fj) d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z ddl
mZmZ dd lmZmZmZ ej e Z dd
lmZmZmZ dd lm Z n# e $ r d Zd
Zd ZdZ Y nw xY wde de fdZ de de de dee fdZ de de ddfdZ! d dee" de#de de fdZ$ d!de de#d e#de d e#dee" de ddfd Z%de de ddfd Z&dS )"z
Website isolation support for X-Ray INI files.
This module provides functions to manage xray.ini files in per-website
directories when CageFS website isolation is enabled.
N)iglob)Optional)
disable_quota)docroot) user_contextcagefsctl_get_prefix )is_excluded_path$get_domain_php_version_from_selectorINI_USER_LOCATIONS)(is_website_isolation_allowed_server_wideis_isolation_enabled#get_websites_with_enabled_isolation)get_website_idc dS NF r ]/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/reconfiguration/website_isolation.pyr
r
+ ur c dS r r users r r r / r r c g S Nr r s r r r 3 s r r domainc D t sdS |t | v S r )r
r )r r s r is_per_website_php_selectorr : s) 3 5 5 u 8>> >>r
website_id php_ver_dirreturnc F t | }|dS d| d| d| d| d S )a
Build path to xray.ini in per-website directory.
:param user: Username
:param website_id: Website ID hash
:param php_ver_dir: PHP version directory (e.g., 'alt-php80')
:return: Full path to xray.ini or None if cagefs prefix not available
Nz /var/cagefs//z/etc/cl.php.d/z /xray.ini)r )r r r prefixs r _get_per_website_ini_pathr% @ sD "$
'
'F
~t Z& Z Z4 Z Zz Z ZK Z Z ZZr c
t | | sdS i }d}d}t D ][}t |d D ]A}t | r |d | }|j | k r1|j }|j }n"# t d| Y _xY wt j
|d }t j
| s t | 5 } t j
| }
| ||
< ddd n # 1 swxY w Y # t $ r4} t d|t% | Y d} ~ ;d} ~ ww xY w]|r|dS t' | } | d }
t) |
}t+ | | }| | }|s/t/ t1 | d }t5 | || }t j
| }t j
| s t d| dS t; || 5 t= 5 t |d 5 } | | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d
|| dS # t@ $ r'} t d || Y d} ~ dS d} ~ ww xY w) a
Copy xray.ini files from base user locations to per-website directories.
This function is called by cagefsctl when enabling website isolation for a user.
If xray.ini exists in base location (meaning user has active tasks), copy it
to per-website directories. Overwrites existing files for consistency.
Each domain may have a different PHP version set via cloudlinux-selector,
so we determine the domain's actual PHP version from cl.selector symlinks.
:param user: Username to regenerate ini files for
Npathr z!Cannot get pw_record for path: %szxray.iniz+Cannot read xray.ini for path: %s, error=%sr z*Per-website ini directory does not exist: wzCreated %s for domain %szFailed to create %s: %s)!r r r r
pw_namepw_uidpw_gidloggerdebugosr' joinexistsopenbasenamereadOSErrorerrorstr get_docrootr r getnextitervaluesr% dirnameinfor r write Exception)r r base_ini_filesuidgidlocationdir_path pw_recordini_filefr edocroot_result
document_rootr domain_php_vercontentini_pathini_dirs r $regenerate_ini_for_website_isolationrO N sV 'tV 4 4 N
C
C& hv .// H ))
,HV ,X 6 6 $,, & &
@(KKKw||Hj99H7>>(++
(^^ ;q"$'"2"28"<"JJH gooh''G
7>>' " " JJJKKK=
#s
#
# ]__ d8S6I6I Q
GGG /6BBBBB = = = .!<<<<<<<<<=s A8)A88 BD:*7D-! D:-D1 1D:4D1 5D::
E8)E33E8.L >K.
K K 4 K K KK K K.K K. K K." L .K22L 5K26 L
M! MMexisting_contentscounter php_versionc |t | dk rd}nd| d} d| d dS fd }d
t | S ) a:
Generate xray.ini content with a specific task counter value.
:param existing_contents: Existing ini file lines or None for new file
:param counter: Task counter value to set
:param php_version: PHP version for extension path (used only for new files)
:return: Generated ini file content
N zxray.soz /opt/alt/phpz /usr/lib64/php/modules/xray.soz
extension=z
;xray.tasks=
c 3 > K D ]} d| v r d dV | dz V d S )Nz
xray.tasksz ;xray.tasks=rU r )linerQ rP s r update_linez/_generate_ini_with_counter..update_line sX % " "Dt##0W0000000Tk!!!! " "r )lenr/ list)rP rQ rR so_pathrX s `` r _generate_ini_with_counterr] s c+ . . 2 2LLLL g
" " " " " " 774
&& ' ''r rA rB domain_task_countc D t | | sdS t | }|s t d| dS |d }t | } n4# t
$ r'}
t d||
Y d}
~
dS d}
~
ww xY w| sdS t | | } | s t d| dS t | | | } | sdS t j
| }
t j
|
s t d|
dS t ||| } t || 5 t 5 t! | d 5 }| | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d| || | dS # t$ $ r'}
t d | |
Y d}
~
dS d}
~
ww xY w)
aT
Update xray.ini file in per-website directory for a SPECIFIC domain.
This function is called when a tracing task is added/updated for a domain.
The ini file is placed in the directory matching the domain's PHP version
as configured via cloudlinux-selector.
Generates the ini content with domain-specific task counter, which may differ
from the per-user counter when a user has tasks for multiple domains.
:param user: Username
:param uid: User ID for file ownership
:param gid: Group ID for file ownership
:param domain: Domain name (e.g., 'example.com') - REQUIRED
:param domain_task_count: Number of tasks for this specific domain
:param existing_contents: Existing per-user ini file lines (to preserve settings)
:param php_version: PHP version for extension path (used only for new files)
N#Failed to get docroot for domain %sr *Failed to get website_id for domain %s: %s3No specific PHP version set for domain %s, skippingz,Per-website ini directory does not exist: %sr( z+Updated %s for domain %s (PHP %s, tasks=%d)zFailed to update %s: %s)r r7 r, r- r r? r5 r r% r. r' r< isdirr] r r r1 r> r4 )r rA rB r r^ rP rR rI rJ r rH rK rM rN rL rG s r update_website_isolation_inird s 6 'tV 4 4 $V,, LL> G G G F&q)
#M22
A61MMM :$
KKN JFSSS(z>JJH gooh''G
7== ! ! CWMMM )): G G G F&q)
#M22
A61MMM :$
KKN JFSSS(z>JJH
7>>( # # =L&&
)*I,<
=
= Ih 8(FN[[[[[ = = = .!<<<<<<<<<=sY ,A A
B $ BB 8.E1 &E; E1 E E1 E E1 1
F"; F F"r )NN)'__doc__loggingr. rf globr typingr secureior clcommon.cpapir r7 xray.internal.utilsr r xray_inir
r r getLogger__name__r, clcagefslib.domainr
r r #clcagefslib.webisolation.jail_utilsr ImportErrorr6 r r% rO r[ intr] rd ri r r r rx s
" " " " " " 1 1 1 1 1 1 B B B B B B B B
8 $ $
CBBBBBB
NNN
?c ?3 ? ? ? ? [C [S [s [xX[} [ [ [ [ I=s I=C I=D I= I= I= I=^ ( (#D> ( ( ( ( ( ( (P -1 H= H=H=
H= H= H=
H= $D>
H= H=
H= H= H= H=V0=s 0=C 0=D 0= 0= 0= 0= 0= 0=s
A A.-A.