$FiQdZddlZddlZddlZddlZddlmZddlmZddl m Z ddl m Z ddl mZmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZmZmZddlmZm Z m!Z"GddZ#ddZ$dS)zA This module contains classes implementing SSA Manager behaviour N)contextmanager)iglob) disable_quota)Tuple)load_validated_parserload_configuration) flag_file)SSAManagerError) ssa_version) AutoTracer) DecisionMaker) INI_FILE_NAMEINI_USER_LOCATIONS_BASEis_excluded_path)$copy_inis_to_website_isolation_paths(remove_inis_from_website_isolation_pathsregenerate_inis_for_userceZdZdZdZedefdZede fdZ ede fdZ ede fdZ dede fd Z d-d edejfd Zd edefdZdefdZdefdZdefdZdefdZdefdZdede fdZdededefdZdedefdZdeeeefeffdZe dZ!dedededdfd Z"d.d!Z#deeeefeffd"Z$d.d#Z%d.d$Z&d.d%Z'defd&Z(d.d'Z)d.d(Z*defd)Z+d.d*Z,d+eddfd,Z-dS)/Managerz SSA Manager class. ctjd|_t|_ddg|_ddg|_d|_d|_t|_ tttjf|_dS)Nmanagerz!usr/lib64/php/modules/clos_ssa.soz0usr/lib/x86_64-linux-gnu/php/modules/clos_ssa.sozlib64/php/modules/clos_ssa.soz,lib/x86_64-linux-gnu/php/modules/clos_ssa.soz lib/php/extensions/*/clos_ssa.so)z /opt/alt/php[0-9][0-9]/link/confz+/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dz$/opt/plesk/php/[0-9].[0-9]/etc/php.dz'/usr/local/php[0-9][0-9]/lib/php.conf.dzM/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dzA/usr/share/cagefs-skeleton/usr/local/php[0-9][0-9]/lib/php.conf.d)logging getLoggerloggerr ini_file_namemodule_patterns_with_usrmodule_patterns_no_usrmodule_glob_pattern_directadminwildcard_ini_locationsrwildcard_ini_user_locationsOSError ValueError subprocessSubprocessErrorsubprocess_errorsselfs B/opt/cloudlinux/venv/lib64/python3.11/site-packages/ssa/manager.py__init__zManager.__init__,sz' 22 * 0 >) % , :' #0R,' #,C( Z!;" returncddi}|d|Dtj|S)z@ Form a success json response with given kwargs resultsuccessci|]\}}|| Sr1).0kvs r) z$Manager.response..Ns===daQ===r+)updateitemsjsondumps)argskwargs raw_responses r)responsezManager.responseHsI !), ==fllnn===>>>z,'''r+cJtjtS)z Is SSA enabled )ospathisfiler r's r)_enabledzManager._enabledQs w~~i(((r+c ddhS)zK Configuration settings required Request Processor restart requests_duration ignore_listr1r's r)_restart_required_settingsz"Manager._restart_required_settingsXs $]33r+c hdS)N>time correlationdomains_numberrequest_numbercorrelation_coefficientr1r's r)solo_filtered_settingszManager.solo_filtered_settings_s*** *r+settingsc6|j|S)z SSA Agent requires restart in case of changing these configuration: - requests_duration - ignore_list )rF intersection)r(rNs r)_restart_requiredzManager._restart_requiredds .;;HEEEr+Fcommandc  tjdd|gdd|}|jd|dn#tj$r}|jdt |jt |jt |j |j|j|j |j d td |jd |jd |j p|j d }~w|j $rS}|jdt |dt |i td|d|d }~wwxYw|S)z Run /sbin/service utility to make given operation with SSA Agent service :command: command to invoke :check_retcode: whether to run with check or not :return: subprocess info about completed process z /sbin/servicez ssa-agentT)capture_outputtextcheckz ssa-agent z succeededz$SSA Agent %s failed with code %s: %s)cmdretcodestdoutstderrextraz SSA Agent z failed with code z: Nz&Failed to run %s command for SSA AgenterrzFailed to run z for SSA Agent: ) r$runrinfoCalledProcessErrorerrorstrrW returncoderYrZr r&)r(rR check_retcoder.es r)run_service_utilityzManager.run_service_utilityls ?^_%0%,%.48d*7 999F K  ='=== > > > >, ^ ^ ^ K  6AE AL!!AH e !"QX??  @ @ @"\QU\\al\\ahFZRSRZ\\^^ ^% ? ? ? K  FG %*CFFO  5 5 5!===!==?? ? ?  s#9=E BC(( E5AEEr:ct}|| |nO#t$rB}|jddt |itd|d}~wwxYw||r| dd| S) z Change SSA config and restart it. :args: dict to override current option values :return: JSON encoded result of the action z Failed to update SSA config filer]r[z"Failed to update SSA config file: NrestartTrd) roverridewrite_ssa_confr"rrarbr rQrfr=)r(r:configres r) set_configzManager.set_configs '(( L  ! ! # # # # L L L K  @%*CFFO  5 5 5!"Jq"J"JKK K L  ! !$ ' ' D  $ $Yd $ C C C}}s: B=BBcJt}||S)zV Get current SSA config. :return: JSON encoded current config )rl)r r=)r( full_configs r) get_configzManager.get_configs# )** }}K}000r+cD|jrdnd}||S)zY Get current status of SSA. :return: JSON encoded current status enableddisabled) ssa_status)rBr=)r(statuss r)get_ssa_statuszManager.get_ssa_statuss( #m;}}}///r+c|js<||||S)a Enable SSA: - add clos_ssa extension for each PHP version on server - add clos_ssa extension into cagefs for each user and each ver - start SSA Agent (if it is not already started) - restart Apache (etc.) and FPM, reset CRIU images - create flag_file indicating that SSA is enabled successfully :return: JSON encoded current status )rB generate_inisstart_ssa_agent create_flagrvr's r) enable_ssazManager.enable_ssasV}      " " "      ""$$$r+c|jr<||||S)a{ Disable SSA: - remove clos_ssa extension for each PHP version on server - remove clos_ssa extension from cagefs for each user and each ver - stop SSA Agent - restart Apache (etc.) and FPM, reset CRIU images - remove flag_file indicating that SSA is enabled :return: JSON encoded current status )rBremove_clos_inisstop_ssa_agent remove_flagrvr's r) disable_ssazManager.disable_ssasV =   ! ! # # #    ! ! !      ""$$$r+cdtD}||t|jrdnd|t S)z Get SSA statistics. Includes: - config values - version - SSA status (enabled|disabled) - SSA Agent status (active|inactive) :return: JSON encoded current statistics cXi|]'\}}|t|(Sr1)rblower)r2keyvalues r)r5z%Manager.get_stats..s<111zsE3E ((**111r+rrrs)rlversionru agent_status autotracing)r r7r=r rBstatus_ssa_agentr get_stats)r(_configs r)rzManager.get_statss11%''--//111}}MM $ =99:..00" ..00    r+dir_pathc t|S)z= Check if directory path should be excluded. )r)r(rs r)unused_dir_pathzManager.unused_dir_paths )))r+php_rootpatternsc|D]E}tj||}tj|r|cSF|r&tj||dndS)z Search for clos_ssa.so module in php_root using a list of patterns. Returns the first found module path, or the first pattern as expected path if none exist. r)r?r@joinexists)r(rrpattern module_paths r)_find_module_in_rootzManager._find_module_in_rootsu   # #G',,x99Kw~~k** #"""" #7?Frw||Hhqk222BFr+ini_pathc|dr:d|vr6|dd}|||jS|drPd|vrL|dd}|dd}|||jS|d r:d|vr6|dd}|||jS|d r:d|vr6|dd}|||jS|d rjd |vrf|d d}t ttj ||j }|r|dSd S|drjd |vrf|d d}t ttj ||j }|r|dSd S|drXd|vrT|dddd}d|}|||jSd S)z Determine the path to clos_ssa.so module based on ini_path. Returns the expected module path, or empty string if not found. z /opt/alt/phpz /link/confrz4/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-phpz/root/etc/php.dz"/usr/share/cagefs/.cpanel.multiphpz/usr/share/cagefs-skeletonz /etc/php.dz/opt/cpanel/ea-phpz/opt/plesk/php/z(/usr/share/cagefs-skeleton/usr/local/phpz/lib/php.conf.drz/usr/local/phpz /var/cagefs/z/etc/cl.php.d/alt-phpr/z&/usr/share/cagefs-skeleton/opt/alt/php) startswithsplitrrreplacerlistrr?r@rr)r(rr skeleton_pathpossible_pathsphp_ver skeleton_roots r)get_module_pathzManager.get_module_paths   ~ . . V<83K3K~~l33A6H,,Xt7TUU U   U V V V[lpx[x[x$,,-QSoppM$**<88;H,,Xt7TUU U   3 4 4 V9Jh9V9V~~l33A6H,,Xt7TUU U   0 1 1 Tlh6N6N~~l33A6H,,Xt7RSS S   I J J O`dlOlOl~~&788;H!% Xt?c(d(d"e"effN )%a((2   / 0 0 5F(5R5R~~&788;H!% Xt?c(d(d"e"effN )%a((2   ~ . . [3Jh3V3Vnn%<==a@FFsKKANGNWNNM,,]DHHHHH K$$&56>@@@H I I Is 2BB5c#K tj|tj|dVtjdtjddS#tjdtjdwxYw)z Dive into user context by dropping permissions to avoid most of the security issues. Does not cover cagefs case because it also requires nsenter, which is only available with execve() call in our system Nr)r?setegidseteuid)r(uidgids r) _user_contextzManager._user_contextSsn  JsOOO JsOOO EEE JqMMM JqMMMMM JqMMM JqMMMMs ,A*BrrNcT||}|s|jd|dStj|s|jd||tj||j}tj|r | ||5tj ||jd|dddn #1swxYwYn@#t$r3}|jd|t|Yd}~nd}~wwxYwdStj||j}| ||5t5t|d5}|jd||ddddn #1swxYwYdddn #1swxYwYddddS#1swxYwYdS) zB Enable SSA extension for single ini_path (given) zUnable to update file %s, possible permission misconfigurationz7Exception on generating clos_ssa.ini: "%s", error: "%s"N Finished!) rr_rrPermissionErrorrrarbrr)r(rrrres r)rxzManager.generate_iniss ;<<<$($7$7$9$9   JS# ((c8<<<<"      "HIQSSS    !!"[]egjklgmgmnnn  -T-?@@@ %%%%%sA%B37 B3)B..B3c#K|D]O\\}}}tj|D]2}|j|vr ||ftj||fV3PdS)z Generator function searching for clos_ssa.ini files in all existing Additional ini paths Returns tuple of (uid, gid) and path. N)rr?listdirrr@r)r(rrrnames r)find_clos_iniszManager.find_clos_iniss %)$7$7$9$9 ? ? JS# 8,, ? ?%T11Cj"',,x">">>>>>> ? ? ?r+c |jd|D]\\}}} |||5t j|dddn #1swxYwYL#t $r3}|jd|t|Yd}~d}~wwxYwt|j|jddS)z[ Remove all gathered clos_ssa.ini files, including per-website directories zRemoving clos_ssa.ini files...Nz5Exception on removing clos_ssa.ini: "%s", error: "%s"r) rr_rrr?rr exceptionrbr)r(rrclos_inires r)r}zManager.remove_clos_iniss? 9:::$($7$7$9$9   JS# ''S11((Ih'''(((((((((((((((    %%&]_gilmnioioppp  11CDDD %%%%%s;A;A/# A;/A3 3A;6A3 7A;; B8)B33B8c|d}|jr|dddS|dddS)ze Start SSA Agent service or restart it if it is accidentally already running rustartTrirhNrfrcr(rs r)ryzManager.start_ssa_agentsa //99  " D  $ $WD $ A A A A A  $ $Yd $ C C C C Cr+cp|d}|js|dddSdS)z` Stop SSA Agent service or do nothing if it is accidentally not running rustopTriNrrs r)r~zManager.stop_ssa_agentsN //99 & A  $ $V4 $ @ @ @ @ @ A Ar+cZ |ddn#t$rYdSwxYwdS)z: Get SSA Agent status: active or inactive ruTriinactiveactive)rfr r's r)rzManager.status_ssa_agentsJ   $ $XT $ B B B B   :: xs  ((cttd5 dddn #1swxYwY|jdtddS)zE Create a flag file indicating successful enablement rN Flag file z created)rr rr_r's r)rzzManager.create_flags)S ! !                   9i999:::::s $((c  tjt|jdtddS#t $r=}|jdtdt|Yd}~dSd}~wwxYw)z: Remove a flag file indicating enablement rz removedz removal failed: N)r?rr rr_r"rrb)r(res r)rzManager.remove_flags C Ii K  =)=== > > > > > C C C K  AYAAQAA C C C C C C C C C Cs4O@t&1C111100000%C%%%%"%S%%%%" 3    (****** GS GD GS G G G G@@@@@@DIeCHos&: ;IIII4^"1s1111111<&&&&, ?eCHos&: ; ? ? ? ?&&&&& D D D DAAAA#;;;; C C C C'C''''!!!! FS FT F F F F F Fr+rr,Manager instancectS)zk Factory function for appropriate manager initialization :return: appropriate manager instance )rr1r+r)initialize_managerrs 99r+)r,r)%rr8rr?r$ contextlibrglobrsecureiortypingr configurationrr internal.constantsr internal.exceptionsr internal.utilsr modules.autotracerr modules.decision_makerr clos_ssa_inirrrwebsite_isolationrrrrrrr1r+r)rs  %%%%%%""""""DDDDDDDD))))))000000''''''******111111 \F\F\F\F\F\F\F\F~r+