9Mjz
& d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlmc mZ ddlmZ ddlmZmZ ddlmZ ddlmZ ddlmZm Z m Z m Z ddl m Z m!Z!m"Z" ddl#Z#dd l$m%Z% dd
l&m'Z' dd l(m)Z) dd l*m+Z+m,Z,m-Z-m.Z. dd
l/m0Z0 ddl1m2Z2 ddl3m4Z4 ddl5m6Z6 ddl7m8Z8 ddl9m:Z; ddlZ>m?Z?m@Z@mAZAmBZB ddlCmDZDmEZE ejF d ZGeHeIe jJ fZKde de fdZLde de fdZMde de fdZNdeOfd ZPdefd ZQd eOdefd ZRdeSfd ZTd!e!eU deSfd"ZVd!e!eU deSfd#ZWdeSfd$ZXe?fd%eSd&eSddfd'ZYe?fd&eSdeSfd(ZZdeSfd)ZZde"e[ fd*Z\eNdeSfd+ Z]d,eSde"eS fd-Z^de"eS fd.Z_d\d/Z`e@fd0eSde"eS fd1Za ejb d2 Zcd3eSddfd4Zdd3eSd5eedeefd6Zfd7eSd8eSddfd9Zgd:eSdd;fd<Zhd=eOdeOfd>Zid3eSde"ej fd?Zkd3eSde"eS fd@Zld]d3eSddfdAZmd3eSde[fdBZnde[fdCZode[fdDZpdEe[ddfdFZqde[fdGZrde[fdHZsde[fdIZtd,eSde[fdJZudK Zved^dN Zwed_dPeSdQe[fdR Zxed`dSeOddfdT Zye dadWeOdXeOdSeOddfdY ZzedZ Z{d[ Z|dS )bzB
This module contains helpful utility functions for X-Ray Manager
N)contextmanager)date timedeltawraps)glob)socketfromfdAF_UNIX SOCK_STREAM)CallableListOptional)AtexitIntegration)LoggingIntegration)Feature)is_panel_feature_supportedget_cp_description getCPNameis_wp2_environment)get_cl_edition_readable)UIConfig)drop_privileges)get_rhn_systemid_value)php_get_vhost_versions_user)gettext )
sentry_dsnlocal_tasks_storage
agent_file
logging_leveljwt_token_locationuser_agent_sock) XRayErrorXRayManagerExitutilsfuncreturnc F d t fd }|S )zf
Decorator aimed to update ini file in cagefs-skeleton
Applies to task.add nd task.remove
c t j | d j d }| d r8t d r)t j d|dd }n| d rt d rt j d |dd }t j t j | s1t j t j | ndS t j | st j | rt j
| r t d
d |i dS t j
| dS # t $ r7}t d
|t | d Y d}~dS d}~ww xY wdS t j
| r t dd |i dS t! |d 5 }| }ddd n # 1 swxY w Y t j |t j t j z t j z t j z d } t j || t j | dS # t j | w xY w# t $ r7}t d|t | d Y d}~dS d}~ww xY w)zd
Copy ini file to cagefs-skeleton
Action takes place for cPanel ea-php only
r zxray.iniz /opt/cpanelz/usr/share/cagefsz"/usr/share/cagefs/.cpanel.multiphpr Nz
/usr/localz/usr/share/cagefs-skeletonz-Refusing to unlink symlink in cagefs-skeletonxray_iniextraz'Failed to unlink ini in cagefs-skeleton)r+ errz0Refusing to copy over symlink in cagefs-skeletonrbi z'Failed to copy ini into cagefs-skeleton)ospathjoin ini_location
startswithr existsdirnamemkdirlexistsislinkloggerwarningunlinkOSErrorstropenreadO_WRONLYO_CREATO_TRUNC
O_NOFOLLOWwriteclose)args original_ini skeleton_iniesrc src_bytesfds J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/utils.pyupdatez skeleton_update..updateJ s
w||DG$8*EE " "= 1 1 d#7% 7% 7<<(L(4QRR(8 : :LL
$
$\
2
2 t,8. 8. 7<<(D(4QRR(8 : :L7>>"'//,"?"?@@
8 66777 Fw~~l++ 6w|,,
:7>>,// NN#R*4l)C # E E EF:Il+++++ : : :NN#L6B14Q*9 *9 # : : : : : : : : ::
:
:
67>>,// NN#U*4l)C # E E EF ,-- + #
I+ + + + + + + + + + + + + + +W\ [2: 5
BR] R "$ $!HR+++HRLLLLLBHRLLLL
6
6
6 H2>-0VV&5 &5 6 6 6 6 6 6 6 6 6
6ss 3G
H
,HH
=L L J 4 L JL JA
L K> (L >LL
M!,MMc " | i | | dS )
Wraps func
N )rG kwargsr' rO s rN wrapperz skeleton_update..wrapper s)
d f
r )r' rT rO s ` @rN skeleton_updaterV D sK 36 36 36j 4[[ [ NrU c P d d t fd }|S )zs
Decorator aimed to update DBM storage with fake_id:real_id mapping
Applies to task.add nd task.remove
c | d }t t 5 }|j ||j < ddd dS # 1 swxY w Y dS )z-
Update DBM storage contents
r N) dbm_storager task_idfake_id)rG
task_instance task_storages rN rO z"dbm_storage_update..update s Q
,
-
- H 2?2GL . / H H H H H H H H H H H H H H H H H Hs
:>>c t t 5 } || d j = n# t $ r Y nw xY wddd dS # 1 swxY w Y dS )z.
Remove task from DBM storage
r N)rY r r[ encodeKeyError)rG r] s rN removez"dbm_storage_update..remove s ,
-
-
a !7!7!9!9::
s1 A 8A
AAAAA Ac \ j dk r | n.# t $ r!}t t | d}~ww xY w | i | n # t $ r j dk r | w xY w j dk r | dS dS # t $ r!}t t | d}~ww xY w)rQ addNra )__name__ RuntimeErrorr$ r> Exception)rG rS rJ r' ra rO s rN rT z#dbm_storage_update..wrapper s $}%%
$ $ $CFF## # $ D$ !& ! ! ! ! }%%
$}((
)( $ $ $CFF## # $s4
? :?A A(,B
B+
B&&B+r )r' rT ra rO s ` @@rN dbm_storage_updaterg sb H H H 4[[$ $ $ $ $ $ [$6 NrU c F d t fd }|S )z5
Decorator aimed to validate given JWT token
c " t dS )z7
Check if retrieved JWT token is valid
N)is_xray_supportedrR rU rN checkzcheck_jwt..check s rU c , | i |} |S )rQ rR )rG rS tokenrk r' s rN rT zcheck_jwt..wrapper s)
d%f%%
rU r )r' rT rk s ` @rN check_jwtrn sJ
4[[ [ NrU c B t t j S )zJ
Get current epoch timestamp as int
:return: timestamp as int
)inttimerR rU rN timestamprr s
ty{{ rU c J t j t d z
S )zC
Pick a yesterday date
:return: a datetime.date object
r )days)r todayr rR rU rN prev_daterv s
:<<)+++ ++rU tsc * t j | S )zy
Get the datetime.date object for given int timestamp
:param ts: timestamp
:return: datetime.date object
)r
fromtimestamp)rw s rN date_of_timestamprz s b ! !!rU c D t d S )zj
Get a formatted representation of yesterday date
:return: str date in the form of dd/mm/YYYY
z%d/%m/%Y)rv strftimerR rU rN get_formatted_dater} s
;;
+ ++rU linksc f dd fdt | d D S )u
HTML formatted links.
Both the domain (interpolated into the visible body) and the
link (interpolated into the href attribute) are passed through
html.escape(..., quote=True) so HTML-special characters in either
slot cannot break attribute parsing or inject tags. The href is
also explicitly double-quoted — without quotes, whitespace in the
link value would let any subsequent token be parsed as a new
attribute (e.g. ``onmouseover=...``). Defense-in-depth: today the
sole caller (continuous.tracing.generate_mail) passes
url_split(task.url)[0] and task.shared_link, both of which are
derived from controlled sources, but the template must remain
safe for any future caller.
z+{num}) {domain}
c g | ]_\ }}| D ]E\ }} |t j |d t j |d F`S )T)quote)numlinkdomain)itemsformathtmlescape).0ilkv html_items rN
z,get_html_formatted_links.. s
AqAGGII -1Aq Q "k!4 8 8 8 $ AT : : : < < rU r r2 enumerate)r~ r s @rN get_html_formatted_linksr sR >I 99 eQ'' rU c f dd fdt | d D S )z
Formatted links
z{num}) {dom}: {link}r c z g | ]7\ }}| D ] \ }} ||| 8S ))r domr )r r )r r r r r text_items rN r z,get_text_formatted_links.. sk A A AA67ggiiA A.2a &&1!!&<< A A A ArU r r )r~ r s @rN get_text_formatted_linksr sZ 'I 99 A A A A q))A A A B B BrU c t j d } | }| d j }t j 5 }| d| ddd n # 1 swxY w Y | d S # t t j
f$ r"}t t d |d}~ww xY w)ze
Obtain system ID from /etc/sysconfig/rhn/systemid
:return: system ID without ID- prefix
z/etc/sysconfig/rhn/systemidz(.//member[name='system_id']/value/string system_idNzID-z Failed to retrieve system_id)
ETparsegetrootfindtext
sentry_sdkconfigure_scopeset_taglstripr=
ParseErrorr$ _)treerootwhole_idscoperJ s rN read_sys_idr s
Bx566||~~99 GHHM
'
)
) 1U MM+x 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1u%%% R] # B B B899::ABs< AB A:. B :A>>B A>B C0 C
Csys_idagent_system_id_pathc > t j |t j t j z t j z t j z d } t j || t j | dS # t j | w xY w)zH
Write system_id into file /usr/share/alt-php-xray/agent_sys_id
N) r0 r? rB rA rC rD rE r_ rF )r r rM s rN write_sys_idr / sw
%bk)BJ6 F
B
V]]__%%%
s 'B B c B t | 5 }| cddd S # 1 swxY w Y dS # t $ rC}t ddt
| i t cY d}~S d}~ww xY wzA
Read system_id saved by agent during its initialization
Nz8Failed to retrieve agent's system_id, returning real oner. r, )r? r@ stripr= r: infor> r )r agent_sysid_filerJ s rN read_agent_sys_idr < s
&
'
' 3+;#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 F#a&&/ # # # }} s? A &A A AA A A
B 8BB B c L t t 5 } | cddd S # 1 swxY w Y dS # t $ rC}t
ddt | i t cY d}~S d}~ww xY wr ) r? r r@ r r= r: r r> r )r rJ s rN r r J s
*
3!1#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 F#a&&/ # # # }} s? A &A A A
A A
A
B# 8B B# B#c @ t t j } | st }t }t
dt | t | t t d
|| dS )z9Raise XRayError in case of detected non-supported editionzMCurrent CloudLinux edition: %s or Control Panel: %s is not supported by X-RayzMCurrent CloudLinux edition: {} or Control Panel: {} is not supported by X-RayT) r r XRAYr r r: r r> r% r r ) is_supportedcurrent_edition
current_panels rN rj rj Y s -gl;;L f133!
c((#m*<*< > > > a !NNTfUdUbOd Od e e f f f 4rU c 8 t t 5 } | cddd S # 1 swxY w Y dS # t t
f$ r2 t
t d t t z w xY w)zT
Obtain jwt token from /etc/sysconfig/rhn/jwt.token
:return: token read
NzJWT file %s read error) r? r" r@ r r= IOErrorr$ r r> )
token_files rN read_jwt_tokenr g s O
$
%
% - ??$$**,, - - - - - - - - - - - - - - - - - - W O O O233c:L6M6MMNNNOs. A &A A A
A A
A ABfilepathc & t | 5 }| }ddd n # 1 swxY w Y n# t $ r Y dS w xY wd | d dd pdS )z8Get version of package from file. alt-php-xray supportedN. z0.0-0)r? r@ r r= r2 split)r v_fileversions rN pkg_versionr t s
(^^ ,v kkmm))++G , , , , , , , , , , , , , , , 88GMM#&&rr* + + 6w6s3 A 'A A AA A A
A A c t d S )z#Get version of alt-php-xray packagez /usr/share/alt-php-xray/version)r rR rU rN xray_versionr ~ s 8 9 99rU c dt dt dt fd} d }dd}t t j t j }t pd }t
|
}t j t | |d t d ||g
t j 5 }dt d i|_ || n# t $ r Y nw xY wddd dS # 1 swxY w Y dS )u
Initialize Sentry client
shutdown_timeout=0 disables Atexit integration as stated in docs:
'it’s easier to disable it by setting the shutdown_timeout to 0'
https://docs.sentry.io/platforms/python/default-integrations/#atexit
On the other hand, docs say, that
'Setting this value too low will most likely cause problems
for sending events from command line applications'
https://docs.sentry.io/error-reporting/configuration/?platform=python#shutdown-timeout
eventhintr( c | d ddi t d | d< | di }| dd }|r|g| d< | S )z
Add extra data into sentry event
:param event: original event
:param hint: additional data caught
:return: updated event
r- z xray.versionz
0.6-51.el8r server_name fingerprintN)rO r get)r r
extra_datar s rN add_infoz sentry_init..add_info st g ~| <===
6k B Bm YYw++
nn]D99 1$/=E- rU c
d t }|r| d nd }|r| d nd }t rdnd }d|fd|fd|fdt j fdt d fd
t
fd t d ff}|D ] } | j |
d S )
Nr nameWP2zControl Panel NamezControl Panel VersionzControl Panel ProductkernelzCloudLinux version
os_releasezCloudlinux edition Architecture architecture)r r r platformreleaser r r ) sentry_scopecp_description
cp_versioncp_name
cp_producttagstags rN set_tagsz sentry_init..set_tags s +--6DN^'' 222$
0>H.$$V,,,D 0 2 2'@'@A !7!G!GH
' 'C L # & & & ' 'rU Nc d S NrR )pendingtimeouts rN nopezsentry_init..nope s rU )level event_levelzalt-php-xray@0.6-51.el8)callbacki' r )dsn before_sendr max_value_lengthr integrationsidr( N)dictr loggingINFOWARNINGr r r initr r r userrf )r r r sentry_loggingxray_ver
silent_atexitr s rN sentry_initr s D T ,' ' '&
(gl4;OE E EN~~:!:H%t444MO
$%* !7{ C C"0-!@
B B B B
# % %
(55
HUOOOO D s6 'C(? C
C(
CC(CC((C,/C,lognamec H t j t j t j t j t j d}t
t j | g}|dk r&| t j t j
| |t j dd| n8# t $ r+ t j
t j
g Y dS w xY w t j | d n# t $ r Y nw xY w| S )
z[
Configure logging and Sentry
:param logname: path to log
:return: logpath
)debugr r; errorcritical)filenamer z1%(asctime)s [%(threadName)s:%(name)s] %(message)sz%m/%d/%Y %I:%M:%S %p)r r datefmthandlers)r Nr )r DEBUGr r ERRORCRITICALr FileHandlerappend
StreamHandler basicConfigr r= NullHandlerr0 chmodPermissionError)r r levelsr s rN configure_loggingr s7 ? $ F MMM
1 1 1
G OOG 1 3 3 4 4 4&**UGL"A"A#V$:%- / / / / / g&9&;&;%<====
%
Ns%
A8C 1C87C8<D
D D z"^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,31}$usernamec | st d t | st d| t j | dS # t
$ r t d| dw xY w)zValidate that username is a real system user.
Raises ValueError with a clear message if username is empty,
has an invalid format, or does not exist in the system user database.
zusername must not be emptyzInvalid username: z system user does not exist: N)
ValueError_safe_username_patternmatchpwdgetpwnamr` )r s rN validate_system_userr s 75666 ! ' ' 1 1 <:h::;;;P X P P PDDDEE4OPs A A3 clwpos_argsc t | t t j s-d |D }dd | z }dd| ddd|gS d | d
g|z S ) zBuild subprocess argv for /usr/bin/clwpos-user invocation.
Non-CageFS: wraps in sudo -u bash -c with shell-quoted args.
CageFS: passes args directly via cagefs_enter_user argv.
c P g | ]#}t j t | $S rR )shlexr r> )r as rN r z)build_clwpos_user_cmd.. s( ???aek#a&&))???rU z/usr/bin/clwpos-user sudo-uz-sz /bin/bashz-cz/sbin/cagefs_enter_userz/usr/bin/clwpos-user)r r r CAGEFSr2 )r r
safe_parts inner_cmds rN build_clwpos_user_cmdr# s| """ %gn 5 5 6??;???
+chhz.B.BB hk4KK)8&(*56 6rU rK dstc t j | | dS # t $ rD}t t d | |t
| |d}~ww xY w)zZ
Move file with error catching
:param src: source
:param dst: destination
z Failed to move file {} to {}: {}N)shutilmover= r$ r r r> )rK r$ rJ s rN safe_mover( sv _ C _ _ _<CCCcRSffUUVVWW]^^_s
A'?A""A'
sock_locationz
socket objectc t t j dd }|dk rt 5 t j | n# t $ r Y nw xY wt t }| | |
ddd n # 1 swxY w Y n/t dt t }|
|S )z
Create world-writable socket in given sock_location
or reuse existing one
:param sock_location: socket address
:return: socket object
LISTEN_FDSr N )
rp r0 environr umask_0r< FileNotFoundErrorr r bindlistenr
r )r)
listen_fdssockobjs rN
create_socketr4 % s RZ^^L!4455JQ
YY
-(((($
WooG LL ' ' ' NN G[11 Ns7 B2AB2
A&#B2%A&&A B22B69B6lve_idc > t t j sdS d}d| d} t | 5 }|D ]}| | rut
d| t | | d c cddd S ddd n # 1 swxY w Y n@# t $ r3}t
d|t | Y d}~nd}~ww xY wdS ) zX
Retrieve current value of CPU throttled time.
Return 0 in case of failures
r throttled_timez /sys/fs/cgroup/cpu,cpuacct/lvez /cpu.statz%sNzFailed to open %s: %s)
r r LVEr? r4 r: r rp r r r= r r> )r5 marker stat_file stat_valuesvaluerJ s rN get_current_cpu_throttling_timer> = s
&gk 2 2 q
FBBBBIA
)__ H $
H
H##F++ HLLu--- u{{}} 2 26 : :2 > D D F FGGGG H H H H H H H HH
H H H H H H H H H H H H H H H H
A A A ,iQ@@@@@@@@A 1sG C BC6 C C C CC CC
D')DDc d}t j | sdS t j |d| dgddd }|j |j fS # t j $ r6}t
ddt | i Y d}~dS d}~wt $ r3}t
d
t | Y d}~dS d}~ww xY w) z
'selectorctl -u username --user-current' command
:param username: name of user
:return: tuple(stdout, stderr) or None if command fails
z/usr/bin/selectorctlNr z--user-currentTcapture_outputr rk z&Failed to get selectorctl user-currentr. r, z%selectorctl --user-current failed: %s)r0 r1 isfile
subprocessrunstdoutr stderrCalledProcessErrorr: r; r> subprocess_errorsr )r _selectorctlresultrJ s rN _selectorctl_get_versionrK Q sE *L
7>>, ' ' t !%!)!1!3 04$d L L L
}""$$fm&9&9&;&;;; ( . . .? #SVV_ . . . . . . . . . <VV s$ A
A3 3C3+B33
C3 (C..C3c d}t j | sdS t j |d| gddd }|j S # t j $ r6}t ddt | i Y d}~dS d}~wt $ r3}t d t | Y d}~dS d}~ww xY w)
z
'cagefsctl --get-prefix username' command
:param username: name of user
:return: cagefsctl prefix for given username
or None if command fails
/usr/sbin/cagefsctlNz --getprefixTr@ z Failed to get cagefsctl prefixr. r, z cagefsctl --getprefix failed: %s)
r0 r1 rB rC rD rE r rG r: r; r> rH r r
_cagefsctlrJ rJ s rN cagefsctl_get_prefixrP i s/ 'J
7>>* % % t !.!)!+ 04$dL L L }""$$$ ( . . .7 #SVV_ . . . . . . . . . 7VV s# 3A C(+B
C&(CCc d}t j | sdS | |ddg}n|d| g} t j |dd t
d| dS # t j $ r6}t
d d
t | i Y d}~dS d}~wt $ r3}t
d t | Y d}~dS d}~ww xY w)
z
'cagefsctl --remount username' or 'cagefsctl --remount-all' command
:param username: name of user or None (for remount-all)
rM Nz --wait-lockz
--remount-allz --remountT)rk rA z Remounted %szFailed to remount cagefsr. r, z cagefsctl --remount failed: %s) r0 r1 rB rC rD r: r rG r; r> rH r )r rO rG rJ s rN _cagefsctl_remountrR s;
'J
7>>* % % M?;K2 t4==== NH----- ( . . .1 #SVV_ . . . . . . . . . 5VV s# 2A& &C&5+B&&
C&3(C!!C&c 4 d}t j | sdS t j |d| gdd }d|j v S # t $ r3}t dt | Y d}~dS d}~ww xY w) z
'cagefsctl --user-status username' command
:param username: name of user
:return: True if user has Enabled status, False otherwise
rM Fz
--user-statusT)rA r Enabledz"cagefsctl --user-status failed: %sN) r0 r1 rB rC rD rE r rH r: r r> rN s rN _is_cagefs_enabledrU s 'J
7>>* % % u !0!)!+ 04$@ @ @ FM / / 1 111 9VV s 4A
B$(BBc t d 5 } | }ddd n # 1 swxY w Y n# t $ r Y dS w xY wd|v S )z`
Check if there is php.d.location = selector
set in /etc/cl.selector/symlinks.rules
z /etc/cl.selector/symlinks.rulesNFselector)r? r@ r= )
rules_filecontentss rN _is_selector_phpd_location_setrZ s
3
4
4 )
!((H ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) uu !!s' > 2 > 6> 6>
A A c t t 5 } t | dk cddd S # 1 swxY w Y dS )z:Check if there are no active tasks (== empty task storage)r N)rY r lenkeys)r] s rN no_active_tasksr^ s ( ) ) -\<$$&&''1,- - - - - - - - - - - - - - - - - -s %AA A enabledc H t t j sdS t ddd 5 }| | rdnd ddd dS # 1 swxY w Y dS # t
$ r4}t d| t | Y d}~dS d}~ww xY w) zb
Switch on/off throttle statistics gathering by kmodlve
:param enabled: True or False
Nz!/proc/sys/kernel/sched_schedstatswbr )mode buffering 1 0z(Failed to set sched_schedstats to %s: %s) r r r9 r? rE r= r: r r> )r_ frJ s rN switch_schedstatsrg s
&gk 2 2 %
5D /"#
GGG-DD . . . / / / / / / / / / / / / / / / / / / % % % >SVV % % % % % % % % %%s: A# A A# AA# A A# #
B!-)B B!c J t dd du S )zG
Check if end-users have access to X-Ray UI of End-User plugin
hideXrayApp
uiSettingsF)r get_paramrR rU rN is_xray_app_availablerl s# ::
| < < EErU c t t t 5 } | t n## t
t f$ r Y ddd dS w xY w ddd n # 1 swxY w Y dS )z Check if User Agent is listeningNFT)r r r connectr# ConnectionErrorr= )ss rN is_xray_user_agent_activerq s % %
IIo & & & & )
'
4s1 A(8A(A A(AA((A,/A,c B t j d S )z2Check if SSA is disabled by its internal flag-filez /usr/share/clos_ssa/ssa_enabled)r0 r1 rB rR rU rN ssa_disabledrs s w~~ ?@@ @@rU c ~ t t j | j z
dk S # t $ r Y dS w xY w)z.Check is file was modified during the last dayiQ F)rr r0 statst_mtimer= )r s rN is_file_recently_modifiedrw sJ {{RWX . . 77%?? uus +.
<<c p t | 5 t }d d d n # 1 swxY w Y |S r )r r )r rJ s rN get_user_php_versionry su / /,../ / / / / / / / / / / / / / / Ms +//rM 'file object providing a fileno() methodc # K t d D ]} t j | t j t j z t
d| n# t $ rf}t
dt | |j t j
t j fvr t j
d Y d}~d}~ww xY wt |d d dV t j | t j t
d | dS # t j | t j t
d | w xY w)
uq
Context manager for locking given file object
:param fd: а file object providing a fileno() method
x zFile %s lockedzFailed to lock: %sg ?Nz%Failed to lock at all. Exiting threadr; )flagzFile %s unlocked)rangefcntlflockLOCK_EXLOCK_NBr: r r= r> errnoEAGAINEACCESrq sleepr$ LOCK_UN)rM r rJ s rN filelockr s[ 3ZZ
(
( KEMEM 9 : : : KK(" - - - E KK,c!ff 5 5 5wu|U\ ::: JsOOOOOOOO ABB &( ( ( (,
B
&&& &+++++ B
&&& &++++s% AA
C(A C C,D, ,>D EEEHTNNNNNrU r T
target_uid
target_gidc # K t j }t j }t d } t j | }n# t
$ r d}Y nw xY w| ||} n|j } | ||}n|j }|t j | } ||k rWt j | t d| |r&t j |k rt | || k rqt j | t d| |r@t j | k r)||k rt j | t | dV || k r/t j | t d| ||k r/t j | t d| |t j | dS dS # || k r/t j | t d| ||k r/t j | t d| |t j | w w xY w)aH
Context manager to drop privileges during some operation
and then restore them back.
If target_uid or target_gid are given, use input values.
Otherwise, stat target_uid and target_gid from given target_path.
If no target_path given, use current directory.
Use mask if given.
:param target_uid: uid to set
:param target_gid: gid to set
:param target_path: directory or file to stat for privileges,
default -- current directory
:param mask: umask to use
:param with_check: check the result of switching privileges
z6Unable to execute required operation: permission issueNzDropped GID privs to %szDropped UID privs to %szRestored UID privs to %szRestored GID privs to %s)r0 getuidgetgidr ru r= st_uidst_gidr setegidr: r getegidr$ seteuidgeteuid)
r r target_pathr
with_checkprev_uidprev_gidpermission_issue_message stat_infor s
rN set_privilegesr C s " y{{Hy{{H !Y Z Z GK(( !JJ")J !JJ")J x~~:
: .
;;; 6"*,,*44 455 5:
: .
;;; 6"*,,*44:%%
8$$$ 455 5
z ! ! Jx LL3X > > > z ! ! Jx LL3X > > > HTNNNNN z ! ! Jx LL3X > > > z ! ! Jx LL3X > > > HTNNNN s A A A 'G/ /BI2c # K t j | t j | dV t j d t j d dS # t j d t j d w xY w)z
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr )r0 r r )uidgids rN user_contextr sn
3
3
1
1
1
1
s ,A *Bc fd}|S )z:
Decorator to retry method on specific exceptions
c fd}|S )Nc F d}t t d t z }|k rk | i |S # t $ rG}|dz
}t j dt | |}t
j d Y d }~nd }~ww xY w|k k|)Nr z0Request to website failed even after %s retries.r z'Retry to request website, exception: %s)r r r> tupler r; rq r )rG rS retries exceptionrJ exceptions_to_retryr' max_retriess rN rT z7retry_on_exceptions..decorator..wrapper s G"1%W#X#X[^_j[k[k#kllIK''" 40000 011 " " "qLGO$MsSTvvVVV !IJqMMMMMMMM " K'' Os ? B=BBrR )r' rT r r s ` rN decoratorz&retry_on_exceptions..decorator s. rU rR )r r r s `` rN retry_on_exceptionsr s*
rU r r )rM rz r( N)F)r )NNr NT)}__doc__r r r r rer r r0 r r& r rC r rq xml.etree.ElementTreeetree ElementTreer
contextlibr datetimer r functoolsr r r r
r r typingr
r r r sentry_sdk.integrations.atexitr sentry_sdk.integrations.loggingr clcommon.constr clcommon.cpapir r r r clcommon.lib.cleditionr clcommon.ui_configr clcommon.clpwdr clcommon.utilsr !xray.internal.clwpos_safe_importsr xrayr r constantsr r r r! r" r#
exceptionsr$ r% getLoggerr: r= r SubprocessErrorrH rV rg rn rp rr rv rz r> r} r r r r r r boolrj r r r r r compiler r listr# r( r4 r> r rK rP rR rU rZ r^ rg rl rq rs rw ry r rY r. r r r rR rU rN r s
" " " " " " " " " % % % % % % $ $ $ $ $ $ $ $ 7 7 7 7 7 7 7 7 7 7 7 7 + + + + + + + + + + < < < < < < > > > > > > " " " " " " h h h h h h h h h h h h : : : : : : ' ' ' ' ' ' * * * * * * 1 1 1 1 1 1 I I I I I I 3 2 2 2 2 2 2 2
7 # # Z3 C( Cx C C C CL5X 5( 5 5 5 5pH 4 3 ,4 , , , ,"# "$ " " " ",C , , , ,DJ 3 2BDJ B3 B B B B
BS
B
B
B
B ;E
C
3= C 3 8D> O O O O O7# 7(3- 7 7 7 7:hsm : : : :L L L L^ +8 " "s "HSM " " " "J $$IJJ
P3
P4
P
P
P
P
6C
6d
6t
6
6
6
6 _3 _S _T _ _ _ _ 0
C
C
( s x 0 3 8C= 0 . (
"
"
"
"
"- - - - - %t % % % % %$Ft F F F F4 Ad A A A A
, , , ,< 1 1# 1$ 1 1 1 1B # d =AAEH Hs Hs H*-HJNH H H HV & rU