Mj@ d Z ddlZddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
ddl m Z m
Z
mZmZmZmZ ddlmZ ddlmZ dd lmZmZ dd
lmZ d d lm Z d d
l m Z d dl m Z m!Z!m"Z"m#Z#m$Z$ ej% d Z&de'fdZ( G d de
Z)e G d d Z* G d de Z+ G d de+ Z, G d de+ Z-de*fd Z.d/d e/de
e,e-f fd Z0d/d e/d e/ddfd!Z1d0d#Z2d1d%e/d&e'ddfd'Z3d1d%e/d&e'ddfd(Z4d/d%e/deee/ee/ f fd)Z5defd*Z6deee/e-f fd+Z7dee/ fd,Z8d2d-Z9d2d.Z:dS )3zF
This module contains a config parser for cloudlinux-xray-autotracing
N) ConfigParser) dataclass)Enum)AnyUnionTupleIteratorListOptional)ClPwd)Feature)cpusersis_panel_feature_supported)CPAPIException ) flag_fileSSAError)umask_0set_privilegesis_xray_user_agent_active xray_versionis_kernel_version_supportedzautotracing.configreturnc 4 t t j S )zACurrently Auto tracing feature is not supported on Shared edition)r r
AUTOTRACING M/opt/cloudlinux/venv/lib64/python3.11/site-packages/ssa/autotracing/config.pyis_autotracing_supportedr ( s %g&9 : ::r c e Zd ZdZdZdZdS )Statusz
Autotracing statuses
enableddisabledN)__name__
__module__ __qualname____doc__ENABLEDDISABLEDr r r r" r" - s$ GHHHr r" c 2 e Zd ZU dZeed< eed< eed< dS )Userz
User container
uidnamehomeN)r% r& r' r( int__annotations__strr r r r, r, 6 s7
HHH
III
IIIIIr r, c j e Zd ZdZdZdZd
dZd
dZdededdfd Z dedefd
Z
deddfd Z defd Z dS )AutotracingConfigz)
Autotracing basic config parser
confNr c d t j | j t j t j z t j z t j z }n# t $ r Y dS w xY wt j |dd 5 }t j | }t j |j s!t d| j d|j dd | j 7|j | j k r't d| j d |j d
| j | | ddd dS # 1 swxY w Y dS ) a
Read self.config_file, hardened against symlink redirection without a
process-wide privilege drop (safe inside the threaded ssa-agent daemon).
Uses O_NOFOLLOW so a symlink as the final path component is refused, and
an fstat() ownership check (expected_owner_uid) so an intermediate
directory symlink that redirects the read to a root/other-user file is
refused too. A missing/unreadable file is not an error (matches
ConfigParser.read, which silently skips it); a symlink/ownership/type
violation IS refused (file is not parsed).
O_NONBLOCK + an fstat() S_ISREG regular-file check close the FIFO /
special-file DoS: O_NOFOLLOW does NOT reject a FIFO, and a tenant who
replaces the path with a writer-less FIFO would otherwise hang the
privileged read forever (a blocking syscall raises nothing, so no
per-user handler fires). O_NONBLOCK makes the open return immediately
and the S_ISREG check refuses FIFOs, sockets, devices and directories
before any read. A regular file ignores O_NONBLOCK on read, so the
subsequent parse is unaffected.
Nzutf-8replace)encodingerrorszRefusing to read z: not a regular file (mode z#o)z: owned by uid z , expected )osopen config_fileO_RDONLY
O_NOFOLLOW
O_NONBLOCK O_CLOEXECOSErrorfdopenfstatstatS_ISREGst_moder expected_owner_uidst_uid read_file)selffd
config_streamsts r _read_config_filez#AutotracingConfig._read_config_fileM s * )2; +F +VY[Ye+effBB
FF
YrGI
>
>
> *-" B<
++
r p43C p p`b`j p p p pqqq&2ryDD[7[7[ x(8xxxx_c_vxx
NN= ) ) ) * * * * * * * * * * * * * * * * * *s% A A
A A 6B"D%%D),D)c t j | j }t j | st j | dS dS )zh
If subdirectory location for autotracing config file does not exist,
create it
N)r; pathdirnamer= existsmkdir)rK subdir_paths r check_config_dirz"AutotracingConfig.check_config_dirx sP
good&677 w~~k** " H[ ! ! ! ! ! " "r keyvaluec || | j |< | t | j d 5 }| | ddd dS # 1 swxY w Y dS )D
Set given config item 'key' to given value 'value'
wN) main_sectionrV r< r= write)rK rW rX
configfiles r set_config_valuez"AutotracingConfig.set_config_value s (-T
$
$"C
(
( #J JJz " " " # # # # # # # # # # # # # # # # # #s A A!$A!c | nJ# t j t t f$ r+}t
d| j | Y d}~nd}~ww xY w | | j | S # t t j f$ rZ}t |t s!t
d| j | | j | cY d}~S d}~ww xY w)rZ z*Ignoring invalid autotracing config %s: %sNz3Ignoring invalid autotracing config value in %s: %s)
rO configparserErrorrB UnicodeDecodeErrorloggerwarningr= r\ KeyError
isinstance_builtin_defaultsget)rK rW es r get_config_valuez"AutotracingConfig.get_config_value s ^ " " $ $ $ $ "G-?@ ^ ^ ^ NNGIY[\ ] ] ] ] ] ] ] ] ^ 3)*3/ /,,- 3 3 3 a**
I$
)--c22 2 2 2 2 2 2! 3s3 A !AA "A5 5C% AC C% C%c 2 | d| dS )"
Set given status
statusN)r_ )rK rX s r
set_statusz AutotracingConfig.set_status s
h.....r c , | d S )rm rn )rk )rK s r
get_statusz AutotracingConfig.get_status s $$X...r r N)
r% r& r' r( r\ rH rO rV r r_ rk ro rq r r r r4 r4 A s L
)* )* )* )*V" " " "#C # # # # # # 3C 3C 3 3 3 3>/ / / / / / /C / / / / / /r r4 c " e Zd ZdZ fdZ xZS )AdminLevelConfigz Admin level autotracing configc ddi}d| _ t | | _ t || j d d S )Nrn r$ z /usr/share/clos_ssa/autotracingFdefault_sectionstrict)r= dictrh super__init__r\ )rK defaults __class__s r r{ zAdminLevelConfig.__init__ sM j)< "&h
43DUSSSSSr )r% r& r' r( r{
__classcell__r} s @r rt rt sG ((T T T T T T T T Tr rt c ( e Zd ZdZdef fd Z xZS )UserLevelConfigz User level autotracing config
configpathc H dt i}| d| _ t j | j | _ n# t $ r
d | _ Y nw xY wt | | _ t || j d d S )Nrn z/.ssa/autotracingFrv )
rt rq r= r; rE rI rH rB ry rh rz r{ r\ )rK r r| r} s r r{ zUserLevelConfig.__init__ s . 0 0 ; ; = => (;;; +&(gj&9&9&@D # # + + +&*D # # # + "&h
43DUSSSSSs A A"!A")r% r& r' r( r2 r{ r~ r s @r r r sU ''T3 T T T T T T T T T Tr r c t j t j } t | j | j | j S )z*
Get current user and his details
)pwdgetpwuidr; getuidr, pw_uidpw_namepw_dir)pw_entrys r who_am_ir s2 |BIKK((H !18? C CCr user_homec t }|j dk r!| rt | }nAt }n2t rt |j }nt
d |S )zF
Initialize correct config file instance depending on context
r zAuto tracing management is not available. Reason: X-Ray End-User plugin is not enabled, please contact your system administrator for help.)r r- r rt r r/ r )r current_user
conf_instances r config_instancer s ::L1 / +I 6 6MM - . .MM % & & +L,= > >MM ]
r rX userc |r t j | }n&# t $ r}t d| d |d}~ww xY w t |j |j 5 t |j | ddd dS # 1 swxY w Y dS # t $ r}t |j |d}~ww xY wt d 5 t | ddd dS # 1 swxY w Y dS ) zUser 'z ' not foundN
target_uid
target_gid )
r getpwnamrf r r r pw_gidr r ro PermissionErrorstrerrorr )rX r pw_datarj s r r_ r_ s 0 >l4((GG > > >5D55566A = > . 7>gnUUU
B
B //::5AAA
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B . . .1:&&A - . U^^ 0 0 ( ( / / / 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s^
<7< B (B B BB BB
C'B<<C"DD Dsuccessc P t }|j |j }}n%# t $ r t j d}}Y nw xY w |!t d| |||| d S t d| ||||t | d S # t $ r Y d S w xY w)Nunknownz7[audit] operation=%s status=%s uid=%d user=%s target=%sz@[audit] operation=%s status=%s uid=%d user=%s target=%s error=%r) r r- r. Exceptionr; r rd infor2 ) operationtargetrn errorcaller
caller_uid caller_names r _audit_autotracingr s 9"(*fkK
9 9 9"$)++yK
9
= KKI
KKRE
s' A A!B (-B
B%$B%Fusernamemode_allc L | r| n|rdnd} t d}n # t $ r}|j }Y d}~nd}~ww xY w |r| t t t
j j | n&# t $ r}t d|d| d}~ww xY wt d| |S )z
Enable autotracing.
If username is given, the user's config is changed in Admin's mode.
Perform some misconfiguration checks before enabling and
do not enable if some of them appear
all_usersglobalNautotracing_enablefailurern r )
misconfiguration_checksr reasonremove_custom_users_configsr_ r" r) rX r r )r r r issuerj s r enabler * s "
NXXx(M XF !!!
*( ' ) ) ) -x8888 / QRSSSS
+V444 Ls'
8381A. .
B8B Bc | r| n|rdnd} |r| t t t j j | n&# t
$ r}t
d|d| d}~ww xY wt
d| dS )ze
Disable autotracing.
If username is given, the user's config is changed in Admin's mode
r r Nautotracing_disabler r )r r_ r" r* rX r r )r r r rj s r disabler D s
"
NXXx(M XF *( ' ) ) ) .9999 0&RSTTTT
,f55555s 1>
A!A A!c t d}n # t $ r}|j }Y d}~nd}~ww xY w| w t t | dfS # t j $ r"}t t | |d}~ww xY wt |fS )zk
Get status of autotracing.
If username is given, the status for a particular user is returned
N)
r r r r r get_homedirrq NoSuchUserExceptionr2 rt )r r rj s r rn rn T s
!!!
*"577#6#6x#@#@AALLNNPTT T( * * *3q66"" ) * ( ( * *E 11s(
.).AA6 6B' B""B'c \ t S # t $ r t cY S w xY w)zP
Get panel users via cpapi, ignoring exceptions like NotSupported, etc.
)r r tupler r r _panel_usersr h s9 yy wws
++c # K t D ]M} t | }n# t j $ r Y 6w xY w| t | fV NdS )zT
Iterator over all users on the server along with their autotracing configs
N)r r r r r )r _homedirs r user_configsr r s . . ww**400HH( H OH------- . .s !6AAc g } t D ]u\ }} | t j j k r| | C# t $ r&}t d|| Y d}~nd}~ww xY w| S )a3
Get list of disabled users.
This is a best-effort daily pass over UNTRUSTED per-tenant config files.
Each user's status is read independently and ANY per-user config failure
(refusal, OSError, parse error, non-UTF-8 decode, or any other unexpected
exception) is logged with the user and the exception, then skipped instead
of aborting the whole pass. This closes the DoS prong of F-02: a single
tenant who points ``~/.ssa/autotracing`` at a foreign-owned target, or
writes a pathological/binary config into their own home dir, can no longer
break the daily decision-maker pass for every other user. A user whose
config cannot be read is simply not counted as disabled (safe default) and
the pass continues; genuine bugs remain diagnosable via the logged
exception.
zLSkipping user %s in disabled_users pass: cannot read autotracing config (%s)N) r rq r" r* rX appendr rd re )r$ r userconfrj s r disabled_usersr ~ s H *nn ( ""$$(===))) NNiksuv w w w HHHH Os gnUUU
L
L7>>"2">?? LI . :;;;HRW__-=-I J JKKK
L
L
L
L
L
L
L
L
L
L
L
L
L
L
L
. . .1:&&A - . . .s< CA4C8 CC C C C
C4C//C4c 4 dt dt dt fd} t s | dd t s | dd t | d
d t
j t s | d d
d S )z(Additional checks for known malfunctionsr fixr c 4 | d| d}t |d S )Nz
. You should z" in order to get Auto Tracing workre )flagr )r r messages r
make_errorz+misconfiguration_checks..make_error s+ QQ#QQQi0000r z@Your current server setup is unsupported by Auto Tracing featurez*switch Control Panel or CloudLinux editionz1Your kernel does not support throttling detectionzupdate the kernelNzX-Ray is not installedz
install X-Rayz Slow Site Analyzer is disabledz enable it) r2 r r r r r; rQ r r )r s r r r s 13 1S 1X 1 1 1 1
$ % %
j N 8
' ( (
j ?
~~ j1?CCC 7>>) $ $ Hj9;GGGH Hr )N)r N)NFrr );r( loggingr; r rE ra r dataclassesr enumr typingr r r r r
r clcommon.clpwdr clcommon.constr
clcommon.cpapir r clcommon.cpapi.cpapiexceptionsr internal.constantsr internal.exceptionsr internal.utilsr r r r r getLoggerrd boolr r" r, r4 rt r r r2 r r_ r r r rn r r r r r r r r r sL
% % % % % % ! ! ! ! ! ! > > > > > > > > > > > > > > > > " " " " " " > > > > > > > > 9 9 9 9 9 9 * * * * * * * * * * * *
/ 0 0;$ ; ; ; ;
T r/ r/ r/ r/ r/ r/ r/ r/j T T T T T( T T TT T T T T' T T T*D$ D D D D s e4Do4U.V 40 0C 0s 0d 0 0 0 0&
< S 4 D 4
6
6c
6D
6T
6
6
6
6 2 2S 2HU3
3E-F$G 2 2 2 2(e .huS/%9 :; . . . .S 6
.
.
.
. H H H H H Hr