[fX] C d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZmZmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lm Z dd
l m Z ddl m Z ddl!m"Z"m#Z#m$Z$ ddl%m&Z& ddl'm(Z( ddl)m*Z*m+Z+m,Z,m-Z-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4 ddl5m6Z6 ddl7m8Z8m9Z9m:Z: ddl;mZ>m?Z?m@Z@ ddlAmBZBmCZC ddlDmEZE ddlFmGZG dd lHmIZImJZJ dd lKmLZL dd lMmNZNmOZO dd lPmQZQ dd lRmSZSmTZT dd!lAmUZU e eV ZWd"ZX e(d#e*jY ZZ eeCj[ d$% Z\ eeCj[ d&% Z] e4e2eWj^ ' eWj_ Z`d(eeC d)efd*Za G d+ d,e"e# Zb G d- d.e"e# Zc G d/ d0e" Zdd1 Ze G d2 d3ec Zf G d4 d5e" Zg G d6 d7e" ZhdS )8u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)partial) getLogger)Path)DictIterableListTuple)utils)
inactivity)Malware)MyImunifyConfig) HookEvent)
LicenseCLN) MessageType) myimunify_protection_enabled) MessageSink
MessageSourceexpect)g)register_lock_file)Scope
nice_iteratorrecurring_checksafe_cancel_tasksplit_for_chunk)
check_lock)DAYMINUTE
rate_limit)MalwareDatabaseRestoreTask)
CleanupResultMalwareCleanerMalwareCleanupProxy)CleanupStorage)MalwareHitStatusMalwareScanResourceTypeMalwareScanType)MalwareHistory
MalwareHit)ScanAlreadyCompleteError)MalwareDatabaseCleaner)MDSDetachedCleanupMDSDetachedRestore)MalwareDatabaseRestore)HackerTrapHitsSaver
MalwareAction)malware_response)get_username_by_uidis_uid)MalwareIgnorePath cleanupstatus) attributeowner)periodon_drophitsreturnc d | D S )Nc 3 D K | ]}|j t j k |V d S N)r7 r% FOUND.0hits T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/cleanup.py z#filter_cleanable..f s2 H HC3:1A1G#G#GC#G#G#G#G H H r< s rE filter_cleanablerJ e s H H4 H H HHrG c V e Zd Zd Zd Zd Zd Z eej de
fd Z e de
dee d ee
e
f fd
Ze de
d ed ed e
fd
Zde
d e
fdZde
d e
fdZd Zd Ze d Zd Zd Z ddZ d Z e d d Z dS )Cleanupc h d | _ d | _ d| _ d | _ d | _ d | _ d | _ d S )NF)
_cleanup_task_store_original_task_running_loop_sink_proxy_cleanerselfs rE __init__zCleanup.__init__j s9 !$(!
rG c K || _ || _ t | _ t || | _ | | | _ d S )N)loopsink) rQ rR r# rS r" rT create_taskr6 rN rV rY rZ s rE
create_sourcezCleanup.create_sources sY
)++ &Dt<<<
! - -dllnn = =rG c
K d S r@ rH rV rY s rE create_sinkzCleanup.create_sinkz rG c P K | j r t | j d {V d S d S r@ )rN r rU s rE shutdownzCleanup.shutdown} sD 7"4#566 6 6 6 6 6 6 6 6 6 7 7rG messagec
K | d }| d }| d }| d }| d }|d u }t |d }t j |d | } t | } d | D } |sh| | t j t j g \ }
} | |
d {V }
|
|
| d {V z } |t | z
x} r t d | | | j
| | ||||| | _ d S )
Ncause initiator post_actionscan_id
standard_onlyr< )include_scan_infoc F g | ] }|j t j j k | S rH )
resource_typer& FILEvaluerB s rE
z0Cleanup.process_cleanup_task.. s7
$;$@$FFF
FFFrG z"%s/%s hits filtered before cleanup)getlenr) refresh_hitsrJ _split_hits_by_scan_typer' RESCANRESCAN_OUTDATED_filter_rescan_hits _filter_failed_to_cleanup_hitsloggerinforQ r[ _store_originalrO ) rV rd rf rg rh ri rj manual_cleanuporigin_hits_numr< rescan_hitsfiltereds rE process_cleanup_taskz Cleanup.process_cleanup_task s G$$KK ,, kk-00 ++i(( O44
$ gfo..& FO>/A
%%
!% = =-/NO! ! K !% 8 8 E EEEEEEEK t'J'J( ( " " " " " " D 'T2 28 KK4
%)J$:$: eY Wm
%
%
!!!rG r<
scan_typesr= c g g }}| D ];}|j j |v r| | &| | <||fS r@ )scanidtypeappend)r< r target_hits
other_hitsrD s rE rt z Cleanup._split_hits_by_scan_type sd #%bZ ' 'Cz*,,""3''''!!#&&&&J&&rG
time_rangeallowed_attemptsc K g }| rt j |z
}i }t | d D ]\}| t t j d |D | t
j d d {V ]| D ]P}| |j d }||k rt d|j || ;| | Q|S )N
chunk_sizec g | ] }|j
S rH orig_filerB s rE rp z5Cleanup._filter_failed_to_cleanup.. s A A AsS] A A ArG )sincer zVSkip cleanup file '%s', since there are too many attempts to cleanup it in %s sec [%s]) timer updatedictr( get_failed_cleanup_events_countasynciosleeprq r throttled_log_errorr ) r< r r
hits_to_cleanr failed_cleanup_count
hits_chunkrD failuress rE _filter_failed_to_cleanupz!Cleanup._filter_failed_to_cleanup s3
*IKK*,E#% -ds C C C
'
'
$++&F A Aj A A A"' mA&&&&&&&&&&
*
*/33CM1EE ///'@
" $$S)))) rG c R K | |dt z d d {V S )N r r )r r rV r< s rE rw zCleanup._filter_rescan_hits sL 33 QZ! 4
rG c V K | |t t d{V S )zl
Don't try to cleanup the same hit more than
*COUNT_OF_ATTEMPTS_TO_CLEANUP_PER_DAY*
r N)r r $COUNT_OF_ATTEMPTS_TO_CLEANUP_PER_DAYr s rE rx z&Cleanup._filter_failed_to_cleanup_hits sL
33 A 4
rG c
K t j |t j t | }g }g } |D ]}
t j |
j d {V r| |
n| |
N# t $ r@} t d|
j | | |
Y d } ~ d } ~ ww xY w| r!t j | t j |}t j d 5 t! j | d {V \ } }
}d d d n # 1 swxY w Y |
D ]w}
| j t) j d |
j t j t1 t3 j d {V x| | ||||| | D ]&\ }t j fd|
D | 't j | t; j ||| d {V d S )Nz3Ignore re-check failed for file %s: %s; keeping hitcleanup_storagez*Failed to store the original from {} to {})rd timestampc g | ]}|v | S rH rH )rC hhit_lists rE rp z+Cleanup._store_original.. s "F"F"FX
1
rG rf rg ) r)
set_statusr% CLEANUP_STARTED_group_by_statusr4 is_path_ignoredr r Exceptionry exceptionrA r tracktaskr$ store_allrR process_messager
CleanupFailedformatpathintr
_add_to_proxyitemsdelete_instancesr0 cleanup_failed)rV r< rf rg rh ri rj original_status hits_to_keep ignored_hitsrD exc succeededfailed not_existr7 r s @rE r{ zCleanup._store_original s3 d$4$DEEE*400
)
)C
)*:3=IIIIIIII - '',,,, '',,,
)
)
) IM
##C((((((((
) !,0@0F G G G D
"
"#4
5
5 P P1?1I$1O1O+O+O+O+O+O+O (Ivy P P P P P P P P P P P P P P P
C*,,)DKK M>+> "$)++ . .
uig}
!0 5 5 7 7 P P FH !"F"F"F"Ff"F"F"F O O O O#I...* Ui
s* A
B
C6C C E EEc g }g }|D ]?} t || }
|
r| | *| | @| j ||||d| | j |||||| d S )NT)"decide_if_standard_signatures_onlyr rS add) rV r< rf rg rh ri rj standard_only_hits
advanced_hitsrD standard_only_users rE r zCleanup._add_to_proxy s
* *C!C=" " "
*"))#.... $$S))))
rG c $ t | }|S r@ )_group_by_user)r< user_hitss rE
_user_hitszCleanup._user_hits; s "4(( rG c # K | j }|D ].\ }}}}}}d |D fd|D }| |||||fV /d S )Nc F g | ] }t j d |j | S )z\w+-BLKH-|cloudhash\.|cld-)rematchr rB s rE rp z0Cleanup._cloud_assisted_hits..K s= 8 938DD rG c g | ]}|v| S rH rH )rC rD blacklists rE rp z0Cleanup._cloud_assisted_hits..P s# LLLCs)7K7KC7K7K7KrG )rS flush)
rV action_hitsrf rg rh ri rj all_hits regular_hitsr s
@rE _cloud_assisted_hitsz Cleanup._cloud_assisted_hits@ s k''))
# I
MLLL8LLLL
rG c K d |D }t j ||t | | }| j | d {V d S )Nc 6 g | ]}| S rH )as_dictrB s rE rp z'Cleanup._start_hook..\ s ...#
...rG )
cleanup_idstarted total_filesDUMP)r MalwareCleanupStartedrr rR r )rV r r r< dumpcleanup_starteds rE _start_hookzCleanup._start_hook[ sr .....#9!D
j(( 99999999999rG Nc K | | }| |pg } h || D ]}
| |
g } | |
g } | | z }
g }| D ]} t j |j d {V r!t j |gt j n| | Y# t $ r@}t d|j | | | Y d }~d }~ww xY wg }| D ]} t j |j d {V r!t j |gt j n| | Y# t $ r@}t d|j | | | Y d }~d }~ww xY w|} |} d | | z D }|rjt | fd| D } fd| D } t j | t j ||| d {V fd|
D }
| s| s
d | D }d | D }t d ||z t% j j }t+ j }t- |
r|
}t/ j s\t d
|d | j t9 j |
i ||d ||||g
d {V t= | d {V x}s t d|d %|}
| |||
d {V | j! " |
|tF j$ || d {V \ }}}| j t9 j |
|||||||||
d {V d S )Nz0Ignore check failed for file %s: %s; keeping hitc D g | ] }|j | S rH )orig_file_pathexistsrC r s rE rp z(Cleanup._clean_files.. s= # # #'..00## # #rG c g | ]}|v| S rH rH rC r
preflight_sets rE rp z(Cleanup._clean_files.. s* q
/E/EA/E/E/ErG c g | ]}|v| S rH rH r s rE rp z(Cleanup._clean_files.. s# N N NAq
7M7Ma7M7M7MrG r c g | ]}|v| S rH rH r s rE rp z(Cleanup._clean_files.. s* ! ! ! 0F0FA0F0F0FrG c g | ] }|j
S rH r rB s rE rp z(Cleanup._clean_files.. s ;;;sS];;;rG c g | ] }|j
S rH r rB s rE rp z(Cleanup._clean_files.. s 999sS]999rG zCleaning files: %sz)Can't clean files for non panel user uid=z, since license is limitedz#Cleanup failed. License restriction)
r< resultr r errorrf rg rh ri argsz Can't find username for uid=z. Skip cleanup)softr rj )%r rq r4 r r r) r r% rA r r ry r setr r0 r debuguuiduuid4hexr r3 r is_unlimitedr rR r r MalwareCleanupr2 warningr rT startConfig CLEANUP_TRIM) rV r< r rf rg rh ri rj r user_hits_blackuser hits_regular
hits_black
user_hits_allfiltered_hits_regularrD r filtered_hits_blackpreflight_not_existfilesblackr r uidusernamer r cmdr s @rE _clean_fileszCleanup._clean_filese s OOD)) //)/r::2i2/2 { { D$==r22L(,,T266J (: 5M %' !#
6
6
6 . >s} M MMMMMMM :"-se5E5KLLLL-44S999 6 6 6$$J
*00555555556 #% !
4
4 4 . >s} M MMMMMMM 8"-se5E5KLLLL+223777 4 4 4$$J
(..s33333333
4 1L,J# #%
2# # #
#
#$7 8 8
+ O N N N N N N
+,?@@@#-' '
! ! ! ! ,! ! !
;;l;;;E99j999E LL-uu} = = = )JikkGd||
!.00 LL3 3 3 3 *44#2!.#%'1$+"G"'&/(3$+!#
*=c*B*B$B$B$B$B$B$BB NNG3GGG "":w
FF F F F F F F F'+}':':( + (; ( ( " " " " " " FE3 *,,*&! ) # ' + #
]{ { s2 1AC
D6D DAE11
F;;6F66F;c K | j rd S | j j s| j d S d| _ t j d 5 | }|D ],\ }}}}}}}| ||||||| d {V - d| _ n # d| _ w xY w d d d d S # 1 swxY w Y d S )NTr6 )r rf rg rh ri rj F) rP rS r< resetr r r r r
) rV datar r rf rg rh ri rj s rE _cleanupzCleanup._cleanup sv = F{ K F
"
"9
-
- & &
&0022 ! ++ "+ #"+$/ '&3 , & !&
%%%%
- & & & & & & & & & & & & & & & & & &s+ CAB' C' B00CCC c > K | d {V d S r@ )r rU s rE r6 zCleanup.cleanup s, mmoo rG )NNNNNN) __name__
__module__ __qualname__rW r] r` rc r r MalwareCleanupTaskr r staticmethodlistr r' r rt floatr r rw rx r{ r r r r r
r r r6 rH rG rE rL rL i s > > >
7 7 7 VK *++(
$ (
(
(
,+(
T ' ' $_ 5 ' tTz ' ' ' \ ' #(
d
t
$
2
2
2
h
> \ 6: : : H H H HT & & &B _Q rG rL c e Zd Zej Zd Zd Zed de e
de fd Z e
ej d Zd ZdS )
ResultProcessorc
K d S r@ rH r_ s rE r` zResultProcessor.create_sink ra rG c K || _ d S r@ )rR r\ s rE r] z ResultProcessor.create_source s
rG Nr< r7 c X t j | || | D ]}||_ ||_ d S r@ )r) r r7
cleaned_at)r< r7 r rD s rE _set_hit_statusz ResultProcessor._set_hit_status s@ dFJ777 ( (C CJ 'CNN ( (rG c K |d }|d | d }| d }t j }fd|D }fd|D }| d }|rLd |d d D } t d
t | t | || |r+r)t d |t g }
t |d
2 3 d {V } | rD| j r| | P|
| f6 g } |D ]F} | j s|
| 1| | G| }t j ||| d {V fd|D }
t j |
|| d {V |
|
t j | fd|D }t j ||| d {V fd|D }t j ||| d {V |
|t j | fd|D }t j ||| d {V |
|t j | t+ j |
t j |
|| d {V t/ || D ]\ }}|
|| | | d {V |S )Nr< r rf rg c g | ]}|v | S rH rH rC rD r s rE rp z0ResultProcessor.store_result..- s :::SC6MMSMMMrG c g | ]}|v| S rH rH r$ s rE rp z0ResultProcessor.store_result... s# @@@sc.?.?s.?.?.?rG r c g | ] }|j
S rH r r s rE rp z0ResultProcessor.store_result..2 s ;;;aak;;;rG z=Cleanup: %d/%d hits unmatched in result (error=%r, sample=%s)uC Cleanup: partial failure — error=%r but %d result entries presentd r r c H g | ] }| | S rH ) requires_myimunify_protectionr$ s rE rp z0ResultProcessor.store_result..] s? )
)
)
c{88::)
)
)
)
rG c H g | ] }| | S rH ) is_failedr$ s rE rp z0ResultProcessor.store_result..k s. FFF#fSk.C.C.E.EF#FFFrG c H g | ] }| | S rH )
is_cleanedr$ s rE rp z0ResultProcessor.store_result..p . HHH3vc{/E/E/G/GH3HHHrG c H g | ] }| | S rH )
is_removedr$ s rE rp z0ResultProcessor.store_result..v r/ rG )rq r ry r rr r r r r r r0 cleanup_unable%cleanup_requires_myimunify_protectionr! r% %CLEANUP_REQUIRES_MYIMUNIFY_PROTECTIONr cleanup_done CLEANUP_DONEcleanup_removedCLEANUP_REMOVEDr) r r r "send_failed_to_cleanup_hits_to_mrs)rV rd r< rf rg now processed unprocessedr sampler rD still_unprocessedr* r cleanedremovedr7 r r s @rE store_resultz ResultProcessor.store_result% s !( ' 1 G$$KK ,, ikk::::D::: @@@@d@@@ G$$ ;;;rr?;;;F NN)K D
V NN1F
&ySAAA * * * * * * *# c{$$&&
*%,,.. * &&s++++ $$S))) B . .C%,,..
. %%%%!((----' * u
)
)
)
)
)
)
)
%
A ))
) B
GFFFFFF* %9
IHHH)HHH( 5I
W&6&CSIIIHHHH)HHH+ 5I
W&6&FLLL#I...% Ui
!1f E E K K M M 3 3 FH 6 2 2 2 255f=========s E6c
K |r~| j t j d |D d d {V | j t j d |D d d {V d S d S )Nc L g | ]!}t j |j |j "S rH )r1 HitInfor hashrB s rE rp zFResultProcessor.send_failed_to_cleanup_hits_to_mrs.. s9 )0 II rG cleanup_failure_current)r<
upload_reasonc g | ];}t j t t j | |j . sR
)0 A# F F G G H rG cleanup_failure_original)rR r r MalwareMRSUpload)rV failed_to_cleanup_hitss rE r9 z2ResultProcessor.send_failed_to_cleanup_hits_to_mrs s ! *,,, #9 #<
*,,,
$: #=
rG r@ )r r r r AVSCOPEr` r] r r r) rI r! r r r rA r9 rH rG rE r r s HE
( (d: . ( ( ( ( \( VK &''` ` ('`D rG r c e Zd ZdZd Zd Zd Zd Z ee j
e j d Z
eedee d Zd
S ) StorageControllerz'Remove old backed up files from storagec 6 d | _ t j | _ d S r@ ) _clear_taskr CLEANUP_KEEP_keeprU s rE rW zStorageController.__init__ s (
rG c b K | | | _ d S r@ )r[ daily_clearrS r_ s rE r` z StorageController.create_sink s. ++D,<,<,>,>??rG c P K | j r t | j d {V d S d S r@ )rS r rU s rE rc zStorageController.shutdown sD 5"4#344 4 4 4 4 4 4 4 4 4 5 5rG c | K t j }|| j t z z
}|| j dz t z z
}t j t j |k t j | d {V }|r t d| d S d S )Nr z/Cleanup storage have cleaned. Files removed: %s) r rU r r) deletewherer executer$ clearry rz )rV r: keep_hits keep_origcleareds rE _clearzStorageController._clear s ikk$*s** 4:>S00 !!*"7)"CDDLLNNN&,Y77777777 KKA7
rG c K | j t j k r-t j | _ | d {V d S d S r@ )rU r rT ra )rV _s rE config_updatedz StorageController.config_updated sP :, , , ,DJ++-- - ,rG T)check_period_firstcheck_lock_period lock_filec > K | d {V d S r@ )ra rU s rE rW z StorageController.daily_clear s. kkmmrG N)r r r __doc__rW r` rc ra r r ConfigUpdater
log_error_and_ignorerd r r r LOCK_FILErW rH rG rE rQ rQ s 11) ) )@ @ @5 5 5 VK $%% U !! "! &%
_
rG rQ c T t j sdS | | dk st | r|S dS )z. sZ
U ""
',&6&6&8&8
II
rG r )superrA r r/ update_sa_hits)rV rd to_remove __class__s rE rA z!ResultProcessorIm360.store_result s ,,W55555555
%h / 5 5 7 7
"0Y???????????rG ) r r r ri r IM360rO r r r rA
__classcell__)rx s @rE rq rq sl
KE VK &''@ @ @ @ ('@ @ @ @ @rG rq c ^ e Zd Zej Zd Zed Zd Z d Z
e e j
d Z e e j d Z e e j de j fd Z e e j d Z e e j de j fd
Zd S ) CleanupDbc d | _ d S r@ )rQ rU s rE rW zCleanupDb.__init__ s
rG c K t j j }t || | d {V d S r@ )r r r r+ r )r app_namer s rE _start_cleanerzCleanupDb._start_cleaner sJ Z\\%
$Zx@@FFHHHHHHHHHHHrG c K t j sWt j t j x} d S t d|j
|j |j t j
|gt j | |j
|j d {V d S )NzCleaning hit: (%s::%s::%s))r) db_hits_under_cleanupr db_hits_pending_cleanuporder_byr ascfirstry rz r r r r r% r r )rV next_hits rE
_cleanup_nextzCleanupDb._cleanup_next s , . . 5 5 7 7 ' > @ @*.224455
F ( M
xj*:*JKKK!!("4h6GHHHHHHHHHHHrG c L K || _ | d {V d S r@ )rQ r r_ s rE r` zCleanupDb.create_sink s7
"""""""""""rG c K t j |d }t | }d |D }|sd S t j |t j | d {V d S )Nr< c F g | ] }|j t j j k | S rH )rm r& DBro rB s rE rp z2CleanupDb.process_cleanup_task.. s7
$;$>$DDD
DDDrG )r) rs rJ r r% CLEANUP_PENDINGr )rV rd r< r db_hitss rE r z CleanupDb.process_cleanup_task s &wv77(..
$
F g'7'GHHH """""""""""rG c K |d }t | } | d {V }nT# t $ rG t d| Y t j t |j d d S w xY w t j t |j d n-# t j t |j d w xY wt j
| d {V d S )Nri z;Cannot complete cleanup %s, assuming it is already completeT
ignore_errors) r, completer* ry r shutilrmtreerI detached_dirr rZ r )rV rd clean_iddetached_cleanupcleanup_outcomes rE parse_cleanup_resultsz CleanupDb.parse_cleanup_results sP 9%-h77 $4$=$=$?$? ? ? ? ? ? ?OO' NNM
M$122$
M$122$
FM$122$
f$$_55555555555& 6 B4 %BB4 BB4 4*C rd c B K t j |j }t j |j }t j |t
j t j t j |t
j | d {V d S r@ )
r) db_hits_under_cleanup_inr r r r% r6 r rA r )rV rd cleaned_hits failed_hitss rE update_cleaned_hits_statusz$CleanupDb.update_cleaned_hits_status. s ":7;LMM 9'.II *7
k+;+ABBB """""""""""rG c K t j }t j |t j | d{V dS )zc
Clear the queue when the cleanup fails,
set hits' status back to infected
N)r) r r r% rA r rV rd r< s rE update_failed_hits_statusz#CleanupDb.update_failed_hits_status: sW /11 d$4$:;;; """""""""""rG c K d }d }t j |j }t j ||| d {V t j |j }t j ||| d {V d S )Nr )r) get_db_hitsr r0 r5 r r )rV rd rf rg r r s rE save_cleanup_events_in_historyz(CleanupDb.save_cleanup_events_in_historyF s !-g.?@@ (
!,W^<< * u
rG N)r r r r ry rO rW r r r r` r r r r MalwareCleanCompleter MalwareDatabaseCleanupr MalwareDatabaseCleanupFailedr r rH rG rE r| r| sV KE I I \II I I(# # # VK *++ # # ,+ # VK ,--6 6 .-6$ VK .// #"9 # # # 0/ # VK 455 # # 65 # VK .//
"9
0/
rG r| c v e Zd Zej Zd Zed Zd Z ede
e de
e fd Z e
ej defd Z e
ej d Z e
ej d
Z e
ej d Z e
ej d Zd
S )RestoreOriginalDbc d | _ d S r@ )rY rU s rE rW zRestoreOriginalDb.__init__Y s
rG c 8 K t j sWt j t j x} d S | j t j
k r| j nd }t
d| j | j | t! | j | j | d {V t j | gt j d S )Nz(Restoring from cleanup hit: (%s::%s::%s))r r signature_id)r) db_hits_under_cleanup_restorer db_hits_pending_cleanup_restorer r r r r7 r% CLEANUP_REMOTE_RESTORE_PENDINGr ry rz r r r. restorer CLEANUP_RESTORE_STARTED)hit_to_restorer s rE
_restore_nextz RestoreOriginalDb._restore_next\ sE
4 6 6 = = ? ? >@@ Xj 2 6 6 8 899UWW
F $ >? ?
' ' 6 $ #
% )#,%
'))
. F
rG c L K || _ | d {V d S r@ )rY r r_ s rE r` z RestoreOriginalDb.create_sink s7 """""""""""rG r< r= c d | D S )Nc 3 D K | ]}|j t j k |V d S r@ )r7 r% r rB s rE rF z:RestoreOriginalDb._filter_under_restore.. s?
z - EEE
EEEE
rG rH rI s rE _filter_under_restorez'RestoreOriginalDb._filter_under_restore s#
rG rd c K t j t j |j k t j |j k }t j }|j r4| t j |j k }t j
}t j || | d {V d S r@ )
r) r r[ r r r r% CLEANUP_RESTORE_PENDINGr r r r r )rV rd queryrestore_statuss rE queue_db_restorez"RestoreOriginalDb.queue_db_restore s
U:'7<7
8
8
U:&'*::
;
;
*A MKK
73G GHHE - LN
"""""""""""rG c K |d }t | } | d {V }nT# t $ rG t d| Y t j t |j d d S w xY w t j t |j d n-# t j t |j d w xY wt j
| d {V d S )Nri z;Cannot complete restore %s, assuming it is already completeTr ) r- r r* ry r r r rI r r rZ r )rV rd
restore_iddetached_restorerestore_messages rE parse_restore_resultsz'RestoreOriginalDb.parse_restore_results sP Y'
-j99 $4$=$=$?$? ? ? ? ? ? ?OO' NNM
M$122$
M$122$
FM$122$
f$$_55555555555r c K t j |j }t j | | t
j | d {V d S r@ )r) r r r r r% rA r )rV rd
restored_hitss rE update_restored_hits_statusz-RestoreOriginalDb.update_restored_hits_status sq ".w/@AA
& &} 5 57G7M
"""""""""""rG c F K | d }| d }t j |j }|D ]^}t j |j |j t j j
|j |j |||j
|j |j |j d {V _t j |j }|D ]^}t j |j |j t j j
|j |j |||j
|j |j |j d {V _d S )Nrf rg ) r r rm
file_owner file_userrg rf db_hostdb_portdb_namer )rq r) r r r0 cleanup_restored_originalr r r& r ro r9 r r r r r r cleanup_failed_restore)rV rd rf rg r rD r s rE save_restore_events_in_historyz0RestoreOriginalDb.save_restore_events_in_history sc G$$KK ,, ".w/@AA
C 9] 5 8 > 9 (# -
!,W^<<
C 6] 5 8 > 9 (# -
rG c K t j }t j |t j | d{V dS )zg
Clear the queue when the restore fails,
set hits' status back to cleanup_done
N)r) db_hits_under_restorationr r% r6 r r s rE r z+RestoreOriginalDb.update_failed_hits_status sW 355 d$4$ABBB """""""""""rG N)r r r r ry rO rW r r r` r r) r r r r r MalwareRestoreCompleter r. r r MalwareDatabaseRestoreFailedr rH rG rE r r V sj KE #
#
\#
J# # #
z"
*
\
VK 233#.H # # # 43#" VK .//6 6 0/6( VK .//# # 0/# VK .//" " 0/"H VK 455# # 65# # #rG r )iri r r r r r functoolsr loggingr pathlibr typingr r r r defence360agentr
defence360agent.apir defence360agent.contracts.configr r r
%defence360agent.contracts.hook_eventsr !defence360agent.contracts.licenser "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr !defence360agent.contracts.pluginsr r r &defence360agent.internals.global_scoper 'defence360agent.subsys.persistent_stater defence360agent.utilsr r r r r defence360agent.utils.check_lockr defence360agent.utils.commonr r r imav.contracts.messagesr imav.malwarelib.cleanup.cleanerr! r" r# imav.malwarelib.cleanup.storager$ imav.malwarelib.configr% r& r' imav.malwarelib.modelr( r) imav.malwarelib.scanr* imav.malwarelib.scan.mds.cleanerr+ !imav.malwarelib.scan.mds.detachedr, r- imav.malwarelib.scan.mds.restorer. imav.malwarelib.subsys.malwarer/ r0 imav.malwarelib.utilsr1 imav.malwarelib.utils.user_listr2 r3 r4 r ry r AV_IM360rl group_by_attributer r r r r rJ rL r rQ r rq r| r rH rG rE r sq *
. . . . . . . . . . . . ! ! ! ! ! ! * * * * * * < ; ; ; ; ; 8 8 8 8 8 8 : : : : : : N N N N N N
5 4 4 4 4 4 F F F F F F 8 7 7 7 7 7 @ @ @ @ @ @ @ @ @ @ > > > > > >
; : : : : :
= < < < < < < < 9 9 9 9 9 9 C C C C C C D C C C C C M M M M M M M M 2 2 2 2 2 2 4 3 3 3 3 3 8 '( $ y%. 9 9 7:8HMMM 6'JJJDjjV^DDD
L
I8J/ IH I I I Ii i i i i k= i i i X
I I I I Ik= I I IX' ' ' ' ' ' ' ' T @ @ @ @ @? @ @ @$j
j
j
j
j
j
j
j
ZV# V# V# V# V# V# V# V# V# V#rG