no o: J d Z ddlZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z ddl m
Z
ddlmZ ddlmZmZmZmZmZmZmZmZ ddlmZmZm Z ddl m Z dd l m Z dd
l!m"Z"m#Z#m$Z$m%Z% dd l&m'Z' dd l(m)Z) dd
l*m+Z+ ddl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 ej3 e4 Z5d$dZ6 G d de2 Z7 G d de1 Z8 G d de2 Z9de:de:fdZ;dee:e Z? G d d ee:e?f Z@ G d d ZA G d! d"e## ZBdS )%u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)suppress)islice)CallableDict GeneratorListOptionalSetTupleUnion)MalwareMalwareSignaturesMyImunifyConfig) MessageType)&ms_clean_requires_myimunify_protection)RecurringCheckStop Singletonbase64_encode_filenamerecurring_check) MalwareTune) curator_path)
MalwareHit) DeletionType ErrorTypeRescanResultTypeRevisiumCSVFileRevisiumJsonFileRevisiumTempFilec Z t j rt | | S t | | S N)r USE_JSON_REPORTr r tempdirmodes T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/cleanup/cleaner.pycleaner_result_instancer' A s- " / ... 7D ) )) c e Zd ZdS )MalwareCleanerLogN)__name__
__module__ __qualname__ r( r& r* r* G s Dr( r* c > e Zd ZdZdZ ed d ZdS )MalwareCleanerProgressz+
Get progress from external source
r c K | }n-# t $ r t t j $ r Y d S w xY w|d }|| j z
|c}| _ || d S )Ncurrent)readFileNotFoundErrorr jsonJSONDecodeError _progress)selfcallbackdataprogress increments r& watchz MalwareCleanerProgress.watchR s 99;;DD ' ' '$&& &# FF ?$,t~$=x! 4>s &AAN)r+ r, r- __doc__r8 r r> r. r( r& r0 r0 K sI I_Q r( r0 c e Zd Zd ZdS )MalwareCleanupFileListc | j d 5 }| d |D d d d d S # 1 swxY w Y d S )Nwbc 3 : K | ]}t | d z V dS )
N)r ).0fs r& z/MalwareCleanupFileList.write..e s0 MMq/22U:MMMMMMr( )_pathopen
writelines)r9 filelistws r& writez MalwareCleanupFileList.writec s
Z__T
"
" Na
LLMMHMMM M M M N N N N N N N N N N N N N N N N N Ns AA A N)r+ r, r- rN r. r( r& rA rA b s( N N N N Nr( rA pathreturnc N t j t j | S )zRound-trip through fsencode/fsdecode to match FilenameField behavior.
Ensures CleanupResult keys are consistent with MalwareHit.orig_file
which goes through FilenameField's os.fsencode/os.fsdecode cycle.
)osfsdecodefsencode)rO s r& _normalize_pathrU h s ;r{4(( ) ))r( valuec D t | S # t $ r Y dS w xY w)zbConvert str|int to int, in case errors return -2
-1 used as default value when storing CH
)int
ValueError)rV s r&
_parse_intr[ q s5 5zz rrs
c b e Zd Zdeeeeef f f fd Zd Zd Z d Z
d Z d Z xZ
S )CleanupResultEntryr; c t t | dd t | dd |d |d t | dd t | dd t | dd | d d
| d d
d S )
NdesrG rmbmahb ha) r_ ra rb rG rc mtime_before mtime_after hash_before
hash_after)super__init__r[ get)r9 r; __class__s r& rn zCleanupResultEntry.__init__| s #r**++#r**++3i3i#r**++#DHHT2$6$677"488D"#5#566 r**xxb))
r( c | s| rdS | d t j k r#t d| d dS | d t j k o| d t j k S )NFra z2File has changed, assuming that it was cleaned: %srG Tr_ ) is_failed requires_myimunify_protectionr
NOT_CLEANEDUPloggerwarningNO_ERRORr INJECTION_REMOVEDr9 s r&
is_cleanedz CleanupResultEntry.is_cleaned s >> t A A C C 5 9 / / / NNDd3i
4
I+ +
<S \ ;;
r( c | o+| d t j k o| d t j k S )Nra r_ )rr r rw r rx ry s r&
is_removedz CleanupResultEntry.is_removed s?
;S Y //
;S L ::
r( c . | d t j k S Nrc )r DETECTEDry s r& rr z CleanupResultEntry.is_failed s Cy , 555r( c . | d t j k S r~ )r REQUIRED_ADVANCED_SIGNATURESry s r& rs z0CleanupResultEntry.requires_myimunify_protection s Cy , IIIr( c X | o| d t j k S )Nra )rr r FILE_NOT_EXISTSry s r& not_existz CleanupResultEntry.not_exist s& >>###NS Y5N(NNr( )r+ r, r- r strr
rY rn rz r| rr rs r
__classcell__rp s @r& r] r] { s
T#uS#X"6 7
,
6 6 6J J JO O O O O O Or( r] c e Zd ZdZd fd Zedeeef defd Z deeef f fd Z
deeef f fd Z xZ S )
CleanupResultz5
Cleanup result container for result entries
Nc f |r-t d |D d S d S )Nc T i | ]%}t |d t | &S )rG )rU r] )rF ra s r&
z*CleanupResult.__init__.. s? $AcF++-?-B-B r( )rm rn )r9 reportrp s r& rn zCleanupResult.__init__ sW GG #
r( hitrP c $ t | d| S )N orig_file)getattr)r s r& __keyzCleanupResult.__key s sK---r( c l t | | S r! )rm __contains___CleanupResult__keyr9 r rp s r& r zCleanupResult.__contains__ s% ww##DJJsOO444r( c l t | | S r! )rm __getitem__r r s r& r zCleanupResult.__getitem__ s% ww""4::c??333r( r! )
r+ r, r- r? rn staticmethodr
r r r r r r r s @r& r r s .5j ) .c . . . \.5c:o 6 5 5 5 5 5 54uS*_ 5 4 4 4 4 4 4 4 4 4 4r( r c 6 e Zd Zej ZddZdddddZdZdZdZ d Z
d
Z e d e
d ee d
edee dee f
d Zed
ededee fd ZdefdZ ddeeee ee f fdZe dededefd Z dS )MalwareCleanerNTc |r|nt j | _ t | _ || _ || _ d S r! )asyncioget_event_loop_loopMalwareCleanupProxy_proxy_sink_watch_progress)r9 loopsinkwatch_progresss r& rn zMalwareCleaner.__init__ s= !?TTw'='?'?
)++
- r( ) blacklistuse_csv
standard_onlyc
d t }
d|
ddddd|z dd|z d g
} |r| d
|z | d |z d |z g t j r| d
|r| d|z g n| d|z g | r| dg t
j | j r/| d | | j |r| d | S )Nz/opt/ai-bolit/wrapperz
--deobfuscatez
--nobackupz--forcibly_cleanupz--rescanz --list=%sz--input-fn-b64-encodedz
--username=%sz--report-hashesz--black-list=%sz--log=%sz
--progress=%sz--disable-cloudavz--csv_result=%sz --result=%sz--standard-onlyz--avdbz--soft) r appendextendr CLEANUP_DISABLE_CLOUDAVrR rO existsPROCU_DB) r9 filename
progress_path result_pathlog_pathsoftusernamer r r cleaner_binarycmds r& _cmdzMalwareCleaner._cmd sd & # ( " $ h &
6 JJ(94 5 5 5
X% -/
* , JJ* + + + 6 JJ)K78 9 9 9 9 JJ
34 5 5 5 , JJ)* + + +
7>>$- ( ( & JJx JJt} % % % ! JJx
r( zCleanup failed. r1 excr
returncodestdoutstderrc t | j j |||| d nd|| d nd S )Nreplaceerrorsrg ) exception return_codecommandouterr)dictrp r+ decode)r r r r r s r& _get_cleaner_error_infoz&MalwareCleaner._get_cleaner_error_info s_ m,"393E
Y
///2393E
Y
///2
r( rP c H |dk rdS | j }|r| d nd}|| j k r|| j z
} t j | j }|t j k r| d| dS |t j k r| d| d S |t j k r| d
| dS | d | S # t $ r Y nw xY wd |v r d
|v r| dS d|v r| d| dS d|v r| d| dS d|v r| d| dS || j
k r| dS || j k r| dS || j k r d|v r| dS | d| S )zCategorize procu process failures into explicit error types.
Returns a human-readable error string if the process failed,
or None on success (exit code 0).
r Nr r rg z Segmentation fault (signal )z Process killed (signal z
, likely OOM)z Process terminated (signal z Process killed by signal zAllowed memory size ofzbytes exhaustedz Out of memoryz Fatal errorz PHP fatal error (exit code z Parse errorz PHP parse error (exit code z$error while loading shared librariesz! Shared library error (exit code z General error (exit code 1)z# Input file not found (exit code 2)zInvalid usernamez! Invalid username (exit code 255)z Process exited with code )
CLEANUP_ERROR_PREFIXr _SIGNAL_EXIT_CODE_OFFSET
signal_moduleSignalsnameSIGSEGVSIGKILLSIGTERMrZ _EXIT_ERROR_GENERAL_EXIT_ERROR_INPUT_NOT_FOUND _EXIT_ERROR_INVALID_USERNAME)clsr r prefix stderr_textsig_numsig_names r& _categorize_process_errorz(MalwareCleaner._categorize_process_error! s$ ??4)9?Gfmm9m555R 4 4 4 3#??G
G(099> m 333 $MM(MMMMm 333! < <$,< < < m 333 $MM(MMMM FFHFFF
% 3 3![00 ,,, , K ' ' GG*GGG G K ' ' GG*GGG G 1[ @ @ LLzLLL L 0 0 0 ::: : 8 8 8 AAA A #: : :"k11 ??? ?@@J@@@s B( (
B54B5infoc B K | j r t j i |dt t j i }| j | d {V d S # t j $ r t $ r t
d Y d S w xY wd S )N timestampz-Exception while sending CleanupFailed message) r r
CleanupFailedrY timeprocess_messager CancelledError Exceptionru r )r9 r msgs r& _send_cleanup_failed_messagez+MalwareCleaner._send_cleanup_failed_message\ s :
!/?t? S-=-= >? j0055555555555)
C
s AA% %3B B c K t j }t | }t |t }| || }t
|d 5 } t
|d 5 }
t | 5 } |5 } t | 5 }
| | |r|
| | j
r7| j |
| j j |r8| | j | j | j |
j |||
j || }n1| | j | j | j |
j |||| }t$ dd | d\ }}d } t+ j j |t, j t, j d d {V }| d {V \ }}| }n# t* j $ rD |r@t9 t: 5 | d d d n # 1 swxY w Y t> $ r&}| |||r|j! nd
|| }t$ " d |# d d
|# d d|# d i |d|i | $ i |tK tM | d {V tO tQ | |fcY d }~cd d d cd d d cd d d cd d d cd d d S d }~ww xY w| ) |j! | }|r|| tU | ||j! || }t$ " d||j! | | $ i |tK | d {V n|s| j+ d}| tU | ||j! || }t$ " d|j! tY | | $ i |tK | d {V nVtY | tY | k r6t$ - dtY | tY | tO | ||fcd d d cd d d cd d d cd d d cd d d S # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )N)r$ i r# )r r r r )r r r z Executing %s )r( r( )r r ~ zCleanup failed exit_code=r z: %sr r r )extra)messagez4Cleanup process failed: %s (exit_code=%d, stderr=%s)z Report is emptyzNCleanup report is empty despite successful exit (exit_code=%d, input_files=%d)z5Partial cleanup report: %d entries for %d input files).tempfile
gettempdirr'
isinstancer is_standard_onlyrA r0 r* rN r r create_taskr> r progress_cbr r ru debugjoinr
subprocesscreate_subprocess_execPIPE communicater4 r r ProcessLookupError terminater r r errorro r r r r reprr RuntimeErrorr lenrv )r9 userrL r r r r$ result_filer flistblkr< resultlogr r r procr r r r s r& startzMalwareCleaner.startj s %''-g>>> [/:: --dMBB
#%
u 5
*%
u 5 (
u 5 {
u 5 '-.?/
/
/
u 5 KK ! ! !
% )$$$#
P
&&x~~dk6M'N'NOOO
iiN %OL ! !l #"/
iiN %OL ! #"/
LL # 7 7 7 HCD
7 $ / F%?%?
"&!1!1!3!3333333S )
)!"455 ) ) ((() ) ) ) ) ) ) ) ) ) ) ) ) ) )
7
7
733'+4DOO 4 M 0G0GMMMxx::% ::4T4;44
776t6tCHH 5 5 56 %S 3666666Qu 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5n
7& 224?CHHE (
33 ''O 4 JO 773t3tE 2 2 23
4FFF33 ''O 4 6OMM 773t3tE 2 2 23 Vs8}},,KKKMM !((%4ku 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5 u 5s$ "V<4V$V
U6 D U %A"H
U %N
.I N
IN
IN
%C N
N
U U6 V
! V$- V<N
FU " U6 . V
: V$ V< U##U6 &U#'U6 * V
6U:
:V
=U:
>V
V$
V V$V V$ V<$V( (V<+V( ,V<<W W r r c dS )z@Check if only standard signatures should be applied for the userF)r ENABLEDr )r r s r& r z MalwareCleaner.is_standard_only s
ur( )NNT)TNN) r+ r, r- r r rn r r r r r r r r r r rY r
bytesr classmethodr r r r r r boolr r. r( r& r r s )H. . . . 3 3 3 3 3j - "# #& "
#Y
\
8A8A 8A
# 8A 8A 8A [8At t $
B5 B5
}hsmT#Y6 7B5 B5 B5 B5H
s
4
D
\
r( r c h e Zd ZdZ d Zd Zdeeeee ee
f ddf fdZ d dZ d Z
d
ZdS ) r i' c T dx| _ | _ t t | _ d S Nr )r3 totalr sethitsry s r& rn z MalwareCleanupProxy.__init__ s# $%% tz $$ r( c P | j |||||f | d S r! )r update)r9 cause initiator post_actionscan_idr r s r& addzMalwareCleanupProxy.add s+
I{G] C
&,,,,,r( rP Nc # K | j r| j \ }}t | }t t || j }t
|d }|@| j | | | j | | | xj t | z
c_ g ||R V | j d S d S r! ) r popitemiterr r _CHUNK_SIZEnextr r r r )r9 scan_infor all_hits
remaining_hits r& flushzMalwareCleanupProxy.flush s i # "i / / 1 1OItDzzHvh(899::D 4 0 0M ( )$(( 777 )$++H555 JJ#d)) #JJ"9"d"" " " " i # # # # #r( r c & | xj |z
c_ d S r! )r3 )r9 r= s r& r z MalwareCleanupProxy.progress_cb s ! r( c " dx| _ | _ d S r )r3 r ry s r& resetzMalwareCleanupProxy.reset" s $%% tzzzr( c t | j | j t | j z z dz S # t
$ r Y d S w xY w)Nd )rY r3 r r r ZeroDivisionErrorry s r& get_progressz MalwareCleanupProxy.get_progress% sR t|tzC NN'BCcIJJ J 44 s 36
AA)r )r+ r, r- r rn r r r r r r r" r r% r) r. r( r& r r s K% % %
# 5c8S#56dB C# # # #"" " " "& & & r( r ) metaclass)NN)Cr? r r6 loggingrR signalr r r r collectionsr
contextlibr itertoolsr typingr r r r r
r r r
defence360agent.contracts.configr r r "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr defence360agent.utilsr r r r imav.contracts.configr imav.malwarelib.enginer imav.malwarelib.modelr imav.malwarelib.utils.revisiumr r r r r r getLoggerr+ ru r' r* r0 rA r rU rY r[ r r] r r r r. r( r& r: s * # # # # # # O O O O O O O O O O O O O O O O O O O O
; : : : : : . - - - - - / / / / / / , , , , , ,
8 $ $* * * * ( - .N N N N N - N N N *# *# * * * *eCHo # 4O 4O 4O 4O 4O 4O 4O 4On4 4 4 4 4D 001 4 4 42q q q q q q q q h * * * * *I * * * * * *r(