#TJ X d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ddlmZ ddlmZ ddlmZ dd lmZ ej e Z ed
Z ed Z e d z Z d
Z!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ* ed Z+ G d de, Z-dedee. ddfd Z/d e e. dee e. e e. f fd Z0d ede e. fd Z1 G d! d"e2 Z3 G d# d$e. Z4d%e.d&e.dee e. e e. f fd'Z5 G d( d) Z6d*e.dee. d+e e. de6fd,Z7 G d- d. Z8d*e.dee. de8fd/Z9deddfd0Z:d1ed2ede;fd3Zde;fd7Z?de;fd8Z@d;d9ZAde;fd:ZBdS ).
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)Path)CallableIterableListOptionalSetTuple)ANTIVIRUS_MODEMalware) HostingPanel) check_run)MalwareIgnorePath) crontab_pathz4/etc/sysconfig/imunify360/malware-filters-admin-confz)/var/imunify360/files/realtime-av-conf/v1 processedzpd-combined.txtzav-internal.txtzav-internal-optimized.txtz av-admin.txtzav-admin-paths.txtignoredi zimunify-realtime-avz/usr/bin/i360-exclcompz /usr/sbin/imunify-realtime-avc e Zd ZdZdS )PatternLengthErrorz(Raised when pattern's length is too big.N)__name__
__module__ __qualname____doc__ L/opt/imunify360/venv/lib/python3.11/site-packages/imav/subsys/realtime_av.pyr r < s 22Dr r dirbasedirsreturnc | dz d 5 }t | D ]7}| t j | dz 8 ddd dS # 1 swxY w Y dS )z+Save list of basedirs in a file inside dir.zbasedirs-list.txtw
N)opensortedwriteospathrealpath)r r fbasedirs r _save_basedirsr) B s
#
# ) )# . . 6! h'' 6 6G
GGBG$$W--4 5 5 5 5 66 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s AA//A36A3pathsc g g }}| D ]J}| d r | |dd 5| | K||fS )zSplit paths into two lists: absolute and relative.
Relative paths start with +. This + sign is removed from resulting path.+ N)
startswithappend)r* absoluterelativer% s r _split_pathsr2 I sm RhH " " ??3 " OODH % % % % OOD ! ! ! ! X r r% c | 5 }d |D }d |D cddd S # 1 swxY w Y dS # t $ r g cY S w xY w)zRead file at path and return its lines as a list.
Empty lines or lines starting with '#' symbol are skipped. Lines are
stripped of leading and trailing whitespace. If the file does not exist,
empty list is returned.c 6 g | ]}| S r )strip).0lines r
z _read_list..^ s 000dTZZ\\000r c b g | ],}t | d k | d *|-S )r #)lenr. )r6 xs r r8 z _read_list.._ s3 MMM!A
1<<;L;L
A
r N)r! FileNotFoundError)r% r' liness r
_read_listr? V s
YY[[ NA00a000EMMuMMM N N N N N N N N N N N N N N N N N N s. A ; A ?A ?A AAc e Zd ZdZdee dee ddf fd Zedede fd Z
ed ee dee dee fd
Z d e ddfd Z
xZS )
_Watchedz8Holds a list of watched glob patterns ready to be saved.r r r Nc t t | \ }} fd| || z D d S )Nc 3 K | ]8} | t j | V 9d S N) _is_validr$ r% r& )r6 pselfs r z$_Watched.__init__..j sY
~~a
G Q
r )super__init__r2 extend_extend_relative)rG r r r0 r1 __class__s ` r rJ z_Watched.__init__g s
)!__(
5 5h I II
r patternc j | d s t d| dS dS )z(Return True if watched pattern is valid./z+skipping watched path %s: not starts with /FTr. loggerwarningrN s r rE z_Watched._is_validp sA !!#&& NN=w
5tr r* c g }| D ]:}|D ]5}| t j || 6;|S )z7Join basedirs with all paths and return resulting list.)r/ r$ r% join)r* r extendedr% r( s r rL z_Watched._extend_relativez sV = =D#
=
= Wd ; ;<<<<
=r r% c | d 5 }| d | ddd dS # 1 swxY w Y dS )z$Save watched list at specified path.r r N)r! r# rV rG r% r' s r savez
_Watched.save s
YYs^^ %q
GGDIIdOO $ $ $ % % % % % % % % % % % % % % % % % %s )A AA)r r r r r strr rJ staticmethodboolrE rL r rZ
__classcell__)rM s @r rA rA d s BB
$s)
s3x
D
3 4 \ S SX $s) \% %$ % % % % % % % %r rA c e Zd ZdZededefd Zededefd Zededefd Z e
de e de e dd fd Z
d
efd Zd S )
_Ignoredz:Holds a list of ignored regexp patterns ready to be saved.rN r c j | d r t d| dS dS )z1Return True if relative ignored pattern is valid.^z0skipping relative ignored path %s: starts with ^FTrQ rT s r _is_valid_relativez_Ignored._is_valid_relative sA c " " NNBG
5tr c D | d r
| dd S | S )z.Remove leading slash from pattern, if present.rP r- N)r. rT s r _remove_leading_slashz _Ignored._remove_leading_slash s- c " " 122; r c t j | dS # t $ r t d| Y dS w xY w)z7Return True if pattern successfully compiles as regexp.Tz*skipping ignored pattern %s: invalid regexF)recompile ExceptionrR rS rT s r _compilesz_Ignored._compiles s[ Jw 4 NN g | ]} | |S r )rj r6 rF clss r r8 z*_Ignored.from_patterns.. s* <<. sa
%%a((
.1]]1-=-=
% %a ( (
r r z^(?:{})/(?:{})| z^$)r2 r; formatrV r/ r` )ro rk r r0 r1 relative_patternpats ` r
from_patternsz_Ignored.from_patterns s
*( 3 3(<<< || _ || _ || _ || _ d S rD )r r r r )rG r r r r s r rJ z_IgnoredCtx.__init__ s' !
"4 r r c h |t z }| d | j |t z | j |t z | j |t z | j $| j |t z d S d S )NTr ) _IGNORED_SUB_DIRr r rZ r r r r _PD_NAMEr _INTERNAL_OPTIMIZED_NAMEr s r rZ z_IgnoredCtx.save s " "
1~-...
K((( Q\""" " . # ( (-E)E F F F F F / .r rD )r r r r` r rJ r rZ r r r r r s 26
5
5
5
5
5
%X .
5
5
5
5
5G G G G G G G Gr r c L t | d \ }}t | d \ }}d }|rt || }t t || t || t ||z | | S )Nz ignored.txtzignored-optimized.txt)r r` rv r )r r internal_ignored
admin_ignoredoptimized_ignored_r s r _ignored_contextr s &3J
&N&N#m )5LMMq
% 3 3 x
/:: }h77 /- ?JJ r c t j }d d |D }| t z t z }| | d S )Nr c 3 h K | ]-}t j t j | d z V .dS )
N)base64 b64encoder$ fsencode)r6 r% s r rH z'_admin_ignored_paths.. sM $ $8<T**++e3$ $ $ $ $ $r )r path_listrV r _ADMIN_PATHS_NAME write_bytes)r
ignored_pathsignored_paths_base64targets r _admin_ignored_pathsr sn %/11M 88 $ $@M$ $ $ #
#&7
7F
+,,,,,r dir1dir2c X | D ]}| rt |||j z r dS | sF||j z }| s dS | | k r dS dS )zXCompare content of two folders if files in this directory are the
same return False.TF)iterdiris_dir_contain_changesr{ is_filer
read_bytes)r r fileothers r r r ! s
;;== dTY&677
tt||~~ ty ||~~ 44 ?? 0 0 2 2 2 244 3 5r saversc | d }| r!t j t | | |D ]
} || | r| d }| r!t j t | | | | | n$# t $ r | | w xY wt | | S | | dS )zySave configs in directory dir using saves callable.
Each function in savers will be called with single dir argument.z.tmpz.backupT)
with_suffixr shutilrmtreer[ r with_namerenameri r )r r temprZ backups r
_save_configsr 2 s2 ??6 " "D {{}} !
c$ii JJLLL T
zz||
y)) ==?? ' M#f++ & & &
6 KK MM# V,,, Cts #C9 9!Dc t t z t z } t t z } | }| r2t
j t | t | k s+| |
| d S d S # t $ r |
| Y d S w xY wrD ) _PROCESSED_PATHr r r lstat
is_symlinkr$ readlinkr[ unlink
symlink_tor= )r sourcer s r _update_pd_symlinkr N s
/
/(
:F
8
#F &
LLNN
&$&KF $<$<F $K$K MMOOO f % % % % % %L$K " " "&!!!!!!"s B/ / CCc t } | t t j r. t
t t t fdt | j j t | j j t g }t |S )z*Generate new malware paths filters config.c , t | h S rD )r) )r r
extra_watcheds r z"generate_configs..k s s,Gh,G ,GHH r )r )r r setr CRONTABS_SCAN_ENABLEDaddr[ r r r r NAMErZ r r r )rz changedr r s @@r generate_configsr _ s NNE~~ HEEM$ /#lnn--... H H H H H UZ G G G L UZ 2 2 7
G Nr c 4 t S rD ) _BIN_PATHr r r r is_installedr u s r c K t dt dg t t g g} | D ]L} | d {V # t j $ r t
$ r%}t d| Y d }~Ed }~ww xY wd S )Nservicerestartz)realtime_av.reload_services exception: %s)r
REALTIME_SERVICE_NAME _PD_PREPAREasyncioCancelledErrorri rR rS )taskstes r reload_servicesr y s 9 3Y?@@;-
E K K KGGGGGGGG% K K K NNF J J J J J J J J K K Ks =A;A66A;c * t o t j S rD )r
r INOTIFY_ENABLEDr r r should_be_runningr s 9'"99r )r N)Cr r r loggingr$ rg r pathlibr typingr r r r r r defence360agent.contracts.configr
r +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr
imav.malwarelib.modelr imav.malwarelib.scan.crontabr getLoggerr rR r r~ r r r r r r r rx REALTIME_PACKAGEr r r ri r r[ r) r2 r? listrA r` r r r r r r r] r r r r r r r r r r r s *
A A A A A A A A A A A A A A A A D D D D D D D D D D D D D D + + + + + + 3 3 3 3 3 3 5 5 5 5 5 5 8 $ $ dIJJ ABB + "6 ( ( - & D0 1 1 6 6C 6T 6 6 6 6
S
eDItCy,@&A
T d3i "% "% "% "% "%t "% "% "%J= = = = =s = = =@ 4 4C 4E$s)T#Y2F,G 4 4 4 4 ) ) ) ) ) ) ) ) "3x3;C= G G G G G G G G. C [ ,-d -t - - - -4 t "t T(D64<*@%A d 8& & & &"$ , d K K K K :4 : : : : : :r