ȼhe=g d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ej
e Z dZ
deded efd
Z ed d Zdd
edz d efdZdZefd
ed eee edz f fdZ G d de ZdS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
DEF-43111: AV-mode watcher that restarts aibolit-resident when the
malware-stack kill-switch (force_aibolit_stack) flips.
Polls FLAGS_PLAIN_PATH (one-flag-name-per-line plain text written by
defence360agent.plugins.feature_flags.FeatureFlagsSync) on a short
interval; on a False<->True transition, scans /etc/systemd/system/
aibolit-resident.service.d/ for drop-in overrides (logs a WARNING if
present) and calls imav.malwarelib.subsys.aibolit.restart_on_sigs_or_config_update.
In IM360 mode the Go resident-agent already owns this transition (see
src/resident-agent/plugins/feature_flags/plugin.go), so this watcher is
Scope.AV only to avoid double-restarting.
N)
MessageSource)FLAGS_PLAIN_PATH)Scopeforce_aibolit_stacknamedefaultreturnc t j | }|s|S t | S # t $ r" t
d| || |cY S w xY w)u Read an int env var tolerantly. A non-numeric value (empty string,
typo, etc.) must NOT raise at import time — the watcher lives in the
AV agent entry point and a bad env var would otherwise kill the agent.
zBaibolit-resident FF watcher: %s=%r is not an int, using default %d)osenvirongetint
ValueErrorloggerwarning)r r raws ]/opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins/aibolit_resident_ff_watcher.py_env_intr 1 s~
*..
C
3xx
s 4 )A A !I360_FORCE_AIBOLIT_STACK_POLL_SEC pathc | t } t | d 5 }|D ].}| d t k r ddd dS / ddd n # 1 swxY w Y n# t t
f$ r Y nw xY wdS )u Return True iff force_aibolit_stack appears in the plain-text sidecar.
Reads FLAGS_PLAIN_PATH directly (one bare flag name per line, sorted,
written atomically by both FeatureFlagsSync._write_flags and the Go
resident-agent). The aibolit-resident systemd unit's ExecStart= shell
greps the same file, so reading it here keeps the watcher's transition
detector aligned with the unit-file decision.
Bypasses any caching deliberately:
- Avoids the mtime cache in defence360agent.internals.feature_flags.is_enabled
(whole-second resolution would race with an immediately-following
write and silently mask transitions inside the same wall-clock second).
- Avoids the JSON file's value-interpretation surface (truthy/falsy
across bool/int/string variants); the plain file already represents
the enabled-set semantic, so exact-line match is the right comparison.
`path` defaults to the module-level FLAGS_PLAIN_PATH resolved at call
time (NOT bound at function-definition time) so unit tests can override
that constant via monkeypatch and have it take effect here.
Returns False when the file is missing, unreadable, empty, or the flag
name is not present — matching the agent's default-off semantics.
Nzutf-8)encoding
TF)r openrstrip _FORCE_AIBOLIT_STACK_FF_NAMEOSErrorUnicodeDecodeError)r flines r "_read_force_aibolit_stack_uncachedr" I s 0 |
$
)
)
) Q
;;t$$(DDD D
' (
5s@ A' $A A'
A A' A A' "A #A' 'A;:A;z./etc/systemd/system/aibolit-resident.service.dc t t j | }n*# t $ r g dfcY S t $ r}g |fcY d}~S d}~ww xY wt d |D }|dfS )u Scan `path` for .conf drop-in files (blocking syscall).
Returns ``(sorted_conf_names, None)`` on success, where the list is empty
if the directory exists but contains no .conf overrides. Returns
``([], None)`` when the directory is absent (clean state — no warning).
Returns ``([], err)`` for unexpected OSErrors so the async caller can log
with ``exc_info=err``.
Lives at module scope (not a method) so the async caller can pass it to
``loop.run_in_executor`` without partially binding ``self``.
Nc 3 X K | ]%}|j d |j V &dS )z.confN)r endswith).0es r z4_scan_aibolit_resident_dropin_dir.. s7 GGaafoog.F.FG16GGGGGG )listr scandirFileNotFoundErrorr sorted)r entriesr' confss r !_scan_aibolit_resident_dropin_dirr0 p s rz$''(( 4x 1u GG7GGG G GE $;s !$ A A A A A c X e Zd Zej Zd dZd dZd dZd dZ d dZ
de d e ddfd
Z dS ) AibolitResidentFFWatcherr Nc > d | _ d | _ d | _ d | _ d S N)_loop_task _last_mtime _last_valueselfs r __init__z!AibolitResidentFFWatcher.__init__ s& 7;
*.
)-(,r) c p K || _ | | | _ d S r4 )r5 create_task
_poll_loopr6 )r: loopsinks r
create_sourcez&AibolitResidentFFWatcher.create_source s0
%%doo&7&788
r) c K | j ?| j | j d {V d S # t j $ r Y d S w xY wd S r4 )r6 cancelasyncioCancelledErrorr9 s r shutdownz!AibolitResidentFFWatcher.shutdown st : ! J
j )
" !s
3 AAc K | d {V n;# t j $ r t $ r t dd Y nw xY wt j t d {V w)NTz'aibolit-resident FF watcher poll failedexc_info)
_poll_oncerD rE Exceptionr r sleep_POLL_INTERVALr9 s r r> z#AibolitResidentFFWatcher._poll_loop s 0
oo'''''''''')
=
-// / / / / / / / 0s 5AAc K t j } | d t j j t d {V }n# t $ r d }Y nw xY w|| j k rd S | d t t d {V }| j
}||| _ || _
d S ||k rK | || d {V n-# t $ r t dd Y d S w xY w|| _ || _
d S )NzGfailed to apply force_aibolit_stack transition; will retry on next pollTrH )rD get_event_looprun_in_executorr r getmtimer r r7 r" r8 _handle_transitionrK r error)r: r? mtime new_value old_values r rJ z#AibolitResidentFFWatcher._poll_once s %'' ..bg&(8 EE EEE D$ $ $ F .. 46F
$ %D (D F ! !
--iCCCCCCCCCC
. !
!$s# 1A AA/ C &C65C6rV rU c K t d|| t j }| dt
t d{V \ }}|#t dt | n6|r4t dt d | ddlm } |
dd d{V dS )
u Restart aibolit-resident on a force_aibolit_stack flip.
Restart picks up the FF in the unit-file's ExecStart= shell. Also
scans for systemd drop-ins under
/etc/systemd/system/aibolit-resident.service.d/ — anything there
(notably rustbolit/scripts/use_rustbolit_realtime.sh's
rustbolit.conf) overrides the base unit's FF check, so we log a
loud WARNING. We do NOT remove drop-ins automatically — too
aggressive (could blow away legitimate operator overrides).
Restart errors propagate — the caller (``_poll_once``) catches
them, logs ERROR, and rolls back the recorded state so the next
poll re-detects the transition. Swallowing here would silently
leave the watcher stuck on the wrong state.
z_force_aibolit_stack transitioned %s -> %s; restarting aibolit-resident to pick up new selectionNz'could not scan %s for drop-in overridesrH zraibolit-resident has systemd drop-in overrides at %s; FF flip may be ineffective until they are removed. Files: %sz, r )aibolitT) r r rD rO rP r0 _AIBOLIT_RESIDENT_DROPIN_DIRjoinimav.malwarelib.subsysrX restart_on_sigs_or_config_update)r: rV rU r? r/ scan_errrX s r rR z+AibolitResidentFFWatcher._handle_transition s& $
C
%'' $ 4 4 - (!
!
x
NN9,!
NN - %
32222266tTBBBBBBBBBBBr) )r N)
__name__
__module__ __qualname__r AVSCOPEr; rA rF r> rJ boolrR r) r r2 r2 s HE- - - - 9 9 9 9
0
0
0
0,% ,% ,% ,%\4C 4C*.4C
4C 4C 4C 4C 4C 4Cr) r2 r4 )__doc__rD loggingr !defence360agent.contracts.pluginsr 'defence360agent.internals.feature_flagsr defence360agent.utilsr getLoggerr^ r r strr r rM rc r" rY tupler* r r0 r2 rd r) r rm su ! !F ; ; ; ; ; ; D D D D D D ' ' ' ' ' ' 8 $ $ 4 3 * =rBB! !S4Z !4 ! ! ! !H P -
49gn $% 0CC CC CC CC CC} CC CC CC CC CCr)