9Mj9 d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z ddlmZmZ dd lmZmZmZ ej e Zd
Zd Z dd lm Z m Z m Z dd
l m Z n# e!$ r d Z d Z d Z dZ Y nw xY wde"de"fdZ#de"de"de"de e" fdZ$de"de"ddfdZ%d"de e& de'de"de"fd Z( d#de"d e'd e'de"d e'de e& de"ddfd Z)de"de"ddfd!Z*dS )$z
Website isolation support for X-Ray INI files.
This module provides functions to manage xray.ini files in per-website
directories when CageFS website isolation is enabled.
N)iglob)Optional)
disable_quota)docroot) user_contextcagefsctl_get_prefix )is_excluded_path$get_domain_php_version_from_selectorINI_USER_LOCATIONSi i )(is_website_isolation_allowed_server_wideis_isolation_enabled#get_websites_with_enabled_isolation)get_website_idc dS NF r ]/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/reconfiguration/website_isolation.pyr
r
= ur c dS r r users r r r @ r r c g S Nr r s r r r C s r r domainc D t sdS |t | v S r )r
r )r r s r is_per_website_php_selectorr I s) 3 5 5 u 8>> >>r
website_id php_ver_dirreturnc F t | }|dS d| d| d| d| d S )a
Build path to xray.ini in per-website directory.
:param user: Username
:param website_id: Website ID hash
:param php_ver_dir: PHP version directory (e.g., 'alt-php80')
:return: Full path to xray.ini or None if cagefs prefix not available
Nz /var/cagefs//z/etc/cl.php.d/z /xray.ini)r )r r r prefixs r _get_per_website_ini_pathr% O sD "$
'
'F
~t Z& Z Z4 Z Zz Z ZK Z Z ZZr c
t | | sdS i }d}d}t D ]}t |d D ]}t | r |d | }|j | k r1|j }|j }n+# t $ r t d| Y gw xY wt j |d }t j
| s t j |t j t j z t j z } nw# t$ $ rj}
|
j t& j k r!t d| Y d}
~
&t d|t/ |
Y d}
~
Ud}
~
ww xY w t j | } t3 j | j sLt d| | d k r( t j | # t$ $ r Y w xY w| j |k rSt d
|| j | | d k r( t j | "# t$ $ r Y /w xY w5| j t> k rXt d || j t> | d k r( t j | # t$ $ r Y w xY wt j | d 5 } d } t j ! | }
| " t> ||
< ddd n # 1 swxY w Y no# t$ $ rb}
t d
|t/ |
Y d}
~
| d k r( t j | ]# t$ $ r Y jw xY wpd}
~
ww xY w| d k r( t j | # t$ $ r Y w xY w# | d k r& t j | w # t$ $ r Y w w xY ww xY w|r|dS tG | }|d }tI | }tK | | }|& | }|s/tO tQ |) d }tU | || }t j + | }t j
| s t , d| dS t[ || 5 t] 5 t |d 5 } | / | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d|| dS # t $ r'}
t d||
Y d}
~
dS d}
~
ww xY w)a
Copy xray.ini files from base user locations to per-website directories.
This function is called by cagefsctl when enabling website isolation for a user.
If xray.ini exists in base location (meaning user has active tasks), copy it
to per-website directories. Overwrites existing files for consistency.
Each domain may have a different PHP version set via cloudlinux-selector,
so we determine the domain's actual PHP version from cl.selector symlinks.
:param user: Username to regenerate ini files for
Npathr z!Cannot get pw_record for path: %szxray.iniz Refusing to follow symlink at %sz+Cannot open xray.ini for path: %s, error=%sz'Refusing to read %s: not a regular filez0Refusing to read %s: owner uid %d != user uid %dz3Refusing to read %s: size %d bytes exceeds limit %drz+Cannot read xray.ini for path: %s, error=%sr z*Per-website ini directory does not exist: wzCreated %s for domain %szFailed to create %s: %s)0r r r r
pw_namepw_uidpw_gid Exceptionloggerdebugosr' joinexistsopenO_RDONLY
O_NOFOLLOW
O_NONBLOCKOSErrorerrnoELOOPwarningerrorstrfstatstatS_ISREGst_modeclosest_uidst_size MAX_INI_SIZEfdopenbasenameread get_docrootr r getnextitervaluesr% dirnameinfor r write)r r base_ini_filesuidgidlocationdir_path pw_recordini_filefdestfr docroot_result
document_rootr domain_php_vercontentini_pathini_dirs r $regenerate_ini_for_website_isolationrb ] s} 'tV 4 4 N
C
C& H H hv .// G G H ))
,HV ,X 6 6 $,, & &
@(KKK
w||Hj99H7>>(++
WXr{R]'BR]'RSS
7ek))NN#ExPPP HHHH JHVYZ[V\V\]]]
&
Xb\\|BJ// NNA 6 88 " 5 9##NNJ & 88 " % : ,,NNM
$ 88 " Yr3'' G1B"$'"2"28"<"JJH gooh''G
7>>' " " JJJKKK=
#s
#
# ]__ d8S6I6I Q
GGG /6BBBBB = = = .!<<<<<<<<<=s A8)A88%B B $9D
F(0F
)F
FAM&G<<
H
H
-MI
I('I(-7M,K
KKM*?L5) M5L9 9M<L9 =M O
N- )N(4O ?N
N#"N#(N--O 7O
OO P(O=<P=
P
P P
PV- V#U-4U
U-U U- U U-! V-U1 1V4U1 5V8 V- VV- V V- -
W 7 WW existing_contentscounter php_versionc |t | dk rd}nd| d} d| d dS fd }g }d
}t | d D ]v\ }}|t | d
d z
}|t k s |t k r t dt dt d | | wd | S )a:
Generate xray.ini content with a specific task counter value.
:param existing_contents: Existing ini file lines or None for new file
:param counter: Task counter value to set
:param php_version: PHP version for extension path (used only for new files)
:return: Generated ini file content
N zxray.soz /opt/alt/phpz /usr/lib64/php/modules/xray.soz
extension=z
;xray.tasks=
c 3 > K D ]} d| v r d dV | dz V d S )Nz
xray.tasksz ;xray.tasks=rh r )linerd rc s r update_linez/_generate_ini_with_counter..update_line sX % " "Dt##0W0000000Tk!!!! " "r r r )startzutf-8
surrogatepassz*existing xray.ini too large to preserve (>z bytes or >z lines) )len enumerateencoderE
MAX_INI_LINES
ValueErrorappendr2 ) rc rd re so_pathrk out total_bytesnrj s `` r _generate_ini_with_counterry s8 c+ . . 2 2LLLL g
" " " " " "
CK [[]]!444 4s4;;w@@AAA % %]):): l\llVclll
4
773<<r rR rS domain_task_countc t | | sdS t | }|s t d| dS |d }t | } n4# t
$ r'}
t d||
Y d}
~
dS d}
~
ww xY w| sdS t | | } | s t d| dS t | | | } | sdS t j
| }
t j
|
s t d|
dS t ||| }n4# t $ r'}
t d| |
Y d}
~
dS d}
~
ww xY w t! || 5 t# 5 t% | d 5 }| | ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y t d | || | dS # t( $ r'}
t d
| |
Y d}
~
dS d}
~
ww xY w) aT
Update xray.ini file in per-website directory for a SPECIFIC domain.
This function is called when a tracing task is added/updated for a domain.
The ini file is placed in the directory matching the domain's PHP version
as configured via cloudlinux-selector.
Generates the ini content with domain-specific task counter, which may differ
from the per-user counter when a user has tasks for multiple domains.
:param user: Username
:param uid: User ID for file ownership
:param gid: Group ID for file ownership
:param domain: Domain name (e.g., 'example.com') - REQUIRED
:param domain_task_count: Number of tasks for this specific domain
:param existing_contents: Existing per-user ini file lines (to preserve settings)
:param php_version: PHP version for extension path (used only for new files)
N#Failed to get docroot for domain %sr *Failed to get website_id for domain %s: %s3No specific PHP version set for domain %s, skippingz,Per-website ini directory does not exist: %szRefusing to update %s: %sr* z+Updated %s for domain %s (PHP %s, tasks=%d)zFailed to update %s: %s)r rI r/ r0 r r. r< r r% r1 r' rN isdirry rs r; r r r4 rP r8 )r rR rS r rz rc re r\ r] r rY r^ r` ra r_ r[ s r update_website_isolation_inir sT 6 'tV 4 4 $V,, LL> G G G F&q)
#M22
A61MMM :$
KKN JFSSS(z>JJH gooh''G
7== ! ! CWMMM,->@QS^__ 2Ha@@@=
#s
#
# ]__ d8S6I6I Q
GGG BHfVdfwxxxxx = = = .!<<<<<<<<<=s ,A A
B $ BB 2E
E5 E00E59H$ G9G")G ? G" G G"G G" G9"G& &G9)G& *G9- H$ 9G==H$ G=!H$ $
I. IIc J t | | sdS t | }|s t d| dS |d }t | }n4# t
$ r'}t d|| Y d}~dS d}~ww xY w|sdS t | | }|s t d| dS t | || }|sdS t j
| sdS t j
| }t |j |j 5 t j | ddd n # 1 swxY w Y t d||| dS # t
$ r'}t d|| Y d}~dS d}~ww xY w)ax
Remove xray.ini file from per-website directory for a SPECIFIC domain.
This function is called when the last tracing task for a domain is removed.
The ini file is removed from the directory matching the domain's PHP version
as configured via cloudlinux-selector.
:param user: Username
:param domain: Domain name (e.g., 'example.com') - REQUIRED
Nr| r r} r~ z!Removed %s for domain %s (PHP %s)zFailed to remove %s: %s)r rI r/ r0 r r. r< r r% r1 r' r3 pwdgetpwnamr r, r- unlink) r r r\ r] r rY r^ r` rV s r remove_website_isolation_inir Q s 'tV 4 4 $V,, LL> G G G F&q)
#M22
A61MMM :$
KKN JFSSS(z>JJH
7>>( # # =L&&
)*I,<
=
= Ih 8(FN[[[[[ = = = .!<<<<<<<<<=sY ,A A
B $ BB 8.E1 &E; E1 E E1 E E1 1
F"; F F"r )NN)+__doc__r9 loggingr1 r r? globr typingr secureior clcommon.cpapir rI xray.internal.utilsr r xray_inir
r r getLogger__name__r/ rE rr clcagefslib.domainr
r r #clcagefslib.webisolation.jail_utilsr ImportErrorr= r r% rb listintry r r r r r r s
" " " " " " 1 1 1 1 1 1 B B B B B B B B
8 $ $
CBBBBBB NNN ?c ?3 ? ? ? ? [C [S [s [xX[} [ [ [ [ y=s y=C y=D y= y= y= y=x) )(4. )3 )]` )lo ) ) ) )d )-I= I=
I= I=
I=
I=
I= ~
I= I=
I= I= I= I=X0=s 0=C 0=D 0= 0= 0= 0= 0= 0=s A' 'A:9A: