9Vj*g ~ d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d
l m Z d dl m Z m Z m!Z!m"Z" d dl#m$Z$ d dl%m&Z&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d Z2d Z3de4dz fdZ5de4de6fdZ7d Z8d Z9d Z:d gZ;d d d!Zd$ Z?de4fd%Z@d&ZA e jB d ' d( ZCd) ZDd* ZEd+ ZFd, ZGd- ZHd. ZId/ ZJd0e4fd1ZKd0e4fd2ZLd0e4fd3ZMd4 ZNd5e4fd6ZOd7 ZPdeQfd8ZRde4fd9ZSdeQfd:ZTd; ZUd< ZVd>de4d5e4dz fd=ZWdS )? N) defaultdict)Path)ClPwd)setup_mount_dir_cagefsCAGEFSCTL_TOOL)cpusersis_panel_feature_supported)docroot)Feature)NoDomain)PyLve ) user_exists)UserNotFoundError) admin_configconfig
jail_utils litespeed)DOCROOTS_ISOLATED_BASE)validate_docroot validate_docroot_no_symlinks)write_jail_mounts_config) reload_processes_with_docroots)start_monitoring_servicestop_monitoring_service) trigger_xray_ini_regeneration trigger_ssa_ini_regenerationc T t j t j S N)ospathisfiler WEBSITE_ISOLATION_MARKER Fopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/domain.py(is_website_isolation_allowed_server_wider' ' s
7>>,? @ @@r% c T t j t j S r )r r! r" r "WEBSITE_ISOLATION_AVAILABLE_MARKERr$ r% r& &is_website_isolation_feature_availabler* + s
7>>,I J JJr% returnc . t j t j } t j t j }| r8|r6t
j d t j t j d dS | rdS |rdS dS )u Return the current user mode for website isolation.
Returns:
``"allow_all"`` – all users allowed, denied dir lists exceptions.
``"deny_all"`` – no users allowed, allowed dir lists exceptions.
``None`` – not initialised yet.
zBoth site-isolation.users.allowed and site-isolation.users.denied directories exist. Removing allowed directory, treating as allow_all mode.T
ignore_errors allow_alldeny_allN)
r r! isdirr ISOLATION_DENIED_DIRISOLATION_ALLOWED_DIRloggingwarningshutilrmtree)
has_denied has_alloweds r& get_isolation_user_moder: / s | @AAJ'-- BCCK k
Y
l8MMMM{ { z 4r% userc t j t j sdS t }|dk r t j t j | S |dk r t j t j | S dS )u Check whether *user* is allowed to use website isolation.
Combines the global marker with the two-mode user model:
* **allow_all** – allowed unless the user is in the denied directory.
* **deny_all** – denied unless the user is in the allowed directory.
Fr/ r0 ) r r! r" r r# r: user_in_dirr2 r3 )r; modes r& %is_website_isolation_allowed_for_userr? H sw 7>>,? @ @ u " $ $D { +L,MtTTTT z' (JDQQQ 5r% c j t j t j st t
t ddd t t j } | j
dd | t j
g ddd dS dS ) zCSet up mount directories and the global marker if not already done.*TF)prefixremount_cagefsremount_in_background)parentsexist_ok)z/usr/bin/systemctlz try-restartzclwpos_monitoring.service)capture_outputtextN)r r! r" r r# r strr r parentmkdirtouch
subprocessrun) marker_paths r& "_ensure_isolation_mount_and_markerrP Y s
7>>,? @ @
& ' ' u
<@AA === N N N
r% z/etc/cagefs/proxy.commandsz> w~~f%% 7++D11 tOGc&&F&&&& E>r% c d}| D ]e\ }| vr
t j | r*| d }fd|D }d | } d}f| |fS )zRemove proxy entries whose binaries no longer exist on disk.
Returns the (possibly updated) content string and a bool indicating
whether any entries were removed.
FT)keependsc D g | ] }| d | S )rU )
startswith).0lr\ s r&
z)_remove_proxy_entries.. s0 AAAq iii)@)@AAAAr% )rV r r! rW
splitlinesjoin)rY rZ removedr] linesr\ s @r& _remove_proxy_entriesrk s G }} V g
7>>& ! ! ""D"11AAAAEAAA''%.. G r% c t t dd 5 } | }ddd n # 1 swxY w Y n# t $ r d}Y nw xY wd}d|vrEt j dt |r| d s|d z
}|t d z z
}d
}t |t \ }}|r t j d t d
}t |t \ }}|r t j d t d
}|sdS t j
t }t j |d
t j |d \ }} t j |dd 5 } | | ddd n # 1 swxY w Y t j |t n## t( $ r t j | w xY wd t. d z }t3 j t6 ddg|t2 j t2 j d t3 j t6 dgt2 j t2 j d dS )a Register the ``cagefsctl-user`` proxyexec alias if not already present.
Appends the ``CAGEFSCTL_USER`` entry to ``/etc/cagefs/proxy.commands``
and runs ``cagefsctl --update-list`` to pull the required binaries into
the CageFS skeleton. This is a no-op when the entry already exists.
Also registers/unregisters the LVD helper binaries
(``lvd-registry-helper``, ``lvd-limits-helper``) depending on whether
they are present on disk.
rzutf-8)encodingNrf FCAGEFSCTL_USERz Registering cagefsctl-user in %srT Tz Registering LVD helpers in %sz"Removing stale LVD helpers from %s)rF z.proxy.commands.)dirrB wz --wait-lockz
--update-list)inputstdoutstderrcheckz--update-wrappers)rs rt ru ) openPROXY_COMMANDS_PATHreadFileNotFoundErrorr4 inforX CAGEFSCTL_USER_PROXY_ENTRYr^ LVD_PROXY_ENTRIESrk r r! dirnamemakedirstempfilemkstempfdopenwritereplace
BaseExceptionunlinkrh CAGEFSCTL_USER_BINARIESencoderM rN r DEVNULL) frY changedr[ ri proxy_dirfdtmp_path update_lists r& ensure_proxyexec_commandr s
%sW
=
=
= ffhhG Gw&& 79LMMM 7++D11 tOG-44'1BCCNGU 46IJJJ,W6GHHGW 9;NOOO 344IK D))))# :LMMMLB
Yr3
1
1
1 Q
GGG
8 01111
(
99 455<DDFFKN 8!! N ,-!! s^ A : A >A >A AA'G >F G F$$G 'F$( G G&c t t } | dk rNd}t j t j t j d t j t j d nMd}t j t j t j d t j t j d |S )u Flip the isolation user mode without modifying any per-user state.
Unlike :func:`allow_website_isolation_server_wide` and
:func:`deny_website_isolation_server_wide`, this function only flips
the mode indicator directories. It does **not** clean up existing
user isolation or alter the per-user exception lists.
* ``allow_all`` → ``deny_all``
* ``deny_all`` → ``allow_all``
* not initialised → ``allow_all``
Returns:
The new mode after toggling (``"allow_all"`` or ``"deny_all"``).
r/ r0 Tr> rF r- )
rP r: r r~ r r3 DIR_MODEr6 r7 r2 )currentnew_modes r& toggle_isolation_user_moder s '(((%''G+
L6\=R]abbbb
l7tLLLLL
L5L>D E EEr% c t t j sdS t sdS t sdS t j dd| gdd dS )z;Create LVP infrastructure for user via lvectl (idempotent).N/usr/sbin/lvectlzallow-domain-limitsTru rG r r LVEr r rM rN usernames r& _allow_domain_limitsr ' sr %gk 2 2 # % % & ( ( N&(=xH d4 4 4 4 4 4r% c t t j sdS t sdS t j dd| gdd dS )z1Tear down LVP infrastructure for user via lvectl.Nr zdeny-domain-limitsTr r r r r rM rN r s r& _deny_domain_limitsr 4 s_ %gk 2 2 # % % N&( sr %gk 2 2 # % % & ( ( N 3V<4 r% c t t j sdS t sdS t j dd|gdd dS )z!Unregister domain LVE via lvectl.Nr zdisable-domain-limitsTr r r s r& _unregister_domain_lver M s_ %gk 2 2 # % % N 4f=4 r% c t t t j t j t j d t j t j d t D ]S} t | s t | ## t j t f$ r t! j d| Y Pw xY wdS )u@ Switch to *allow_all* mode – all users are allowed by default.Tr r- z5Failed to enable domain limits for user %s, skipping.N)rP r r r~ r r2 r r6 r7 r3 r r r rM CalledProcessErrorr r4 exceptionr s r& #allow_website_isolation_server_wider Y s &((( K 1 8MX\]]]]
M,4DIIIIII
8$$ * * * *-w7 G
s B+CCc t t D ]S} t | s t | ## t j t f$ r t j d| Y Pw xY wt t j t j
t j d t j t j d dS )u Switch to *deny_all* mode – no users are allowed by default.
Disables domain isolation for every user and switches the mode.
z6Failed to disable domain limits for user %s, skipping.Tr r- N) _cleanup_all_users_isolationr r r rM r r r4 r rP r r~ r r3 r r6 r7 r2 r s r& "deny_website_isolation_server_wider o s
!"""II
8$$ ) ) ) )-w7 H
'(((K 2 9NY]^^^^
M,34HHHHHHs A +A.-A.r c t t t }|dk r t j t j | np|dk r t j t j | nJt j t j t j
d t j t j | t | dS )u; Allow website isolation for *username* (mode-aware).
* **allow_all** – removes *username* from the denied directory.
* **deny_all** – adds *username* to the allowed directory.
* **not initialised** – sets up infrastructure in *deny_all* mode
with *username* as the first allowed user.
r/ r0 Tr N) rP r r: r remove_user_from_dirr2 add_user_to_dirr3 r r~ r r r r> s r& allow_website_isolation_for_userr s '((( " $ $D {),*KXVVVV
$\%GRRRR L6\=R]abbbb$\%GRRR"""""r% c t }|dk r t j t j | n%|dk r t j t j | t
| t | dS )u Deny website isolation for *username* (mode-aware).
* **allow_all** – adds *username* to the denied directory.
* **deny_all** – removes *username* from the allowed directory.
Also disables all domain isolation for the user.
r/ r0 N)r: r r r2 r r3 _cleanup_user_isolationr r s r& deny_website_isolation_for_userr sx # $ $D {$\%FQQQQ
),*LhWWW H%%%!!!!!r% c 6 t | sdS t j | }|j sdS d |j D }t j | d t | d t
j | n%# t $ r t j
d| Y nw xY wt | t |
| D ]2\ }}|t j d| t! j | | 3dS )z4Remove all domain isolation state for a single user.Nc . i | ]}|t | S r$ _get_docroot_or_nonerc ds r&
z+_cleanup_user_isolation.. s0 '( " " r% )r ) user_configz8Failed to remove LiteSpeed dedicated PHP handlers for %sfilter_by_docrootsz|Unable to detect document root for domain %s, configuration cleanup failed. Contact CloudLinux support if the error repeats.)r r load_user_configenabled_websitessave_user_configr r !remove_all_dedicated_php_handlers Exceptionr4 r r listvaluesrV errorr remove_website_token_directory)r user_cfgdomain_docroot_mapr r
s r& r r s x &x00H $ ,4,E HT2222 X48888R3H==== R R R F R R R R RR #T*<*C*C*E*E%F%F )..00 E E
7 ? M(
1(GDDDD E Es (A= = B B c t t D ]7} t | # t $ r t j d| Y 4w xY wt }|st
dS dS )z9Remove domain isolation state for every user that has it.z:Unable to disable website isolation for user %s, skipping.N)r #users_with_enabled_domain_isolationr r r4 r r )r
users_lefts r& r r s <>>?? #H - - - - L
566J " !!!!!" "s / AAr c ^ t | d S # t t f$ r Y d S w xY w)Nr )get_domain_docrootr
IndexError)r s r& r r sA !&))!,, j ! tts ,,c t sdS t j | }n# t $ r Y dS w xY wt j | S )NF)r' r get_jail_config_pathr r r! rW )r; domains_config_paths r& is_isolation_enabledr se 3 5 5 u ( =d C C uu
7>>- . ..s '
55c p d t D } i }| D ]}t | }|r|||< |S )Nc N g | ]"}t | t | |#S r$ )r r )rc us r& re z7users_with_enabled_domain_isolation.. s1 P P P1[^^ P8LQ8O8O PQ P P Pr% )r #get_websites_with_enabled_isolation)usersuser_domain_pairsr; domains_with_isolations r& r r sV P P P P PE = =!DT!J!J ! =&< d # r% c t | st j d| g S t j | j S )Nz=User %s not found, cannot get websites with enabled isolation)r r4 r5 r r r )r; s r& r r sG t KT S S S "4 ( ( 99r% c t } t t }| D ]S\ }}|D ]K} t | d }n# t
t f$ r Y ,w xY w|| | LT|S )z
Returns pairs user: set(docroots) for all users with website isolation enabled
Used by monitoring service to watch docroots changes to load actual list of docroot paths
instead of stale storage
r )r r setrV r r r add)users_with_isolationpairsr; domainsr drs r& !get_docroots_of_isolated_websitesr
s ?@@ E-3355
g F
'//2 j)
$KOOB Ls AA+*A+c t | st j d| d S t j | } t t
| d }t |t | j
n/# t $ r"}t j d| || Y d }~d S d }~ww xY w||j vr|j
| t j | | t j | | t j | | t% j ddd|gd t) | | t+ j | | n&# t. $ r t j d | | Y nw xY wt3 | t5 | g
t7 t9 | | t; | t= | | d S ) Nz2User %s not found, cannot enable website isolationr z4Skipping website isolation for user %s domain %s: %s cagefsctlz--rebuild-alt-php-iniz--domainT)ru z9Failed to apply LiteSpeed dedicated PHP handler for %s/%sr ) r r4 r5 r r r r r r get_pw_by_namepw_dir
ValueErrorr appendr create_website_token_directory create_overlay_storage_directoryr rM rN r r enable_dedicated_php_handlerr r r r r r r r )r; r r
document_rootexcs r& enable_website_isolationr s5 t @$ H H H)$//K ();F)C)CA)FGG
$]EGG4J4J44P4P4WXXXX B &# [111$++F333 -dMBBB/mDDD
D+... NK!8*fMUYZZZZ T;/// W.t]CCCC W W W Gv W W W W WW #4=QRX=Y=Y>
C(C##C(,D D$#D$c Z t | st j d| d S t j | }d }g }|-t |j }d |j D }g |_ n6||j v r-|g}t | g}|j | t j | | t | | |ry t j | d |j D n%# t $ r t j d| Y nw xY wt | | |D ]}|t! j | | |D ]D} t% | | # t& j t* f$ r t j d| Y Aw xY wt- }|st/ d S d S )Nz3User %s not found, cannot disable website isolationc , g | ]}t | S r$ r )rc websites r& re z-disable_website_isolation.. s.
.5 ) )
r% c , g | ]}t | S r$ r r s r& re z-disable_website_isolation.. s! OOOQ%a((OOOr% r r z1Failed to unregister domain LVE for %s, skipping.)r r4 r5 r r r r r remover r r r r r r r r r rM r r r r )r; r r reload_docrootsdomains_to_unregisterr r r s r& disable_website_isolationr sm t A4 I I I)$//KO
~ $[%A B B
9D9U
(* $$ ;/ / /!' /778$++F333
D+... T;/// K U 6OO+2NOOO
U U U Mt
U
U
U
U
U U 'tPPPP , K KM $ 5dM J J J J
" H H H "4 + + + +-w7 H H H CQ
H
H
H
H
H H
?@@ " !!!!!" "s$ $C1 1 DD E+FFr )X functoolsr4 r r6 rM r collectionsr pathlibr clcommonr clcommon.clcagefsr r clcommon.cpapir r r
r clcommon.constr clcommon.cpapi.cpapiexceptionsr lve_utils.pylve_wrapperr
fsr
exceptionsr webisolationr r r r webisolation.configr webisolation.docroot_validationr r webisolation.jail_config_builderr webisolation.phpr webisolation.servicer r webisolation.triggersr r r' r* rI r: boolr? rP rw r{ r r| r^ rk r r r lru_cacher r r r r r r r r r r r r r dictr r r r r r r$ r% r& r s
# # # # # # D D D D D D D D > > > > > > > > 8 8 8 8 8 8 " " " " " " 3 3 3 3 3 3 ) ) ) ) ) ) ) ) ) ) ) ) E E E E E E E E E E E E 7 7 7 7 7 7 [ [ [ [ [ [ [ [ F F F F F F < < < < < < S S S S S S S S ^ ^ ^ ^ ^ ^ ^ ^A A AK K Kt 2 "
$ 3 [
FA * &@ @ @FC J/ + Q
"
"
"F F F
4
4
44 4 4 ,I I I4#s # # # #."c " " " "&"Ec "E "E "E "EJ " " " / / / T :c : : : :4 $?' ?' ?'D&L &L &LR4" 4"C 4"t 4" 4" 4" 4" 4" 4"r%