U|dB떩 d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZmZmZmZmZmZ d dlmZ d dlmZ d Zd Z ed d
Zer
e Ze Z e Z G d d e Z ee Z d
Z d Z!d Z"d Z#d Z$d Z% G d d Z& ed d Z'er
e' Z(d Z)d Z*d Z+d Z,d Z-da.d Z/d Z0d Z1d Z2d Z3d! Z4d" Z5d:d#Z6d:d$Z7d:d%Z8d;d&Z9dd+Zd. Z?d/ Z@daAd0 ZB ee01 ZCd2 ZDdaEd@d3ZFd4 ZGdAd5ZHd6 ZId7 ZJejK d8 ZLejK d9 ZMdS )B N) lru_cache)
TYPE_CHECKING)
cdllc_long Structurec_ushortc_ubytec_charPOINTERc_intc_void_pc_char_p)ClPwd)drop_user_privilegesc | dk rt S | dk rt S t dt d| )Nlibcliblvezmodule z has no attribute )
_load_libc _load_liblveAttributeError__name__)names h/builddir/build/BUILD/imunify360-venv-2.6.2/opt/imunify360/venv/lib/python3.11/site-packages/secureio.py __getattr__r sK v~~||
~~
E8EEtEE
F
FF c J ddgt S )Nr r )globalskeys r r __dir__r # s H 0wyy~~ / / 00r )maxsizec t j d } t t t g| j _ t | j _ t t g| j _ t | j _ t g| j _ t | j _ t g| j _ t | j _ t g| j _ d | j _ t g| j _ t | j _ | S )Nz libc.so.6)
r LoadLibraryr fchownargtypesrestypefchmod fdopendirr
readdir
DIRENTRY_P rewinddirclosedir)r s r r r ( s K ( (D !5%0DK DK !5>DK DK %gDN %DN &JDL%DL (jDN !DN 'ZDM !DM Kr c 6 e Zd Zdefdefdefdefdedz fgZdS )DIRENTRYd_inod_offd_reclend_typed_name N) r
__module__ __qualname__ino_toff_tr r r
_fields_r r r r. r. P sA % % X 7 6C< HHHr r. c H t | || S N)r r$ )fduidgids r r$ r$ ] s << r3 , ,,r c F t | | S r; )r r' )r< modes r r' r' a s << r4 ( ((r c D t | S r; )r fdopenr< s r rB rB e s << r " ""r c D t | S r; )r r) dirps r r) r) i s << % %%r c D t | S r; )r r+ rE s r r+ r+ m s << ! !$ ' ''r c D t | S r; )r r, rE s r r, r, q s << & &&r c T e Zd ZdZd Zd Zd Zd Zd Zd Z d Z
d Z d
Z d Z
d Zd
S )StubLVEz?Stub implementation of LVE functions for systems without liblvec dS Nr )selfpath parent_paths r open_not_symlinkzStubLVE.open_not_symlinkx rr c dS rL r )rN r< s r check_dirzStubLVE.check_dir{ rR r c dS rL r )rN rO
descriptorrP s r isdirz
StubLVE.isdir~ rR r c dS rL r )rN rO permr< rP s r set_perm_dir_securezStubLVE.set_perm_dir_secure rR r c dS rL r )rN rO r= r> r< rP s r set_owner_dir_securez StubLVE.set_owner_dir_secure rR r c dS rL r )rN rO rY r= r> r< rP s r create_dir_securezStubLVE.create_dir_secure rR r c dS rL r )rN rO rY r= r> rP s r makedirs_securezStubLVE.makedirs_secure rR r c d S r; r )rN r< bufs r get_path_from_descriptorz StubLVE.get_path_from_descriptor s tr c dS Nr r )rN dirsubdirs r is_subdirzStubLVE.is_subdir qr c dS re r rN s r enable_quota_capabilityz StubLVE.enable_quota_capability ri r c dS re r rk s r disable_quota_capabilityz StubLVE.disable_quota_capability ri r N)r r5 r6 __doc__rQ rT rW rZ r\ r^ r` rc rh rl rn r r r rJ rJ u s II r rJ c l t j d } nF# t $ r9 t j d } n # t $ r t cY cY S w xY wY nw xY wt t g| j _ t | j _ t g| j _ d| j _ t g| j
_ t | j
_ t t t g| j _ t | j _ t t t t g| j _ t | j _ t t t t t g| j
_ t | j
_ t t t t t t g| j _ t | j _ t t t t t g| j _ t | j _ t t g| j _ t | j _ t t g| j _ t | j _ | S )z>Load liblve if available, otherwise return stub implementationzlibsecureio.so.0z liblve.so.0N)r r# OSErrorrJ r rQ r% r r& closefdrT rW rZ r\ r^ r` rc rh )r s r r r s !"455 %m44FF 99
F )1(';F$&+F# %gFN !FN
"'F $F &uh 7FL FL ,4UE8*LF ').F & -5eUE8+TF (*/F ' *25%x(XF %',F $ (0uh&OF#%*F"
16x/@F#,.6F#+ "*8 4F $F Ms/
A7AAAAAAc F t | | S r; )r rQ )rO rP s r _open_not_symlinkrt s >> * *4 = ==r c D t | S r; )r rT rC s r rT rT s >> # #B ' ''r c H t | || S r; )r rW )rO rV rP s r rW rW s >> j+ > >>r c F t | | S r; )r rc )r< rb s r rc rc s >> 2 22s ; ;;r c F t | | S r; )r rh )rf rg s r rh rh s >> # #C 0 00r Tz/var/log/cagefs-update.logi Fc Z t j | t j t j z S r; )osopenO_RDONLY
O_NOFOLLOWrO s r rQ rQ s
74r}4 5 55r c F t j t | d S )Nr)rz rB rQ r~ s r open_file_not_symlinkr s
9%d++S 1 11r c 6 t j | }t | }|st d t | g } t | }|sn"|j }| |j 4t | t | |S )z:Returns list of entries of directory pointed by descriptorzfdopendir error)
rz dupr( RuntimeErrorr+ r) contentsappendr3 r, )r< fd2rF dirlistentrypentrys r flistdirr s
&**C S>>D .,---
dOOOG% u|$$$ % dOOO TNNN Nr c Z | ( t j | d S # t $ r Y d S w xY wd S r; )rz closerq rC s r rr rr 7 sF ~ HRLLLLL DD ~s
((c |d}t | ||| }|dk r|S | |d| z dd dS )z{Sets permissions to directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredNrM r z.Error: failed to set permissions of directory FT)r rZ encode)rO rY rP r< loggers r rZ rZ ? sr
z
+ +DKKMM4[EWEWEYEY Z ZB Avv
?$FtTTT 4r c |d}t | |||| }|dk r|S | |d| z dd dS )zSets owner and group of directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredNrM r z(Error: failed to set owner of directory FT)r r\ r )rO r= r> rP r< r s r r\ r\ M st
z
, ,T[[]]Cb+J\J\J^J^ _ _B Avv
9D@%NNN 4r c |d}t | ||||| }|dk r|S | |d| z dd dS )zCreates directory if it does not exist, sets permissions/owner otherwise
Returns descriptor if successful
Returns None if error has occuredNrM r #Error : failed to create directory FT)r r^ r )rO rY r= r> rP r< r s r r^ r^ [ sv
z
) )$++--sC[M_M_MaMa b bB Avv
4t;UDIII 4r c t | |||| }|r|r |d| z dd |S )zeRecursive directory creation function
Returns 0 if successful
Returns -1 if error has occuredr FT)r r` r )rO rY r= r> rP r ress r r` r` i sg ..
(
( c3 HZHZH\H\
]
]C
Jv J4t;UDIII Jr c ||||t d |duo|du}|rt || t | }| }| |rt |S # t t f$ r_}|rt t d| z dz t | z t d| |s t j d Y d}~dS d}~ww xY w)z read file not following symlinksNzEread_file_secure: uid and gid should be both null or be both not nullzError: failed to read : )
r
set_user_permr readlinesr
set_root_permrq IOErrorloggingstr SILENT_FLAGsysexit) filenamer= r>
exit_on_error write_log drop_perm file_objectcontentes r read_file_securer s s S_bcccD 7s$I c3
+H55 '')) OOO W OOO(83e;c!ffDkSTV_```
s AA< <C,
AC''C, c
T t j | }|rt || d}d} t j d| \ }} t j |d }
|
d | |s$|"| t ||| rt d t || rt d |
n+# t t f$ r} |
n# t $ r Y nw xY w t j | n# t $ r Y nw xY w t j | n# t $ r Y nw xY w|rt! t# d| d t% | d
d t( d | Y d} ~ d
S d} ~ wt $ rD} t# dt% | t( d t+ j d Y d} ~ nd} ~ ww xY wd} t j | | nl# t $ r_} d
} t# d|z d z t% | z t( d | t j | n# t $ r Y nw xY wY d} ~ nd} ~ ww xY w|rt! | S )z!Returns True if error has occuredNcagefs_)prefixrf w z
fchown failedz
fchmod failedz Error: failed to write file r ErrnozErr coder TzError: Fz$Error: failed to rename tempfile to )rz rO dirnamer tempfilemkstemprB writejoinr$ rq r' r r Exceptionunlinkr r r replacer r r rename)
r ini_pathr= r> r rY r dirpathr< temp_pathr r errors
r write_file_securer s0 gooh''G c3
BI" ( wGGG
IiC(( "'''**+++ /S_ b#s##
/ o... "d +/** * W D HRLLLL D Ii D OOO ]8 ] ]AwPZ8[8[ ] ]
ttttt "#a&&""K333
E
)X&&&& 6AEICPQFFRT_abdmnnn Ii D Ls B/C( (H:DF?
D F?D F? D54F?5
E?F?EF?EF?
E(%F?'E((AF??
H :H HH, ,
J6/J&I;:J;
JJJJJr c |%t j }t |dd t j | }d\ }} t j ||| \ }} t j |dd 5 }
|
| ddd n # 1 swxY w Y nu# t t f$ ra || t j | n# t t f$ r Y nw xY w t j | n# t t f$ r Y nw xY w w xY w t j
| | t j | | nI# t t t f$ r/ t j | n# t t f$ r Y nw xY w w xY w|ht j } t j | t j t j | d
k rt j | dS dS dS ) aP
Safely write string content to a file
:param content: str
:param dest_path: str -> path to a file
:param perm: int -> permissions for the file
:param prefix: str -> add to temporary file name
:param suffix: str -> add to temporary file name
:param as_user: str -> name of the user to drop privileges to
NTF)effective_or_realset_envNN)r suffixrf r surrogateescape)errorsr )rz getgroupsr rO r r r rB r r rq r r chmodr TypeErrorgetuidseteuidsetegidgetgid setgroups) r dest_pathrY r r as_user
old_groupsr r< r f_tempruids r write_file_via_tempfiler s \^^
WeLLLLgooi((G MB ( f'; ; ;
I
Yr3'8
9
9
9 "V LL ! ! ! " " " " " " " " " " " " " " " W
:* HRLLLL! D Ii ! D
D!!!
)Y'''' Wi ( Ii ! D
y{{
4
29;; 199 L $ $ $ $ $
9s
1B, >B B, B$$B, 'B$(B, ,D CD C,)D +C,,D 0DD DD DD "*E
F%E:9F:F F
FFc D t j | ng# t f$ rY}|rGt dt | z dz t | z t j d nY d }~dS Y d }~nd }~ww xY wt | | } t j | nS# t f$ rE}|r3t d|t | t j d nY d }~dS Y d }~nd }~ww xY w t j | ng# t f$ rY}|rGt dt | z dz t | z t j d nY d }~dS Y d }~nd }~ww xY w| dk rda
d S t d a
d S )
Nzfailed to set egid to z: r rM z'failed to set supplementary groups to :zfailed to set euid to r TF)
rz r rq print_errorr r r
get_groupsr r root_flagr rl )r= r> r r groupss r r r s
3 : 03s88;dBSVVK L L L HQKKKK22222
KKKK S
!
!F
V : A63q66 R R R HQKKKK22222
KKKK
3 : 03s88;dBSVVK L L L HQKKKK22222
KKKK axx ..000 sF A;A A66A;B$ $ C4/5C//C48D
E1A E,,E1c t j d nR# t f$ rD}| r2t dt | t j d nY d }~dS Y d }~nd }~ww xY w t j d nR# t f$ rD}| r2t dt | t j d nY d }~dS Y d }~nd }~ww xY wt dd } t j | nS# t f$ rE}| r3t d|t | t j d nY d }~dS Y d }~nd }~ww xY wda
d S )Nr zfailed to set euid to 0 :r rM z Error: failed to set egid to 0 :z.Error: failed to set supplementary groups to :T) rz r rq r r r r r r r r )r r r s r r r ' s
1
: 3SVV < < < HQKKKK22222
KKKK
1
: :CFF C C C HQKKKK22222
KKKK 1
F
V : H&RUVWRXRX Y Y Y HQKKKK22222
KKKK IIIsD A&4A!!A&*A? ? C
4C C"C7 7 E5EEc t ddt j | D ] }t |dt j t t j d S )NzError: )endfile)r )printr stderr)argsas r r r I s[ (#*----
+ +
aSsz***** szr c V t }t }t }|D ]Y}|| j }|D ]G} || j }n# t
$ r Y w xY w|| k r | || j HZ| | t | S )z$Returns supplementary groups for uid) get_grp_dict get_pwd_dictsetgr_mempw_uidKeyErroraddgr_gidlist) r= r> grpwr groupmembersuser
member_uids r r r P s B B
UUF - -U)" - -D
X_
S
2e9+,,,
- JJsOOO <<s
A
A A c p t )i a t j } | D ]}|t |j < t S r; )grp_dictgrpgetgrallgr_name)r lines r r r e s;
\^^ * *D%)HT\ " " Or )min_uidc 4 t S r; )clpwd
get_user_dictr r r r r r s r c X |s|rt | |rt }t s t \ }}t t >t j d }t t dd at j | t | t d nU# t t f$ rA}t dt t | t j d Y d }~nd }~ww xY w|st! || d S d S d S )N r r
z writing to )r r get_permr log_filerz umaskr{ LOGFILEr rq r r r r r r ) msgsilentverboser root_flag_savedr= r> umask_savedr s r r r y s/ #JJJ $# zzHC OOO
htnn a00%%% NN3 NN4 !
wA 7 7 7 HQKKKKKKKK $ #s # # # # ##$ $ $ $s A9B? ?D7D Dc t j } t j }nI# t f$ r;}t dt | t
j d Y d }~nd }~ww xY w| |fS )Nzfailed to get (euid,egid)r )rz geteuidgetegidrq r r r r )r= r> r s r r r sy jlljll : /Q888 8Os &) A/1A**A/c | r t n t S )z
Set CAP_SYS_RESOURCE capability
:param bool clear: Set on if it's true, set off otherwise
:return: 0 for success, -1 otherwise
:rtype: int
)r rn rl )clears r set_capabilityr
s9 9> 6<>> 2 2 4 4 4
^^
3
3
5
56r c F t j | t S )a
Change effective uid of current process and set CAP_SYS_RESOURCE capbality
to prevent "Disk quota exceeded" error
:param int euid: User ID to set it as current effective UID
:return: 0 if capability was set successfuly, -1 otherwise
:rtype: int
)rz r r
)r= s r
change_uidr s JsOOO r c | s"t dS t dS )zZ
Disable quota kernel check to allow us to write
more than user can by quota.
N)r rl rn enableds r _set_quota_checks_statusr sD
2..00000//11111r c # ~ K t d d V t d d S # t d w xY w)NFr T)r r r r
disable_quotar sT U++++/
...... .....s * <c # K t j | } d V t j | d S # t j | w xY wr; )rz r ) umask_value saved_umasks r set_umaskr sO (;''K
s 2 Ar r; )NNTT)Tr T)r r N)T)FTT)F)Nr r r
contextlibrz functoolsr typingr ctypesr r r r r r
r r r
r clcommonr clcommon.clpwdr r r r r r7 r8 r. r* r$ r' rB r) r+ r, rJ r r rt rT rW rc rh r r MIN_UIDr rQ r r rr rZ r\ r^ r` r r r r r r r r r r r r r r r
r r contextmanagerr r r r r r" s
/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / /G G G1 1 1
4 > :< > >( ( (? ? ?< < <1 1 1
&
6 6 62 2 2 8 2; ; ; ;~ AE3% 3% 3% 3%l$ $ $ $N D $ g ! ! !
$ $ $ $4 6 6 6 6
2 2 2 / / / r