M d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z m Z m
Z
d dlZd dlZd dlmZ d dlmZ ej e ZdZ G d d
e
Z G d d e Z G d
d Zde e de e fdZ de de fdZ de de de fdZ G d d Z G d d e Z! G d d e! Z" G d d e! Z#dS )! N)abstractmethod)suppress)dedent)MappingOptionalProtocol)atomic_rewrite)open_dir_no_symlinksi c ~ e Zd Ze d dedefd Zededdfd Zed
ee defd Z
dS )
IConfigProviderFT
force_read
ignore_errorsc t NNotImplementedError)selfr
r s ^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/config_provider.pyread_config_filez IConfigProvider.read_config_file s
"! configreturnNc t r r )r r s r write_config_filez!IConfigProvider.write_config_file !!r timestampc t r r r r s r modified_sincez IConfigProvider.modified_since! r r FT) __name__
__module__ __qualname__r boolr r r r floatr r r r r s >B" " "7;" " " ^"
" "D " " " ^" " "D " " " ^" " "r r c e Zd ZdS ) ConfigErrorN)r! r" r# r& r r r( r( & s Dr r( c e Zd ZdZd Zd ZdS ) JsonMessagezPretty-print given *obj* as JSON.
To be used for logging. Example:
logging.info("object: %s", JsonMessage(obj))
c || _ d S r )_obj)r objs r __init__zJsonMessage.__init__3 s
r c 8 t j | j d S )NT) sort_keys)jsondumpsr, r s r __str__zJsonMessage.__str__6 s z$)t4444r N)r! r" r# __doc__r. r4 r& r r r* r* * s< 5 5 5 5 5r r* prev_sectionsectionc ^ pi pi z
} z
} fd|D fd|D fd z D dS )z*Return difference between config sections.c " i | ] }|| S r& r& ).0vr6 s r
z diff_section..A s
;
;
;Qa a
;
;
;r c " i | ] }|| S r& r& )r: r; r7 s r r< z diff_section..B s
4
4
4a
4
4
4r c V i | ]%}| | k || | f&S r& r& )r: r; r6 r7 s r r< z diff_section..D sE
A'!*,,
Q,,,,r )-+?keys)r6 r7 removed_settingsadded_settingss `` r diff_sectionrF : s %2LmG#((**W\\^^; \\^^l&7&7&9&99N
;
;
;
;*:
;
;
;
4
4
4
4^
4
4
4
"''))GLLNN:
r prev_confconfc # b K z
} fd|D V z
}fd|D V fd z D V dS )z,Compare *prev_conf* with the current *conf*.c " i | ] }|| S r& r& )r: r7 rG s r r< z diff_config..O s
G
G
G77Ig&
G
G
Gr c " i | ] }|| S r& r& )r: r7 rH s r r< z diff_config..Q s
@
@
@g7DM
@
@
@r c n i | ]1}| | k |t | | 2S r& )rF )r: r7 rH rG s r r< z diff_config..S sL W g . . i 0$w-@@ . . .r NrB )rG rH removed_sectionsadded_sectionss `` r diff_configrO L s ~~''$))++5
G
G
G
G6F
G
G
GGGGYY[[9>>#3#33N
@
@
@
@
@
@
@@@@ !((499;;6 r main_conf base_confr c t || \ }}}i }| D ]\ }}|| v r|||< || v r| |i || d | |i d || d D |S )a
Return dict derived from *main_conf* excluding parts
that are equal in *base_conf*.
For example,
>>> base_conf = {
"SECTION1": {"OPTION1": "default", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>> main_conf = {
"SECTION1": {"OPTION1": "value", "OPTION2": "default"},
"SECTION2": {"OPTION1": "default"}
}
>>>
>>> exclude_equals(main_conf=main_conf, base_conf=base_conf)
{'SECTION1': {'OPTION1': 'value'}}
>>>
r@ c & i | ]\ }}||d S ) r& )r: kr; s r r< z"exclude_equals..t s" CCCTQAaDCCCr rA )rO itemsrC
setdefaultupdate)rP rQ _addedchangedresultr7 values r exclude_equalsr^ Z s $ $Iy99Aug
F#//++ ejjll " " #F7O gllnn $ $ gr * * 1 1''2B32G H H H gr * * 1 1CCWW%5c%:%@%@%B%BCCC
Mr c e Zd ZdZddZd Zd Z dd ed
ed efd Z d
e
d efdZ d Z d Z
d e
fdZd e
fdZdee d efdZdS ) ConfigReaderzM
ConfigFile file for settings page.
Location config file is PATH
Nc 0 || _ || _ || _ d S r )path
disclaimer permissions)r rc rd re s r r. zConfigReader.__init__ s $&r c N d | j j | j S )Nz<{classname}({path})>) classnamerc )format __class__r# rc r3 s r __repr__zConfigReader.__repr__ s+ &--n1 .
r c d| j S )NzConfigReader at )rc r3 s r r4 zConfigReader.__str__ s -$)---r FTr
r r c 2 t j | j t k rt d | j }t |d 5 }t d| | }ddd n # 1 swxY w Y n/# t $ r}t d |d}~wt $ r i cY S w xY w | | S # t $ r*}t | |ri cY d}~S |d}~ww xY w)zCRead config file into memory.
Raises ConfigError.
zConfig file is too largerzReading config file %sNz Unable to decode config file)
osrc getsize_MAX_CONFIG_SIZEr( openloggerinforeadUnicodeDecodeErrorFileNotFoundErrorload_config_bodyerror)r r
r filename config_filetextes r r z ConfigReader.read_config_file su
wty)),<<<!"<===yHh$$
* 4h???"''))
*
*
*
*
*
*
*
*
*
*
*
*
*
*
* " E E E <==1 D III ((.. . LLOOO
G sf AB 0B B BB BB
C 'B77C C
C" "
D, D DDDr{ c
t j | }n+# t j $ r}t d| d |d }~ww xY w|i S t |t
s(t d | j | |S )Nz.Imunify360 config is not valid YAML document ()z;Imunify360 config is invalid or empty: path={!r}, text={!r})yaml safe_load YAMLErrorr(
isinstancedictrh rc )r r{ r r| s r rw z ConfigReader.load_config_body s ^D))FF~ EEEE
>I&$'' ))/ 4)@)@
s ?:?c d S r r& r3 s r
_pre_writezConfigReader._pre_write r c d S r r& r3 s r _post_writezConfigReader._post_write r r c d}| j r |t | j z
}|dz
}|t j |d z
}|S )Nra
F)default_flow_style)rd r r dumpr r config_texts r _serialize_configz ConfigReader._serialize_config sN ? 6$/22 2K 4 KtyEBBBB r c | | | }t | j |d| j | |S )NF)backupre )r r r rc re r r s r r z ConfigReader.write_config_file sd ,,V44 I{5d>N
r r c dS )NTr& r s r r zConfigReader.modified_since s tr ra Nr )r! r" r# r5 r. rj r4 r$ r r strrw r r r r r r% r r& r r r` r` y s#
' ' ' '
. . . ?C 7;
4S T &
3 3 D r r` c b e Zd Zd fd Zd Z ddedef fd
Zdd Zd ee d
efd
Z
xZ S )CachedConfigReaderra Nc t || d | _ d | _ i | _ || _ d S r )superr. mtimesize_configre r rc rd re ri s r r. zCachedConfigReader.__init__ s@
z***&*
%) &r c f d | j j | j | j | j S )Nz9{classname} <'{path}', modified at {mtime}, {size} bytes>)rg rc r r )rh ri r# rc r r r3 s r r4 zCachedConfigReader.__str__ s7 G N N .5YjY
O
r FTr
r c H | | j s|r| j } t | | _ | j Wt t
|| j }t | r&t j d| gt t | R n]# t $ rP}t j | t d| t | j |s|Y d}~nd}~ww xY w| | j S )z(Update config if config file is modified)r Nz-%s modified: removed=%s, added=%s, changed=%sz*%s is invalid, using previous settings: %s)r r r r r listrO anyrr rs mapr* r(
sentry_sdkcapture_exceptionwarning_refresh_stat_cache)r r
r prev_configdiffsrx ri s r r z#CachedConfigReader.read_config_file sW tz * * 'j ' ,K
$ww 7 7"/ 8 :) [$,!G!G H HE5zz K !e 4 4
,U333@ --
% K
*
$ $ & & &|s 'B, ,
D6ADDr c t j | j }|j | _ |j | _ dS # t $ r d| _ d| _ Y dS w xY w)z-Sync cached mtime/size with the file on disk. N)rn statrc st_mtimer st_sizer rv )r r s r r z&CachedConfigReader._refresh_stat_cache s] 749%%D DJ DIII DJDIIII s 15 AAr c |d} t j | j }|j |j }}n# t
$ r d\ }}Y nw xY w||k p
|| j k S )zWhether the config has updated since *timestamp*.
(as defined by its last modification time and size)
:param timestamp: None means that the file has never been read before
Nr )r r )rn r rc r r rv r )r r r r r s r r z!CachedConfigReader.modified_since sz I <749%%D !%
t|gHH ! ) ) ) ( Hggg ) )#;w$)';;s . A A r r )r N) r! r" r# r. r4 r$ r r r r% r
__classcell__ri s @r r r s ' ' ' ' ' '
?C! ! ! 7;! ! ! ! ! ! F < //`` and the
config file inside it must end up owned by ``root:`` with
modes ``0750`` / ``0640``. Earlier revisions performed the
``mkdir`` -> ``chown`` -> ``chmod`` sequence on path strings, which
left a TOCTOU window: between the directory existing and the
metadata syscalls, a swap to a symlink could redirect the chown to
an arbitrary inode. See DEF-41586 / CLOS-3965 for context.
The hardened path opens the parent ``USER_CONFDIR`` once with
``O_NOFOLLOW`` at every component, then performs every subsequent
operation (``mkdir``/``chown``/``chmod``/atomic write) relative to
that fd or to a fresh ``O_NOFOLLOW`` fd of the user subdir. No
user-controlled path string is dereferenced more than once.
i i c X t | || _ d S r )r r. username)r rc r ri s r r. zUserConfigReader.__init__M s&
r c d| j S )NzConfig of user )r r3 s r r4 zUserConfigReader.__str__Q s 0 000r parent_fdnamer c t t 5 t j || j | ddd n # 1 swxY w Y t j |t j t j z t j z | S )a Return an O_NOFOLLOW fd for ``name`` inside *parent_fd*.
Creates the directory first if it does not already exist. The
``O_NOFOLLOW`` flag guarantees that, if a symlink appears in the
slot at any time after this call returns, every subsequent
``fchown``/``fchmod``/atomic-rewrite bound to the returned fd
operates on the originally opened inode.
)modedir_fdNr ) r FileExistsErrorrn mkdirDIR_PERMISSIONSrq O_RDONLY O_DIRECTORY
O_NOFOLLOW)r r r s r _open_user_subdirz"UserConfigReader._open_user_subdirT s o
&
& H H HT 4Y G G G G H H H H H H H H H H H H H H Hw K". (2= 8
s >AAc t j | j j }t j | j \ }}t j | \ }}t | } | || } t j |d| t j
|| j | | } t || dd|| j | t j |t j t j z | }
t j |
d| t j
|
| j t j |
n# t j |
w xY w t j | n# t j | w xY w t j | n# t j | w xY w| S )Nr F)r uidgidre r r )pwdgetpwnamr pw_gidrn rc splitr
r chownfchmodr r r FILE_PERMISSIONSrq r r close) r r r confdirbasename userconfdirr r user_fdr file_fds r r z"UserConfigReader.write_config_filee s l4=))0 GMM$) 4 4 "
g 6 6 X )55 * ,,YAAG&
" !S))) '4#7888 " 4 4V < < $ 5" ' K"-/"
&HWa---Igt'<===HW%%%%BHW%%%%%!!!!!!!!! HY BHY s= 8G BF 0E# F #E99F =G F((G G)
r! r" r# r5 r r r. r4 intr r r r r s @r r r 8 s " O ! ! ! ! !1 1 1
3
c
c
"63 6 6 6 6 6 6 6 6r r )$r1 loggingrn r abcr
contextlibr textwrapr typingr r r r r defence360agent.utilsr defence360agent.utils.fd_opsr
getLoggerr! rr rp r Exceptionr( r* r rF rO r^ r` r r r r& r r r s
. . . . . . . . . . 0 0 0 0 0 0 = = = = = = 8 $ $
"
"
"
"
"h
"
"
" )
5
5
5
5
5
5
5
5 x~ $ 4 t $ 4 >X X X X X X X XvN< N< N< N< N< N< N< N