ruạṛ
a ^�iV � @ s d dl Z d dlZd dlZd dlZd dlZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZ ddlmZmZmZ dZ dZ dZ dZ d Z!d d d d �Z"d d e#dg�fdde#dg�fgZ$ej%dd� �Z&dd� Z'dd� Z(dd� Z)G dd� de*�Z+dd� Z,dNd d �Z-d d � Z.d d!� Z/d"d#� Z0dOd%d&�Z1d'd(� Z2e)d)d*� �Z3e)d+d,� �Z4e)d-d.� �Z5d/d0� Z6d1d2� Z7d3d4� Z8d5d6� Z9d7d8� Z:d9d:� Z;e)e,ej<d;d<� ���Z=d=d>� Z>ej<e�?d?�ej@e)e,e jAdfd@dA������ZBe)dBdC� �ZCdDdE� ZDdFdG� ZEdPdHdI�ZFdJdK� ZGdLdM� ZHdS )Q� N� )�auth� capabilities�config�config_handlers� constants�errors�fetch� log_utils�platform_utils� process_utils�selinux� server_info� update_utils�utils)� HTTPError�json_loads_nstr�urlquotez!/usr/libexec/kcare/libcare-client)z/run/libcare/libcare.sockz/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotate�db�ZmysqldZmariadbdZpostgresZubuntuz16.� libnss_dnsz7.c s� t tj�} t� � z t�� }|d �� }|d }W n* tyZ tD ]\}}}� |O � qBY n<0 |d }tD ],\}}}|d u s�||v rh|� |�rh|� q�qh� fdd�| D �S )Nr r �.c s g | ]}|� vr|�qS � r )�.0�lib�Z blacklistedr �-/usr/libexec/kcare/python/kcarectl/libcare.py� <listcomp>R � z/_get_effective_libcare_libs.<locals>.<listcomp>) �listr � LIBCARE_LIBS�setr � get_distro�lower� Exception�LIBCARE_LIBS_BLACKLIST� startswith) �libsZ distro_info�distro�version�_Zbl_libsZversion_dottedZ bl_distroZ bl_versionr r r �_get_effective_libcare_libs; s r+ c C s g d�t � d�S )Nr )r r' )r+ r r r r �get_userspace_mapU s �r, c G s t jjtjd| g|�R � S )N� userspace)�os�path�joinr � PATCH_CACHE)�libname�partsr r r �get_userspace_cache_path\ s r4 c s � fdd�}|S )Nc s� z�� | i |��W z t d� W S tyT } z tjd�|�dd� W Y d }~S d }~0 0 S z t d� W q� ty� } z tjd�|�dd� W Y d }~q�d }~0 0 nHz t d� W n8 ty� } z tjd�|�dd� W Y d }~n d }~0 0 0 d S )N� clearcachez$Libcare cache clearing failed: '{0}'F�� print_msg)�libcare_clientr$ r �logerror�format)�args�kwargs�err��clblr r �wrappera s *� ,� z$clear_libcare_cache.<locals>.wrapperr �r? r@ r r> r �clear_libcare_cache` s rB c s0 e Zd Zd� fdd� Zd dd�Zdd� Z� ZS ) �UserspacePatchLevelNc s t | | ��| |�S �N)�super�__new__)�clsr2 �buildid�level�baseurl�� __class__r r rF o s zUserspacePatchLevel.__new__c C s || _ || _|| _|| _d S rD )rI r2 rH rJ )�selfr2 rH rI rJ r r r �__init__r s z UserspacePatchLevel.__init__c G s t | j| jt| �g|�R � S rD )r4 r2 rH �str)rM r3 r r r � cache_pathx s z UserspacePatchLevel.cache_path)N)N)�__name__� __module__� __qualname__rF rN rP � __classcell__r r rK r rC n s rC c s dd� �� �fdd�}|S )Nc S s� d\}}z�| du rt � } i }g }t| �D ],}|�dd�||�d�< |�|�dg �� q(tj|dd�}d �d d � |�� D ��}d �t|��}W tj t |d d � tj t |d d � n"tj t |d d � tj t |d d � 0 dS )z(KPT-1543 Save info about applied patches)� rU N�latest-versionrU �package�patches�cve)� cve_field� c S s g | ]}d � |��qS )� �r0 )r �recr r r r � r zLrefresh_applied_patches_list.<locals>.save_current_state.<locals>.<listcomp>T)� ensure_dir) � _libcare_info�_get_patches_info�get�extendr �extract_unique_cvesr0 �items�sorted� atomic_write�LIBCARE_PATCHES�LIBCARE_CVE_LIST)�infoZversionsZcvesZpackagesZ all_patchesr^ Zcves_setr r r �save_current_state} s �z8refresh_applied_patches_list.<locals>.save_current_statec s0 d }z � | i |��}|W �|� S �|� 0 d S rD r )r; r< rj �r? rk r r r@ � s �z-refresh_applied_patches_list.<locals>.wrapperr rA r rl r � refresh_applied_patches_list| s rm c C sD t jpd}t| �} t|�� �}t�t�| d�|| |d�}|dt� d|� 7 }t�| d�}zt � t j �|dd�}W n* tjy� tjt||�d d � � Y n0 t�|j� tt�|�� ��}|�d g �}t�|�s�t�d � | ���t |||d |�d��} t |d �} t||| d�} t j �!| ��r2t j �"| �dk�r�t�|d �}z t j#|| t j$t �%| �d� W n> t&�y� } z$| j'dv �r�t�(d��� W Y d } ~ n d } ~ 0 0 t||| �} dd| d| dg}t)j*|d d d�\}}}|�r�tj+d� |||�dd ��t||d �}t j �,|��s t j �-|��r t�|� t �.| |d � t �/|d |� d S ) N�main�uz latest.v1z?info=�updater' F)� check_licenseT)� ignore_errorsr zkLatest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.rI rJ z patch.tar.gzr Z patch_url)�check_signature� hash_checker)i� i� zKC+ licence is required�tarZxfz-Cz--no-same-owner�� catch_stdout� catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}zpatches unpacking error��status�latestz.tmp)0r �PREFIXr �stripr �get_patch_server_url� LIBNAME_MAPrb r Zencoded_server_lib_infor �wrap_with_cache_keyr � urlopen_authr �NotFound�shutil�rmtreer4 r � set_feature_flags_from_headers�headersr �nstr�readr �has_lc_capabilities�CapabilitiesMismatchr: rC rO r. r/ �exists�getsize� fetch_url� USE_SIGNATURE�get_hash_checkerr �code�NoLibcareLicenseExceptionr � run_command� KcareError�islink�isdir�symlink�rename)r2 �build_id� patch_level�prefix�url� cache_dst�response�meta�required_capabilitiesrI �plevelZ patch_path�ex�dst�cmdr� �stdout�stderrZ link_namer r r �fetch_userspace_patch� sV �� � r� c C sL | t _| st� tj| r dndd� | r0t� tj�d| r@dnd � d S )N�FALSE�YES)�LIBCARE_DISABLEDzlibcare service is �enabled�disabled) r r� �libcare_server_stopr � update_config�libcare_server_startr �kcarelogrj )r� r r r �set_libcare_status� s r� c C s� t jstj�t j�r^t�t jddg� t�t jddg� t�t jddg� t�t jddg� n6zt�dd�ddg} W n t y� Y d S 0 t�| � d S )N�stop�libcare.socket�libcare.service� reset-failed�libcare�service�z /usr/sbin/z/sbin/) r �SKIP_SYSTEMCTL_CHECKr. r/ r� � SYSTEMCTLr r� �find_cmdr$ �r� r r r r� � s r� c C s� t jstj�t j�r�tjt jdddgddd�\} }}| dkr@d S t�t jddg� t�t jddg� t�t jd d g� t�t jd dg� t�t jd dg� n@t� r�d S zt� d d �d d g}W n t y� Y d S 0 t�|� d S )Nz is-activez--quietr� Trv r r� r� r� r� �startr� r� ) r r� r. r/ r� r� r r� �libcare_server_startedr� r$ )r� r* r� r r r r� � s( � r� Tc s� d� dd� t|pg �D ��}ddg}� s6|dd|g7 }z t|� }W n8 tyz } z tjd�|�d d ��W Y d }~n d }~0 0 g }|�d �D ]0}|r�z|�t � |�� W q� t y� Y q�0 q�d d � |D �}|D ]&}t � fdd�|d � � D ��|d< q�|S )N�|c s s | ]}d � |�V qdS )z({0})N)r: )r �procr r r � <genexpr> r z _libcare_info.<locals>.<genexpr>rj z-jz-lz-rz/Gathering userspace libraries info error: '{0}'zuserspace libs info errorry r[ c S s$ g | ] }|� d �|� d�|d��qS )�comm�pid)r� r� r' )�pop)r �liner r r r r z!_libcare_info.<locals>.<listcomp>c 3 s& | ] \}}d |v s� s||fV qdS )�patchlvlNr )r �k�v��patchedr r r� # r r' )r0 rf r8 r$ r r� r: �split�append�json�loads� ValueError�dictre )r� �limitZregexpr� �linesr= �resultr� r r� r r` s& * $r` c C s� t � }| D ]0}|d �� D ] \}}|�|d |d f� qq g }t� }|D ]j}|D ]`\}} t||t| �d�} tj�| �rRt | d�� } |� t � | �� W d � qR1 s�0 Y qRqJ|S )Nr' rH r� z info.json�r) r! re �addr, r4 rO r. r/ �isfile�openr� r� �load) rj rX r^ r* �datar� �umapr� r� r� Zpatch_info_filename�fdr r r ra ( s 2ra c C s t t� �S rD )ra r` r r r r �libcare_patch_info_basic8 s r� c C s" t � } | st�d� t�d| i�S �NzNo patched processes.r� )r� r r9 r� �dumps�r� r r r �libcare_patch_info= s r� c C s" t � } | st�d� t�d| i�S r� )r` r r9 r� r� r� r r r � libcare_infoE s r� c C s* i } t � D ]}|�dd�| |�d�< q | S )NrV rU rW )r� rb )r� r^ r r r �_libcare_versionM s r� c C s* t � �� D ]\}}| �|�r | S q dS )NrU )r� re r& )r2 rW r) r r r �libcare_versionT s r� c C s d� dd� | D ��d S )Nr c s s | ]}t �|�d V qdS )� N)r �bstr)r �pr r r r� \ r z(libcare_client_format.<locals>.<genexpr>r� r] )�paramsr r r �libcare_client_format[ s r� c C s, t D ]} tj�| �r| S qt�d��d S )Nz Libcare socket is not found.)�LIBCARE_SOCKETr. r/ r� r r� )Zlibcare_socketr r r � get_available_libcare_socket_ s r� c G s� t jrt�d��t�tjtjd�}|�d� d}z�|�t � � |�t j � t | �}t � dj| d�� |�|� |�d�}|s~q�||7 }qn|�dd �}t � d j|d �� |W |�� S |�� 0 d S ) NzLibcare is disabled.r � r zLibcare socket send: {cmd}r� i zutf-8�replacez!Libcare socket recieved: {result}r� )r r� r r� �socket�AF_UNIX� SOCK_STREAM� settimeout�connectr� �LIBCARE_SOCKET_TIMEOUTr� r �logdebugr: �sendall�recv�decode�close)r� �sock�resr� r� r� r r r r8 f s* �r8 c C s� | D ]�}zt dt|�� W n8 tyR } z tjd�|�dd��W Y d }~n d }~0 0 z t d� W q ty� } z tjd�|�dd��W Y d }~qd }~0 0 qd S )NZstoragez(Userspace storage switching error: '{0}'z userspace storage switch errorry rp z%Userspace patch applying error: '{0}'zuserspace patch apply error)r8 r4 r$ r r� r: )r� r� r= r r r �libcare_patch_apply~ s * r� c C sJ z t d� W n8 tyD } z tjd�| �dd��W Y d } ~ n d } ~ 0 0 d S )N�unloadz&Userspace patch unloading error: '{0}'z userspace patch unload errorry �r8 r$ r r� r: �r= r r r �libcare_unload� s r� c C sF z t d� W n4 ty@ } z t�d�| ���W Y d} ~ n d} ~ 0 0 dS )z;Reload libcare-server plugin without restarting the server.Zrepluginz Userspace replugin error: '{0}'Nr� r� r r r �libcare_replugin� s r� r� c C s� t � | tjkrtjsdS t� }|du r4t|�� �}g }|D ]}|�|� |g �� q<|slt � d� |�� dS t |d�\}}}}|r�t�d��|s�t � d� dS t�tj�tjd�� t � z t|� W n@ tj�y } z$t �t| �� t�d��W Y d} ~ n d} ~ 0 0 t� } t| �} ttdd � | D ����s2dS t � d j |d �� t � d j | d �� t dd � | � � D ��} t dd � |� � D ��} | | }t dd � | � � D ��}t � dj t |�|d�� | �!� D ] \}}t � d� |t |��� �q�| S )z0Patch userspace processes to the latest version.Nz No such userspace patches: {0}�r� z8There were errors while patches downloading (unpacking).zNo patches were found.r- z)There were errors while patches applying.c s s | ]}|d V qdS )r' Nr )r �itemr r r r� � r z&do_userspace_update.<locals>.<genexpr>zPatched before: {before})�beforezPatched after: {after})�afterc s s | ]}|D ] }|V q qd S rD r �r re r� r r r r� � r c s s | ]}|D ] }|V q qd S rD r r r r r r� � r c s s | ]}t |�V qd S rD )�len)r r� r r r r� � r z�The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)�count�overallz*Object `{0}` is patched for {1} processes.)"�rotate_libcare_logsr �UPDATE_MODE_AUTOr �LIB_AUTO_UPDATEr, r �keysrc rb r �loginfor: �check_userspace_updatesr r� r �restore_selinux_contextr. r/ r0 r1 r� r9 rO r` �_get_userspace_procs�anyr� r! �values�sumr re )�moder� r� Zprocess_filterZuserspace_patch�failed�something_foundr* r r� Z data_afterr Zuniq_procs_afterZuniq_procs_before�diffr r� r� r r r �do_userspace_update� sV ��r c C sj z<zt � \} }}}W n tjy2 Y W t� dS 0 W t� nt� 0 | rNdS |rVdS tjdd�rfdS dS )N� r �.libcarestatus��filename� r )r r r� r r �status_gap_passed)r r* �libs_not_patchedr r r �get_userspace_update_status� s �r c C s\ i }| D ]N}|d � � D ]<\}}|�d�r||vr:g ||< || �|d |d f� qq|S )Nr' r� r� r� )re rb r� �rj r� r r2 r^ r r r r � s r c C sF t � }| D ]6}|d �� D ]$\}}|�||d |�dd�f� qq |S )Nr' rH r� r )r! re r� rb r r r r �_get_userspace_libs s r c s2 � s$t � }g � � fdd�|�� D � td� d�}t|�}d }}d}t|�D ]�}|\}} } z t|| | � d}| dkrxd}W qL tjy� } z d}t� t | �� W Y d } ~ qLd } ~ 0 tj tj fy� Y qL tj y� � Y qL tj�y } z d}t�t | �� W Y d } ~ qLd } ~ 0 0 qLtjdd� ||||fS ) Nc s g | ]}� � |��qS r )rc )r r' r� r r r r z+check_userspace_updates.<locals>.<listcomp>F)r� r� Tr r r )r, r r` r r r� r r� r �logwarnrO r� r� �AlreadyTrialedExceptionr� r9 r �touch_status_gap_file) r� r� Z data_beforer r r r r^ r2 r� r� �er� r r� r r s6 "& r c s^ d} d}t jddd�}|r�z t j|tgdd�\} }}W n0 tyf } zd} t|�}W Y d }~n d }~0 0 | r�tjd �|�dd � ntj d dd � d � t j � � �s�d S t jd }z�t �� �}t�d��� �fdd�|D �}dd� |D �}|jdd� d} |D ]8\}} | t j �| �7 } | |kr�t �| � tj�d| � q�W n" t�yX tjddd � Y n0 d S )Nr rU Z logrotateF)� raise_excT)rx r z5failed to run logrotate for libcare logs, stderr: {0}r6 z logrotate utility wasn't foundz/var/log/libcare/i z ^\d+\.log.*c s$ g | ] }�� |�rtj�� |��qS r )�matchr. r/ r0 )r �fn�Zlibcare_log_directoryZ pidlog_rer r r L r z'rotate_libcare_logs.<locals>.<listcomp>c S s g | ]}t j�|�|f�qS r )r. r/ �getctime)r �fpr r r r N r )�reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfiles)r r� r� �LIBCARE_LOGROTATE_CONFIGr$ rO r r9 r: r! r. r/ r� r �!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MB�listdir�re�compile�sortr� �remover� rj �logexc) �rcr� Zlogrotate_pathr* r$ Zmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_size�filepathr r( r r 3 s< r c C sJ zt �dd�ddg} W n ty* Y dS 0 t j| ddd�\}}}|dkS ) zKAssume that whenever the service is not running, we did not patch anything.r� r� r� rz FTrv r )r r� r$ r� )r� r� r* r r r r� ] s r� )N)TN)N)Ir� r. r/ r� r� rU r r r r r r r r r r r r r r �py23r r r �Dict�List�Optional�Set�TupleZLIBCARE_CLIENTr� rh ri r, r r! r% �cachedr+ r, r4 rB �intrC rm r� r� r� r� r` ra r� r� r� r� r� r� r� r8 r� �log_all_parent_processesr� r� �track_update_status�skip_if_no_selinux_module�UPDATE_MODE_MANUALr r r r r r r� r r r r �<module> st @ � 5 H #*
cải xoăn