Mjo d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddl m Z m Z m Z ddl m!Z!m"Z"m#Z$ G d d Z%ddZ&dS )zA
This module contains classes implementing SSA Manager behaviour
N)contextmanager)iglob)
disable_quota)OptionalTuple )load_validated_parserload_configuration) flag_file)SSAManagerError) ssa_version)
AutoTracer)
DecisionMaker)
INI_FILE_NAMEINI_USER_LOCATIONS_BASEis_excluded_path)$copy_inis_to_website_isolation_paths(remove_inis_from_website_isolation_pathsregenerate_inis_for_userc J e Zd ZdZd Zd Zedefd Ze de
fd Z e de fd Z
e de fd Zd ede fd
Zd0d edej fd
Zd ededeej fdZdedefdZdefdZdefdZdefdZdefdZdefdZdede
fdZ dede defdZ d edefd Z de e e!e!f ef fd Z"e#d Z$d e!d!e!d edd"fd#Z%d1d$Z&de e e!e!f ef fd%Z'd1d&Z(d1d'Z)d1d(Z*defd)Z+d1d*Z,d1d+Z-defd,Z.d1d-Z/d.edd"fd/Z0d"S )2Managerz
SSA Manager class.
c t j d | _ t | _ ddg| _ ddg| _ d| _ d| _ t | _
t t t j f| _ d S )Nmanagerz!usr/lib64/php/modules/clos_ssa.soz0usr/lib/x86_64-linux-gnu/php/modules/clos_ssa.soz lib64/php/modules/clos_ssa.soz,lib/x86_64-linux-gnu/php/modules/clos_ssa.soz lib/php/extensions/*/clos_ssa.so)z /opt/alt/php[0-9][0-9]/link/confz+/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dz$/opt/plesk/php/[0-9].[0-9]/etc/php.dz'/usr/local/php[0-9][0-9]/lib/php.conf.dzM/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dzA/usr/share/cagefs-skeleton/usr/local/php[0-9][0-9]/lib/php.conf.d)logging getLoggerloggerr
ini_file_namemodule_patterns_with_usrmodule_patterns_no_usr module_glob_pattern_directadminwildcard_ini_locationsr wildcard_ini_user_locationsOSError
ValueError
subprocessSubprocessErrorsubprocess_errorsselfs B/opt/cloudlinux/venv/lib64/python3.11/site-packages/ssa/manager.py__init__zManager.__init__. sx ' 22 *
0 >)
%
, :'
# 0R,'
# ,C("):z7Q!R c J t j } t j | j }n# t
$ r d}Y nw xY wd d | D }| j d||||| d S # t
$ r Y d S w xY w)Nz c 3 * K | ]\ }}|d |V dS )=N .0kvs r* z!Manager._audit..O s1 #Q#QAqqq!!$4#Q#Q#Q#Q#Q#Qr, z0[audit] operation=%s status=%s uid=%d user=%s %s)
osgetuidpwdgetpwuidpw_name Exceptionjoinitemsr info)r) operationstatusdetailsuidusername detail_partss r* _auditzManager._auditH s )++C
' <,,4
'
'
'&
' 88#Q#Q #Q#Q#QQQL K BIvWZ\dfr
DD s- B 0 B ?B ?AB
B"!B"returnc ddi}| d | D t j | S )z@
Form a success json response with given kwargs
resultsuccessc i | ]\ }}|| S r1 r1 r2 s r*
z$Manager.response..\ s = = =daQ = = =r, )updater> jsondumps)argskwargs raw_responses r* responsezManager.responseV sI
!), = =fllnn = = =>>>z,'''r, c J t j t S )z
Is SSA enabled
)r7 pathisfiler r( s r* _enabledzManager._enabled_ s
w~~i(((r, c
ddhS )zK
Configuration settings required Request Processor restart
requests_duration ignore_listr1 r( s r* _restart_required_settingsz"Manager._restart_required_settingsf s
$]33r, c
h dS )N> time correlationdomains_numberrequest_numbercorrelation_coefficientr1 r( s r* solo_filtered_settingsz Manager.solo_filtered_settingsm s eeeer, settingsc 6 | j | S )z
SSA Agent requires restart in case of changing these configuration:
- requests_duration
- ignore_list
)r[ intersection)r) rc s r* _restart_requiredzManager._restart_requiredq s .;;HEEEr, Fcommandc t j dd|gdd| }| j d| d n# t j $ r}| j dt
|j t
|j t
|j |j |j |j |j
d t d
|j d |j d |j p|j
d
}~w| j $ rS}| j dt
| dt
| i t d| d| d
}~ww xY w|S )z
Run /sbin/service utility to make given operation with SSA Agent service
:command: command to invoke
:check_retcode: whether to run with check or not
:return: subprocess info about completed process
z
/sbin/servicez ssa-agentTcapture_outputtextcheckz
ssa-agent z
succeededz$SSA Agent %s failed with code %s: %s)cmdretcodestdoutstderrextraz
SSA Agent z failed with code z: Nz&Failed to run %s command for SSA AgenterrzFailed to run z for SSA Agent: )
r% runr r? CalledProcessErrorerrorstrrm
returncodero rp r r' )r) rg
check_retcoderI es r* run_service_utilityzManager.run_service_utilityy s Q ^ +w7SW_l F
K =' = = = > > > >, p p p K 6AE
AL!!AH
e \]\dee
""nqu"n"n "n"nXYX`Xldedl"n"noo o% Q Q Q K FG ]bdghidjdj\k l l l!"O7"O"OA"O"OPP P Q
s# 9= E B C((
E5AEEunitc t j d||gddd }| j d|||j |S # | j $ r5}| j d||t | Y d}~dS d}~ww xY w)u
Run systemctl on a specific unit. Failures are logged but never raised
— the socket unit may be absent on legacy / non-systemd installs, and
a best-effort attempt is enough for shutdown paths.
:return: the CompletedProcess on success (any return code, since
``check=False``), or ``None`` if systemctl could not be spawned at
all (e.g. missing binary). Callers must guard ``.returncode``
access against ``None``.
z/bin/systemctlTFri zsystemctl %s %s rc=%dz!Failed to run systemctl %s %s: %sN)r% rt r r? rx r' warningrw )r) rg r| rI rz s r*
run_systemctlzManager.run_systemctl s ^%5w$EVZaemrsssF K 4gtVEV W W WM% K CWdTWXYTZTZ [ [ [44444 s >A
B *A;;B rP c
t }fdt | D }| | nv# t
$ ri}| j ddt | i | dd|t | t d| d }~ww xY w| dd
| | r| d d
|
S )z
Change SSA config and restart it.
:args: dict to override current option values
:return: JSON encoded result of the action
c $ i | ] \ }}|v ||
S r1 r1 )r3 r4 r5 rP s r* rL z&Manager.set_config.. s% VVVDAqAQUII1aIIIr, z Failed to update SSA config filers rq
set_configfailure)previous requestedrv z"Failed to update SSA config file: NrJ )r newrestartTry )r dictr> overridewrite_ssa_confr# r rv rw rF r rf r{ rS )r) rP configprevious_valuesrz s ` r* r zManager.set_config sW '((VVVVD ,@,@,F,F,H,HVVV L ! ! # # # # L L L K @PSTUPVPV X X X KK i/UYadefagagK h h h!"Jq"J"JKK K L
L)o4 PPP ! !$ ' ' D $ $Yd $ C C C}} s %A: :
C-A$C((C-c J t }| | S )zV
Get current SSA config.
:return: JSON encoded current config
)r )r
rS )r) full_configs r*
get_configzManager.get_config s#
)** }}K}000r, c D | j rdnd}| | S )zY
Get current status of SSA.
:return: JSON encoded current status
enableddisabled)
ssa_status)rW rS )r) rA s r* get_ssa_statuszManager.get_ssa_status s(
#m;}}}///r, c b | j }|sw | | | n9# t $ r,}| dddt
| d}~ww xY w| dd|rdnd | S ) a
Enable SSA:
- add clos_ssa extension for each PHP version on server
- add clos_ssa extension into cagefs for each user and each ver
- start SSA Agent (if it is not already started)
- restart Apache (etc.) and FPM, reset CRIU images
- create flag_file indicating that SSA is enabled successfully
:return: JSON encoded current status
enable_ssar r )previous_staterv NrJ r )r )rW
generate_inisstart_ssa_agent create_flagr< rF rw r )r) was_enabledrz s r* r zManager.enable_ssa s m
""$$$$$&&& """"
L)JVYZ[V\V\ ]]]
L)'A99A>c
| j }| dk }|s"|r | j dt | | | n># t $ r1}| dd|rdnd|t | d}~ww xY w| dd |rdnd|
| S ) u
Disable SSA, authoritatively, regardless of the flag file state.
Historically this method short-circuited when the flag file was
absent, which left ssa-agent.service running via socket activation
whenever the flag file had been deleted out-of-band (CLPRO-3076).
We now always reconcile real state: stop+disable the agent service
AND its socket, remove any clos_ssa.ini files present, and clear the
flag file if it exists. Inconsistency between the flag file and the
runtime state is logged as a warning so future drift can be traced.
Ordering: ``stop_ssa_agent`` runs **first**, so a later failure (e.g.
ini removal raising on a filesystem error) cannot leave the
OOM-prone daemon running — stopping the agent is the core guarantee
this method exists to provide.
- stop+disable SSA Agent service and ssa-agent.socket
- remove clos_ssa extension for each PHP version on server
- remove clos_ssa extension from cagefs for each user and each ver
- remove flag_file indicating that SSA is enabled
:return: JSON encoded current status
activeup disable_ssa: inconsistent state — flag file %s is missing but ssa-agent is active; reconciling from real state disable_ssar r r )r agent_activerv NrJ )r r ) rW status_ssa_agentr r~ r stop_ssa_agentremove_clos_inis remove_flagr< rF rw r )r) r r rz s r* r zManager.disable_ssa s3 . m ,,..(: | K G
! ! ! ! ! # # # KK ,7 GyyZ )!ff
9+5]YYS]lx
""$$$s . s0 ZZZzsE3E
((**ZZZr, r r )r versionrA agent_status autotracing)r
r> rS r
rW r r get_stats)r) _configs r* r zManager.get_stats s [Z=O=Q=Q=W=W=Y=YZZZ}} MM $
=99: ..00" ..00
r, dir_pathc t | S )z=
Check if directory path should be excluded.
)r )r) r s r* unused_dir_pathzManager.unused_dir_path( s )))r, php_rootpatternsc |D ]E}t j || }t j | r|c S F|r&t j ||d ndS )z
Search for clos_ssa.so module in php_root using a list of patterns.
Returns the first found module path, or the first pattern as expected path if none exist.
r )r7 rU r= exists)r) r r pattern module_paths r* _find_module_in_rootz Manager._find_module_in_root. su
# #G ',,x99Kw~~k**
#""""
# 7?Frw||Hhqk222BFr, ini_pathc | d r:d|v r6| d d }| || j S | d rPd|v rL| dd }| d d }| || j S | d r:d|v r6| d d }| || j S | d
r:d|v r6| d d }| || j S | d rjd |v rf| d d }t
t t j
|| j }|r|d S d
S | d rjd |v rf| d d }t
t t j
|| j }|r|d S d
S | d rXd|v rT| d d d d }d| }| || j S d
S )z
Determine the path to clos_ssa.so module based on ini_path.
Returns the expected module path, or empty string if not found.
z /opt/alt/phpz
/link/confr z4/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-phpz/root/etc/php.dz"/usr/share/cagefs/.cpanel.multiphpz/usr/share/cagefs-skeletonz
/etc/php.dz/opt/cpanel/ea-phpz/opt/plesk/php/z(/usr/share/cagefs-skeleton/usr/local/phpz/lib/php.conf.dr z/usr/local/phpz /var/cagefs/z/etc/cl.php.d/alt-phpr /z&/usr/share/cagefs-skeleton/opt/alt/php)
startswithsplitr r replacer listr r7 rU r= r )r) r r
skeleton_pathpossible_pathsphp_ver
skeleton_roots r* get_module_pathzManager.get_module_path: s ~ . . V<83K3K ~~l33A6H,,Xt7TUU U
V W W V!X-- $ , ,-QSo p pM$**<88;H,,Xt7TUU U 3 4 4 V9Jh9V9V ~~l33A6H,,Xt7TUU U 0 1 1 Tlh6N6N ~~l33A6H,,Xt7RSS S I J J O`dlOlOl ~~&788;H !% Xt?c(d(d"e"e f fN
)%a((2
/ 0 0 5F(5R5R ~~&788;H !% Xt?c(d(d"e"e f fN
)%a((2 ~ . . [3Jh3V3V nn%<==a@FFsKKANG NW N NM,,]DHHHHH ! K$$( ! H
I I Is 2B%B>=B>c # 6 K t j } t j t j | j | n+# t t f$ r t j g Y nw xY wt j | t j
| dV t j
d t j d t j | dS # t j
d t j d t j | w xY w)z
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr ) r7 getgroups
initgroupsr9 r: r; KeyErrorr# setgroupssetegidseteuid)r) rC gid saved_groupss r*
_user_contextzManager._user_context s |~~ '
!
cl3 / / 7==== g&
!
!
! R
! JsOOO JsOOO EEE JqMMM JqMMM L & & & & &
JqMMM JqMMM L & & & &s) ,A C %A-*C ,A--/C >DrC r Nc
| | }|s | j d| dS t j | s| j d|| t j || j }t j | r | || 5 t j
| | j d| ddd n # 1 swxY w Y n@# t $ r3}| j d|t | Y d}~nd}~ww xY wdS t j || j }| || 5 t 5 | j d| t j |t j t j z t j z t j z d }nW# t& $ rJ}| j d|t | Y d}~ddd ddd dS d}~ww xY wt j |d 5 } | d
ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd dS # 1 swxY w Y dS ) zB
Enable SSA extension for single ini_path (given)
zUnable to update file %s, possible permission misconfigurationz7Exception on generating clos_ssa.ini: "%s", error: "%s"N Finished!)
r r? r r PermissionErrorr< rv rw r r )r) rC r r rz s r* r zManager.generate_inis s
;<<<$($7$7$9$9 JS#
((c8<<<<"
!acklll
!!"[]egjklgmgmnnn
-T-?@@@ %%%%%s A%B37 B3 )B..B3c # K | D ]O\ \ }}}t j | D ]2}| j |vr ||ft j || fV 3PdS )z
Generator function searching for clos_ssa.ini files
in all existing Additional ini paths
Returns tuple of (uid, gid) and path.
N)r r7 listdirr rU r= )r) rC r r names r* find_clos_iniszManager.find_clos_inis s %)$7$7$9$9 ? ? JS#
8,,
?
?%T11 Cj"',,x">">>>>>>
? ? ?r, c | j d | D ]\ \ }}} | || 5 t j | ddd n # 1 swxY w Y L# t $ r3}| j d|t | Y d}~d}~ww xY wt | j | j d dS )z[
Remove all gathered clos_ssa.ini files, including per-website directories
z Removing clos_ssa.ini files...Nz5Exception on removing clos_ssa.ini: "%s", error: "%s"r )
r r? r r r7 r r< exceptionrw r )r) rC r clos_inirz s r* r zManager.remove_clos_inis s?
9:::$($7$7$9$9 JS#
''S11 ( (Ih'''( ( ( ( ( ( ( ( ( ( ( ( ( ( (
%%&]_gilmnioioppp
11CDDD %%%%%s; A;A/# A;/A3 3A;6A3 7A;;
B8)B33B8c | dd | d }|j r| dd dS | dd dS ) a
Start SSA Agent service or restart it if it is accidentally
already running, and (re-)enable it so it survives a reboot.
``enable`` is the symmetric counterpart of the ``disable`` performed
in ``stop_ssa_agent``: ``disable_ssa`` disables the unit, so
``enable_ssa`` must re-enable it, otherwise enabling SSA after a
previous disable would not persist across the next boot (CLPRO-3076).
On a fresh install the unit is already enabled, so this is a no-op
there.
enablessa-agent.servicerA startTr r Nr r{ rx r) r s r* r zManager.start_ssa_agent sx
8%8999//99 " D $ $WD $ A A A A A $ $Yd $ C C C C Cr, c 0 | dd | dd | d }|j s| dd | dd | dd | dd | dd dS # | dd | dd | dd | dd w xY w) u]
Stop SSA Agent and make the disabled state survive a reboot.
Stopping the service alone is not enough on systemd, for two reasons:
* ``ssa-agent.socket`` keeps listening and will re-spawn the service
the moment a PHP worker writes to /opt/alt/clos_ssa/run/ssa.sock.
* ``ssa-agent.service`` is shipped *enabled* (``WantedBy=multi-user.target``)
and pulls the socket back up via ``Requires=ssa-agent.socket`` on
the next boot — so a plain stop reverts at reboot, and the agent's
periodic ssa.db maintenance can OOM again (CLPRO-3076 / CLPRO-3077).
We therefore stop *and disable* both units. ``disable`` only removes
boot-time wants symlinks, so it is what makes the change persistent;
disabling the socket also prevents socket-activation from starting a
disabled service (``disable`` does not block socket activation on its
own). ``enable_ssa`` re-enables the service via ``start_ssa_agent``.
Belt-and-suspenders ordering:
1. **Socket-first** stops socket activation so nothing can spawn a
fresh agent process between the service stop and our own socket
stop (closes a narrow race window). The ``run_systemctl`` helper
is best-effort and never raises.
2. **try/finally** around the service-utility calls re-asserts the
full stop+disable of *both* units on the failure path, so if
``run_service_utility`` throws ``SSAManagerError`` (e.g. systemd
stop timeout, ``/sbin/service`` missing) the unit cleanup still
runs — guaranteeing the CLPRO-3076 fix even on degraded systems.
The fallback ``stop`` goes through ``/bin/systemctl`` (a different
binary from ``/sbin/service``), so it can succeed where the
primary stop failed.
stopzssa-agent.socketdisablerA Tr r Nr r s r* r zManager.stop_ssa_agent! s9 H
6#5666 9&8999 ? 33H==L *
E((t(DDD
v'9 : : : v': ; ; ; y*< = = = y*= > > > > >
v'9 : : : v': ; ; ; y*< = = = y*= > > > >s 3B; ;ADc Z | dd n# t $ r Y dS w xY wdS )z:
Get SSA Agent status: active or inactive
rA Tr inactiver )r{ r r( s r* r zManager.status_ssa_agentY sJ $ $XT $ B B B B :: xs
((c t t d 5 ddd n # 1 swxY w Y | j dt d dS )zE
Create a flag file indicating successful enablement
r N
Flag file z created)r r r r? r( s r* r zManager.create_flagc s )S
!
! 9i999:::::s $((c t j t | j dt d dS # t
$ r=}| j dt dt | Y d}~dS d}~ww xY w)z:
Remove a flag file indicating enablement
r z removedz removal failed: N)r7 r r r r? r# r~ rw )r) rz s r* r zManager.remove_flagk s S Ii K =) = = = > > > > > S S S K QY Q QQ Q Q R R R R R R R R R Ss r s
% % % % % % " " " " " " " " " " " " " " D D D D D D D D ) ) ) ) ) ) 0 0 0 0 0 0 ' ' ' ' ' ' * * * * * * 1 1 1 1 1 1
f F f F f F f F f F f F f F f FR r,