File: //usr/libexec/kcare/python/kcarectl/libcare.pyo
�
�;jc @ s� d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m Z m Z m
Z
m Z m Z m
Z
m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z e r� d d l m Z m Z m Z m Z m Z n d Z d4 Z d Z! d
Z" d Z# i d d
6d d 6d d 6Z$ d d e% d g � f d d e% d g � f g Z' e j( d � � Z) d � Z* d � Z+ d � Z, d e- f d � � YZ. d � Z/ d d d � Z0 d � Z1 d � Z2 d � Z3 e4 d d � Z5 d � Z6 e, d! � � Z7 e, d" � � Z8 e, d# � � Z9 d$ � Z: d% � Z; d& � Z< d' � Z= d( � Z> d d) � Z? e, e/ e j@ d* � � � � ZA d+ � ZB e j@ e jC d, � e jD e, e/ e
jE d d d- � � � � � � ZF e, d. � � ZG d/ � ZH d0 � ZI d d d1 � ZJ d2 � ZK d3 � ZL d S(5 i����Ni ( t autht capabilitiest configt config_handlerst constantst errorst fetcht log_utilst platform_utilst
process_utilst selinuxt server_infot update_utilst utils( t HTTPErrort json_loads_nstrt urlquote( t Dictt Listt Optionalt Sett Tuples! /usr/libexec/kcare/libcare-clients /run/libcare/libcare.socks /var/run/libcare.socks /var/cache/kcare/libcare_patchess /var/cache/kcare/libcare_cvelists& /etc/sysconfig/kcare/libcare.logrotatet dbt mysqldt mariadbdt postgrest ubuntus 16.t
libnss_dnss 7.c C s� t t j � } t � } y* t j � } | d j � } | d } Wn5 t k
ry xz t D] \ } } } | | O} qY WnV X| d } xH t D]@ \ } } } | d k s� | | k r� | j
| � r� | } Pq� q� Wg | D] }
|
| k r� |
^ q� S( Ni i t .( t listR t LIBCARE_LIBSt setR t
get_distrot lowert Exceptiont LIBCARE_LIBS_BLACKLISTt Nonet
startswith( t libst blacklistedt distro_infot distrot versiont _t bl_libst version_dottedt bl_distrot
bl_versiont lib( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _get_effective_libcare_libs; s
'c C s i d d d g d 6t � d 6S( NR R R R R& ( R1 ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_userspace_mapU s c G s t j j t j d | | � S( Nt userspace( t ost patht joinR t PATCH_CACHE( t libnamet parts( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_userspace_cache_path\ s c s � f d � } | S( Nc sY z � | | � SWd y t d � Wn/ t k
rS } t j d j | � d t �n XXd S( Nt
clearcaches$ Libcare cache clearing failed: '{0}'t print_msg( t libcare_clientR" R t logerrort formatt False( t argst kwargst err( t clbl( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt wrappera s ( ( RD RE ( ( RD s- /usr/libexec/kcare/python/kcarectl/libcare.pyt clear_libcare_cache` s
t UserspacePatchLevelc B s) e Z d d � Z d d � Z d � Z RS( c C s t | | � j | | � S( N( t supert __new__( t clsR8 t buildidt levelt baseurl( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyRI o s c C s( | | _ | | _ | | _ | | _ d S( N( RL R8 RK RM ( t selfR8 RK RL RM ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt __init__r s c G s t | j | j t | � | � S( N( R: R8 RK t str( RN R9 ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt
cache_pathx s N( t __name__t
__module__R$ RI RO RQ ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyRG n s c s d � � � � f d � } | S( Nc S s d \ } } z� | d k r' t � } n i } g } xL t | � D]> } | j d d � | | j d � <| j | j d g � � q@ Wt j | d d �} d j g | j � D] } d j | � ^ q� � } d j t | � � } Wd t j
t | d
t �t j
t
| d
t �Xd S( s( KPT-1543 Save info about applied patchest s latest-versiont packaget patchest cve_fieldt cves
t Nt
ensure_dir( RT RT ( R$ t
_libcare_infot _get_patches_infot gett extendR
t extract_unique_cvesR6 t itemst sortedt atomic_writet LIBCARE_PATCHESt Truet LIBCARE_CVE_LIST( t infot versionst cvest packagest all_patchest rect cves_set( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt save_current_state} s 1c s/ d } z � | | � } | SWd � | � Xd S( N( R$ ( RA RB Rf ( RD Rm ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyRE � s
( ( RD RE ( ( RD Rm s- /usr/libexec/kcare/python/kcarectl/libcare.pyt refresh_applied_patches_list| s c C s� t j p d } t | � } t | j � � } t j t j | d � | | | d � } | d t j d | � 7} t j | d � } | r� t
j j d | | � } n i } | r� i | d 6| d <n y% t
j t j � | d
t | �} Wn� t j k
rD| r"t j d j | | � d t �d St j t | | � d
t �� nL t k
r�} | j d k r�| r�t j d j | � d d �� n � n Xt j | j! � t" t j# | j$ � � � }
|
j d g � } t% j& | � s�t j' d j | � � � n t( | | |
d |
j d � � } t) |
d � }
t | | |
d � } t
j j* | � sit
j j+ | � d k r�t j |
d � } y, t
j, | | d t j- d t
j. | � �Wq�t k
r�} | j d( k r�t j/ d � � n � q�Xn t | | |
� } d d | d | d! g } t0 j1 | d" t d# t �\ } } } | r`t j d$ j | | | � d d% �� n t | | d& � } t
j j2 | � r�t
j j3 | � r�t j | � n t
j4 |
| d' � t
j5 | d' | � | S() Nt maint us latest.v1s ?info=t updateR& t tagst Stickyt headerst
check_licenses; No libcare patchset available for {0} at tag {1}, skipping.R< t
ignore_errorsi� s8 Invalid sticky patch tag {0}: server rejected the value.t statuss invalid lib sticky patchR sk Latest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.RL RM s patch.tar.gzi t patch_urlt check_signaturet hash_checkeri� i� s KC+ licence is requiredt tart xfs -Cs --no-same-ownert catch_stdoutt catch_stderrs( Patches unpacking error: '{0}' '{1}' {2}s patches unpacking errort latests .tmp( i� i� (6 R t PREFIXR t stripR
t get_patch_server_urlt LIBNAME_MAPR] R t encoded_server_lib_infoR4 R5 R6 R t wrap_with_cache_keyR t urlopen_authR@ R t NotFoundR t loginfoR? R$ t shutilt rmtreeR: Rd R t codet
KcareErrorR t set_feature_flags_from_headersRt R t nstrt readR t has_lc_capabilitiest CapabilitiesMismatchRG RP t existst getsizet fetch_urlt
USE_SIGNATUREt get_hash_checkert NoLibcareLicenseExceptionR t run_commandt islinkt isdirt symlinkt rename( R8 t build_idt patch_levelt tagt prefixt urlt cache_dstt extra_kwargst responset ext metat required_capabilitiesRL t plevelt
patch_patht dstt cmdR� t stdoutt stderrt link_name( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt fetch_userspace_patch� sr '% "+,
$!%c C sj | t _ | s t � n t j d | r/ d n d � | rF t � n t j j d | r^ d n d � d S( Nt LIBCARE_DISABLEDt FALSEt YESs libcare service is t enabledt disabled( R R� t libcare_server_stopR t
update_configt libcare_server_startR t kcarelogRf ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt set_libcare_status� s
c C s� t j s t j j t j � r� t j t j d d g � t j t j d d g � t j t j d d g � t j t j d d g � nA y t j d d � d d g } Wn t k
r� d SXt j | � d S(
Nt stops libcare.sockets libcare.services reset-failedt libcaret services
/usr/sbin/s /sbin/( s
/usr/sbin/s /sbin/(
R t SKIP_SYSTEMCTL_CHECKR4 R5 R� t SYSTEMCTLR R� t find_cmdR" ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s
c C s3 t j s t j j t j � r� t j t j d d d g d t d t �\ } } } | d k ra d St j t j d d g � t j t j d d g � t j t j d d
g � t j t j d d g � t j t j d d g � nN t � r� d Sy t j
d d � d
d g } Wn t k
r!d SXt j | � d S( Ns is-actives --quiets libcare.serviceR} R~ i R� s libcare.sockets reset-failedR� t startR� s
/usr/sbin/s /sbin/( s
/usr/sbin/s /sbin/( R R� R4 R5 R� R� R R� Rd t libcare_server_startedR� R" ( R� R+ R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� s&
c sg d j d � t | p g � D� � } d d g } � sM | d d | g 7} n y t | � } Wn1 t k
r� } t j d j | � d d �� n Xg } xN | j d
� D]= } | r� y | j t j
| � � Wq� t k
r� q� Xq� q� Wg | D]3 } i | j d � d 6| j d � d 6| d
6^ q� } x8 | D]0 } t
� f d � | d
j � D� � | d
<q/W| S( Nt |c s s' | ] } d j t j | � � Vq d S( s ({0})N( R? t ret escape( t .0t proc( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>$ s Rf s -js -ls -rs/ Gathering userspace libraries info error: '{0}'Rw s userspace libs info errors
t commt pidR& c 3 s4 | ]* \ } } d | k s" � r | | f Vq d S( t patchlvlN( ( R� t kt v( t patched( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>= s ( R6 Ra R= R" R R� R? t splitt appendt jsont loadst
ValueErrort popt dictR` ( R� t limitt regexpR� t linesRC t resultt line( ( R� s- /usr/libexec/kcare/python/kcarectl/libcare.pyR[ s& % "
@
.c C s� t � } xJ | D]B } x9 | d j � D]' \ } } | j | d | d f � q' Wq Wg } t � } x� | D]{ } xr | D]j \ } } t | | t | � d � }
t j j |
� ry t |
d � � } | j
t j | � � Wd QXqy qy Wql W| S( NR& RK R� s info.jsont r(
R R` t addR2 R: RP R4 R5 t isfilet openR� R� t load( Rf RV Rk R+ t dataR� t umapR� R� R� t patch_info_filenamet fd( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR\ B s
#
'c C s
t t � � S( N( R\ R[ ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_info_basicR s c C s3 t � } | s t j d � n t j i | d 6� S( Ns No patched processes.R� ( R� R R> R� t dumps( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_infoW s c C s3 t � } | s t j d � n t j i | d 6� S( Ns No patched processes.R� ( R[ R R> R� R� ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_info_ s c C s= i } x0 t � D]% } | j d d � | | j d � <q W| S( Ns latest-versionRT RU ( R� R] ( R� Rk ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _libcare_versiong s #c C s7 x0 t � j � D] \ } } | j | � r | Sq Wd S( NRT ( R� R` R% ( R8 RU R* ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_versionn s c C s d j d � | D� � d S( NRT c s s" | ] } t j | � d Vq d S( t N( R
t bstr( R� t p( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>v s R� ( R6 ( t params( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_client_formatu s c C s: x$ t D] } t j j | � r | Sq Wt j d � � d S( Ns Libcare socket is not found.( t LIBCARE_SOCKETR4 R5 R� R R� ( t libcare_socket( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_available_libcare_sockety s
c G s t j r t j d � � n t j t j t j d � } | j d � d } z� | j t � � | j t j
� t | � } t j
d j d | � � | j | � x- t r� | j d � } | s� Pn | | 7} q� W| j d d � } t j
d
j d | � � | SWd | j � Xd S( Ns Libcare is disabled.i i
RT s Libcare socket send: {cmd}R� i s utf-8t replaces! Libcare socket recieved: {result}R� ( R R� R R� t sockett AF_UNIXt SOCK_STREAMt
settimeoutt connectR� t LIBCARE_SOCKET_TIMEOUTR� R t logdebugR? t sendallRd t recvt decodet close( R� t sockt resR� R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR= � s(
c C s2 | r� x� | D]{ } t d | | � } t j j | � s= q
n y t d d | � Wq
t k
r� } t j d j | | � d d �� q
Xq
Wd Sx� | D]� } y t d t | � � Wn1 t k
r� } t j d j | � d d �� n Xy t d � Wq� t k
r)} t j d
j | � d d �� q� Xq� Wd S( NRr Rq s --storages3 Userspace patch applying error (storage={0}): '{1}'Rw s userspace patch apply errort storages( Userspace storage switching error: '{0}'s userspace storage switch errors% Userspace patch applying error: '{0}'( R: R4 R5 R� R= R" R R� R? ( R� R� R� t storage_pathRC ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_apply� s*
"c C sF y t d � Wn1 t k
rA } t j d j | � d d �� n Xd S( Nt unloads& Userspace patch unloading error: '{0}'Rw s userspace patch unload error( R= R" R R� R? ( RC ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_unload� s c C s@ y t d � Wn+ t k
r; } t j d j | � � � n Xd S( s; Reload libcare-server plugin without restarting the server.t replugins Userspace replugin error: '{0}'N( R= R" R R� R? ( RC ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_replugin� s R� c C s� t � | t j k r$ t j r$ d St � } | d k rN t | j � � } n g } x' | D] } | j | j
| g � � q[ W| s� t j d j
| � � d St d | d | � \ } } } } | r� t j d � � n | s� t j d � d St j t j j t j d � � t � y t | d | �Wn8 t j k
rb}
t j t |
� � t j d � � n Xt � } t | � } t t d � | D� � � s�d St j d j
d
| � � t j d j
d | � � t d
� | j � D� � }
t d � | j � D� � } |
| } t d � | j � D� � } t j d j
d t! | � d | � � x9 | j" � D]+ \ } } t j d j
| t! | � � � qZW| S( s0 Patch userspace processes to the latest version.s No such userspace patches: {0}R� R� s8 There were errors while patches downloading (unpacking).s No patches were found.R3 s) There were errors while patches applying.c s s | ] } | d Vq d S( R& N( ( R� t item( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr> s s Patched before: {before}t befores Patched after: {after}t afterc s s" | ] } | D] } | Vq
q d S( N( ( R� R` R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr> s c s s" | ] } | D] } | Vq
q d S( N( ( R� R` R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr> s c s s | ] } t | � Vq d S( N( t len( R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr> s s� The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.t countt overalls* Object `{0}` is patched for {1} processes.N(# t rotate_libcare_logsR t UPDATE_MODE_AUTOR t LIB_AUTO_UPDATER$ R2 R t keysR^ R] R R� R? t check_userspace_updatesR R� R
t restore_selinux_contextR4 R5 R6 R7 R R> RP R[ t _get_userspace_procst anyR� R t valuest sumR R` ( t modeR� R� R� t process_filtert userspace_patcht failedt something_foundR+ R R� t
data_afterR t uniq_procs_aftert uniq_procs_beforet diffR
R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt do_userspace_update� sR
!
#c C sn z5 y t � \ } } } } Wn t j k
r3 d SXWd t � X| rJ d S| rT d St j d d � rj d Sd S( Ni i t filenames .libcarestatusi i ( R R R� R R t status_gap_passed( R R+ t libs_not_patched( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_userspace_update_status s c C s� i } xy | D]q } xh | d j � D]V \ } } | j d � r$ | | k rX g | | <n | | j | d | d f � q$ q$ Wq
W| S( NR& R� R� R� ( R` R] R� ( Rf R� R R8 Rk ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR . s
*c C se t � } xU | D]M } xD | d j � D]2 \ } } | j | | d | j d d � f � q' Wq W| S( NR& RK R� i ( R R` R� R] ( Rf R� R R8 Rk ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _get_userspace_libs9 s
.c C s� | s> t � } g } g | j � D] } | j | � ^ q" n t d t d | � } t | � } t } } t } x"t | � D]} | \ }
} } yO t |
| | d | �}
| r� |
d k r� w| n t } | d k r� t } n Wq| t
j k
r} t } t j
t | � � q| t
j t
j f k
r-q| t
j k
rC� q| t
j k
r�} t | d d � d k rs� n t } t j t | � � q| Xq| Wt j d d � | | | | f S( NR� R� R� i Rw s invalid lib sticky patchR s .libcarestatus( R2 R R^ R[ R@ R Rd R# R� R$ R R� R t logwarnRP R� R� t AlreadyTrialedExceptionR� t getattrR> R t touch_status_gap_file( R� R� R� R& t data_beforeR R R R! Rk R8 R� R� R� t eR� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR A s> )
c C s� d } d } t j d d t �} | r� y( t j | t g d t �\ } } } Wn% t k
rv } d } t | � } n X| r� t j d j
| � d t �q� n t j d d t �d
} t j
j | � s� d St j d } y� t j | � } t j d
� } g | D]* } | j | � rt j
j | | � ^ q}
g |
D] } t j
j | � | f ^ q:} | j d t � d }
xY | D]Q \ } } |
t j
j | � 7}
|
| k r{t j | � t j j d | � q{q{WWn$ t k
r�t j d d t �n Xd S( Ni RT t logrotatet raise_excR~ i s5 failed to run logrotate for libcare logs, stderr: {0}R< s logrotate utility wasn't founds /var/log/libcare/i i s ^\d+\.log.*t reverses% Removed %s because of logs size limits) Failed to cleanup libcare server logfilesi ( R R� R@ R� t LIBCARE_LOGROTATE_CONFIGRd R" RP R R> R? R$ R4 R5 R� R t! LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MBt listdirR� t compilet matchR6 t getctimet sortR� t removeR� Rf t logexc( t rcR� t logrotate_pathR+ R) t libcare_log_directoryt max_total_sizet log_filest pidlog_ret fnt pidlog_filest fpt pidlog_files_with_ctt
total_sizet filepath( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR r s< ("
7+
c C sb y t j d d � d d g } Wn t k
r3 t SXt j | d t d t �\ } } } | d k S(
sK Assume that whenever the service is not running, we did not patch anything.R� s
/usr/sbin/s /sbin/R� Rw R} R~ i ( s
/usr/sbin/s /sbin/( R R� R" R@ R� Rd ( R� R� R+ ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s
$( s /run/libcare/libcare.socks /var/run/libcare.sock(M R� R4 R� R� R� RT R R R R R R R R R R R
R R R
t py23R R R R@ t typingR R R R R t LIBCARE_CLIENTR� Rc Re R- R� R R$ R# t cachedR1 R2 R: RF t intRG Rn R� R� R� R� Rd R[ R\ R� R� R� R� R� R� R� R= R t log_all_parent_processesR R t track_update_statust skip_if_no_selinux_modulet UPDATE_MODE_MANUALR R" R R# R R R� ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt <module> sl ^ +
L
" $ $H 1 *