fjv
B d Z ddlZddlZddlZddlZddlmZ ddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlmc mZ ddlmZ ddlmZmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z m Z m!Z!m"Z" dd l#m$Z$m%Z%m&Z& ddl'Z'dd
l(m)Z) dd l*m+Z+ dd l,m-Z- dd
l.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4 ddl5m6Z6 ddl7m8Z8 ddl9m:Z: ddl;mZ> ddl?m@ZA ddlBmCZCmDZDmEZEmFZFmGZGmHZH ddlImJZJmKZK ejL d ZMeNeOe
jP fZQde$de$fdZRde$de$fd ZSde$de$fd ZTdeUfd ZVdefd ZWd eUdefd!ZXdeYfd"ZZd#e%e[ deYfd$Z\d#e%e[ deYfd%Z]deYfd&Z^eEfd'eYd(eYddfd)Z_eEfd(eYdeYfd*Z`deYfd+Z`de&ea fd,ZbeTdeYfd- Zcd.eYde&eY fd/Zdde&eY fd0Zed^d1ZfeFfd2eYde&eY fd3Zg ejh d4 Zid5eYddfd6Zjd5eYd7ekdekfd8Zld9eYd:eYddfd;ZmdZnd?eUdeUfd@Zod5eYde&ep fdAZqd5eYde&eY fdBZrd_d5eYddfdCZsd5eYdeafdDZtdeafdEZudeafdFZvdGeaddfdHZwdeafdIZxdeafdJZydeafdKZzd.eYdeafdLZ{dM Z|ed`dP Z}edadReYdSeafdT Z~edbdUeUddfdV Ze dcdYeUdZeUdUeUddfd[ Zed\ Zd] ZdS )dzB
This module contains helpful utility functions for X-Ray Manager
N)getuser)contextmanager)date timedeltawraps)glob)socketfromfdAF_UNIX SOCK_STREAM
SOCK_DGRAMAF_INETAF_INET6)CallableListOptional)AtexitIntegration)LoggingIntegration)Feature)is_panel_feature_supportedget_cp_description getCPNameis_wp2_environment)get_cl_edition_readable)UIConfig)drop_privileges)get_rhn_systemid_value) get_hostname)php_get_vhost_versions_user)gettext )
sentry_dsnlocal_tasks_storage
agent_file
logging_leveljwt_token_locationuser_agent_sock) XRayErrorXRayManagerExitutilsfuncreturnc F d t fd }|S )zf
Decorator aimed to update ini file in cagefs-skeleton
Applies to task.add nd task.remove
c t j | d j d }| d r8t d r)t j d|dd }n| d rt d rt j d |dd }t j t j | s1t j t j | ndS t j | st j | rt j
| r t d
d |i dS t j
| dS # t $ r7}t d
|t | d Y d}~dS d}~ww xY wdS t j
| r t dd |i dS t! |d 5 }| }ddd n # 1 swxY w Y t j |t j t j z t j z t j z d } t j || t j | dS # t j | w xY w# t $ r7}t d|t | d Y d}~dS d}~ww xY w)zd
Copy ini file to cagefs-skeleton
Action takes place for cPanel ea-php only
r zxray.iniz /opt/cpanelz/usr/share/cagefsz"/usr/share/cagefs/.cpanel.multiphpr" Nz
/usr/localz/usr/share/cagefs-skeletonz-Refusing to unlink symlink in cagefs-skeletonxray_iniextraz'Failed to unlink ini in cagefs-skeleton)r0 errz0Refusing to copy over symlink in cagefs-skeletonrbi z'Failed to copy ini into cagefs-skeleton)ospathjoin ini_location
startswithr existsdirnamemkdirlexistsislinkloggerwarningunlinkOSErrorstropenreadO_WRONLYO_CREATO_TRUNC
O_NOFOLLOWwriteclose)args original_ini skeleton_iniesrc src_bytesfds J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/utils.pyupdatez skeleton_update..updateL s
w||DG$8*EE " "= 1 1 d#7% 7% 7<<(L(4QRR(8 : :LL
$
$\
2
2 t,8. 8. 7<<(D(4QRR(8 : :L7>>"'//,"?"?@@
8 66777 Fw~~l++ 6w|,,
:7>>,// NN#R*4l)C # E E EF:Il+++++ : : :NN#L6B14Q*9 *9 # : : : : : : : : ::
:
:
67>>,// NN#U*4l)C # E E EF ,-- + #
I+ + + + + + + + + + + + + + +W\ [2: 5
BR] R "$ $!HR+++HRLLLLLBHRLLLL
6
6
6 H2>-0VV&5 &5 6 6 6 6 6 6 6 6 6
6ss 3G
H
,HH
=L L J 4 L JL JA
L K> (L >LL
M!,MMc " | i | | dS )
Wraps func
N )rL kwargsr, rT s rS wrapperz skeleton_update..wrapper s)
d f
r )r, rY rT s ` @rS skeleton_updater[ F sK 36 36 36j 4[[ [ NrZ c P d d t fd }|S )zs
Decorator aimed to update DBM storage with fake_id:real_id mapping
Applies to task.add nd task.remove
c | d }t t 5 }|j ||j < ddd dS # 1 swxY w Y dS )z-
Update DBM storage contents
r N) dbm_storager$ task_idfake_id)rL
task_instance task_storages rS rT z"dbm_storage_update..update s Q
,
-
- H 2?2GL . / H H H H H H H H H H H H H H H H H Hs
:>>c t t 5 } || d j = n# t $ r Y nw xY wddd dS # 1 swxY w Y dS )z.
Remove task from DBM storage
r N)r^ r$ r` encodeKeyError)rL rb s rS removez"dbm_storage_update..remove s ,
-
-
a !7!7!9!9::
s1 A 8A
AAAAA Ac \ j dk r | n.# t $ r!}t t | d}~ww xY w | i | n # t $ r j dk r | w xY w j dk r | dS dS # t $ r!}t t | d}~ww xY w)rV addNrf )__name__ RuntimeErrorr) rC Exception)rL rX rO r, rf rT s rS rY z#dbm_storage_update..wrapper s $}%%
$ $ $CFF## # $ D$ !& ! ! ! ! }%%
$}((
)( $ $ $CFF## # $s4
? :?A A(,B
B+
B&&B+r )r, rY rf rT s ` @@rS dbm_storage_updaterl sb H H H 4[[$ $ $ $ $ $ [$6 NrZ c F d t fd }|S )z5
Decorator aimed to validate given JWT token
c " t dS )z7
Check if retrieved JWT token is valid
N)is_xray_supportedrW rZ rS checkzcheck_jwt..check s rZ c , | i |} |S )rV rW )rL rX tokenrp r, s rS rY zcheck_jwt..wrapper s)
d%f%%
rZ r )r, rY rp s ` @rS check_jwtrs sJ
4[[ [ NrZ c B t t j S )zJ
Get current epoch timestamp as int
:return: timestamp as int
)inttimerW rZ rS timestamprw s
ty{{ rZ c J t j t d z
S )zC
Pick a yesterday date
:return: a datetime.date object
r" )days)r todayr rW rZ rS prev_dater{ s
:<<)+++ ++rZ tsc * t j | S )zy
Get the datetime.date object for given int timestamp
:param ts: timestamp
:return: datetime.date object
)r
fromtimestamp)r| s rS date_of_timestampr s b ! !!rZ c D t d S )zj
Get a formatted representation of yesterday date
:return: str date in the form of dd/mm/YYYY
z%d/%m/%Y)r{ strftimerW rZ rS get_formatted_dater s
;;
+ ++rZ linksc f dd fdt | d D S )z
HTML formatted links
z){num}) {domain}
c z g | ]7\ }}| D ] \ }} ||| 8S ))numlinkdomainitemsformat).0ilkv html_items rS
z,get_html_formatted_links.. sk A A ADAq67ggiiA A.2a &&11Q&?? A A A ArZ r" r7 enumerate)r r s @rS get_html_formatted_linksr sZ .
sk A A AA67ggiiA A.2a &&1!!&<< A A A ArZ r" r )r r s @rS get_text_formatted_linksr sZ 'I 99 A A A A q))A A A B B BrZ c t j d } | }| d j }t j 5 }| d| ddd n # 1 swxY w Y | d S # t t j
f$ r"}t t d |d}~ww xY w)ze
Obtain system ID from /etc/sysconfig/rhn/systemid
:return: system ID without ID- prefix
z/etc/sysconfig/rhn/systemidz(.//member[name='system_id']/value/string system_idNzID-z Failed to retrieve system_id)
ETparsegetrootfindtext
sentry_sdkconfigure_scopeset_taglstriprB
ParseErrorr) _)treerootwhole_idscoperO s rS read_sys_idr s
Bx566||~~99 GHHM
'
)
) 1U MM+x 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1u%%% R] # B B B899::ABs< AB A:. B :A>>B A>B C0 C
Csys_idagent_system_id_pathc > t j |t j t j z t j z t j z d } t j || t j | dS # t j | w xY w)zH
Write system_id into file /usr/share/alt-php-xray/agent_sys_id
N) r5 rD rG rF rH rI rJ rd rK )r r rR s rS write_sys_idr ! sw
%bk)BJ6 F
B
V]]__%%%
s 'B B c B t | 5 }| cddd S # 1 swxY w Y dS # t $ rC}t ddt
| i t cY d}~S d}~ww xY wzA
Read system_id saved by agent during its initialization
Nz8Failed to retrieve agent's system_id, returning real oner3 r1 )rD rE striprB r? inforC r )r agent_sysid_filerO s rS read_agent_sys_idr . s
&
'
' 3+;#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 F#a&&/ # # # }} s? A &A A AA A A
B 8BB B c L t t 5 } | cddd S # 1 swxY w Y dS # t $ rC}t
ddt | i t cY d}~S d}~ww xY wr ) rD r% rE r rB r? r rC r )r rO s rS r r < s
*
3!1#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 F#a&&/ # # # }} s? A &A A A
A A
A
B# 8B B# B#c @ t t j } | st }t }t
dt | t | t t d
|| dS )z9Raise XRayError in case of detected non-supported editionzMCurrent CloudLinux edition: %s or Control Panel: %s is not supported by X-RayzMCurrent CloudLinux edition: {} or Control Panel: {} is not supported by X-RayT) r r XRAYr r r? r rC r* r r ) is_supportedcurrent_edition
current_panels rS ro ro K s -gl;;L f133!
c((#m*<*< > > > a !NNTfUdUbOd Od e e f f f 4rZ c 8 t t 5 } | cddd S # 1 swxY w Y dS # t t
f$ r2 t
t d t t z w xY w)zT
Obtain jwt token from /etc/sysconfig/rhn/jwt.token
:return: token read
NzJWT file %s read error) rD r' rE r rB IOErrorr) r rC )
token_files rS read_jwt_tokenr Y s O
$
%
% - ??$$**,, - - - - - - - - - - - - - - - - - - W O O O233c:L6M6MMNNNOs. A &A A A
A A
A ABfilepathc & t | 5 }| }ddd n # 1 swxY w Y n# t $ r Y dS w xY wd | d dd pdS )z8Get version of package from file. alt-php-xray supportedN. z0.0-0)rD rE r rB r7 split)r v_fileversions rS pkg_versionr f s
(^^ ,v kkmm))++G , , , , , , , , , , , , , , , 88GMM#&&rr* + + 6w6s3 A 'A A AA A A
A A c t d S )z#Get version of alt-php-xray packagez /usr/share/alt-php-xray/version)r rW rZ rS xray_versionr p s 8 9 99rZ c B dt dt dt fd} fd}dd}d dt ffd t t j t j
}t
pd }t | }t j t | |d
||g t j 5 }dt d p% pt p
t i|_ || n# t $ r Y nw xY wddd dS # 1 swxY w Y dS )u
Initialize Sentry client
shutdown_timeout=0 disables Atexit integration as stated in docs:
'it’s easier to disable it by setting the shutdown_timeout to 0'
https://docs.sentry.io/platforms/python/default-integrations/#atexit
On the other hand, docs say, that
'Setting this value too low will most likely cause problems
for sending events from command line applications'
https://docs.sentry.io/error-reporting/configuration/?platform=python#shutdown-timeout
eventhintr- c | d ddi | di }| dd }|r|g| d< | S )z
Add extra data into sentry event
:param event: original event
:param hint: additional data caught
:return: updated event
r2 z xray.versionz
0.6-48.el9 fingerprintN)rT get)r r
extra_datar s rS add_infoz sentry_init..add_info s` g ~| <===YYw++
nn]D99 1$/=E- rZ c t }|r| d nd }|r| d nd }t rdnd }d|fd|fd|fdt j fdt d fd
t
fd t d fd
fdt ff }|D ] } | j |
d S )Nr nameWP2zControl Panel NamezControl Panel VersionzControl Panel ProductkernelzCloudLinux version
os_releasezCloudlinux edition Architecture architecture
ip_addressusername) r r r platformreleaser r r r ) sentry_scopecp_description
cp_versioncp_name
cp_producttagstagip_addrs rS set_tagsz sentry_init..set_tags s +--6DN^'' 222$
0>H.$$V,,,D 0 2 2'@'@A !7!G!GH wwyy)WYY' ' 'C L # & & & ' 'rZ Nc d S NrW )pendingtimeouts rS nopezsentry_init..nope s rZ c t | t 5 } | |df | d }n# t $ r d}Y nw xY wddd n # 1 swxY w Y |S )aI
address_family - we can choose constants represent the address
(and protocol) families
(AF_INET for ipv4 and AF_INET6 for ipv6)
private_ip - specify some private ip address. For instance:
ipv4 -> 10.255.255.255 or ipv6 -> fc00::
r" r N)r
r connect getsocknamerk )address_family
private_ipsIPs rS
try_get_ipz sentry_init..try_get_ip s NJ
/
/ 1
:q/***]]__Q'
s4 A(1A
A(
AA(AA((A,/A,c ` t dft dff} | D ]\ }} || }|r|c S dS )z&
Retrieve server's IP
z10.255.255.255zfc00::z 127.0.0.1)r r )
ipversionsaddr_fampriv_ipipr s rS r z sentry_init..ip_addr sZ /08X2FF
!+ HgHg..B
{rZ )level event_levelzalt-php-xray@0.6-48.el9)callbacki' )dsn before_sendr max_value_length integrationsidr r- N)dictrC r loggingINFOWARNINGr r r initr# r r r r userrk ) r r r sentry_loggingxray_ver
silent_atexitr r r s @@rS sentry_initr
t s D T "' ' ' ' '*
S (gl4;OE E EN~~:!:H%t444MO
$%*"0-!@B B B B
# % % (55aalnnaX_XaXa
HUOOOO D
s6 -=D+ C76D7
DDDDDDlognamec H t j t j t j t j t j d}t
t j | g}|dk r&| t j t j
| |t j dd| n8# t $ r+ t j
t j
g Y dS w xY w t j | d n# t $ r Y nw xY w| S )
z[
Configure logging and Sentry
:param logname: path to log
:return: logpath
)debugr r@ errorcritical)filenamer z1%(asctime)s [%(threadName)s:%(name)s] %(message)sz%m/%d/%Y %I:%M:%S %p)r r datefmthandlers)r Nr )r DEBUGr r ERRORCRITICALr
FileHandlerappend
StreamHandler basicConfigr rB NullHandlerr5 chmodPermissionError)r r levelsr s rS configure_loggingr! s7 ? $ F MMM
1 1 1
G OOG 1 3 3 4 4 4&**UGL"A"A#V$:%- / / / / / g&9&;&;%<====
%
Ns%
A8C 1C87C8<D
D D z"^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,31}$r c | st d t | st d| t j | dS # t
$ r t d| dw xY w)zValidate that username is a real system user.
Raises ValueError with a clear message if username is empty,
has an invalid format, or does not exist in the system user database.
zusername must not be emptyzInvalid username: z system user does not exist: N)
ValueError_safe_username_patternmatchpwdgetpwnamre )r s rS validate_system_userr( s 75666 ! ' ' 1 1 <:h::;;;P X P P PDDDEE4OPs A A3 clwpos_argsc t | t t j s-d |D }dd | z }dd| ddd|gS d | d
g|z S ) zBuild subprocess argv for /usr/bin/clwpos-user invocation.
Non-CageFS: wraps in sudo -u bash -c with shell-quoted args.
CageFS: passes args directly via cagefs_enter_user argv.
c P g | ]#}t j t | $S rW )shlexquoterC )r as rS r z)build_clwpos_user_cmd.. s( ???aek#a&&))???rZ z/usr/bin/clwpos-user sudo-uz-sz /bin/bashz-cz/sbin/cagefs_enter_userz/usr/bin/clwpos-user)r( r r CAGEFSr7 )r r)
safe_parts inner_cmds rS build_clwpos_user_cmdr5 s| """ %gn 5 5 6??;???
+chhz.B.BB hk4KK)8&(*56 6rZ rP dstc t j | | dS # t $ rD}t t d | |t
| |d}~ww xY w)zZ
Move file with error catching
:param src: source
:param dst: destination
z Failed to move file {} to {}: {}N)shutilmoverB r) r r rC )rP r6 rO s rS safe_mover: sv _ C _ _ _<CCCcRSffUUVVWW]^^_s
A'?A""A'
sock_locationz
socket objectc t t j dd }|dk rt 5 t j | n# t $ r Y nw xY wt t }| | |
ddd n # 1 swxY w Y n/t dt t }|
|S )z
Create world-writable socket in given sock_location
or reuse existing one
:param sock_location: socket address
:return: socket object
LISTEN_FDSr N )
ru r5 environr umask_0rA FileNotFoundErrorr
r bindlistenr r
)r;
listen_fdssockobjs rS
create_socketrF * s RZ^^L!4455JQ
YY
-(((($
WooG LL ' ' ' NN G[11 Ns7 B2AB2
A&#B2%A&&A B22B69B6lve_idc > t t j sdS d}d| d} t | 5 }|D ]}| | rut
d| t | | d c cddd S ddd n # 1 swxY w Y n@# t $ r3}t
d|t | Y d}~nd}~ww xY wdS ) zX
Retrieve current value of CPU throttled time.
Return 0 in case of failures
r throttled_timez /sys/fs/cgroup/cpu,cpuacct/lvez /cpu.statz%sNzFailed to open %s: %s)
r r LVErD r9 r? r ru r r rB r rC )rG marker stat_file stat_valuesvaluerO s rS get_current_cpu_throttling_timerP B s
&gk 2 2 q
FBBBBIA
)__ H $
H
H##F++ HLLu--- u{{}} 2 26 : :2 > D D F FGGGG H H H H H H H HH
H H H H H H H H H H H H H H H H
A A A ,iQ@@@@@@@@A 1sG C BC6 C C C CC CC
D')DDc d}t j | sdS t j |d| dgddd }|j |j fS # t j $ r6}t
ddt | i Y d}~dS d}~wt $ r3}t
d
t | Y d}~dS d}~ww xY w) z
'selectorctl -u username --user-current' command
:param username: name of user
:return: tuple(stdout, stderr) or None if command fails
z/usr/bin/selectorctlNr1 z--user-currentTcapture_outputr rp z&Failed to get selectorctl user-currentr3 r1 z%selectorctl --user-current failed: %s)r5 r6 isfile
subprocessrunstdoutr stderrCalledProcessErrorr? r@ rC subprocess_errorsr )r _selectorctlresultrO s rS _selectorctl_get_versionr] V sE *L
7>>, ' ' t !%!)!1!3 04$d L L L
}""$$fm&9&9&;&;;; ( . . .? #SVV_ . . . . . . . . . <VV s$ A
A3 3C3+B33
C3 (C..C3c d}t j | sdS t j |d| gddd }|j S # t j $ r6}t ddt | i Y d}~dS d}~wt $ r3}t d t | Y d}~dS d}~ww xY w)
z
'cagefsctl --get-prefix username' command
:param username: name of user
:return: cagefsctl prefix for given username
or None if command fails
/usr/sbin/cagefsctlNz --getprefixTrR z Failed to get cagefsctl prefixr3 r1 z cagefsctl --getprefix failed: %s)
r5 r6 rT rU rV rW r rY r? r@ rC rZ r r
_cagefsctlr\ rO s rS cagefsctl_get_prefixrb n s/ 'J
7>>* % % t !.!)!+ 04$dL L L }""$$$ ( . . .7 #SVV_ . . . . . . . . . 7VV s# 3A C(+B
C&(CCc d}t j | sdS | |ddg}n|d| g} t j |dd t
d| dS # t j $ r6}t
d d
t | i Y d}~dS d}~wt $ r3}t
d t | Y d}~dS d}~ww xY w)
z
'cagefsctl --remount username' or 'cagefsctl --remount-all' command
:param username: name of user or None (for remount-all)
r_ Nz --wait-lockz
--remount-allz --remountT)rp rS z Remounted %szFailed to remount cagefsr3 r1 z cagefsctl --remount failed: %s) r5 r6 rT rU rV r? r rY r@ rC rZ r )r ra rL rO s rS _cagefsctl_remountrd s;
'J
7>>* % % M?;K2 t4==== NH----- ( . . .1 #SVV_ . . . . . . . . . 5VV s# 2A& &C&5+B&&
C&3(C!!C&c 4 d}t j | sdS t j |d| gdd }d|j v S # t $ r3}t dt | Y d}~dS d}~ww xY w) z
'cagefsctl --user-status username' command
:param username: name of user
:return: True if user has Enabled status, False otherwise
r_ Fz
--user-statusT)rS r Enabledz"cagefsctl --user-status failed: %sN) r5 r6 rT rU rV rW r rZ r? r rC r` s rS _is_cagefs_enabledrg s 'J
7>>* % % u !0!)!+ 04$@ @ @ FM / / 1 111 9VV s 4A
B$(BBc t d 5 } | }ddd n # 1 swxY w Y n# t $ r Y dS w xY wd|v S )z`
Check if there is php.d.location = selector
set in /etc/cl.selector/symlinks.rules
z /etc/cl.selector/symlinks.rulesNFselector)rD rE rB )
rules_filecontentss rS _is_selector_phpd_location_setrl s
3
4
4 )
!((H ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) uu !!s' > 2 > 6> 6>
A A c t t 5 } t | dk cddd S # 1 swxY w Y dS )z:Check if there are no active tasks (== empty task storage)r N)r^ r$ lenkeys)rb s rS no_active_tasksrp s ( ) ) -\<$$&&''1,- - - - - - - - - - - - - - - - - -s %AA A enabledc H t t j sdS t ddd 5 }| | rdnd ddd dS # 1 swxY w Y dS # t
$ r4}t d| t | Y d}~dS d}~ww xY w) zb
Switch on/off throttle statistics gathering by kmodlve
:param enabled: True or False
Nz!/proc/sys/kernel/sched_schedstatswbr )mode buffering 1 0z(Failed to set sched_schedstats to %s: %s) r r rK rD rJ rB r? r rC )rq frO s rS switch_schedstatsry s
&gk 2 2 %
5D /"#
GGG-DD . . . / / / / / / / / / / / / / / / / / / % % % >SVV % % % % % % % % %%s: A# A A# AA# A A# #
B!-)B B!c J t dd du S )zG
Check if end-users have access to X-Ray UI of End-User plugin
hideXrayApp
uiSettingsF)r get_paramrW rZ rS is_xray_app_availabler~ s# ::
| < < EErZ c t t t 5 } | t n## t
t f$ r Y ddd dS w xY w ddd n # 1 swxY w Y dS )z Check if User Agent is listeningNFT)r
r r
r r( ConnectionErrorrB )r s rS is_xray_user_agent_activer s % %
IIo & & & & )
'
4s1 A(8A(A A(AA((A,/A,c B t j d S )z2Check if SSA is disabled by its internal flag-filez /usr/share/clos_ssa/ssa_enabled)r5 r6 rT rW rZ rS ssa_disabledr s w~~ ?@@ @@rZ c ~ t t j | j z
dk S # t $ r Y dS w xY w)z.Check is file was modified during the last dayiQ F)rw r5 statst_mtimerB )r s rS is_file_recently_modifiedr sJ {{RWX . . 77%?? uus +.
<<c p t | 5 t }d d d n # 1 swxY w Y |S r )r r )r r\ s rS get_user_php_versionr su / /,../ / / / / / / / / / / / / / / Ms +//rR 'file object providing a fileno() methodc # K t d D ]} t j | t j t j z t
d| n# t $ rf}t
dt | |j t j
t j fvr t j
d Y d}~d}~ww xY wt |d d dV t j | t j t
d | dS # t j | t j t
d | w xY w)
uq
Context manager for locking given file object
:param fd: а file object providing a fileno() method
x zFile %s lockedzFailed to lock: %sg ?Nz%Failed to lock at all. Exiting threadr@ )flagzFile %s unlocked)rangefcntlflockLOCK_EXLOCK_NBr? r rB rC errnoEAGAINEACCESrv sleepr) LOCK_UN)rR r rO s rS filelockr s[ 3ZZ
(
( KEMEM 9 : : : KK(" - - - E KK,c!ff 5 5 5wu|U\ ::: JsOOOOOOOO ABB &( ( ( (,
B
&&& &+++++ B
&&& &++++s% AA
C(A C C,D, , s/
8D>>D EEEHTNNNNNrZ r T
target_uid
target_gidc # K t j }t j }t d } t j | }n# t
$ r d}Y nw xY w| ||} n|j } | ||}n|j }|t j | } ||k rWt j | t d| |r&t j |k rt | || k rqt j | t d| |r@t j | k r)||k rt j | t | dV || k r/t j | t d| ||k r/t j | t d| |t j | dS dS )aH
Context manager to drop privileges during some operation
and then restore them back.
If target_uid or target_gid are given, use input values.
Otherwise, stat target_uid and target_gid from given target_path.
If no target_path given, use current directory.
Use mask if given.
:param target_uid: uid to set
:param target_gid: gid to set
:param target_path: directory or file to stat for privileges,
default -- current directory
:param mask: umask to use
:param with_check: check the result of switching privileges
z6Unable to execute required operation: permission issueNzDropped GID privs to %szDropped UID privs to %szRestored UID privs to %szRestored GID privs to %s)r5 getuidgetgidr r rB st_uidst_gidr setegidr? r getegidr) seteuidgeteuid)
r r target_pathr
with_checkprev_uidprev_gidpermission_issue_message stat_infor s
rS set_privilegesr H s " y{{Hy{{H !Y Z Z GK(( !JJ")J !JJ")J x~~:
: .
;;; 6"*,,*44 455 5:
: .
;;; 6"*,,*44:%%
8$$$ 455 5 EEE:
8 /::::
8 /:::
s A A A c # K t j | t j | dV t j d t j d dS # t j d t j d w xY w)z
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr )r5 r r )uidgids rS user_contextr sn
3
3
1
1
1
1
s ,A *Bc fd}|S )z:
Decorator to retry method on specific exceptions
c fd}|S )Nc F d}t t d t z }|k rk | i |S # t $ rG}|dz
}t j dt | |}t
j d Y d }~nd }~ww xY w|k k|)Nr z0Request to website failed even after %s retries.r" z'Retry to request website, exception: %s)r# r rC tupler r@ rv r )rL rX retries exceptionrO exceptions_to_retryr, max_retriess rS rY z7retry_on_exceptions..decorator..wrapper s G"1%W#X#X[^_j[k[k#kllIK''" 40000 011 " " "qLGO$MsSTvvVVV !IJqMMMMMMMM " K'' Os ? B=BBrW )r, rY r r s ` rS decoratorz&retry_on_exceptions..decorator s. rZ rW )r r r s `` rS retry_on_exceptionsr s*
rZ r r )rR r r- N)F)r )NNr NT)__doc__r r r& regetpassr r r r5 r r8 r, rU r rv xml.etree.ElementTreeetree ElementTreer
contextlibr datetimer r functoolsr r r
r r r
r r r typingr r r r sentry_sdk.integrations.atexitr sentry_sdk.integrations.loggingr clcommon.constr clcommon.cpapir r r r clcommon.lib.cleditionr clcommon.ui_configr clcommon.clpwdr clcommon.utilsr clcommon.lib.networkr !xray.internal.clwpos_safe_importsr xrayr! r constantsr# r$ r% r& r' r(
exceptionsr) r* getLoggerr? rB r# SubprocessErrorrZ r[ rl rs ru rw r{ r rC r r r r r r r boolro r r r r
r! compiler$ r( listr5 r: rF rP r r] rb rd rg rl rp ry r~ r r r r r r^ r@ r r r rW rZ rS r s
" " " " " " " " " % % % % % % $ $ $ $ $ $ $ $ ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' + + + + + + + + + + < < < < < < > > > > > > " " " " " " h h h h h h h h h h h h : : : : : : ' ' ' ' ' ' * * * * * * 1 1 1 1 1 1 - - - - - - I I I I I I 3 2 2 2 2 2 2 2
7 # # Z3 C( Cx C C C CL5X 5( 5 5 5 5pH 4 3 ,4 , , , ,"# "$ " " " ",C , , , ,BDJ B3 B B B BBDJ B3 B B B B
BS
B
B
B
B ;E
C
3= C 3 8D> O O O O O7# 7(3- 7 7 7 7:hsm : : : :_ _ _ _D +8 " "s "HSM " " " "J $$IJJ
P3
P4
P
P
P
P
6C
6d
6t
6
6
6
6 _3 _S _T _ _ _ _ 0
C
C
( s x 0 3 8C= 0 . (
"
"
"
"
"- - - - - %t % % % % %$Ft F F F F4 Ad A A A A
, , , ,< 1 1# 1$ 1 1 1 1B # d =AAE? ?s ?s ?*-?JN? ? ? ?D & rZ