관리-도구
편집 파일: __init__.cpython-39.pyc
a d4hP � @ sR d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZ ddlmZ dd lmZ dd lmZ dd lmZ dd lm Z dd lm Z ddlm Z ddlm Z ddlm Z ddlm!Z! ddlm"Z" ddlm#Z# ddlm$Z$ ddlm%Z% ddlm&Z& ddl'm(Z(m)Z)m*Z*m+Z+m,Z, ddl$m-Z-m.Z.m/Z/ dZ0dZ1dZ2d Z3d Z4d Z5d Z6d Z7e�8d!ej9�Z:e�8d"�Z;ej<�=d#��r�e j<�>d d#� ej?d$e@d%� ejG�HejI� d&d'� ZJd(d)� ZKd*d+� ZLd,d-� ZMd.d/� ZNd�d0d1�ZOd2d3� ZPd4d5� ZQd6d7� ZRd8d9� ZSd:d;� ZTd<d=� ZUG d>d?� d?eV�ZWG d@dA� dAe.�ZXG dBdC� dCe.�ZYG dDdE� dEe.�ZZdFdG� Z[edHdI� �Z\d�dJdK�Z]dLdM� Z^dNdO� Z_i Z`dPdQ� Zaeae*jb_cede dRd��s~z8d dleZfd dlgZhefji�jehjk�efji�jdS�k �r0eldT��W n el�yF Y n80 dUdV� Zme*jnZoG dWdX� dXep�ZqG dYdZ� dZe*jn�Zrere*_nejsfd[d\�Ztd]d^� Zud_d`� ZvG dadb� dbep�Zwdcdd� Zxdedf� Zyd�dhdi�Zzdjdk� Z{dldm� Z|d�dndo�Z}dpdq� Z~drds� Zdtdu� Z�dvdw� Z�dxdy� Z�dzd{� Z�d|d}� Z�d~d� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�ej�ejsfd�d��Z�d�d�� Z�ej�fd�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d Z�d�dĄ Z�dS )�� )�print_functionN)�ArgumentParser)�datetime)�contextmanager� )�config)� constants)� log_utils)�utils)� process_utils)�platform_utils)� http_utils)�auth)�config_handlers)�libcare)�selinux)�fetch)� update_utils)�errors)�kcare)� server_info)�URLError� HTTPError�httplib� urlencode�json_loads_nstr)�SafeExceptionWrapper� KcareError�NotFound�c Zv2)Z12hZ24hZ48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh)z latest.v2z /etc/sysconfig/kcare/sysctl.conf� z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C s@ t � } tj�t�r<ttd�}|D ]}| �|�� � q |�� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r1 �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistJ s r3 c C sB |� d�}| r(d�|d | |d g�}nd�|d |d g�}|S )N�.r ���)�split�join)�ptype�filenameZ name_partsr1 r1 r2 � _apply_ptypeT s r: c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S �N)r: r � PATCH_BIN� PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE� PATCH_DONE)r8 r1 r1 r2 � apply_ptype] s rA c C s� t �� \} }}d}t|t�r^t|t�s^z d|jt�|j�|jf }W q� t t fyZ Y q�0 nNt|t t t f�r�t|t�s�d| }n*t|t �r�|jp�t|j�} |jp�d|j }t�� }tjt�� |d |d t| dt| ��|d�t�|d��t|dd�d �S ) N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z agent_versionZpython_version�distroZdistro_version�error�details� tracebackrE ) �sys�exc_info� isinstance�OSErrorr �errnor& �strerrorr9 �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrH r � get_distror �VERSIONZget_python_version�getattr�strr7 rI Z format_tb)rT �value�tbZdetails_sanitizedrF r1 r1 r2 � format_exception_without_detailse s, �r] c C st t jr d S t�t� �} t�t�t� | ���}t� d�d | }t � |t �� �}zt �|� W n tyn Y n0 d S )Nz/api/kcarectl-tracez?trace=)r �UPDATE_FROM_LOCAL�json�dumpsr] r �nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ encoded_trace�urlZrequestr1 r1 r2 �send_exc� s rf c C s� t �� }|dkr t �|d� dS t �� t �� }|dkrBt �d� t �d� ttjd��0}t � |� � d� t � |� � d� W d � n1 s�0 Y |r�t � |� z | � W n( t y� tj�d� t �d� Y n0 t �d� dS )z� Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: r N�ar � zWait exception)r& �fork�waitpid�setsid�_exitr- r* r ZLOG_FILE�dup2�fileno�time�sleeprd r �kcarelog� exception)�funcrp �pid�fdr1 r1 r2 � nohup_fork� s( . rv c C s� t j�tjd�} t j�| �r�t| d��P}z,t|�� �}|t j t � � krRt || ��W n t yf Y n0 W d � n1 s|0 Y t�| t�� � dS )a Check the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. �.kcareprev.lockr$ N)r& r' r7 r � PATCH_CACHEr( r* �int�readr �SUCCESS_TIMEOUTro � PreviousPatchFailedException� ValueErrorr � atomic_write� timestamp_str)Zanchor_filepathZafile� timestampr1 r1 r2 � touch_anchor� s $r� c C st zt �t j�tjd�� W n ty, Y n0 td| � tj � � zt dd� W n t yn t j�d� Y n0 dS )z� See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. rw �done��reasonzCannot send update info!N)r& �remover' r7 r rx rM �register_actionr �get_loaded_modules�clear�get_latest_patch_levelrd r rq rr �� state_datar1 r1 r2 � commit_update� s r� c C s( t jtj�tjd�t�| |d�d� d S )N�patchesrB )Z exclude_path) r �clean_directoryr& r' r7 r rx r �get_cache_path)�khashZplevelr1 r1 r2 � clear_cache� s r� c C s> t jpd}d�|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r �PREFIXr7 r rx r& r' )r� �fname�prefixZ module_dirr. r1 r1 r2 �get_current_level_path� s r� c C s t jt| d�t|�dd� d S )N�latestT)Z ensure_dir)r r~ r� rZ )r� � patch_levelr1 r1 r2 �save_cache_latest� s r� c C sV t | d�}tj�|�rRz$tt|d��� �� �}t� | |�W S t t fyP Y n0 d S )Nr� r$ ) r� r& r' r( ry r* rz �stripr �LegacyKernelPatchLevelr} rQ )r� Zpath_with_latest�plr1 r1 r2 �get_cache_latest� s r� c @ s e Zd ZdS )�CertificateErrorN)rC � __module__� __qualname__r1 r1 r1 r2 r� s r� c @ s e Zd Zdd� ZdS )�UnknownKernelExceptionc C s* t �| d�t�� d t�� t�� �� d S )N�LNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r ) rd �__init__�formatr rW �platform�releaser �get_kernel_hash��selfr1 r1 r2 r� s ��z UnknownKernelException.__init__N)rC r� r� r� r1 r1 r1 r2 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )�ApplyPatchErrorc sJ t t| �j|i |�� || _|| _|| _|| _t�� d | _ t � � | _ d S �Nr ) �superr� r� �code� freezer_style�level� patch_filer rW rF r� r� )r� r� r� r� r� �args�kwargs�� __class__r1 r2 r� s zApplyPatchError.__init__c C s0 d� | j| j| j| j| jd�dd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})�, c S s g | ] }t |��qS r1 )rZ )�.0�ir1 r1 r2 � <listcomp> � z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rF r� r7 r� r� r1 r1 r2 �__str__ s �zApplyPatchError.__str__�rC r� r� r� r� � __classcell__r1 r1 r� r2 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )r| c s& t t| �j|i |�� || _|| _d S r; )r� r| r� r� �anchor)r� r� r� r� r� r� r1 r2 r� % s z%PreviousPatchFailedException.__init__c C s d}|� | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager1 r1 r2 r� * s �z$PreviousPatchFailedException.__str__r� r1 r1 r� r2 r| $ s r| c C s� t jd�| � }ztt�|�}t�t�|�� ��}t |d �}|dkrNt d� n2|dkr`t d� n |dkrrt d� nt d �|�� |W S t y� } zt � ||� W Y d }~n d }~0 0 d S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizerh z!No KernelCare license for that IPzUnknown error {0}r5 )r �REGISTRATION_URLr� r �urlopenr � data_as_dictra rz ry �printr r �print_cln_http_error)�keyre �response�resr� �er1 r1 r2 �!set_monitoring_key_for_ip_license3 s "r� c c sT t jrtjt jdd� z d V W t jrPtjt jdd� nt jrNtjt jdd� 0 d S )NT)�shell)r ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr1 r1 r1 r2 � execute_hooksG s �r� c C s� t � }|j}|j}t�� }| dkrdt|�tjt� � t � � |t t �� �|d�}td� tt�|�� nZtd� tt|�� tdt|� � ttj� tt� � � tt � � � t|� tt �� � dS )a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: r_ )Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_inforZ r � AUTO_UPDATEr � kcare_unamer� r� ry r Z get_uptimer� r_ r` )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr1 r1 r2 � plugin_infoS s. � r� c C s` t �� } ztdd�}W n ty6 tjr.dnd Y S 0 | d u rDdS | |krPdS t�� r\dS dS )N�infor� r � r rh )r �loaded_patch_levelr� r� r �IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)� current_levelZlatest_patch_levelr1 r1 r2 �get_update_status� s r� c C s2 t �� d d� \} }| dkr*|�d�r*dS dS d S )Nrh Z CloudLinuxz7.�extrarB )r rW � startswith)rF �versionr1 r1 r2 �edf_fallback_ptype� s r� c C sl | j | jf}t�||�}t�|| j�| _| j�tj tj d� |tvrZ| j� � dd� t|< | j rh| � � dS )z�Function remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect r Nrh )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ resolved_addrr1 r1 r2 �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr1 )r� r1 r1 r2 �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �SSLSockc C s || _ d| _d S r� )� _ssl_conn�_makefile_refs)r� r� r1 r1 r2 r� � s zSSLSock.__init__c G s( | j d7 _ tj| jg|�R ddi�S )Nr r- T)r� r� Z _fileobjectr� �r� r� r1 r1 r2 �makefile� s zSSLSock.makefilec C s | j s | jr | j�� d | _d S r; )r� r� r- r� r1 r1 r2 r- � s z SSLSock.closec G s | j j|� S r; )r� �sendallr� r1 r1 r2 r� � s zSSLSock.sendallN)rC r� r� r� r� r- r� r1 r1 r1 r2 r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t j�| � tj�tjj�}|�tjjtjj B � t j rJ|� tjj t� n|� tjjt� |�� tj�|| j�}|�� | jp�| j}|�|�� � |�� t j r�t|�� |� t|�| _d S r; ) r �HTTPConnection�connect�OpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r �CHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� �ctxZconnZ server_hostr1 r1 r2 r� � s z PyOpenSSLHTTPSConnection.connectN)rC r� r� r� r1 r1 r1 r2 r� � s r� c C sZ t �� }tjd ur$t �|ttj��S tD �]$}tjrBt �||�}n t �|t ||��d t � | � }z�t � tj�|dd�}t�|j� t� t�|�� ��� }tjd�| |�dd� |r�|�d�r�t |�}t � ||d |d |d �W S t �|t|��W S t �y Y q( t �yL } z"|j d v �r6t!d ��� W Y d }~q(d }~0 0 q(t"� �d S ) N�?F�� check_licensez;fetch patch level, reason: {0}, kernel latest response: {1}�Z print_msg�{r� �baseurlr� )i� i� zKC licence is required)#r r� r � PATCH_LEVELr� ry � PATCH_LATESTr^ Zget_kernel_prefixed_url�stickyfyr Zbased_server_infor Zwrap_with_cache_keyr � urlopen_authr Zset_config_from_patchserver�headers�update_all_kmod_paramsr ra rz r� r �loginfor� r� r ZKernelPatchLevelr r r� r r� ) r� �moder� r� re r� r� Z latest_info�exr1 r1 r2 �fetch_patch_level� s0 " r c C sB | � t|tj��}tj�d�|�� ztj |ddd� W dS t y` tj�d�|�� Y dS t y� } z$tj� d�|t |��� W Y d }~n d }~0 0 | � t|tj�tj �}tj�d�|�� ztj |dd� W nd t �y tj�d�|�� Y dS t�y< } z$tj�d �|t |��� W Y d }~n d }~0 0 dS ) NzProbing patch URL: {0}F�HEAD)r� �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1}r� z{0} is not available: {1})�file_urlr: r r< r rq r� r� r r r rd �debugrZ r ZSIGr )r� r8 Zbin_urlr re r1 r1 r2 � probe_patch s( ..r c C sF |t jkr| �t j�}n | �|�}| �|�}tj||tjt� | �d�S )N)Z hash_checker) r �KMOD_BINZkmod_urlr � cache_pathr Z fetch_urlr � USE_SIGNATUREZget_hash_checker)r� �namere Zdstr1 r1 r2 � fetch_and_verify_kernel_file6 s r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )� PatchFetcherNc C s || _ d S r; )r� )r� r� r1 r1 r2 r� A s zPatchFetcher.__init__c C s t | j|�S r; )r r� )r� r r1 r1 r2 �_fetchD s zPatchFetcher._fetchc C sr | j �tj�}| j �tj�}| j �tj�}| j �tj�}tdd� ||||fD ��opt j � |�dkopt j � |�dkS )Nc s s | ]}t j�|�V qd S r; )r& r' r( )r� r' r1 r1 r2 � <genexpr>N r� z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r r r@ r< r= r r �allr& r' �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr1 r1 r2 �is_patch_fetchedG s ��z PatchFetcher.is_patch_fetchedc C s, | j d u rtd��| j s | j S | �� r6t�d� | j S t�d� t| j tj�r�z tj | j � t j �dd�}W n t y| Y n(0 |j�dd �}|r�| j �t�|��| _ z| �t j � W n* t y� td�| j t jp�d���Y n0 | �t j� | �tj� | �� tj| j � t j �d d d � t � tj � | j S ) Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r � KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�defaultr� �wb�r )!r� r} r r r rL r r� r r r r r< r r r� �upgrader ra r r r� � PATCH_TYPEr= r r �extract_blacklistr~ r r@ r �restore_selinux_contextrx )r� �respr� r1 r1 r2 � fetch_patchS s< �� zPatchFetcher.fetch_patchc C sJ t | j�tj�d��� }|rFt�|�}|rFt� | j�tj �|� d�� d S )Nr$ r ) r* r� r r r= rz � BLACKLIST_RE�searchr r~ r> �group)r� ZbufZmor1 r1 r2 r { s z PatchFetcher.extract_blacklistc C s� |du r dS zt |tj�}W n ty0 Y dS 0 |j�dd�}|rT|�t�|��}|� tj�}t |d��&}t dd� |� � D ��}W d � n1 s�0 Y |D ]}t ||� q�t �tj� dS )z� Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nr r$ c S s g | ] }|� � �qS r1 )r� )r� �fixupr1 r1 r2 r� � r� z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r r r? r r r� r r ra r r* r% � readlinesr r r rx )r� r� r r� Z fixups_fnamer/ �fixupsr$ r1 r1 r2 � fetch_fixups� s 4 zPatchFetcher.fetch_fixups)N) rC r� r� r� r r r r r' r1 r1 r1 r2 r ? s (r c C s6 t � } t| j� | jtjkr(t�d� n t�d� d S )Nr r )r� r� �msgr� �PLI�PATCH_NEED_UPDATErJ �exit)r� r1 r1 r2 � kcare_check� s r, c C s t � } t| �}z t�� }W n ty0 i }Y n0 t�� }d}|d urZt�|d �� d�}t� � }t |� dg ��}t dd� |D ��}t�� }|s�td� ntd� td �|�� td �|�� |d kr�td �|�� |d kr�td �|�� || d kr�td� td� d S )NZUnknown�tsz%Y-%m-%dr� c s s | ]}t |�d g ��V qdS )r� N)�lenr� )r� Zrecr1 r1 r2 r � r� z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z fromtimestamp�strftimer� r. r� �sumr� r� r� ) r� � kcare_info� libcare_info�stateZ latest_updateZeffective_versionZkernel_vulnerabilitiesZuserspace_vulnerabilitiesr� r1 r1 r2 �show_generic_info� s4 r5 Fc C s� z�t dtjd�}|st�|�tj�}t�t � |�� � �}| r�g i }}|� d�D ]0}t� |�}|rvd|v rv|�|� qP|�|� qP||d< t�|�}t|� W nL ty� } z t�||j� W Y d}~dS d}~0 ty� td� Y n0 d S ) z� Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None r� )r� �policy� � kpatch-namer� Nr zNo patches availabler )r� r � POLICY_REMOTEr� r r r= r ra r r rz r6 r� �append�updater_ r` r� r r r� re ) �is_jsonr� re � patch_infor� r. �chunk�datar� r1 r1 r2 �kcare_latest_patch_info� s, r@ c C s� d| j i}| jd ur�t| �}g }|�d�D ]0}t�|�}|rPd|v rP|�|� q*|�|� q*||d< t� � }|rx|d nd|d< |S )Nr� r7 r8 r� r� �unknown) r( r� �_kcare_patch_infor6 r r� r: r; r Z read_dumped_kernel_patch_level)r� r. r= r� r> r? Zsaved_patch_levelr1 r1 r2 r/ � s r/ c C sP t �� }t �|| jtj�}tj�|�s.t d��t |d�� � }|rLt � d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.r$ rB )r r� r� r� r r= r& r' r( r r* rz r! �sub)r� r� r r� r1 r1 r2 rB s � rB c C sT t � }| s:|jdkr t|j� |jd u r,d S tt|�� nttjt|�dd�� d S )Nr T)Z sort_keys) r� r� r� r( r� rB r_ r` r/ �r< r� r1 r1 r2 r= s r= c C s: t jd| g}t�|�}t�� }d}t�||�t�||�kS )Nz file-infozkpatch-build-time)r � KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr1 r1 r2 � is_same_patch s rI c C sL |dkr dS | r || k r dS | |kr(dS t �t �� |tj�}t|�sHdS dS )Nr FT)r r� r� r r< rI )� applied_level� new_levelrH r1 r1 r2 �kcare_need_update" s rL c C sp t jrltj�t�r t�ttj�s6tj � d� t�� d S t j dddtgdd�\} }}| dkrltj � d� | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctl�-qz-pT�� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr& r' r( � SYSCTL_CONFIG�access�R_OKr rq �warningr� r r� )r� �_r1 r1 r2 � update_sysctl4 s rU c s� t j�t�sttd��� t �tt j�s>tj � d� t�� dS ttd��l}|� � }|� d� |D ]$� t� fdd�| D ��s`|�� � q`|D ]}|�|d � q�|�� W d � n1 s�0 Y dS ) z*Update SYSCTL_CONFIG accordingly the editsrg zFile {0} has no read accessNzr+r c 3 s | ]}� � |�V qd S r; )r� )r� r$ �r0 r1 r2 r P r� z#edit_sysctl_conf.<locals>.<genexpr>� )r& r' r( rP r* r- rQ rR r rq rS r� r% �seek�any�write�truncate)r� r: Zsysctl�linesrg r1 rV r2 �edit_sysctl_conf? s r] c C s& | D ] }t �|�rtd�|���qd S )NzDDetected '{0}' kernel module loaded. Please unload that module first)�CONFLICTING_MODULES_RE�matchr r� )r� �moduler1 r1 r2 �detect_conflicting_modulesX s ra c C s d� t�� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer1 r1 r1 r2 �get_kcare_kmod_link^ s rb c C sp t dd�} t�t�� | tj�}tj�|�s.d S t |d��$}|� � dd � dkW d � S 1 sb0 Y d S )Nr� r� �rbi��s ~Module signature appended~ ) r� r r� r� r r r& r' r( r* rz )r� Z kmod_fileZvfdr1 r1 r2 �kmod_is_signedb s rd c K s\ d| g}|� � D ]\}}|�d�||�� qtj|dd�\}}}|dkrXtd�| |���d S )Nz /sbin/insmodz{0}={1}TrN r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.)�itemsr: r� r r� r )Zkmodr� �cmdr� r[ r� rT r1 r1 r2 � load_kmodk s rg c C s: t �� rt� std��t �� s.t �� s.t �� r6td��d S )Nz4Secure boot is enabled. Not supported by KernelCare.zWYou are running inside a container. Kernelcare should be executed on host side instead.)r Zis_secure_bootrd r Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr1 r1 r1 r2 �check_compatibilityt s rh c C sP t �d�}t j|dgddd�d dk}|rL| dv rLt�d�| �� t�d� d S ) NZmodinfoZkmodlveT�rO � catch_stderrr ��freer� z3{0} patch type conflicts with kmodlve kernel moduler )r Zfind_cmdr� r �logerrorr� rJ r+ )r8 rf Z has_kmodlver1 r1 r2 � check_patch_type_compatibility{ s rn c C sL t �ddd| g�}g }|�d�D ]&}|�� r |�d�\}}}|�|� q |S )Nz /sbin/modinfoz-FZparmrW �:)r rF r6 r� � partitionr: )� kcare_link�stdoutZavailable_paramsr0 Z param_namerT r1 r1 r2 �get_kmod_available_params� s rs c C sL t jr dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rB )� kpatch_debugZ kmsg_outputZ kcore_outputZ kdumps_dirZenable_crashreporter) r � KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErL � KDUMPS_DIRrZ ZENABLE_CRASHREPORTERr1 r1 r1 r2 �make_kmod_new_params� s �rw c C sB t jr tj�t j�s t�t j� t� �� D ]\} }t| |� q*d S r; ) r rv r& r' �exists�makedirsrw re �update_kmod_param)Zparam�valr1 r1 r2 r � s r c C s� d}t j�|| �}t j�|�s"d S z<t|d�� }|�t|�� W d � n1 sR0 Y W n" ty� tj � d| |� Y n0 d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r& r' r7 rx r* rZ rZ rd r rq rG )Zkmod_param_nameZ param_valueZ params_rootZ param_pathr/ r1 r1 r2 rz � s 0 rz c s� t � }t�| |tj�}zt�||� W n ty< |}Y n0 tj r^t j � tj �s^t � tj � t� }t|�� t� fdd�|�� D ��}t|fi |�� t� d S )Nc 3 s" | ]\}}|� v r||fV qd S r; r1 )r� �k�v�Zavailable_kmod_paramsr1 r2 r � r� z"load_kcare_kmod.<locals>.<genexpr>)rb r r� r r �shutil�copyrd r rv r& r' rx ry rw rs �dictre rg � update_depmod)r� r� rq Z kcare_fileZ kmod_paramsr1 r r2 �load_kcare_kmod� s r� c C sX dg}| d ur |� d| g� tj|ddd�\}}}|rTtjd�d�|�||�dd� d S ) Nz /sbin/depmodz-aTri z%Running of `{0}` failed with {1}: {2}� Fr� )�extendr r� r rm r� r7 )�unamerf r� rT �stderrr1 r1 r2 r� � s �r� c C s4 t jd| gdd�\}}}|dkr0td�| |���d S )Nz /sbin/rmmodTrN r z Unable to unload {0} kmod {1})r r� r r� )�modnamer� rT r1 r1 r2 � unload_kmod� s r� c C sP g }dg| D ]<}t �| |d�|��}tj�|�rt|� |�d�|�� q|S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r& r' rx rg r: )r� r� r� Zloaded�mod�modpathr1 r1 r2 � apply_fixups� s r� c C s> | D ]4}z t |� W q ty6 tj�d| � Y q0 qd S )Nz$Exception while unloading module %s.)r� rd r rq rr )r& r� r1 r1 r2 � remove_fixups� s r� c C s� | r | }n6t jrt j}n(t� �|�r2d| t jdfS d| t jdfS dddddd�}|�� }||v rj|| }ntd�|| t jd���|| t jdfS ) NZfreeze_conflictTr FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3}))r Z PATCH_METHODr3 � intersection�upperr r� )�freezerr� r Zpatch_method_mapr1 r1 r2 �get_freezer_style� s$ � r� rB c s� | ||d�� t d� � t�� }t�� }t|� t||�}t�| |tj�}t | |� d� |tj t � � t�|��} d|v } | o�t�| |�} |d u} | o�t|�o�t�| �} � �|| d�� | r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d � � td� d } | �s<t d � � t| |� |�rHt� t d � � t|| || |� t� t� d� |t� � �� t � � t d� � t � fdd�tj!d� d S )N)r� Zfuturer �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�load�patchz5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S r; )r� r1 r� r1 r2 �<lambda>E r� z kcare_load.<locals>.<lambda>)rp )"r� r r� r� ra r� r� r r< r� r� r r r Z parse_unameZis_kmod_version_changedrI Z kcare_update_effective_versionr; r� �kpatch_ctl_unpatchr� r� r� r� �kpatch_ctl_patchrU r r r� r Ztouch_status_gap_filerv r{ )r� r� r r� � use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ same_patchr& r1 r� r2 � kcare_load sT � r� c C s� t jg}t�||tj�}tj�|�r2|� d|g� |� dd|g� |� d|d g� |� | � t j |dd�\}}}|dkr�t |||| ��d S )Nz-br� z-d�-mr TrN )r rE r r� r r> r& r' rx r� r: r r� r� ) r� r� r� r� r� r� Zblacklist_filer� rT r1 r1 r2 r� H s r� c C sZ t jtjdd| d gddd�\}}}|dkrVtjd�||�dd� td �|t| ����d S ) Nr� r� r Tri �4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}Fr� �Error unpatching [{0}] {1}) r r� r rE r rm r� r rZ )r� r� rr r� r1 r1 r2 r� U s � r� c C s8 | |d< t t�� �|d< t�tj�tjd�t |�� d S )N�actionr- z kcare.state) ry ro r r~ r& r' r7 r rx rZ )r� r� r1 r1 r2 r� _ s r� c C sl d}t j�|�sd S t �|�D ]H}t j�||dd�}t j�|�sBq t �|�}|| kr t �|� t|� q d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r& r' �isdir�listdirr7 �islink�readlink�unlinkr� )� kmod_linkZ modules_path�entryZ sym_link_pathZ target_pathr1 r1 r2 �update_weak_modulese s r� c C sZ t �� }t� }z|�|� W n6 tyR } z |s>td�|���W Y d }~n d }~0 0 t �� }t| |�}t � �� d|v �r|d u}|r�t t � � ||�}t j tjdd|d gddd�\} } } t|� | dkr�tjd�| | �d d � td �| t|����tjt�t�d td �t�d� t� } tj � | ��r.t� | � t | � W d � n1 �sL0 Y d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.r r� r� r Tri r� Fr� r� r )�count�delay) r r� r r' rd r r� r� r� r� r� r� r r� r rE r� r rm rZ r Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rb r& r' r( r� r� ) r� �forcer� �pf�errr� r� Z need_unpatchr& r� rr r� r� r1 r1 r2 � kcare_unloadu s@ �� � � r� c C s8 t � }| rt|�S |jdkr"|jS |jd ur4t�� S d S r� )r� �_kcare_info_jsonr� r( r� r rG rD r1 r1 r2 r2 � s r2 c C sR d| j i}| jd ur>|�t�t�� �� |�t�|�d��� | j |d< t � |�S )Nr� zkpatch-descriptionz kpatch-state) r( r� r; r r� r rG Zparse_patch_descriptionr� r4 r_ r` )r� r. r1 r1 r2 r� � s r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r) r r rh r� c C s" || _ || _|| _|| _|| _d S r; )r� r( � remote_lvlr� r4 )r� r� r( r� r� r4 r1 r1 r2 r� � s z PLI.__init__N)rC r� r� r� r* �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r1 r1 r1 r2 r) � s r) c C s� t �� } z�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nj ty� tj }t j r�d � t j t �� d t�� �}n d � t �� d t�� t �� �}t||d d d �}Y n0 |S ) Nr� r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingsr� Z unavailable)r r� r� rL r) r* r� r� r� r� r � STICKY_PATCHr� r rW r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r( r4 r� r1 r1 r2 r� � sF � � � � ���r� c C s� d}zXt �� }td|fd| fg�}tjd�|� }t�|�}t� t� |� � ��}t |d �W S t y� } zt�||� W Y d}~dS d}~0 ty� } zt�||� W Y d}~dS d}~0 t� y� } z t�d�|�� W Y d}~d S d}~0 0 dS ) z� Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise N� server_id�tagz/tag_server.plain?{0}r� ������zInternal Error {0}���)r � get_serveridr r r� r� r r� r r� ra rz ry r r r� r rd rm ) r� re r� Zqueryr� r� r� ZueZeer1 r1 r2 � tag_server� s" r� c C s� t �d�} t�d�| �� t}t�� ��}z:t� | |j �}t � t � | �|j � t�|j |� |j }W n4 ty� } z t�d�|�� W Y d }~n d }~0 0 tjd|tjgdd�\}}}|r�td�||���W d � n1 s�0 Y d S )Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)rj z Script failed with '{0}' {1})r rc r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler Zfetch_signaturer Z save_to_filer r� Zcheck_gpg_signaturerd rm r r� r � PATCH_SERVERr )Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturer� r� rT r� r1 r1 r2 �kcdoctor s & r� c C sB t �d�t��} zt�| � W n ty2 Y dS 0 t�d� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r rc r� �EFFECTIVE_LATESTr r� r r r )re r1 r1 r2 �check_new_kc_version% s �r� c C s� t �� }t|�}|tjkp*|tjko*|du }zt| |�}W n> tyx } z&|rR� ntj � d� |�� W Y d}~n d}~0 0 |tjkr�|}n<|}|du r�|tj kr�t � |d�}n|tjkr�|}ntd��|S )a� Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string NzUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r r9 ZPOLICY_LOCAL_FIRSTr rd r rq rS r� Z POLICY_LOCALr� r ) r� r6 r r� Z cached_levelZconsider_remote_exZ remote_levelr r� r1 r1 r2 r� 2 s& ( r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdv rnt�� rnt jpXt }t dd d � |�f� t � d � | �� ntd � | ���d S ) N�edfr rB Zprober� �r rk )zfs.enforce_symlinksifownerzfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernel)r r r r r � update_configr Z is_cpanelZ FORCE_GID� CPANEL_GIDr] r� r r r )r8 �gidr1 r1 r2 �update_patch_typeW s �r� c C s� t �� ttj� |tjkr"t� ztd||d�}W n^ t y� } zF|tj tj fv r|tj r|t |�}tj�|� W Y d}~dS � W Y d}~n d}~0 0 t�� }t|�}|�� t||d�s�t�d� dS z(tjtjddd� tjtjdd d� W n t�y tj�d � Y n0 t� � }|tj k�s,tj �rvt � �2 |� |� t |||| |tj kd � W d � n1 �sl0 Y t�!|� t"||� dS ) ax :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode r; )r� r6 r N)rJ rK z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_n�patternz kmsg*.logz#Error during crash reporter cleanup)r� )#r Zlog_all_parent_processesrn r r r r9 r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� rZ r rq rS r r� r r rL r r r� rv rd rr r� r� r� r' r� Zdump_kernel_patch_levelr� ) r� r r6 r� r� r( r� r� r� r1 r1 r2 � do_updatem s< 8 r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr<td��tjrHtjS | t j krltjp\tj}tjphtj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzrelease-) r1 �boolr r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r r� r� Zpatchsetr1 r1 r2 � get_sticky� s* ��� r� c C s | d | S )Nr4 r1 )r� r� r1 r1 r2 � _stickyfy� s r� c C s t |�}|s| S |dkr"t|| �S t�� }|sDtj�d� t�d� zt � t j d� |� �}W n< ty� } z$t�||j� t�d� W Y d}~n d}~0 0 t�t�|�� ��}t|d �}|dkr�t|d | �S |d kr�| S |d k� r�tj�d � t�d � tj�d|d � t�d� dS )z� Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. �KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rh zEServer ID is not recognized. Please check if the server is registeredr5 zError: r� r� )r� r� r r� r rq r� rJ r+ r r� r r� r� r r� re r r� ra rz ry )�filer �sr� r� r� r� r� r1 r1 r2 r� � s2 r� c C s� g }| s dS | � d�}|d }|dd� }|�d�}||krLtdt| � ��|s`| �� |�� kS |dkrt|�d� n>|�d �s�|�d �r�|�t�|�� n|�t�|�� d d �� |D ]}|�t�|�� q�t� d d � |� d tj �} | � |�S )zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr4 r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r6 r� r� �repr�lowerr: r� �re�escape�replace�compiler7 � IGNORECASEr_ ) Zdn�hostnameZ max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr1 r1 r2 �_dnsname_match� s( r� c C s g }t | �� �D ]2}| �|�}|�� dkrdd� t|��d�D �}q| sPtd��g }|D ]*\}}|dkrXt||�rx d S |�|� qX|s�| � � j }t||�r�d S |�|� t |�dkr�t d� |d �tt|�����n*t |�dkr�t d � ||d ���nt d ��d S ) NZsubjectAltNamec S s g | ]}|� � �d d��qS )ro r )r� r6 )r� �itr1 r1 r2 r� + r� z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}r� z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ get_extensionZget_short_namerZ r6 r} r� r: Z get_subjectZ commonNamer. r� r� r7 �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� r[ Zcnr1 r1 r2 r� & s2 � r� c C s$ t ddd�} | jdddd� | jdd d dd� | jd d dd� | jd dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCdd� | jdDdEdd� | jdFdGdd� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdPtd dQdR� | jdSdTdd� | jdUdVdd� | �� }|jdWdXdPd� |jdYdZdd� |jd[d\dd� | jd]d^dPd dQd_� | jd`dadbddQdc� | jdddedf� | jdgdhdd� | jdidjdkdldm� tj�s�| jdndodpdqdQdr� | jdsdtdpdqdudr� | jdvdwdd� | jdxdydzdd� | jd{ddd� | jd|d}d~dd� | jdd�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | �� }tj�t � � � tj�s�t j d�g7 _ |j d u�rt td |j �d�����tj ��rd�S d�S |j�s|j�r2tj�r(tjt_ntjt_n|j�rBtjt_|j�sjt� � d�k�rjt d�t j d�� d�S t j!}|j�r�t j"}n|j�r�t j#}t$�%|� |j&�r�t'�(� |j)�r�|j)d�k�r�t*|j)�t_+t j,tj+d�� nd t_+t j,dd�� |j-d u�r t j,|j-d�� |j-t_.|j/�rdQt_0|j1�r(dQt_2|j3�r6dut_4|j5�rDt5� |j6�rZt7�8d�t9� n8|j:�r�tj;d�k�r�tj<d�k�r~dntj<�p�d�|_=du|_|j>�r�|j>t_?|j@�r�t7�8d�t9� d�t_?tj?�Ad��t_?tj?�r�tj?tBv�r�t$jC�Dd��Etj?d��FtB��� |jG�rdut_Hd�|jG t_I|j=�r&tJ|j=� tj;d�k�rTtK� t_;t7�8d��Etj;�pLd��t9� |jL�rrt tMjL|jNd��� d S tOtj;� |jP�r�tQ� d S |jR�r�|jN�r�tRd�d�� ntR� d S |jS�r�t j,d�d�� d S |jT�r�t j,d�d�� d S |jU�r�t �V|jU� d S |jW�rtX|jW�S |jY�r tZ�Y� |j[�rNtj;d�k�r>t j,d�d�� tZ�[|j[|j\�S |j]�rltZ�]� d�k�rhd�S d�S |j^d u�r�t_|j^�S |j`�r�t tja� tb|dpd �d u�r�tc�d|je� d�S tj�s�|jf�r�tc�g� S |jh�r�tc�i� d u�r�t$�jd�� |jk�rtcjitjld�� n|jm�r tc�n� t$�jd�� |jo�r4t tc�p� � |jq�rHt tc�r� � |js�rjtc�t� �rjt tc�u|js�� |jvd u�r�|jvdk�r�tjw�p�txtcjy�z� �}nd�d�� |jv�d��D �}tcjit{|�d��d u�r�t$�jd�� |j|�r�tcjitjld d�� |j}� r t t~|jNd��� d}|j� r t7�8d�t9� d�}|j�� r*|j�}|j�� rDt�|tj�tj�d�� |j� rdt�|tj�d�� t$�jd�� |j� rxt t���� � |j�� r�t�||j�d�� t$�jd�� |j� r�dQt_�t���t���d�d��� t�|tjld�� |j�� r�t�|jNd�� |j�� r�t�� S |j�� r�t�|jNd�� |j�� r t�� t�t j��d�k� r t�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrB Z store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z --app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz --auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z --nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz --registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z --nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz --plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� rU r �requiredz--check-compatibilityzCheck compatibility.z --clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz --edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r r� rM z--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r� z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionr: z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� Zdestr� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez --lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz --lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr� zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr� r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledr� r r zPlease run as root)r� )r� )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r zMFlag --test has been deprecated and will be not available in future releases.r �/z(Prefix `{0}` is not in expected one {1}.r� zfile:z+edf patches are deprecated. Fallback to {0})r< r_ )r� ZYES)r� ZNOrl r� r� z Userspace patches are applied.r z Userspace patches are unloaded.c S s g | ]}|� � �� �qS r1 )r� r� )r� Zptchr1 r1 r2 r� ~ r� zmain.<locals>.<listcomp>)�limit)r r� zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r r6 zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentry Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_args�__dict__r; r Zget_config_settings�FLAGSZ has_flagsr% �filterr6 �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr� r& �getuidr� rJ r� �logging�INFOZWARNING�DEBUGr Zinitialize_loggingr� r Zclear_all_cacheZset_patch_levelrZ r� r� Zset_sticky_patchr� Z nosignaturer Z no_check_certr� rt ru rh Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr ZPREV_PATCH_TYPEZset_patch_typer� r� r r� �EXPECTED_PREFIXrq rS r� r7 Zlocalr^ r� r� r� Zapp_infor r_ rA Zdoctorr� r� Zenable_auto_updateZdisable_auto_updateZ set_configZupdate_config_from_argsZset_monitoring_keyr� Z unregisterr �registerZregister_autoretryr� r� r� r� rX rY r Zset_libcare_statusr� Zuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updater Zlib_auto_updater� Z lib_unloadZlibcare_unloadZlib_infor3 Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater� �listZ USERSPACE_MAP�keys�sortedZuserspace_auto_updater� r2 Znofreezer� Z smart_updater� r� Z UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSro rp �randomZuniformr= Zstatusr� Zlatest_patch_infor@ Zcheckr, r. �argvr5 )ZparserZexclusive_groupr� r� r� r� r1 r1 r2 �mainO s: ������������ � � ����� r )N)N)F)F)N)rB F)rB F)r )�Z __future__r rb r_ r� r& r� r r� r� r� ZsslrJ r� ro rI r� Zargparser r � contextlibr rB r r r r r r r r r r r r r r r r Zpy23r r r r r r r r r� r� r� r) r� r� rP r� r� �DOTALLr! r^ r' r� �insert�filterwarningsr� �Optional�Dict�Tuple�Any�Union�Setrq ZsetLevelr� r3 r: rA r] rf rv r� r� r� r� r� r� r} r� r� r� r| r� r� r� r� r� r� r� r� r� rY Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z StrictVersion� __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r� r r r r r, r5 r@ r/ rB r= rI rL rU r] ra rb rd rg rh rn rs rw r rz r� r� r� r� r� r� r� r� r� r� r� r� r2 r� r) r� r� r� r� r9 r� r� r� r� r� r� r� r� r r1 r1 r1 r2 �<module> s & 4 a # ? , 2 %7 , 3)