C!Mjx7 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
m Z m Z m
Z
d dlmZ d dlmZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lm Z m Z m Z m Z d d l m!Z! d d l"m#Z$ ej% e& Z'd
Z(de)de e* fdZ+de)de e* fdZ,de)de)de e* fdZ-de de*fdZ.de de)fdZ/de fdZ0de*de1fd Z2d e*de
e1e1e3f fd Z4d Z5d e)d!e e* de*fd"Z6 d+d e)d!e e* de e* fd#Z7 d,de)d%e e* d&e)de
e e* e3f fd'Z8de e
e*e*f fd(Z9d)ej: de e
e*e*f fd*Z;dS )- N)Logger)ListOptionalTuple)drop_privileges) run_commandExternalProgramFailedis_user_present)cpusers)get_main_username_by_uid)REDIS_SERVER_BIN_FILE) WposError)
USER_WPOS_DIRis_run_under_userdrop_permissions_if_neededrun_in_cagefs_if_needed) NoPackage)gettextz /opt/alt/redis/bin/redis-cli file_pathreturnc d}t j | sd} t || gd }| d }|d d d }g }| d D ]G} | t | 8# t $ r Y Dw xY w|S # t t f$ r Y nw xY wg S )
z
Retrieves list of PID list processes, which uses file (using fuser utility)
This can find any process (for example php), not only redis service process
:param file_path: Filename to check
:return: PID list
z/usr/bin/fuserz /sbin/fuserFreturn_full_output
r : ) ospathexistsr splitstripappendint
ValueErrorr
IndexError)r fuser_binarystd_out
lines_list
s_pid_listpid_lists_pids N/opt/cloudlinux/venv/lib64/python3.11/site-packages/clwpos/daemon_redis_lib.py_get_pids_for_filer. 2 s $L
7>>, ' ' %$
|Y 7ERRR ]]4((
]((--a06688
%%c** E
EKKMM 2 23333
!: .
Is6 A4C! 4CC!
C C! C C! !C54C5usernamec t dddd| gd }n# t $ r g cY S w xY w| d }t | dk rg S g }|d d
}|D ]^}| }|rF | t
| N# t $ r Y Zw xY w_|S ) zz
Update PID list in cache for user using /bin/ps utility
:param: username: Username to scan
:return: None
z/bin/psz-opidz-uFr r r N)r r r! lenr" r# r$ r% )r/ r( r)
user_pid_listlines r- _get_user_pidsr6 R s y$tX F[`aaa t$$J
: MABB J zz||
$$S %6%67777
s ((<4B11
B>=B>home_dirc t j |t d }t | }t | }g }|D ]}||v r| | |S )z
Get redis PID list for user
:param username: user name
:param home_dir: User's homedir
:return: PID list or [] if user has no redis
redis.sock)r r joinr r. r6 r# )r/ r7 redis_socket_file
pid_list_sock user_pidsr+ r1 s r- _get_user_redis_pidsr> r sn X}lKK&'899M x((IH ! ! ) OOC O _loggerr1 c t st d t j |t j t
j d t j |t j n# t $ r Y nw xY wn;# t $ r.}|
d|t | Y d}~nd}~ww xY w| dt | dS )zj
Kill process by pid
:param _logger: Logger to log errors
:param pid: Process pid to kill
z;Internal error! Trying to kill process with root privileges z+Can't kill redis process, pid %s; error: %sNzKilled process with pid=%s)
r r r killsignalSIGTERMtimesleepSIGKILLOSErrorwarningstrinfo)r@ r1 es r- kill_process_by_pidrN s WUVVVT
V^$$$
1
GC ( ( ( ( D T T TEsCPQFFSSSSSSSST LL-s3xx88888s; 3B A3 2B 3
B =B ?B B
B<$B77B<loggerc H t | sdS t j | }t |j |j }| dt | | t | 5 |D ]}t | | ddd dS # 1 swxY w Y dS )zq
Kill all user's redice processes
:param logger: Logger to log errors
:param username: User name
Nz%Killing redis with pid=%s for user=%s)
r
pwdgetpwnamr> pw_namepw_dirrL rK r rN )rO r/ user_pwdredis_pid_list redis_pids r- _kill_all_redises_for_userrX s 8 $ $ |H%%H)(*:HOLLN
KK7^9L9LhWWW " " 3 3' 3 3I 2 2 2 2 33 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s 3BB Bc t }nN# t t t t f$ r.}| dt
| Y d}~dS d}~ww xY w|D ]}t | | dS )z[
Find and kill lost redices for all panel users
:param logger: Daemon's logger
z"Can't get user list from panel: %sN)r rI IOErrorr& r rJ rK rX )rO usersrM r/ s r- kill_all_users_redisesr\ s
Wj) 4 ;SVVDDD 5 5"6844445 5s A #AA uidc
T t | }t j | }n9# t $ r, t dt
| Y dS w xY wt j |j
t d }t d|dg}t | 5 t | }t d|t
|j t
|j t
|j ddd n # 1 swxY w Y |j dk S ) a$
/opt/alt/redis/bin/redis-cli -s /home/cltest1/.clwpos/redis.sock ping
Could not connect to Redis at /home/cltest1/.clwpos/redis.sock: No such file or directory
echo $?
1
/opt/alt/redis/bin/redis-cli -s /home/cltest1/.clwpos/redis.sock ping
PONG
echo $?
0
4Redis check error for user %s. No user with such uidFr9 z-spingzDRedis health check for user=%s, return code=%s, stdout=%s, stderr=%sNr )r rQ rR KeyErrorrO rJ rK r r r: rT r _REDIS_CLI_BIN_FILEr r rL
returncodestdoutstderr)r] r/ rU redis_socket_pathredis_ping_cmdoutputs r- redis_socket_health_checkri sR +C00<)) MsSVxxXXXuu X_m\RR)41BFKN #H - - ( (( 88 Z )**
&&
&& ( ( (( ( ( ( ( ( ( ( ( ( ( ( ( ( ( !!s" #& 2A A $A$DDDuser_idc " t j | }|j }n\# t $ rO t dt
| ddt d dt
| idfcY S w xY w t | }ne# t $ rX}t d|t
| ddt d t
| |d dfcY d
}~S d
}~ww xY w|sddt d d |d dfS ddd
difS )a
Check user's redis is alive
:param user_id: uid to check sockets
return True/False - redis alive/not alive
:return: Tuple: (redis is working/not working, is user present, errors dict)
error - (False, False {"result": "error", "context": "..."})
r_ Fz9Redis check error for user with uid %(uid)s. No such userr] resultcontextz+Redis check error for user %s. Error is: %sTz1Redis CLI start error %(error)s for user %(user)s)erroruserNz1Redis CLI check error %(error)s for user %(user)sz=Redis is not pingable for user, most likely it is not startedrm success)
rQ getpwuidrS ra rO rJ rK _ri Exception)rj rU r/ is_redis_aliverM s r- is_user_redis_aliverv s @<((# @ @ @MsSZ||\\\e*e(f(f*/W )> @ @ @ @ @ @@
Q27;; Q Q QDhPSTUPVPVWWWd*](^(^47FFH)N)N Q Q Q Q Q Q Q Q QQ
<dq)\']']2q19); ); < < < < ), ,,s/ AA76A7;B
C-A
C("C-(C- redis_pid_filename expected_uidc t j | t j t j z t j z } t j | }t
j |j st d ||j
|k rt d t j |t }t j
| n# t j
| w xY wt | dd S )a
Read and parse the redis pid from the pid file in a hostile-input-safe way.
The pid path lives under the user-owned /.clwpos/, so when the root
daemon reads it the file is attacker-controlled. Open with O_NOFOLLOW so a
symlink planted at the path is not followed (raises OSError/ELOOP), fstat to
require a regular file owned by the expected user (rejects FIFO/device/cross
-owner targets that could block or mislead root), and read a bounded length.
:param redis_pid_filename: Redis PID filename
:param expected_uid: UID the pid file must be owned by, or None to skip the
owner check (caller already runs as the target user)
:return: parsed pid
:raises OSError, ValueError: on any guard failure or parse error
z$redis pid file is not a regular fileNz redis pid file owner mismatchasciistrict)r openO_RDONLY
O_NOFOLLOW O_CLOEXECfstatstatS_ISREGst_moderI st_uidread_REDIS_PID_FILE_MAX_BYTEScloser$ decoder" )rx ry fdstraws r- _read_pid_from_pid_filer s
#R[2=%@2<%O P PB
Xb\\|BJ'' B@AA A # \(A(A9:: :gb344
szz'8,,2244 5 55s A2C Cc t d D ]b} t | | }t j |d |c S # t t
t t f$ r t j d Y _w xY wdS )ai
Get redis process PID from redis pid file. Wait up to 10 seconds
:param redis_pid_filename: Redis PID filename
:param expected_uid: UID the pid file must be owned by when read in root
context (None skips the owner check for already-dropped callers)
:return: Redis PID or None on error (pid file absent/invalid or redis not started)
d r g?N)
ranger r rC rI rZ r% UnicodeDecodeErrorrF rG )rx ry ir1 s r- &_get_redis_pid_from_pid_file_with_waitr s 3ZZ )* rN rX r\ boolri dictrv r r r r r Processr r? r- r s
( ( ( ( ( ( ( ( ( ( * * * * * *
# " " " " " 3 3 3 3 3 3 2 2 2 2 2 2 / / / / / / 5 4 4 4 4 4
8 $ $4 # $s) @ S T#Y @3 # $s) "9 9c 9 9 9 9,3v 3 3 3 3 3$ 56 5 5 5 5"3 "4 " " " ": - -tT4/?)@ - - - -B 6 68C= 6UX 6 6 6 6: JN s 9A# RZ[^R_ . 6:., .,3 .,08
.,/2.,>CHSMSWDW>X., ., ., .,b #tE#s(O, # # # # FN xc3h/H r?