관리-도구
편집 파일: libcare.cpython-39.pyc
a d4h�D � @ s d dl Z d dlZd dlZd dlZd dlZddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddlm Z dd lm Z dd lm Z dd lmZ dd lmZ dd lmZ ddlmZ ddlmZmZmZ dZdZdZdZ dZ dddddd�Z g d�ddgdd gd �Z d d � Z d d!� Z!G d"d#� d#e"�Z#d$d%� Z$dUd&d'�Z%d(d)� Z&d*d+� Z'd,d-� Z(dVd/d0�Z)d1d2� Z*d3d4� Z+e!d5d6� �Z,e!d7d8� �Z-d9d:� Z.d;d<� Z/d=d>� Z0d?d@� Z1dAdB� Z2dCdD� Z3e!e$dEdF� ��Z4ej5e!e$ej6dfdGdH����Z7e!dIdJ� �Z8dKdL� Z9dMdN� Z:dWdOdP�Z;dQdR� Z<dSdT� Z=dS )X� N� )� constants)�config)�config_handlers)� log_utils)� process_utils)�utils)�auth)�errors)�selinux)�fetch)� update_utils)� server_info)�json_loads_nstr�urlquote� HTTPErrorz!/usr/libexec/kcare/libcare-client)z/run/libcare/libcare.sockz/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotate�db�qemu)�mysqld�mariadbd�postgres�qemu-kvm�qemu-system-x86_64)r r r r r �libcZlibssl)r r �libsc G s t jjtjd| g|�R � S )N� userspace)�os�path�joinr � PATCH_CACHE)�libname�parts� r" �-/usr/libexec/kcare/python/kcarectl/libcare.py�get_userspace_cache_path. s r$ c s � fdd�}|S )Nc s� z�� | i |��W z t d� W S tyT } z tjd�|�dd� W Y d }~S d }~0 0 S z t d� W q� ty� } z tjd�|�dd� W Y d }~q�d }~0 0 nHz t d� W n8 ty� } z tjd�|�dd� W Y d }~n d }~0 0 0 d S )N� clearcachez$Libcare cache clearing failed: '{0}'F�� print_msg)�libcare_client� Exceptionr �logerror�format)�args�kwargs�err��clblr" r# �wrapper3 s *� ,� z$clear_libcare_cache.<locals>.wrapperr" �r0 r1 r" r/ r# �clear_libcare_cache2 s r3 c s0 e Zd Zd� fdd� Zd dd�Zdd� Z� ZS ) �UserspacePatchLevelNc s t | | ��| |�S �N)�super�__new__)�clsr �buildid�level�baseurl�� __class__r" r# r7 A s zUserspacePatchLevel.__new__c C s || _ || _|| _|| _d S r5 )r: r r9 r; )�selfr r9 r: r; r" r" r# �__init__D s z UserspacePatchLevel.__init__c G s t | j| jt| �g|�R � S r5 )r$ r r9 �str)r> r! r" r" r# � cache_pathJ s z UserspacePatchLevel.cache_path)N)N)�__name__� __module__� __qualname__r7 r? rA � __classcell__r" r" r< r# r4 @ s r4 c s dd� �� �fdd�}|S )Nc S s� d\}}z�| du rt � } i }g }t| �D ]<}|�dd�||�d�< |�dg �D ]}|�|�d�� qNq(d�d d � |�� D ��}d�|�}W tjt|d d � tjt |d d � n"tjt|d d � tjt |d d � 0 dS ) z(KPT-1543 Save info about applyed patches)� rF N�latest-versionrF �package�patchesZcve� c S s g | ]}d � |��qS )� �r )�.0�recr" r" r# � <listcomp>[ � zLrefresh_applied_patches_list.<locals>.save_current_state.<locals>.<listcomp>T)� ensure_dir) � _libcare_info�_get_patches_info�get�appendr �itemsr � atomic_write�LIBCARE_PATCHES�LIBCARE_CVE_LIST)�infoZversionsZcvesZpackagesZ cves_listrN �patchr" r" r# �save_current_stateO s �z8refresh_applied_patches_list.<locals>.save_current_statec s0 d }z � | i |��}|W �|� S �|� 0 d S r5 r" )r, r- rZ �r0 r\ r" r# r1 a s �z-refresh_applied_patches_list.<locals>.wrapperr" r2 r" r] r# � refresh_applied_patches_listN s r^ c C s t jpd}t| �} t|�� �}t�t�| d�|| |d�}|dt� t� d|�� 7 }t�| d�}zt � t j�|dd�}W n* tjy� tjt||�d d � � Y n0 t�|j� tt�|�� ��}t|||d |�d ��}t|d �} t||| d �} t j � | ��rt j � | �dk�r~t�|d �}z t j || t j!t �"|�d� W n> t#�y| } z$| j$dv �rft�%d��� W Y d } ~ n d } ~ 0 0 t||| �} dd| d| dg} t&j'| d d d�\}}}|�r�t�(d�)|||���t||d�}t j �*|��s�t j �+|��r�t�|� t �,| |d � t �-|d |� d S )N�main�uz latest.v1z?info=�updater F)� check_licenseT)� ignore_errorsr: r; z patch.tar.gzr Z patch_url)Zcheck_signature� hash_checker)i� i� zKC+ licence is required�tarZxfz-Cz--no-same-owner�� catch_stdout� catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}�latestz.tmp).r �PREFIXr �stripr �get_patch_server_url� LIBNAME_MAPrT r Zencode_server_lib_infoZserver_lib_infor �wrap_with_cache_keyr � urlopen_authr �NotFound�shutil�rmtreer$ r �set_config_from_patchserver�headersr �nstr�readr4 r@ r r �exists�getsize� fetch_url� USE_SIGNATURE�get_hash_checkerr �code�NoLibcareLicenseExceptionr � run_command� KcareErrorr+ �islink�isdir�symlink�rename)r �build_id� patch_level�prefix�url� cache_dst�response�metar: �plevelZ patch_path�ex�dst�cmdr| �stdout�stderrZ link_namer" r" r# �fetch_userspace_patchl sD r� c C sL | t _| st� tj| r dndd� | r0t� tj�d| r@dnd � d S )N�FALSE�YES)�LIBCARE_DISABLEDzlibcare service is �enabled�disabled) r r� �libcare_server_stopr � update_config�libcare_server_startr �kcarelogrZ )r� r" r" r# �set_libcare_status� s r� c C s: zt �dd�ddg} W n ty* Y d S 0 t �| � d S )N�service�z /usr/sbin/z/sbin/�libcare�stop�r �find_cmdr) r~ �r� r" r" r# r� � s r� c C st t jstj�t j�r:t�t jddg� t�t jddg� n6zt�dd�ddg} W n t yd Y d S 0 t�| � d S )Nz reset-failedr� Zrestartzlibcare.socketr� r� �start) r �SKIP_SYSTEMCTL_CHECKr r rw � SYSTEMCTLr r~ r� r) r� r" r" r# r� � s r� Tc s� d� dd� t|pg �D ��}ddg}� s6|dd|g7 }z t|� }W n4 tyv } z t�d�|���W Y d }~n d }~0 0 g }|�d �D ]0}|r�z|�t � |�� W q� t y� Y q�0 q�d d � |D �}|D ]&}t � fd d�|d � � D ��|d < q�|S )N�|c s s | ]}d � |�V qdS )z({0})N)r+ )rM �procr" r" r# � <genexpr>� rP z _libcare_info.<locals>.<genexpr>rZ z-jz-lz-rz/Gathering userspace libraries info error: '{0}'rJ c S s$ g | ] }|� d �|� d�|d��qS )�comm�pid)r� r� r )�pop)rM �liner" r" r# rO � rP z!_libcare_info.<locals>.<listcomp>c 3 s& | ] \}}d |v s� s||fV qdS )�patchlvlNr" )rM �k�v��patchedr" r# r� � rP r )r �sortedr( r) r r r+ �splitrU �json�loads� ValueError�dictrV )r� �limitZregexpr� �linesr. �resultr� r" r� r# rR � s& & $rR c C s� t � }| D ]0}|d �� D ] \}}|�|d |d f� qq g }tD ]j}|D ]`\}}t||t|�d�} tj�| �rLt | d�� } |� t � | �� W d � qL1 s�0 Y qLqD|S )Nr r9 r� z info.json�r) �setrV �add� USERSPACE_MAPr$ r@ r r �isfile�openrU r� �load) rZ rI rN �_�datar� r� r� r� Zpatch_info_filename�fdr" r" r# rS � s 2rS c C s t t� �S r5 )rS rR r" r" r" r# �libcare_patch_info_basic� s r� c C s" t � } | st�d� t�d| i�S �NzNo patched processes.r� )r� r r* r� �dumps�r� r" r" r# �libcare_patch_info� s r� c C s" t � } | st�d� t�d| i�S r� )rR r r* r� r� r� r" r" r# � libcare_info� s r� c C s* i } t � D ]}|�dd�| |�d�< q | S )NrG rF rH )r� rT )r� rN r" r" r# �_libcare_version� s r� c C s* t � �� D ]\}}| �|�r | S q dS )NrF )r� rV � startswith)r rH �versionr" r" r# �libcare_version s r� c C s d� dd� | D ��d S )NrP c s s | ]}t �|�d V qdS )� N)r �bstr)rM �pr" r" r# r� rP z(libcare_client_format.<locals>.<genexpr>r� rL )�paramsr" r" r# �libcare_client_format s r� c C s, t D ]} tj�| �r| S qt�d��d S )Nz Libcare socket is not found.)�LIBCARE_SOCKETr r rw r r )Zlibcare_socketr" r" r# � get_available_libcare_socket s r� c G s� t jrt�d��t�tjtjd�}|�d� d}z�|�t � � |�t j � t | �}t � dj| d�� |�|� |�d�}|s~q�||7 }qn|�dd �}t � d j|d �� |W |�� S |�� 0 d S ) NzLibcare is disabled.r � rP zLibcare socket send: {cmd}r� i zutf-8�replacez!Libcare socket recieved: {result}r� )r r� r r �socket�AF_UNIX� SOCK_STREAM� settimeout�connectr� �LIBCARE_SOCKET_TIMEOUTr� r �logdebugr+ �sendall�recv�decode�close)r� �sock�resr� r� r� r" r" r# r( s* �r( c C s� | D ]�}zt dt|�� W n4 tyN } z t�d�|���W Y d }~n d }~0 0 z t d� W q ty� } z t�d�|���W Y d }~qd }~0 0 qd S )NZstoragez(Userspace storage switching error: '{0}'ra z%Userspace patch applying error: '{0}')r( r$ r) r r r+ )r� r� r. r" r" r# �libcare_patch_apply, s & r� c C sF z t d� W n4 ty@ } z t�d�| ���W Y d } ~ n d } ~ 0 0 d S )N�unloadz&Userspace patch unloading error: '{0}')r( r) r r r+ )r. r" r" r# �libcare_unload9 s r� c C s� t �� t� | tjkr"tjs"dS |du r6tt� � �}g }|D ]}|� t� |g �� q>|snt � d�|�� dS t|d�\}}}}|r�t�d��|s�t � d� dS t�tj�tjd�� t� z t|� W n@ tj�y } z$t �t|�� t�d��W Y d}~n d}~0 0 t� } t | �} t tdd � | D ����s4dS t � d j|d �� t � d j| d �� t dd � | � � D ��} t dd � |� � D ��} | | } t!dd � | � � D ��}t � djt"| �|d�� | �#� D ] \}}t � d�|t"|��� �q�| S )z0Patch userspace processes to the latest version.Nz No such userspace patches: {0}�r� z:There was an errors while patches downloading (unpacking).zNo patches were found.r z+There was an errors while patches applying.c s s | ]}|d V qdS )r Nr" )rM �itemr" r" r# r� t rP z&do_userspace_update.<locals>.<genexpr>zPatched before: {before})�beforezPatched after: {after})�afterc s s | ]}|D ] }|V q qd S r5 r" �rM rV r� r" r" r# r� { rP c s s | ]}|D ] }|V q qd S r5 r" r� r" r" r# r� | rP c s s | ]}t |�V qd S r5 )�len)rM r� r" r" r# r� rP z�The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)�count�overallz*Object `{0}` is patched for {1} processes.)$r �log_all_parent_processes�rotate_libcare_logsr �UPDATE_MODE_AUTOr �LIB_AUTO_UPDATE�listr� �keys�extendrT r �loginfor+ �check_userspace_updatesr r r �restore_selinux_contextr r r r r� r* r@ rR �_get_userspace_procs�anyr� r� �values�sumr� rV )�moder� Zprocess_filterZuserspace_patch�failed�something_foundr� r� r� Z data_afterr� Zuniq_procs_afterZuniq_procs_beforeZdiffr� r� r� r" r" r# �do_userspace_updateB sV ��r c C sN zt � \} }}}W n tjy( Y dS 0 | r2dS |r:dS tjdd�rJdS dS )N� r �.libcarestatus��filename� r )r� r r r �status_gap_passed)r� r� �libs_not_patchedr" r" r# �get_userspace_update_status� s r c C s\ i }| D ]N}|d � � D ]<\}}|�d�r||vr:g ||< || �|d |d f� qq|S )Nr r� r� r� )rV rT rU �rZ r� r� r rN r" r" r# r� � s r� c C sF t � }| D ]6}|d �� D ]$\}}|�||d |�dd�f� qq |S )Nr r9 r� r )r� rV r� rT r r" r" r# �_get_userspace_libs� s r c s� � s g � � fdd�t �� D � td� d�}t|�}d }}d}t|�D ]�}|\}}} z t||| � d}| dkrrd}W qF tjtjfy� Y qF tj y� � Y qF tj y� } z d}t � t | �� W Y d } ~ qFd } ~ 0 0 qFtjdd� ||||fS ) Nc s g | ]}� � |��qS r" )r� )rM r r� r" r# rO � rP z+check_userspace_updates.<locals>.<listcomp>F)r� r� Tr r r )r� r� rR r� r r� r rp r} �AlreadyTrialedExceptionr r r* r@ r �touch_status_gap_file) r� Z data_beforer� r� r r rN r r� r� r� r" r� r# r� � s. & r� c s^ d} d}t jddd�}|r�z t j|tgdd�\} }}W n0 tyf } zd} t|�}W Y d }~n d }~0 0 | r�tjd �|�dd � ntj d dd � d � t j � � �s�d S t jd }z�t �� �}t�d��� �fdd�|D �}dd� |D �}|jdd� d} |D ]8\}} | t j �| �7 } | |kr�t �| � tj�d| � q�W n" t�yX tjddd � Y n0 d S )Nr rF Z logrotateF)� raise_excT)rh r z5failed to run logrotate for libcare logs, stderr: {0}r& z logrotate utility wasn't foundz/var/log/libcare/i z ^\d+\.log.*c s$ g | ] }�� |�rtj�� |��qS r" )�matchr r r )rM �fn�Zlibcare_log_directoryZ pidlog_rer" r# rO � rP z'rotate_libcare_logs.<locals>.<listcomp>c S s g | ]}t j�|�|f�qS r" )r r �getctime)rM �fpr" r" r# rO � rP )�reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfiles)r r� r~ �LIBCARE_LOGROTATE_CONFIGr) r@ r r* r+ �logwarnr r r� r �!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MB�listdir�re�compile�sortrx �remover� rZ �logexc) �rcr� Zlogrotate_pathr� �eZmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_size�filepathr" r r# r� � s< r� c C sJ zt �dd�ddg} W n ty* Y dS 0 t j| ddd�\}}}|dkS ) zKAssume that whenever the service is not running, we did not patch anything.r� r� r� �statusFTrf r r� )r� r| r� r" r" r# �libcare_server_started� s r" )N)TN)N)>r r rq r� r� rF r r r r r r r r r r r r �py23r r r �Dict�List�TupleZLIBCARE_CLIENTr� rX rY r rm r� r$ r3 �intr4 r^ r� r� r� r� rR rS r� r� r� r� r� r� r� r( r� r� �skip_if_no_selinux_module�UPDATE_MODE_MANUALr r r� r r� r� r" r" r" r" r# �<module> s| � - G *