File: //opt/alt/python37/lib/python3.7/site-packages/ssa/__pycache__/manager.cpython-37.pyc
B
V�d�7 � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlmZ dd lmZmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddl m Z G dd� d�Z dd�dd�Z dS )zA
This module contains classes implementing SSA Manager behaviour
� N)�contextmanager)�iglob)�is_cl_solo_edition)�
disable_quota)�Tuple� )�load_validated_parser�load_configuration)� flag_file)�SSAManagerError)� ssa_version)�
AutoTracer)�
DecisionMakerc @ s� e Zd ZdZdd� Zedd�dd��Zeed�dd ��Z ee
d�d
d ��Z ee
d�d d
��Z e
e
d�dd�ZdAeejd�dd�Ze
dd�dd�Zdd�dd�Zdd�dd�Zdd�d d �Zdd�d d �Zdd�d d!�Zeed"�d#d$�Zeee e f ef d�d%d&�Z e d'd(� �Z e e ed)d*�d+d,�Z d)d�d-d.�Z!eee e f ef d�d/d0�Z"d)d�d1d2�Z#d)d�d3d4�Z$d)d�d5d6�Z%ed�d7d8�Z&d)d�d9d:�Z'd)d�d;d<�Z(dd�d=d>�Z)d)d�d?d@�Z*d)S )B�Managerz
SSA Manager class.
c C sD t �d�| _d| _d| _d| _tddd� d�f| _tt t
j f| _ d S ) NZmanagerz clos_ssa.ini)Zphp44Zphp51Zphp52Zphp53zphp\d+-imunifyz php-internal)z /opt/alt/php[0-9][0-9]/link/confz+/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dz$/opt/plesk/php/[0-9].[0-9]/etc/php.dz'/usr/local/php[0-9][0-9]/lib/php.conf.dzM/usr/share/cagefs/.cpanel.multiphp/opt/cpanel/ea-php[0-9][0-9]/root/etc/php.dzA/usr/share/cagefs-skeleton/usr/local/php[0-9][0-9]/lib/php.conf.dz./var/cagefs/*/*/etc/cl.php.d/alt-php[0-9][0-9]c S s t �| �d�d �S )N�/� )�pwd�getpwnam�split)�path� r �</opt/alt/python37/lib/python3.7/site-packages/ssa/manager.py�<lambda>6 � z"Manager.__init__.<locals>.<lambda>)r �user)
�loggingZ getLogger�logger�
ini_file_name� substrings_to_exclude_dir_paths�wildcard_ini_locations�dict�wildcard_ini_user_locations�OSError�
ValueError�
subprocessZSubprocessError�subprocess_errors)�selfr r r �__init__% s zManager.__init__zjson str)�returnc O s* ddi}|� dd� |�� D �� t�|�S )z@
Form a success json response with given kwargs
�result�successc S s i | ]\}}||�qS r r )�.0�k�vr r r �
<dictcomp>B s z$Manager.response.<locals>.<dictcomp>)�update�items�json�dumps)�args�kwargsZ raw_responser r r �response< s zManager.responsec C s t j�t�S )z
Is SSA enabled
)�osr �isfiler
)r& r r r �_enabledE s zManager._enabledc C s ddhS )zK
Configuration settings required Request Processor restart
Zrequests_durationZ ignore_listr )r& r r r �_restart_required_settingsL s z"Manager._restart_required_settingsc C s dddddhS )NZ correlationZcorrelation_coefficientZrequest_numberZtimeZdomains_numberr )r& r r r �solo_filtered_settingsS s z Manager.solo_filtered_settings)�settingsr( c C s | j �|�S )z�
SSA Agent requires restart in case of changing these configuration:
- requests_duration
- ignore_list
)r9 � intersection)r& r; r r r �_restart_requiredX s zManager._restart_requiredF)�commandr( c
C s y0t jdd|gdd|d�}| j�d|� d�� W n� t jk
r� } zd| jjdt|j�t|j�t|j �|j|j|j |j
d�d � t d
|j� d |j� d |j p�|j
� ���W d
d
}~X Y nX | j k
�r
} z6| jjdt|�dt|�id � t d|� d|� ���W d
d
}~X Y nX |S )z�
Run /sbin/service utility to make given operation with SSA Agent service
:command: command to invoke
:check_retcode: whether to run with check or not
:return: subprocess info about completed process
z
/sbin/servicez ssa-agentT)Zcapture_output�textZcheckz
ssa-agent z
succeededz$SSA Agent %s failed with code %s: %s)�cmdZretcode�stdout�stderr)�extraz
SSA Agent z failed with code z: Nz&Failed to run %s command for SSA Agent�errzFailed to run z for SSA Agent: )
r$ �runr �infoZCalledProcessError�error�strr@ �
returncoderA rB r r% )r& r> �
check_retcoder) �er r r �run_service_utility` s. 4$zManager.run_service_utility)r3 r( c
C s� t � }|�|� y |�� W nH tk
rd } z*| jjddt|�id� td|� ���W dd}~X Y nX | �|�r~| j ddd� | �
� S ) z�
Change SSA config and restart it.
:args: dict to override current option values
:return: JSON encoded result of the action
z Failed to update SSA config filerD )rC z"Failed to update SSA config file: N�restartT)rJ ) r �overrideZwrite_ssa_confr" r rG rH r r= rL r5 )r& r3 �configrK r r r �
set_config� s
zManager.set_configc s> t � }tdd�r2� fdd�|�� D �}� j|d�S � j|d�S )zV
Get current SSA config.
:return: JSON encoded current config
T)Zskip_jwt_checkc s i | ]\}}|� j kr||�qS r )r: )r+ �key�value)r& r r r. � s z&Manager.get_config.<locals>.<dictcomp>)rO )r r r0 r5 )r& Z full_configZfiltered_configr )r& r �
get_config� s
zManager.get_configc C s | j r
dnd}| j|d�S )zY
Get current status of SSA.
:return: JSON encoded current status
�enabled�disabled)Z
ssa_status)r8 r5 )r& �statusr r r �get_ssa_status� s zManager.get_ssa_statusc C s2 | j rtddd��| �� | �� | �� | �� S )a�
Enable SSA:
- add clos_ssa extension for each PHP version on server
- add clos_ssa extension into cagefs for each user and each ver
- start SSA Agent (if it is not already started)
- restart Apache (etc.) and FPM, reset CRIU images
- create flag_file indicating that SSA is enabled successfully
:return: JSON encoded current status
zSSA is already enabled�warning)�flag)r8 r �
generate_inis�start_ssa_agent� create_flagr5 )r& r r r �
enable_ssa� s
zManager.enable_ssac C s2 | j stddd��| �� | �� | �� | �� S )a{
Disable SSA:
- remove clos_ssa extension for each PHP version on server
- remove clos_ssa extension from cagefs for each user and each ver
- stop SSA Agent
- restart Apache (etc.) and FPM, reset CRIU images
- remove flag_file indicating that SSA is enabled
:return: JSON encoded current status
zSSA is already disabledrX )rY )r8 r �remove_clos_inis�stop_ssa_agent� remove_flagr5 )r& r r r � disable_ssa� s
zManager.disable_ssac C s> dd� t � �� D �}| j|t� | jr(dnd| �� t� �� d�S )z�
Get SSA statistics.
Includes:
- config values
- version
- SSA status (enabled|disabled)
- SSA Agent status (active|inactive)
:return: JSON encoded current statistics
c S s i | ]\}}t |��� |�qS r )rH �lower)r+ rQ rR r r r r. � s z%Manager.get_stats.<locals>.<dictcomp>rT rU )rO �versionrV � agent_statusZ autotracing)r r0 r5 r r8 �status_ssa_agentr
� get_stats)r& Z_configr r r rf � s
zManager.get_stats)�dir_pathr( c s � fdd�| j D �}|S )z6
Checking for substrings in a string.
c s g | ]}t �|� �r|�qS r )�re�search)r+ Z substring)rg r r �
<listcomp>� s z+Manager.unused_dir_path.<locals>.<listcomp>)r )r& rg �resr )rg r �unused_dir_path� s zManager.unused_dir_pathc c s� x6| j D ],}x&t|�D ]}| �|�r&qd|fV qW qW xp| jD ]f}x`t|d �D ]P}| �|�rbqRy|d |�}W n | j�d|� wRY qRX |j|jf|fV qRW q@W dS )z�
Generator of existing paths (matching known wildcard locations)
for additional ini files
Returns tuple of (uid, gid) and path.
)r r r r zhUnable to get information about user owning %s directory (maybe he`s already terminated?), skip updatingN)r r rl r! r rF Zpw_uidZpw_gid)r& �locationrg Z pw_recordr r r �existing_paths� s
zManager.existing_pathsc c s: z t �|� t �|� dV W dt �d� t �d� X dS )z�
Dive into user context by dropping permissions
to avoid most of the security issues.
Does not cover cagefs case because it also requires nsenter,
which is only available with execve() call in our system
Nr )r6 �setegid�seteuid)r& �uid�gidr r r �
_user_context s
zManager._user_contextN)rq rr �ini_pathr( c C sl t j�|| j�}| �||��F t� �4 t|d�� }| j�d|� |� d� W dQ R X W dQ R X W dQ R X dS )zB
Enable SSA extension for single ini_path (given)
�wzGenerating %s file...zextension=clos_ssa.soN)
r6 r �joinr rs r �openr rF �write)r& rq rr rt r Zinir r r �generate_single_ini s zManager.generate_single_inic C s� | j �d� x�| �� D ]z\\}}}y| �|||� W q tk
rX | j �d|� wY q tk
r� } z| j �d|t|�� wW dd}~X Y qX qW | j �d� dS )zj
Place clos_ssa.ini into each existing Additional ini path,
including cagefs ones
z Generating clos_ssa.ini files...z>Unable to update file %s, possible permission misconfigurationz7Exception on generating clos_ssa.ini: "%s", error: "%s"Nz Finished!)r rF rn ry �PermissionError� ExceptionrG rH )r& rq rr rt rK r r r rZ s zManager.generate_inisc c sV xP| � � D ]D\\}}}x6t�|�D ](}| j|kr2q"||ftj�||�fV q"W q
W dS )z�
Generator function searching for clos_ssa.ini files
in all existing Additional ini paths
Returns tuple of (uid, gid) and path.
N)rn r6 �listdirr r rv )r& rq rr rt �namer r r �find_clos_inis/ s
zManager.find_clos_inisc C s� | j �d� xx| �� D ]l\\}}}y&| �||�� t�|� W dQ R X W q tk
r� } z| j �d|t|�� wW dd}~X Y qX qW | j �d� dS )z8
Remove all gathered clos_ssa.ini files
z Removing clos_ssa.ini files...Nz5Exception on removing clos_ssa.ini: "%s", error: "%s"z Finished!) r rF r~ rs r6 �unlinkr{ Z exceptionrH )r& rq rr Zclos_inirK r r r r^ ; s zManager.remove_clos_inisc C s2 | � d�}|jr | j ddd� n| j ddd� dS )ze
Start SSA Agent service
or restart it if it is accidentally already running
rV �startT)rJ rM N)rL rI )r& rd r r r r[ K s
zManager.start_ssa_agentc C s" | � d�}|js | j ddd� dS )z`
Stop SSA Agent service
or do nothing if it is accidentally not running
rV �stopT)rJ N)rL rI )r& rd r r r r_ V s
zManager.stop_ssa_agentc C s, y| j ddd� W n tk
r& dS X dS )z:
Get SSA Agent status: active or inactive
rV T)rJ ZinactiveZactive)rL r )r& r r r re _ s
zManager.status_ssa_agentc C s. t td�� W dQ R X | j�dt� d�� dS )zE
Create a flag file indicating successful enablement
ru Nz
Flag file z created)rw r
r rF )r& r r r r\ i s
zManager.create_flagc
C sf y"t �t� | j�dt� d�� W n> tk
r` } z | j�dt� dt|�� �� W dd}~X Y nX dS )z:
Remove a flag file indicating enablement
z
Flag file z removedz removal failed: N)r6 r r
r rF r" rX rH )r& rK r r r r` q s
zManager.remove_flagc C s t � �� }| jf |�S )zG
Get last report.
:return: JSON encoded report
)r Zget_json_reportr5 )r& Zreportr r r �
get_report| s
zManager.get_reportc C s | j r| �� dS )z@
Regenerates clos_ssa inis while SSA is enabled
N)r8 rZ )r& r r r �regenerate_inis� s zManager.regenerate_inis)F)+�__name__�
__module__� __qualname__�__doc__r' � staticmethodr5 �property�boolr8 �setr9 r: r r= rH r$ ZCompletedProcessrL rP rS rW r] ra rf �listrl r �intrn r rs ry rZ r~ r^ r[ r_ re r\ r` r� r� r r r r r s@
r zManager instance)r( c C s t � S )zk
Factory function for appropriate manager initialization
:return: appropriate manager instance
)r r r r r �initialize_manager� s r� ) r� r1 r r6 r rh r$ Z
contextlibr Zglobr Zclcommon.lib.cleditionr Zsecureior �typingr Z
configurationr r Zinternal.constantsr
Zinternal.exceptionsr Zinternal.utilsr Zmodules.autotracerr
Zmodules.decision_makerr r r� r r r r �<module>
s* n