| Y Ht
$ r3}| j d|t | Y d}~d}~ww xY wt | j | j d dS )z
Place clos_ssa.ini into each existing Additional ini path,
including cagefs ones and per-website directories
z Generating clos_ssa.ini files...z>Unable to update file %s, possible permission misconfigurationz7Exception on generating clos_ssa.ini: "%s", error: "%s"N Finished!)
r r> r r PermissionErrorr; rt ru r r )r( rB r r rx s r) r zManager.generate_inis s
;<<<$($7$7$9$9 JS#
((c8<<<<"
"HIQS S S
!!"[]egjklgmgmnnn
-T-?@@@ %%%%%s A%B37 B3 )B..B3c # K | D ]O\ \ }}}t j | D ]2}| j |vr ||ft j || fV 3PdS )z
Generator function searching for clos_ssa.ini files
in all existing Additional ini paths
Returns tuple of (uid, gid) and path.
N)r r6 listdirr rT r< )r( rB r r names r) find_clos_iniszManager.find_clos_inis s %)$7$7$9$9 ? ? JS#
8,,
?
?%T11 Cj"',,x">">>>>>>
? ? ?r+ c | j d | D ]\ \ }}} | || 5 t j | ddd n # 1 swxY w Y L# t $ r3}| j d|t | Y d}~d}~ww xY wt | j | j d dS )z[
Remove all gathered clos_ssa.ini files, including per-website directories
z Removing clos_ssa.ini files...Nz5Exception on removing clos_ssa.ini: "%s", error: "%s"r )
r r> r r r6 r r; exceptionru r )r( rB r clos_inirx s r) r zManager.remove_clos_inis s?
9:::$($7$7$9$9 JS#
''S11 ( (Ih'''( ( ( ( ( ( ( ( ( ( ( ( ( ( (
%%&]_gilmnioioppp
11CDDD %%%%%s; A;A/# A;/A3 3A;6A3 7A;;
B8)B33B8c | d }|j r| dd dS | dd dS )ze
Start SSA Agent service
or restart it if it is accidentally already running
r@ startTr r Nry rv r( r s r) r zManager.start_ssa_agent sa
//99 " D $ $WD $ A A A A A $ $Yd $ C C C C Cr+ c p | d }|j s| dd dS dS )z`
Stop SSA Agent service
or do nothing if it is accidentally not running
r@ stopTr Nr r s r) r zManager.stop_ssa_agent sN
//99 & A $ $V4 $ @ @ @ @ @ A Ar+ c Z | dd n# t $ r Y dS w xY wdS )z:
Get SSA Agent status: active or inactive
r@ Tr inactiveactive)ry r r' s r) r zManager.status_ssa_agent sJ $ $XT $ B B B B :: xs
((c t t d 5 ddd n # 1 swxY w Y | j dt d dS )zE
Create a flag file indicating successful enablement
r N
Flag file z created)r r
r r> r' s r) r zManager.create_flag s )S
!
! 9i999:::::s $((c t j t | j dt d dS # t
$ r=}| j dt dt | Y d}~dS d}~ww xY w)z:
Remove a flag file indicating enablement
r z removedz removal failed: N)r6 r r
r r> r" r ru )r( rx s r) r zManager.remove_flag s C Ii K =) = = = > > > > > C C C K AYAAQAA
C
C
C
C
C
C
C
C
C Cs 4O @ t 41C 1 1 1 10 0 0 0 0%C % % % %2%S % % % %2
3
(* * * * * *
GS
GD
GS
G
G
G
G@ @ @ @ @ @DIeCHos&: ; I I I I4 ^" 1s 1 1 1 1 1 1 1<& & & &,
?eCHos&: ;
?
?
?
?& & & && D D D DA A A A# ; ; ; ; C C C C'C ' ' ' '! ! ! ! FS FT F F F F F Fr+ r rF Manager instancec t S )zk
Factory function for appropriate manager initialization
:return: appropriate manager instance
)r r0 r+ r) initialize_managerr - s
99r+ )rF r )&r rM r r6 r8 r$
contextlibr globr secureior typingr
configurationr r internal.constantsr
internal.exceptionsr internal.utilsr modules.autotracerr
modules.decision_makerr clos_ssa_inir r r website_isolationr r r r r r r0 r+ r) r s
% % % % % % " " " " " " D D D D D D D D ) ) ) ) ) ) 0 0 0 0 0 0 ' ' ' ' ' ' * * * * * * 1 1 1 1 1 1
BF BF BF BF BF BF BF BFJ r+