T1)q d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZmZmZ ddlZddlmZmZmZ ddlmZ dd lmZ dd
lmZ dd l m Z dd l m Z dd
l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z' ddl(m)Z)m*Z* ddl+m,Z,m-Z- ddl.m/Z/m0Z0m1Z1 ddl2m3Z3m4Z4 ddl5m6Z6m7Z7 ddl8m9Z9 dZ: ej; e< Z= G d de> Z? G d de/ Z@ G d de/ ZA G d d e/ ZBe
G d d ZC G d d e0e ZD G d! d"eDe1 ZE G d# d$eDe ZF G d% d&eF ZG G d' d(eF ZHdS ))u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)ABC) dataclass)Path)ListOptionalType) MDSReportMessage
ScanFailed)g)TheSink)
hosting_panel)rmtree) to_thread)MalwareCleanCompleteMalwareDatabaseCleanup MalwareDatabaseCleanupFailedMalwareDatabaseRestore MalwareDatabaseRestoreFailedMalwareDatabaseScanMalwareRestoreComplete)ExitDetachedScanTypeMalwareScanResourceType)ScanAlreadyCompleteError
ScanInfoError) DetachedDirDetachedOperation DetachedScan)MDSMDS_PATH)MalwareDatabaseHitInfo scan_report)trim_file_content c e Zd ZdS )DetachedOperationFailedN)__name__
__module__ __qualname__ V/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/mds/detached.pyr& r& O s Dr+ r& c P e Zd ZU dZeed< eed< eed< i ej ddddZdS ) MDSDetachedScanDirz /var/imunify360/dbscan/run/scan ignore_file report_filescan_info_fileignorezscan_info.json)r/ r0 r1 Nr' r( r) DETACHED_DIRr __annotations__r FILESr* r+ r, r. r. S sc 4L
$*
EEEr+ r. c 8 e Zd ZU dZeed< i ej ddiZdS )MDSDetachedCleanupDirz /var/imunify360/dbscan/run/cleanr0 Nr3 r* r+ r, r8 r8 b sB 5L
}
EEEr+ r8 c 8 e Zd ZU dZeed< i ej ddiZdS )MDSDetachedRestoreDirz"/var/imunify360/dbscan/run/restorer0 Nr3 r* r+ r, r: r: m sB 7L
}
EEEr+ r: c \ e Zd ZU ee ed< dZedz ed< dZedz ed< dZe ed< dS )
DbScanInfocmdN scan_type initial_pathr started)
r' r( r) r strr5 r> r? r@ intr* r+ r, r< r< x sW
cNNN IsTz #L#*###GSr+ r< c & e Zd Zddef fd
Z xZS )MDSDetachedOperationr returnc H t | S )N)
start_time)superget_detached_process_state)selfrG __class__s r, rI z/MDSDetachedOperation.get_detached_process_state s ww11Z1HHHr+ )r )r' r( r) rA rI
__classcell__)rK s @r, rD rD sU I I# I I I I I I I I I Ir+ rD c V e Zd ZeZed Zd Zd Zed Z ed Z
ed Z de e
fdZd Zedefd
Zdefd Zej fd Zej d
ddddddddedede e de e de e de e e dededdfdZ dS )MDSDetachedScanc t j S N)r DBrJ s r,
RESOURCE_TYPEz MDSDetachedScan.RESOURCE_TYPE s &))r+ c > | j j S rP ) detached_dir done_fileexistsrR s r, _is_scan_finishedz!MDSDetachedScan._is_scan_finished s *11333r+ c | j j 5 }t j | cd d d S # 1 swxY w Y d S # t
t j f$ r i cY S w xY wrP )rU
progress_fileopenjsonloadFileNotFoundErrorJSONDecodeError)rJ fps r, _get_progress_infoz"MDSDetachedScan._get_progress_info s "05577
%2y}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%!4#78 III s3 A A A AA A A A)(A)c | } t t |d S # t $ r | rdndcY S w xY w)N
progress_maind r )ra rB floatKeyErrorrX )rJ
progress_infos r, progresszMDSDetachedScan.progress so //11
:u]? ;<<== = : : : 0022933 9 9 9 :s !8 "A A c P | j dk rdS d t S )Nr z avd scanningz {} scanning)rh formatr rR s r, phasezMDSDetachedScan.phase s( =A !> ##C(((r+ c t t | d S # t $ r Y dS w xY w)Ntotal_db_countr )rB ra rf rR s r, total_resourcesz MDSDetachedScan.total_resources sI t..001ABCC C 11 s &)
77rE c ~ | j j 5 }t j | }d d d n # 1 swxY w Y | j j j }n # t t j f$ r Y d S w xY wt |d |d |d t | S )Nr= r> r? )r= r> r? r@ ) rU r1 r[ r\ r] pathstatst_mtimer^ r_ r< rB )rJ r` infor@ s r, _load_scan_infoz MDSDetachedScan._load_scan_info s "16688
%By}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%',11338w+> >ur+ c K x}t t |j |j j |j } fd j j d D }nj# t $ r
}t |d }~wt $ rH}t d | t! | |cY d }~S d }~ww xY w|s| d |S |D ]=}t# | j }t$ j | d {V >t+ | j d {V }| | |S )N)argsrp scan_idtypec : g | ]} | S r* rx ).0r0 rJ s r,
z,MDSDetachedScan.complete.. s7 ((55 r+ report*.jsonzUnable to parse MDS reportzNo reports foundr )rt r r r= r? detached_idr> rU rp globr^ r Exceptionlogger exceptionupdate_with_errorrA r r sinkprocess_messager" update_with_report)rJ scan_infomessagehit_report_listereport
report_msg
result_reports ` r, completezMDSDetachedScan.complete s --// /I 8 % '$$
#'#4#9#>#>~#N#N OO ! 2 2 2* 1 9 : : : % %c!ff - - -NNNNNN
% %&8 9 9 9N% 5 5F"643CDDDJ&((44 4 4 4 4 4 4 4 4 )/4;K L LLLLLLL
""=111s* +A5 5
C ?B
C =CC C c @ K d } | t z } | |k r^ | }nk# t t f$ r&}t j d d {V |}Y d }~nd }~ww xY w | |k ^t d| j | d S t j
| }| | r| d S d S # t j
$ r&}t d| Y d }~d S d }~ww xY w)N zICannot find the mds process to kill (%s): %r. Assuming it's already dead.z0Problem when killing the running mds process: %s)MDS_PID_WAIT_TIMEget_pidr^
ValueErrorasynciosleepr warningr psutilProcessr killError)rJ timererrordeadlinepiderrr s r, kill_running_scan_processz)MDSDetachedScan.kill_running_scan_process sv 577 ..egg
llnn%z2
mA&&&&&&&&&
egg
NN/
F >#&&D''--
| NNBC
s- ; A2 A--A2'=C( (D 7DD TN ) exit_typer scan_pathr> scan_startedr= outr r r r r> r r= r r c K |r| d{V | pt g }
|p|
j }|p|
j }|p|
j }t
|p|
j }| t |||| j
||t
t j d{V | j } |t j k rt | j p|} t | j p| }
t% }| |d< |
|d< t& d| j
| |
||d< d|d < | j
|d
< ||d < | | d{V | j s t& d | dS t/ t1 | dS )
a Removes aborted detached scan from scan_queue and writes it to DB.
- Parses data about scan from scan_queue and writes it to DB
- Kills scan process, if it exists
- Deletes scan_dir
- Processes MalwareScan and ScanFailed(in case of 'ABORTED') messages
:param sink: the sink to send messages
:param exit_type: 'ABORTED' by default,
if stopped by user, then 'STOPPED'
:param kill: try to kill a process
:param scan_path: which path was scanned
:param scan_type: what is the scan's type
:param scan_started: when was the scan started (if known)
:param cmd: command line arguments
:param out: command stdout
:param err: command stderr
N)r= )r r rp r r r@ completedr r zScan %s was aborted: %s, %scommandabortedr r rp zNo such directory: %s)r rt r< r= r? r> rB r@ r r r timerU r ABORTEDr# log_fileerr_filer r r rp is_dirr rA )rJ r r r r r> r r= r r r scan_dirstdoutstderrmsgs r, handle_aborted_processz&MDSDetachedScan.handle_aborted_process s > 30022 2 2 2 2 2 2 2((**@jR.@.@.@ "Y] 7!7 4!4 <<9+<== "" ( $ dikk**
$ ,4 4 4&x'899@SF&x'899@SF ,,C CJ CJ NN-t/?
!C N &C N ! -C N#CK&&s++ + + + + + + +}##%% " NN2H = = = = = 3x== ! ! ! ! !r+ ) r' r( r) r. DETACHED_DIR_CLSpropertyrS rX ra rh rk rn r r< rt rx classmethodboolr r r r monotonicr r r rA re r r r* r+ r, rN rN s )
* * X*4 4 4 : : X: ) ) X)
X
*!5
$ [ ! 3 ! ! ! !F 59N > .5#'#'(,#'E" E" E" E"
E" C=
E" C=E" uoE" d3i
E" E" E"
E" E" E" E" E" E"r+ rN c n e Zd ZU dZee ed< ee ed< defdZed Z de
fdZ dS ) MDSDetachedMutableOperationz=Parsing of operations that can succeed or fail for any DB hit SUCCESS_MSGFAIL_MSGrE c K i } fd j j d D } | d {V }|s d j d S |D ]=}t
| j }t j
| d {V > j |d< j d i |S # t $ r
}t |d }~wt $ rb}t | |d< t d j d
t | cY d }~S d }~ww xY w) Nc : g | ]} | S r* r )r r rJ s r, r z8MDSDetachedMutableOperation.complete..T s7 ((00 r+ r zNo z reports foundr r r r zUnable to parse MDS z reportr* )rU rp r
_parse_reportr NAMEr r r r r r r^ r r& rA r r )rJ r r r r r s ` r, r z$MDSDetachedMutableOperation.completeQ s / " / 4 9 9. I I O ! . . ? ???????G #
L}}+J+J+J+J}KKK)
9
9 &vt7G H H H
f,,Z8888888888!%!1GI #4#..g.. . ! 2 2 2* 1& / / / "1vvGG FDI F F F G G G==s1vv=.. . . . . . . /s+ AC
EC
E$AE;EEc | 5 }t j | cd d d S # 1 swxY w Y d S rP rv )r0 rw s r, rx z/MDSDetachedMutableOperation._load_single_reportj s
19Q<< ry c
< K t t j d {V }t t
j d {V }t }t }|D ]}|d x}r3t d| j d| t | |d s-|t t j |||| j
z }t|t t j |||| j
z }||dS )N
error_listzErrors in MDS z: %srows_with_error) succeededfailed)setr HostingPanel get_usersr pwdgetpwallr r r r& r! from_reportr )rJ r users_from_panelpw_allr r r errorss r, r z)MDSDetachedMutableOperation._parse_reporto sI ]%?%A%A%K%K%M%M M M M M M MNN ........EE % F --v
6 =di = = =vFFF-f555+,
S*6 0&$:J #*6 0&$:J '&999r+ N) r' r( r) __doc__r r
r5 r staticmethodrx dictr r* r+ r, r r K s GGg 7m/ / / / /2 \ :d : : : : : :r+ r c e Zd ZdZeZeZeZ e
de fd Z e
j dddededee ddfd Zedefd
ZdS ) MDSDetachedCleanupcleanuprE c , t | j S Nr )r r rR s r, on_complete_messagez&MDSDetachedCleanup.on_complete_message s #$
r+ Nr r r r r c
K |t j k s
J d t d| j | t | j j }t | j j }t d| d| j d| d| }|
| d {V t j t | j j d d S )
Nz;Cleanup cannot be stopped, only aborted status is supportedzCleanup %s was %spath: , detached_id: , out: , err: r T
ignore_errors)r r r rs r r# rU r r r r shutilr rA rp rJ r r r r r r s r, r z)MDSDetachedCleanup.handle_aborted_process s
-5 5 5 5 H
6 5 5
')99EEE"4#4#=>>"4#4#=>>*! ! ! $ 0! ! ! ! ! !
""3'''''''''
c$+011FFFFFFr+ c L |r!| }t |v od|v S dS )Nz--cleanFr{ r} s r, r z&MDSDetachedCleanup.process_is_suitable s2 @llnnGw&?9+? ?ur+ )r' r( r) r r8 r r r r r r r r r r r
rA r r r r r r* r+ r, r r s D,(K+H
%9
X
.5#' G G G G G
C= G
G G G G: $ [ r+ r c e Zd ZdZeZeZeZ e
de fd Z e
defd Zej dddeded ee ddfd
ZdS ) MDSDetachedRestorerestorerE c L |r!| }t |v od|v S dS )Nz --restoreFr{ r} s r, r z&MDSDetachedRestore.process_is_suitable s2 BllnnGw&A;'+A Aur+ c , t | j S r )r r rR s r, r z&MDSDetachedRestore.on_complete_message s %$
r+ Nr r r r c
K |t j k s
J d t d| j | t | j j }t | j j }t d| d| j d| d| }|
| d {V t j t | j j d d S )
Nz;Restore cannot be stopped, only aborted status is supportedzRestore %s was %sr r r r r Tr )r r r rs r r# rU r r r r r r rA rp r s r, r z)MDSDetachedRestore.handle_aborted_process s
-5 5 5 5 H
6 5 5 ')99EEE"4#4#=>>"4#4#=>>*! ! ! $ 0! ! ! ! ! !
""3'''''''''
c$+011FFFFFFr+ )r' r( r) r r: r r r r r r r r r r r r r r
rA r r r* r+ r, r r s D,(K+H$ [
%;
X
.5#' G G G G G
C= G
G G G G G Gr+ r )Ir r r\ loggingr r r abcr dataclassesr pathlibr typingr r r r "defence360agent.contracts.messagesr r
r &defence360agent.internals.global_scoper "defence360agent.internals.the_sinkr
defence360agent.subsys.panelsr defence360agent.utilsr defence360agent.utils.threadsr imav.contracts.messagesr r r r r r r imav.malwarelib.configr r imav.malwarelib.scanr r imav.malwarelib.scan.detachedr r r imav.malwarelib.scan.mdsr r imav.malwarelib.scan.mds.reportr! r" imav.malwarelib.scan.utilsr# r getLoggerr' r r r& r. r8 r: r< rD rN r r r r* r+ r, r s\ *
! ! ! ! ! ! ' ' ' ' ' ' ' ' ' '
5 4 4 4 4 4 6 6 6 6 6 6 7 7 7 7 7 7 ( ( ( ( ( ( 3 3 3 3 3 3
3 2 2 2 2 2 2 2 9 8 8 8 8 8 8 $ $ i K K I I I I I,c I I I
C" C" C" C" C"*L C" C" C"L;: ;: ;: ;: ;:"6 ;: ;: ;:|. . . . .4 . . .b,G ,G ,G ,G ,G4 ,G ,G ,G ,G ,Gr+