PUȹf d Z ddlZddlZddlZddlmZ ej e ZdZ ddl
Z
n
# e $ r dZ
Y nw xY wd Z d Z
d Zd Zd
Zd Zd Zd
Zd Zd Zd ZdS )u
Thin Python wrapper around the _lvdmap C extension (backed by liblve).
Public interface is unchanged — callers (lveapi.py, lvectllib.py) continue
to import and use these functions exactly as before.
N )LvdErrorz/etc/container/lvd_idsc 2 t t d d S )Nz$_lvdmap C extension is not installed)_lvdmapr "py/websiteisolation/id_registry.py_require_lvdmapr
s =>>> r c t j | j }n# t $ r Y dS w xY wt j t t | }t j | sdS |S )zmReturn the registry file path for *username*, or None if the
user does not exist or has no registry file.N)
pwdgetpwnampw_uidKeyErrorospathjoin LVD_IDS_DIRstrexists)usernameuidr s r registry_path_by_usernamer ! sx l8$$+ tt
7<< SXX . .D
7>>$ t Ks
**c t j dk rt d t t j | | }t d||| |S )zzAssign a domain ID for a docroot. Returns existing ID if already
assigned, otherwise allocates the next sequential ID.r "domain ID assignment requires rootz0assigned domain_id %d to docroot '%s' for uid %d)r geteuidr r
r assignloginfo)r docroot domain_ids r assign_domain_idr! . sg
z||q;<<<sG,,IHH
?
& & & r c R t dS t j | | }|dk r|ndS )z;Look up domain ID by docroot. Returns None if not assigned.Nr )r lookup)r r rs r
get_domain_idr% : s/ tsG$$AQ11D r c < t i S t j | S )z/Return dict of docroot -> domain_id for a user.)r get_all_entries)r s r r' r' B s "3 ' ''r c R t t S t j S )z@Return the set of every assigned domain LVE ID across all users.)r setget_all_domain_idsr r r r* r* I s uu % ' ''r c : t dS t j S )zReturn the minimum domain LVE ID.
Delegates to the C library which reads UID_MAX from /etc/login.defs
and returns max(UID_MAX, 60000). Falls back to 60000 if the C
extension is not available.
Ni` )r min_idr r r r, r, P s u > r c @ t j dk rt d t t j | | }| t d|| dS t j | | }t d||||| |S )zMove a domain mapping from *old_docroot* to *new_docroot*.
Uses remove + assign via _lvdmap; the domain_id will be newly
allocated (the C API does not support specifying a target ID).
r z$domain ID reassignment requires rootNuU reassign_docroot: old_docroot '%s' not in registry for uid %d — nothing to reassignz?reassigned docroot from '%s' (id=%d) to '%s' (id=%d) for uid %d)
r r r r
r remover warningr r )r old_docroot new_docrootold_idnew_ids r reassign_docrootr4 \ s
z||q=>>>
^C
-
-F
~ 9:Es L L Lt
^C
-
-FHH & VSJ J J Mr c t j dk rt d t t j | | }| t d||| |S )z?Remove a docroot from the registry. Returns the old ID or None.r domain ID removal requires rootNz,removed domain_id %d for docroot '%s' uid %d)r r r r
r r. r r )r r r2 s r remove_domain_idr7 r sj z||q8999
^C
)
)F
?# ' ' ' Mr c t j dk rt d t t j | }|r)t d| t | |S )z@Remove all domain IDs for a user. Returns list of (docroot, id).r r6 z.removed all domain IDs for uid %d (%d entries)) r r r r
r
remove_allr r len)r removeds r remove_all_entriesr< ~ so z||q8999 %%G $ Ac'll $ $ $ Nr c X t j dk rt d t j t dd t j t }|j dz dk rt j t d n# t $ r Y nw xY wt j
t t | }t j | sCt j
|t j t j z d }t j | dS dS ) a Mark *uid* as domain-isolated by touching its per-user file.
The file acts as a marker so that ``find_all_lve_ids_with_config()``
(which lists ``LVD_IDS_DIR``) can detect the user before any domains
are assigned. The C library's ``lvd_map_assign()`` will later
atomically replace this empty file with a proper hash-table via
rename(2), so the marker never interferes with real data.
r r i T)modeexist_oki i N)r r r makedirsr statst_modechmodOSErrorr r r r openO_CREATO_WRONLYclose)r stmarkerfds r create_empty_registryrL s
z||q;<<<K %$7777
W[
!
!
: & & H[% ( ( (
W\\+s3xx
0
0F
7>>& ! !
WVRZ"+ 5u
=
=
s AB
BB)__doc__r loggingr
exceptionsr getLogger__name__r r r ImportErrorr
r r! r% r' r* r, r4 r7 r< rL r r r rS s8
g!!& NNNN GGG? ? ?
! ! !( ( (( ( ( , s - 77