;lL` ]
d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZ ddlmZmZmZ ddlmZmZ ddlmZ dd lmZ dd
l m Z dd l m Z dd l m!Z! dd
l"m#Z#m$Z$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ej- e. Z/d Z0d Z1d Z2de3fdZ4d Z5d Z6d Z7d Z8d Z9dee:ee e;e f f fdZd!e;d"ee; d#eej? fd$Z@d% ZAd&e;deBfd'ZCde;fd(ZDdS )*u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)Path)AnyDictIterableListLiteralSetTuple)datetime timedeltatimezone)Casefn)
hosting_panel) get_results_iterable_expression) to_thread)AnalystCleanupRequest)AnalystCleanupAPI)MalwareHitStatusMalwareScanResourceTypeQueuedScanState)
MalwareHit MalwareScan)
is_crontab)
CloudwaysUserc d d dddd d d d d d
S )Nr )
userhomeinfected infected_db_infected_totalscan_id scan_date scan_statuscleanup_statusanalyst_status r( T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/utils/user_list.py
stub_entryr+ 4 s/ r) c # K t j D ](} t }| j |d< | j |d< |V )dS )z
Get all system users and initialize a dict for them.
If a user has leftover config files after being deleted then
the panel API might treat him as existent. This is resolved by checking
that a system user is a panel user.
r r N)pwdgetpwallr+ pw_namepw_dir)entryus r* system_usersr3 C sQ LLM& L& r) c K t j d {V fdt D S )Nc ( g | ]}|d v |S r r( ).0r2 userss r*
z panel_users..U s' < < .Z s% 555da! 555r) )allitemsr+ ) user_listkwargsr2 s @r* getrF X sY
5555fllnn555 6 6 HHH <<r) c F d | D }d }t j t j t j d t j t j t j
j k z t j }t j t j t j d t j t j t j
j k z t j }d |D }d |D }t || }|D ]U}t | |j } | | d d | d< t" j j | d
< |j | d < V| D ]\ }
} t | |
} | | d< | D ]} | d | d z | d
< d S )Nc g | ]
}|d S r r( r7 r2 s r* r9 z7update_infected_count_and_last_scan..a * * *1QvY * * *r) c t j t j t j t j t j t j t j t j k t j
| }|S N) r selectscanid completedpathgroup_byhavingr Maxwherein_)_homesqs r* exprz1update_infected_count_and_last_scan..exprc s "K$9;;K
Xk&
'
'
VK)RVK4I-J-JJ
K
K
U;#''//
0
0
r) r r! c ( i | ]}|j |j S r( )r r r7 r1 s r*
z7update_infected_count_and_last_scan.. s NNNU^NNNr) c ( i | ]}|j |j S r( )r r! r[ s r* r\ z7update_infected_count_and_last_scan.. s, */
E% r) rI r r r% r# r6 r" )r rN r r COUNTaliasrU is_infected
resource_typer FILEvaluerR DBr rF rQ r stoppedrO rC ) rD homesrY grouped_hitsgrouped_db_hitsgrouped_hits_dictgrouped_db_hits_dict actual_scansr1 r2 r r! s r* #update_infected_count_and_last_scanrl ` s" * * * * *E */28::+;+;J+G+GHH " $ $'+B+G+MM
O
*/ " "
*/28::+;+;M+J+JKK " $ $'+B+E+KK
M
*/ " "
ON NNN 3B 34??L $ $
+ + +)--ai;;*
*28- |) 1 7 7 9 9 ' 'k % % %&-
@ @ }q /? ?
@ @r) c d | D } || D ]4\ }}t | |j }|j |d< ||d< |j |d< 5d S )Nc g | ]
}|d S rI r( rJ s r* r9 z.update_running_scan_status.. rK r) rI r# r% scan_type)rF rQ rO ro )rD get_scanspathsscanstatusr2 s r* update_running_scan_statusrt sr * * * * *E! %(( ( ( f * * *{) !- + ( (r) c d | D }dt t t d f fd}t || D ]\ }}t | | }||d< dS )a
Updates cleanup status for the list of panel users
If at least on cleanup is running for user then status is 'running'
Else if there are any finished cleanups then status is 'stopped'
If no started and finished cleanups then status is not set
:param user_list:
c g | ]
}|d S r6 r( rJ s r* r9 z)update_cleanup_status.. rK r) r= )runningre Nc
t dt j t j t j f dffd }t dt j t j t j f dffd }t j t j
t dt j | dk dft j | dk dff
d t j
| t j
}| S )z
Returns a list of (user, cleanup_status) tuples where `cleanup_status`
can take one of the values: "running", "stopped", or None
N r rw re r& )r r rs rV r CLEANUP_PENDINGCLEANUP_STARTED CLEANUP_DONECLEANUP_REMOVEDrN r r Sumr_ rU rR tuples)r8 case_running case_stoppedquerys r*
expressionz)update_cleanup_status..expression sQ
%)) , < , <
%)) , 9 , <
--19= --19= %())
U:?&&u--
.
.
Xjo
&
& ||~~ r) r6 r& N)r strr r rF )rD r8 r r rs r2 s r* update_cleanup_statusr s
+ * * * *E1 U30J(K#K L 1 1 1 1 f 8
EJJ % % f % % % $
% %r) c d }t t }| D ]#}||d | $t |t | D ] }||j D ] }|j |d<
d S )Nc h t j t j t j t j | t j t j t j t j k S rM )
r rN rQ rP rU rV rR rS r rT )rf s r* r z)update_last_scan_date..expression sm { /1F G G
U;#''..
/
/
Xk&
'
'
VK)RVK4I-J-JJ
K
K
r) r r$ )r listappendr rQ rP )rD r
home_to_usersr rr s r* update_last_scan_dater s
%%M 1 1d6l#**40000/D '' / / "$), / /D $D // /r) c b | sdS t j t j t d z
d | D }fd}t || }i }|D ]1}|j |v r ||j j |j k r'|||j < 2| D ] }|d }||v r|| }|j |d< !dS )a
Updates cleanup analyst status for the list of panel users.
Checks if users have active cleanup requests (pending or in_progress)
or recently completed requests (within the last 3 days).
:param user_list: List of user dictionaries to update
N )daysc . g | ]}|d
|d S r6 r( rJ s r* r9 z1update_cleanup_analyst_status.. s% ;;;q6;6;;;r) c t j t j t j t j t j t j | t j ddg t j dk t j k z z z t j S )z
Returns a query to fetch active cleanup requests and recently completed
requests for the specified users.
pending in_progressrP )
r rN usernamers last_updated
created_atrU rV order_bydesc)r8 three_days_agos r* r z1update_cleanup_analyst_status..expression s
" (%.%,%2%0
U&/33E:: .488 &
6
/5D 1 > - .
" X+6;;==
>
>1
r) r r' ) r nowr utcr
r r r rs ) rD usernamesr requestsuser_to_requestrequestr2 r r s @r* update_cleanup_analyst_statusr s \(,//)2C2C2CCN <;I;;;I
B /z9EEH O 4 4
/ / 01< ! !
,3()) 1 1V9 & &%h/G").A 1 1r) c t K t d {V }t | t rt j d| d nUt | t
r,t j dd | d nt j d fd|D }t | |fS )Nz.*z^(|z)$c J g | ] } |d | S r6 match)r7 r2 patterns r* r9 z%get_matched_users..D s. FFF1W]]1V9-E-EFQFFFr) )r<
isinstancer recompiler joinlen)r rD
matched_usersr s @r* get_matched_usersr < s !mm######I% #*^%^^^,, E8 $ $ #* 5#((5// 5 5 566*T""FFFF FFFM y>>= ((r) r c K t | d {V \ }}t | t || t | t | t j d {V rt | ||fS rM )r rl rt r r r check_cleanup_allowedr )rp r max_countrD s r* fetch_user_listr H s !25!9!9999999Iy' 222 y)444)$$$)$$$
4
6
6666666 1%i000 i r) r" Tc fd}| || dk r| D ]}| d | S )Nc dv rt nt }|t u rt d nd}| }||}|S )N)r r! r" r$ r )intr chrrF )element
field_typemin_valrc fields r* getterzsort..getterT sc JK K
C '# - -#a&&&1 E"" =E r) )keyreverser" )sortpop)rD r r r r s ` r* r r S sk NNvtN,,, !!! ( (D HH& ' ' ' ' r) rQ users_from_panelpw_allc K t j | }|j x}x}}|j x}}t | } |dk rNt | r?|D ];}
|
j | j k r)|
j |v r |
j |
j |
j }}}|
j x}} nz&get_username_by_uid.. s1 99 S(8(8(8(8(8(899r) )r r r- r. next)r r s ` r* get_username_by_uidr s_
c((C S\**
*
*
*
*
*
*F 9999f999 r) )r" T)E__doc__r loggingr r- r collectionsr pathlibr typingr r r r r r
r r r
r peeweer r defence360agent.subsys.panelsr defence360agent.utilsr defence360agent.utils.threadsr %defence360agent.model.analyst_cleanupr *defence360agent.api.server.analyst_cleanupr imav.malwarelib.configr r r imav.malwarelib.modelr r imav.malwarelib.scan.crontabr imav.malwarelib.utils.cloudwaysr getLogger__name__loggerr+ r3 r< dictrF rl rt r r r r r r r r
struct_passwdr r boolr r r( r) r* r s< *
# # # # # # A A A A A A A A A A A A A A A A A A 2 2 2 2 2 2 2 2 2 2 7 7 7 7 7 7 A A A A A A 3 3 3 3 3 3 G G G G G G H H H H H H
: 9 9 9 9 9 9 9 3 3 3 3 3 3 9 9 9 9 9 9 8 $ $ = = = 2@ 2@ 2@j( ( (@% @% @%F/ / /&E1 E1 E1P )eCd38n1E,E&F ) ) ) ) /3 *&(
&(!$S&(378I3J&( &( &( &(R 0S T c r)