L cv d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl
m Z d dl m
Z
d dlmZ d dlmZmZ e Zd Zd
d
Zd
d Zej fd ZdS ) N)Corenative)EventHookLogger) EventHook)db)run
snake_casec t j rg S t j t j | k }t
| S )N)r deferredr selectwhereeventlist)r hookss R/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/hooks/execute.py get_hooksr sB
{ $ $Y_%= > >E ;; Fc X t j | s"t d | |rBt j | t j s"t d | nAt j | t j s"t d | t j | } t j | }n5# t $ r(}t d | | d}~ww xY w|j t j z r"t d | t j
| }|r|dk r t j | }n5# t $ r(}t d || d}~ww xY w|j t j z r;|j t j z s)t d || dS dS dS dS )
a' Raise ValueError if path is not a safe hook file.
The original check rejected any path under /tmp, /var/tmp, /dev/shm
on the grounds that those dirs are world-writable. That blanket-
by-prefix rule was too coarse: pytest's tmp_path lives under
/tmp/pytest-of-/... and the agent's own integration fixtures
legitimately put hook files there. The real threats are (a) an
attacker-owned file (DB row points at a path the attacker
controls) and (b) a hook whose immediate parent is world-writable
so the file can be swapped between this check and the exec.
The required permission bit differs between branches: subprocess
hooks are exec'd by the kernel (needs X_OK), but native hooks are
loaded via importlib's open()+exec_module path which only needs
R_OK. A standard Python file in mode 0o644 is loadable but not
executable, so requiring +x for native hooks would silently break
the typical native-hook deployment (the `hook add-native` RPC has
never required or documented an executable bit).
z-Hook path does not exist or is not a file: {}z Hook path is not readable: {}z Hook path is not executable: {}z Hook path stat failed: {}: {}Nz Hook path is world-writable: {}/z Hook parent stat failed: {}: {}z=Hook path has world-writable parent without sticky bit {}: {})ospathisfile
ValueErrorformataccessR_OKX_OKrealpathstatOSErrorst_modeS_IWOTHdirnameS_ISVTX)r r realstexcparentpsts r _validate_hook_pathr+ s; ( 7>>$
; B B4 H H
Myrw'' K < C CD I IJJ J K yrw'' M > E Ed K KLL L
7 D ! !DL
WT]] L L L8??cJJKKKL
zDL I:AA$GGHHH
W__T
"
"F
&C-- '&//CC 188EE
K$, & t|1K &..
-- s0 'C< <
D.#D))D.F$ $
G.#GGc K t j }| d t | | d {V |rt j | | d\ }}nct
j | }t j
| }t | gd|| d {V \ }}}n(# t $ r}d t | }}Y d }~nd }~ww xY w||fS )N)r NF)shellinputcwd)asyncioget_event_looprun_in_executorr+ native_hooks execute_hookjsondumpsencoder r r$ r Exceptionrepr) r datar loop exit_codeerrr/ _es r r4 r4 T s' ' %''""4)s B6B; ;
C CC c . K | d }t | }t | j }|sd S t | j | j 5 }|rt
| j j dz }t j
d|d| }t j || |
t j | |j |d< | j | j |d}|D ]} || j | j 5 }
|
t+ | j || j d {V \ } } |
| | d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S ) NDUMPr> zw+z.json)modeprefixsuffixdir tmp_filename)r subtypeparamsr )getdictr r event_hook_loggerrG r
__class____name__tempfileNamedTemporaryFiler5 dumpflushr fsyncfilenonamer r beginr4 finish)
r tempdirrP rH r event_loggerrC tmpr: hook hook_loggerr< r= s
r
execute_hooksr\ m s? 99V D
%[[F ek " "E 5;
6 6 3, . 899C?F-&g C
IdC IIKKK HSZZ\\ " " "%(XF> " [ }
3 3D di <<<
3 !!###'3ItDK( ( ( " " " " " " 3 ""9c222
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3 3#3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s8 B;F
AE0$ F
0E4 4F
7E4 8F
FF)F)r0 r5 r r rN defence360agent.contracts.configr defence360agent.hooksr r3 defence360agent.internals.loggerr defence360agent.model.event_hookr defence360agent.model.instancer defence360agent.utilsr r
rK r r+ r4 TMPDIRr\ r r re s 1 1 1 1 1 1 8 8 8 8 8 8 < < < < < < 6 6 6 6 6 6 - - - - - - 1 1 1 1 1 1 1 1#O%% 7 7 7 7t 2 (,{ 3 3 3 3 3 3r