/lQ d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddl
m Z edd Z ej
e Z G d d Z G d d
ZdS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
)
namedtupleN)sysctlEvent)pathflagscookienamewdc e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZd ej dk rdnd Z e j e d Z e j! d Z"e#d Z$e#d Z%e#d Z&e#d! Z'e#d" Z(e#d# Z)d$S )%InotifyzE
Tiny wrapper for inotify api. See `man inotify` for details
@ i i i i @ i i i i i i @l zlibc.{}Darwinzso.6dylibT) use_errnoiIIIc t t j | | }|dk r5t j }t |t
j | |S )a
Wrapper to all calls to C functions. Raises OSError with appropriate
errno as argument in case of error return value.
:param method: method to call
:param args: method args
:return: called function return value in case of success
)getattrr _libcctypes get_errnoOSErrorosstrerror)methodargsreterrnos T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/subsys/ainotify.py_callz
Inotify._callI sR -ggmV,,d3 "99$&&E%U!3!344 4
c 6 t d S )z
Initialize an inotify instance.
See `man inotify_init` for details
:return: a file descriptor of new inotify instance
inotify_initr r) r* r( initz Inotify.initX s }}^,,,r* c < t d| || S )a
Add a watch to an initialized inotify instance. This method is
idempotent. If called twice with the same :fd: and :path: and
different mask, will change watch flags of current watch.
See `man inotify_add_watch` for details
:param fd: file descriptor returned by `init()`
:param path: path to file or directory to watch
:param mask: bitmask of events to monitor
:return: file descriptor of watch
inotify_add_watchr- )fdr masks r( add_watchzInotify.add_watcha s }} 0"dDAAAr* c : t d| | S )z
Remove existing watch from inotify instance.
:param fd: file descriptor of inotify instance
:param wd: watch file descriptor, returned by `add_watch()`
:return: zero
inotify_rm_watchr- )r2 r
s r( rm_watchzInotify.rm_watcho s }} /R888r* c @ t j | S )z
Unpacks prefix of event struct.
See `man inotify` for details
:param data: struct bytestring
:return: tuple of (wd, flag, cookie, length)
)r event_prefixunpackdatas r(
unpack_prefixzInotify.unpack_prefixy s #**4000r* c ~ t j dt | z | d d S )z
Unpack name field of inotify event struct
See `man inotify` for details
:param data: struct bytestring
:return: name string
z%dsr )structr: lenrstripr; s r( unpack_namezInotify.unpack_name s4 }USYY .55a8??HHHr* N)*__name__
__module__ __qualname____doc__ACCESSMODIFYATTRIB CLOSE_WRITE
CLOSE_NOWRITEOPEN
MOVED_FROMMOVED_TOCREATEDELETE DELETE_SELF MOVE_SELFUNMOUNT
Q_OVERFLOWIGNOREDONLYDIR DONT_FOLLOW EXCL_UNLINKMASK_ADDISDIRONESHOTformatplatformsystem_nr CDLLr r@ Structr9 staticmethodr) r/ r4 r7 r= rC r. r* r( r r ' s F
F
FKM DJH
F
FKIGJGGKKH EG OHO$5$5$A$A&&w O OB FKd + + +E 6=((L \ - - \- B B \ B 9 9 \9 1 1 \1 I I \I I Ir* r c Z e Zd ZdZdZdZdZdZddZd Z d Z
d
Z d Z d Z
d
Zd Zd ZdS )Watcherz1
Asynchronous watcher for inotify events
r g ?zfs.inotify.max_user_watchesNc || _ t | _ t j | _ |p | j j | _ | j | j | j
| d S N) _loopr r/ _fdasyncioQueue_queueput _callback
add_reader_read _reset_state)selfloop
coro_callbacks r( __init__zWatcher.__init__ si
<<>> moo &9$+/
dh
333 r* c 0 i | _ i | _ d| _ d S )Nr* )paths descriptorsbufrs s r( rr zWatcher._reset_state s
r* c F | xj t j | j | j z
c_ t
j j }t | j |k rIt
| j d | \ }}}}||z }t
| j || }| j |d | _ || j vr| j | }|t
j z r1t d| | | |t
j z r t d t% ||||| } | j | | t | j |k Gd S d S )Nz(Got IGNORED event for %s, cleaning watchzInotify queue overflow)rz r" readrj _CHUNK_SIZEr r9 sizerA r= rC rx rV loggerwarning_cleanup_watchrU errorr ri create_taskro )
rs struct_sizer
r r length
struct_endr r evs
r( rq z
Watcher._read s BGDHd&6777 */ $(mm{**(/(=(= + &) ) %Bvv %v-J&&tx J0F'GHHDx
,DH##:b>Dw&
> ##D)))w))
5666tUFD"55B J " "4>>"#5#5 6 6 6/ $(mm{******r* c t j | j }|t || j z z }t
d| j | t j | j | d S )NzRaising %s to %s)r r} _MAX_USER_WATCHESint_WATCHERS_RAISE_COEFFr infowrite)rs current_max_watchesnew_max_watcherss r( _raise_user_watcheszWatcher._raise_user_watches sx $k$*@ A A. $"< <2
2
68H
T+-=>>>>>r* c | j | j t j | j | d| _ dS # | d| _ w xY w)za
Close watcher. Close inotify fd, remove reader and reset state
:return:
N)ri
remove_readerrj r" closerr r{ s r( r z
Watcher.close st
*** HTX DHHH
DHOOOOs A A4c t |t s
J d t d| d} t | j || }|| j |< || j |< dS # t $ rz}|| j
k rN|j t j k r9|
|dz
}t d| Y d}~t d| d}~ww xY w) z
Add file to watch
:param path: file or directory to watch
:param mask: events mask for this watch
zPath must be bytesz Watching %rr Tr
z-Inotify: not enough watches (%r), retrying...Nz Inotify failed while watching %r)
isinstancebytesr r r r4 rj rx ry r! _MAX_WATCH_RETRIESr' ENOSPCr r r )rs r r3 retriesr
es r( watchz
Watcher.watch s $&&<<(<<<& M4(((
&&txt<<!%
2)+ &
d 5555<//,,...qLGNNG HHHH ?FFF
s 5A6 6
C: AC5 C55C:c z | j |d }| | j |d d S d S rh )ry poprx )rs r
descriptors r( r zWatcher._cleanup_watch sD %))$55
! JNN:t , , , , , " !r* c || j vrdS t d| t | j | j | | | dS # | | w xY w)zq
Remove file or directory from watch
:param path: file or directory to remove watch from
NzStop watching %r)ry r r r r7 rj r )rs r s r( unwatchzWatcher.unwatch s
t' ' ' F &--- & TXt'7'= > > > % % % % %D % % % %s +A* *Bc ~ K | j d{V }t d| |S )zF
Get watch event
:return: `Event` named tuple
NzInotify event: %s)rm getr debug)rs events r( get_eventzWatcher.get_event sE
koo'''''''' (%000 r* rh )rD rE rF rG r~ r r r rv rr rq r r r r r r r. r* r( re re s K 5
7 7 7:? ? ?
:- - -
& & & r* re )rG collectionsr rk r r' loggingr" r@ r^ defence360agent.subsysr r getLoggerrD r r re r. r* r( r s * # " " " " "
) ) ) ) ) )
7 EFF
8 $ $dI dI dI dI dI dI dI dIN@ @ @ @ @ @ @ @ @ @r*