w < d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ ej e Zg d
Z g e dddZ g dZ G d d Z d Z d Z! G d d Z" G d d Z#dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
Nwraps)NamedTemporaryFile)AnyDict)uuid4) HookEvent)
hosting_panel)encode_filename)Malware)MalwareScanType)fill_results_owner)
intensity_cpu intensity_io
intensity_ram
detect_elf use_filtersfollow_symlinksexclude_patterns
file_patterns)r r r r r r c : e Zd Zd Zd Zd dZd Zd Zd Zd Z dS )
ScanResultc g | _ d| _ d | _ g | _ d x| _ | _ i | _ || _ || _ || _ d | _
d S )Nr ) scans total_fileserrorerrors _begin_time _end_time_aggregated_results_path_scan_id
_scan_typeargs)selfpathscan_id scan_types U/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/scan_result.py__init__zScanResult.__init__A sV
,004>#%
# c V | j t j t j t j fv S N)r# r
BACKGROUND ON_DEMANDUSERr% s r) is_detachedzScanResult.is_detachedO s( & % #
r+ Nc . |r|| _ |r || _ d S d S r- )r r )r%
begin_timeend_times r) set_start_stopzScanResult.set_start_stopV s/ * )D & %DNNN & &r+ c | j | j | j | j | j | j | j | j d| rd ni d}| j r| j |d d< |S )N)scanidtyper& started completedr r r summaryresultsr= r$ )
r" r# r! r r r r r r2 r$ )r% results r) to_dict_initialzScanResult.to_dict_initial\ s -
+ !^ # / + $ / / 1 19ttr
9 2(, F9 f %
r+ c B | }| j |d< |S )Nr> )r@ r )r% as_dicts r) to_dictzScanResult.to_dictq s$ &&(( !Z r+ c F t t | j | _ | S r- )aggregate_resultlistr r1 s r) _aggregate_resultz ScanResult._aggregate_resultv s %dDJ&788
r+ c f K | t | j d {V | S r- )rG r r r1 s r) getzScanResult.getz s? ,,,,,,,,, r+ )NN)
__name__
__module__ __qualname__r* r2 r6 r@ rC rG rI r+ r) r r @ s
& & & & *
r+ r c B i }| D ]}|d |d | dd |d d}| d r#t d|d | h| |d g |d
|d | d d
| dd
d }| d rd|d< |d r |d | |d d
| |S )N signature
suspiciousextended_suspiciousF timestamp)matchesrP rQ rR ignorez%File match for %s will be ignored: %s file_namesizehashctimer modification_time)hitsrV rW rX rY curableTrZ )rI loggerinfo
setdefaultappendinsert)r aggregated_resultsrecordrS rows r) rE rE sT )+ !+ !+ k* .#)::.CU#K#K ,
::h KK7{#
++ ; v v GQ//%+ZZ0CQ%G%G
::i &!%GI , + K w ' ' ' ' K q' * * * * r+ c d fd}|S )Nc fd D S )Nc 4 i | ]}|t v || S rM )SCAN_HOOK_PARAMS.0optkwargss r)
zAevent_hook.._extract_scan_hook_params.. s* NNNSc=M6M6MVC[6M6M6Mr+ rM rk s `r) _extract_scan_hook_paramsz-event_hook.._extract_scan_hook_params s NNNNFNNNNr+ c F t d fd }|S )Nc
K |pt j }|pt j }
| }|r4t j ||| || } | d {V t j } | f||d| d {V }nk# t j $ r t $ rO} t
d ||| d|t j t | di d}Y d } ~ nd } ~ ww xY w|S )N)r' r( r& r: scan_params)r' r( zScan wrapper task failedr )r8 r9 r& r r: r; r r< ) r hextimer MalwareScanningStartedprocess_messageasyncioCancelledError Exceptionr\ exceptionrepr)
r& r' r( r: rk rq scan_started_event_started scan_resultern fsinks
r) wrapperz)event_hook..wrap..wrapper s ,G ,G33F;;K
?%.%E # ' # + & & &" **+=>>>>>>>>>y{{H
$%A%")Y% %BH% % )
!;<<< #* ) $'(#+%)Y[[!%a "
s B C>/AC99C>NNNr )r r rn r s ` r) wrapzevent_hook..wrap sG q8<' ' ' ' ' ' '
' R r+ rM )r r rn s ` @r)
event_hookr s< O O O+ + + + + +Z Kr+ c \ e Zd Zd Zed Zed Zed Zd ZdS )
DirectAiBolitc d S r- rM )r% ___s r) r* zDirectAiBolit.__init__ s r+ c | K t j r-t j | }||d< d S d S )Ndb_dir)r
RAPID_SCANr
HostingPanelget_rapid_scan_db_dir)home_dir scan_optionsds r) _add_db_dirzDirectAiBolit._add_db_dir sG ' *,,BB8LLA%&L " " " ' 'r+ c fd D S )Nc 4 i | ]}|t v || S rM )DIRECT_SCAN_OPTIONSrh s r) rl z7DirectAiBolit._extract_scan_options.. s1
!$#9L2L2LC2L2L2Lr+ rM rm s `r) _extract_scan_optionsz#DirectAiBolit._extract_scan_options s.
(.
r+ c d| v r&| d d | d | d< d| v r&| d d | d | d< | S )Nr ,r )joinrm s r) _update_scan_optionsz"DirectAiBolit._update_scan_options sm
& ( ()*6),&9K2L)M)MF% & f $ $)@)L&)hhvo/F&G&GF? #
r+ c D t d fd }|S )Nc | K | }|t j t j fv r | | d {V t
| || }| | d||| d| d {V \ |_ |_ t |j |_ |S )Nr4 )r( r' scan_pathr- ) r r r
r0 r. r r r6 r r rF ) r& r' r( r4 rk r r} r r% s r) r z'DirectAiBolit.__call__..wrapper s 44**622 L _ 1?3M NNN&&t\:::::::::$T7I>>K & &* & = = =9::# : :
: : 4 4 4 4 4 4 0K { 0 !%k&7 8K r+ r r r% r r s `` r) __call__zDirectAiBolit.__call__ sA q;?
* r+ N) rJ rK rL r* staticmethodr r r r rM r+ r) r r s
' ' \'
\
\ r+ r c R e Zd Zd ZdefdZed Zed Zd Z dS )PrepareFileListc || _ d S r- )_tmpdir)r% tmpdirs r) r* zPrepareFileList.__init__ s
r+ returnc 6 K | || }|S r- )_write_list_to_file)r% fnamefilesrk r s r) prepare_filez PrepareFileList.prepare_file s! ..ue<< r+ c t | d 5 }d}|D ])}|dz
}| t | *|cd d d S # 1 swxY w Y d S )Nwbr )openwriter )r r r r files r) r z#PrepareFileList._write_list_to_file s
%
!K
/
/q --.... s 0AAAc fd D S )Nc 4 i | ]}|t v || S rM ) SCAN_OPTIONSrh s r) rl z9PrepareFileList._extract_scan_options..% s) JJJSc\6I6IVC[6I6I6Ir+ rM rm s `r) r z%PrepareFileList._extract_scan_options# s JJJJFJJJJr+ c D t d fd }|S )Nc K
| }t | || }| | t
j 5 }
j |j | fi | d {V } |f||d| d {V \ |_ |_ d d d n # 1 swxY w Y ||_ t |j |_ |S )Nr )dir)r( r' ) r r r6 r r r namer r r rF ) r& r' r( r4 rk r r} tfr r r% s r) r z)PrepareFileList.__call__..wrapper( sM 55f==L$T7I>>K & &* & = = =# 555
$5D$5bgt$N$Nv$N$N N N N N N N =>Q>"+W> >@L> > 8 8 8 8 8 84 !;#4
'2K # $k&7 8K s :BB "B r r r s `` r) r zPrepareFileList.__call__' sA q;?
r+ N)
rJ rK rL r* intr r r r r rM r+ r) r r s C \ K K \K r+ r )$__doc__rv loggingrs functoolsr tempfiler typingr r uuidr %defence360agent.contracts.hook_eventsr defence360agent.subsys.panelsr
defence360agent.utilsr imav.contracts.configr imav.malwarelib.configr
imav.malwarelib.utils.user_listr getLoggerrJ r\ r r rg r rE r r r rM r+ r) r s * ' ' ' ' ' ' ; ; ; ; ; ; 7 7 7 7 7 7 1 1 1 1 1 1 ) ) ) ) ) ) 2 2 2 2 2 2 > > > > > > 8 $ $ = = = = = = = =@& & & R1 1 1h2 2 2 2 2 2 2 2j' ' ' ' ' ' ' ' ' 'r+