9Vj d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
dZdZd Zd
efd Zd ed
efd
ZdedededefdZd ed
efdZd ed
efdZd Zd Zd ed
efdZd ZdS ) N)Path)ClPwd)drop_privileges)get_user_var_cagefs_path)apply_metadata_nofollow
write_via_tmpl %#Ds_ l c N t | }t j | d S )Nz/.cagefs/isolates.mounts)r pathlibr )user
cagefs_dirs Wopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/jail_utils.pyget_jail_config_pathr s( )$//J <:??? @ @@
document_rootc | d pd} t }| d D ]}||z }|t z dz }|dS )z
Generates unique id for an isolate website using FNV-1a 64-bit hash.
FNV-1a has excellent avalanche properties and distribution.
Must match the docroot_hash() function in jail C code.
/zutf-8l 016x)rstrip_FNV_OFFSET_BASISencode
_FNV_PRIME)r
hash_valuechars r
get_website_idr sh "((--4M"J $$W-- D Dd
:-1CC
r r c t | }t | }t t | dz }||z }| ddd | dd t
t | ddd t d }| d }t ||| t
|d
|j
d | d }t ||| t
|d dd d
S )z
Create website token directory structure and files in /var/cagefs.
Creates:
- /var/cagefs//.cagefs/website// - token directory
.cagefs/websiteTi )exist_okparentsmodei )r r r z/.cagefs.token z/.cagefs.websitei$ N) r get_pw_by_namer r r mkdirr str_generate_passwordr pw_uid) r r pw
website_idwebsite_base_dir website_dirtokentoken_file_pathdocroot_file_paths r
create_website_token_directoryr. 0 s+
% %B
..J 4T : :;;>OO"Z/K D$UCCCt%000 C , ,eQ::: r " "E %444O+666OUBIqAAA '888+ 0-@@@ -ua;;;;;r parent_fdnamer returnc t j ||| n# t $ r Y nw xY wt j |t j t j z t j z t j z | S )u Create or open ``name`` under ``parent_fd`` rejecting any symlink.
mkdirat(name, parent_fd) followed by openat(name, parent_fd,
O_NOFOLLOW | O_DIRECTORY) — the open raises ELOOP if the path was
pre-planted as a symlink and ENOTDIR if it is a non-directory inode.
EEXIST on the mkdir is benign (idempotent re-run); other errors
propagate. Returns an fd opened on the real directory inode that
the caller is responsible for closing.
)r dir_fd)r3 )osr# FileExistsErroropenO_RDONLY
O_NOFOLLOW O_DIRECTORY O_CLOEXEC)r/ r0 r s r
_mkdir_nofollow_underr; _ sz
D33333
7
bm#bn4r|C s
''c & t | }t |j sdS t j |j t
j t
j z t
j z } t | 5 t |dd } t |dd } t |t | d }t j
| t j
| n# t j
| w xY w t j
| n# t j
| w xY w ddd n # 1 swxY w Y t j
| dS # t j
| w xY w)z
Create overlay storage directory in user's home.
Creates:
- /.cagefs/websites// - storage base for overlays
Drops privileges to user before creating to ensure proper ownership.
N.cagefsi websites)r r" r pw_direxistsr4 r6 r7 r9 r: r r; r close)r r r' home_fd cagefs_fd websites_fdleaf_fds r
create_overlay_storage_directoryrF t s
% %B ?? ! ! # # gbir~!= !LMMG
T
"
" $ $-gy%HHI
$ 3Iz5 Q Q * 3#^M%B%BE G HW%%%H[))))BH[)))))######### $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ s` E: E+D3=2D/D3DD3 E3E E
E: E E: E !E: :Fc t t | dz }|t | z }| rt j | dS dS )z=
Remove website token directory structure and files.
r N)r r r r@ shutilrmtreer r r) r* s r
remove_website_token_directoryrK sg 4T : :;;>OO"^M%B%BBK #
k"""""# #r c \ t j dt | S )z5
Returns path: websites/
r> )r4 pathjoinr )docroots r
website_suffix_with_hashrP s" 7<<
N7$;$; < </.cagefs/websites/
r= )r4 rM rN rP )homedirrO s r
full_website_pathrS s% 7<<,DW,M,M N NNr c t t | dz }|t | z }|dz d dS )z,
Removes cached namespace from disk
r z .cagefs.mntT)
missing_okN)r r r unlinkrJ s r
invalidate_ns_cacherW sU 4T : :;;>OO"^M%B%BBK= ((D(99999r c | dk s| dk rt d dt t j | }d fd|D }|S )z
Generate a random password/token using the same algorithm as the C function.
Uses cryptographically secure random bytes and converts them to alphanumeric characters.
r r! z Invalid buffer length requested>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz c 3 . K | ]}|z V d S )N ).0bcharset charset_sizes r
z%_generate_password.. s- EE1WQ -.EEEEEEr )
ValueErrorlensecrets token_bytesrN )length random_bytesresultr_ r` s @@r
r% r% sx
{{fsll:;;;NGw<rn s
* * * * * * 3 3 3 3 3 3 A A A A A A A A )
A A A
# $,< ,