PATH:
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
__pycache__
/
Editing: libcare.cpython-36.pyc
3 DS�i�J � @ s� d dl Z d dlZd dlZd dlZd dlZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZ ddlmZmZmZ dZdOZdZd Zd Z d d d d �Z d dddgZ dd� Z dddge � d�Z dd� Z!dd� Z"G dd � d e#�Z$d d � Z%dPd d �Z&d!d"� Z'd#d$� Z(d%d&� Z)dQd(d)�Z*d*d+� Z+e"d,d-� �Z,e"d.d/� �Z-e"d0d1� �Z.d2d3� Z/d4d5� Z0d6d7� Z1d8d9� Z2d:d;� Z3d<d=� Z4e"e%ej5d>d?� ���Z6ej5ej7d@�ej8e"e%e j9dfdAdB������Z:e"dCdD� �Z;dEdF� Z<dGdH� Z=dRdIdJ�Z>dKdL� Z?dMdN� Z@dS )S� N� )�auth� capabilities�config�config_handlers� constants�errors�fetch� log_utils�platform_utils� process_utils�selinux� server_info� update_utils�utils)� HTTPError�json_loads_nstr�urlquotez!/usr/libexec/kcare/libcare-client�/run/libcare/libcare.sock�/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotate�db)�mysqld�mariadbd�postgres�libcZlibsslZnscdZlibmc C sp y t j� dd� \} }| j� } W n tk r8 tt�S X |jd�rLtt�S d| krf|jd�rftt�S tdg S )a Return libs list, excluding libnss_dns on distros with cross-library patches (libnss_dns + libresolv) already deployed: - EL7 (all distros): glibc-rh1296031.patch (CVE-2015-7547) - Ubuntu 16.04: revert-CVE-2015-5180.diff See LIBCARE-2943 for details. N� �7Zubuntuz16.Z libnss_dns)r � get_distro�lower� Exception�list� _LIBS_BASE� startswith)�name�version� r% �-/usr/libexec/kcare/python/kcarectl/libcare.py�_get_userspace_lib_list- s r' r r r )r �libsc G s t jjtjd| f|�� S )N� userspace)�os�path�joinr � PATCH_CACHE)�libname�partsr% r% r& �get_userspace_cache_pathF s r0 c s � fdd�}|S )Nc sV z � | |�S y t d� W n6 tk rN } ztjdj|�dd� W Y d d }~X nX X d S )N� clearcachez$Libcare cache clearing failed: '{0}'F)� print_msg)�libcare_clientr r �logerror�format)�args�kwargs�err)�clblr% r& �wrapperK s z$clear_libcare_cache.<locals>.wrapperr% )r9 r: r% )r9 r& �clear_libcare_cacheJ s r; c s0 e Zd Zd� fdd� Zd dd�Zdd� Z� ZS ) �UserspacePatchLevelNc s t | | �j| |�S )N)�super�__new__)�clsr. �buildid�level�baseurl)� __class__r% r& r> Y s zUserspacePatchLevel.__new__c C s || _ || _|| _|| _d S )N)rA r. r@ rB )�selfr. r@ rA rB r% r% r& �__init__\ s z UserspacePatchLevel.__init__c G s t | j| jt| �f|�� S )N)r0 r. r@ �str)rD r/ r% r% r& � cache_pathb s z UserspacePatchLevel.cache_path)N)N)�__name__� __module__� __qualname__r> rE rG � __classcell__r% r% )rC r& r< X s r< c s dd� �� �fdd�}|S )Nc S s� d \}}z�| dkrt � } i }g }x8t| �D ],}|jdd�||jd�< |j|jdg �� q*W tj|dd�}djd d � |j� D ��}djt|��}W dtj t |d d � tj t |d d � X dS )z(KPT-1543 Save info about applied patches� Nzlatest-version�package�patches�cve)� cve_field� c S s g | ]}d j |��qS )� )r, )�.0�recr% r% r& � <listcomp>s s zLrefresh_applied_patches_list.<locals>.save_current_state.<locals>.<listcomp>T)� ensure_dir)rL rL ) � _libcare_info�_get_patches_info�get�extendr �extract_unique_cvesr, �items�sorted� atomic_write�LIBCARE_PATCHES�LIBCARE_CVE_LIST)�infoZversionsZcvesZpackagesZ all_patchesrT Zcves_setr% r% r& �save_current_stateg s z8refresh_applied_patches_list.<locals>.save_current_statec s" d }z� | |�}|S �|� X d S )Nr% )r6 r7 ra )r9 rb r% r& r: y s z-refresh_applied_patches_list.<locals>.wrapperr% )r9 r: r% )r9 rb r& � refresh_applied_patches_listf s rc c C sH t jpd}t| �} t|j� �}tjtj| d�|| |d�}|dtj d|� 7 }tj| d�}yt j t j �|dd�}W n, tjk r� tjt||�d d � � Y nX tj|j� ttj|j� ��}|jd g �}tj|�s�tjd j | ���t |||d |jd��} t |d �} t||| d�} t j j!| � �s6t j j"| �dk�r�tj|d �}y t j#|| t j$t j%| �d� W n< t&k �r� } z | j'd k�r�tj(d��� W Y d d } ~ X nX t||| �} dd| d| dg}t)j*|d d d�\}}}|�r�tj+dj |||�d d ��t||d �}t j j,|� �r$t j j-|��r$tj|� t j.| |d � t j/|d |� d S )!N�main�uz latest.v1z?info=�updater( F)� check_licenseT)� ignore_errorsr zkLatest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.rA rB z patch.tar.gzr Z patch_url)�check_signature� hash_checker� � zKC+ licence is required�tarZxfz-Cz--no-same-owner)� catch_stdout� catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}zpatches unpacking error)�status�latestz.tmp)rk rl )0r �PREFIXr �stripr �get_patch_server_url� LIBNAME_MAPrY r Zencoded_server_lib_infor �wrap_with_cache_keyr � urlopen_authr �NotFound�shutil�rmtreer0 r � set_feature_flags_from_headers�headersr �nstr�readr �has_lc_capabilities�CapabilitiesMismatchr5 r< rF r* r+ �exists�getsize� fetch_url� USE_SIGNATURE�get_hash_checkerr �code�NoLibcareLicenseExceptionr � run_command� KcareError�islink�isdir�symlink�rename)r. �build_id� patch_level�prefix�url� cache_dst�response�meta�required_capabilitiesrA �plevelZ patch_path�ex�dst�cmdr� �stdout�stderrZ link_namer% r% r& �fetch_userspace_patch� sP " r� c C sL | t _| st� tj| r dndd� | r0t� tjjd| r@dnd � d S )N�FALSE�YES)�LIBCARE_DISABLEDzlibcare service is �enabled�disabled) r r� �libcare_server_stopr � update_config�libcare_server_startr �kcarelogra )r� r% r% r& �set_libcare_status� s r� c C s: yt jdd�ddg} W n tk r* d S X t j| � d S )N�service� /usr/sbin/�/sbin/�libcare�stop)r� r� )r �find_cmdr r� )r� r% r% r& r� � s r� c C st t jstjjt j�r:tjt jddg� tjt jddg� n6ytjdd �ddg} W n t k rd d S X tj| � d S ) Nz reset-failedr� Zrestartzlibcare.socketr� � /usr/sbin/�/sbin/�start)r� r� ) r �SKIP_SYSTEMCTL_CHECKr* r+ r� � SYSTEMCTLr r� r� r )r� r% r% r& r� � s r� Tc s dj dd� t|pg �D ��}ddg}� s6|dd|g7 }y t|� }W n6 tk rx } ztjdj|�d d ��W Y d d }~X nX g }x@|jd �D ]2}|r�y|jt j |�� W q� t k r� Y q�X q�W d d � |D �}x.|D ]&}t � fdd�|d j � D ��|d< q�W |S )N�|c s s | ]}d j |�V qdS )z({0})N)r5 )rS �procr% r% r& � <genexpr>� s z _libcare_info.<locals>.<genexpr>ra z-jz-lz-rz/Gathering userspace libraries info error: '{0}'zuserspace libs info error)rp rQ c S s$ g | ] }|j d �|j d�|d��qS )�comm�pid)r� r� r( )�pop)rS �liner% r% r& rU � s z!_libcare_info.<locals>.<listcomp>c 3 s( | ] \}}d |ks� r||fV qdS )�patchlvlNr% )rS �k�v)�patchedr% r& r� � s r( )r, r] r3 r r r� r5 �split�append�json�loads� ValueError�dictr\ )r� �limitZregexpr� �linesr8 �resultr� r% )r� r& rW � s& & &rW c C s� t � }x<| D ]4}x.|d j� D ] \}}|j|d |d f� q W q W g }xbtD ]Z}xT|D ]L\}}t||t|�d�} tjj| �rXt | d��} |j t j | �� W d Q R X qXW qNW |S )Nr( r@ r� z info.json�r) �setr\ �add� USERSPACE_MAPr0 rF r* r+ �isfile�openr� r� �load) ra rN rT �_�datar� r� r� r� Zpatch_info_filename�fdr% r% r& rX � s "rX c C s t t� �S )N)rX rW r% r% r% r& �libcare_patch_info_basic s r� c C s" t � } | stjd� tjd| i�S )NzNo patched processes.r� )r� r r4 r� �dumps)r� r% r% r& �libcare_patch_info s r� c C s" t � } | stjd� tjd| i�S )NzNo patched processes.r� )rW r r4 r� r� )r� r% r% r& � libcare_info s r� c C s. i } x$t � D ]}|jdd�| |jd�< q W | S )Nzlatest-versionrL rM )r� rY )r� rT r% r% r& �_libcare_version s r� c C s* x$t � j� D ]\}}| j|�r |S q W dS )NrL )r� r\ r" )r. rM r$ r% r% r& �libcare_version# s r� c C s dj dd� | D ��d S )N� c s s | ]}t j|�d V qdS )� N)r �bstr)rS �pr% r% r& r� + s z(libcare_client_format.<locals>.<genexpr>r� )r, )�paramsr% r% r& �libcare_client_format* s r� c C s, x t D ]} tjj| �r| S qW tjd��d S )Nz Libcare socket is not found.)�LIBCARE_SOCKETr* r+ r� r r� )Zlibcare_socketr% r% r& � get_available_libcare_socket. s r� c G s� t jrtjd��tjtjtjd�}|jd� d}z||jt � � |jt j � t | �}t j dj| d�� |j|� x |jd�}|s�P ||7 }qpW |jdd �}t j d j|d �� |S |j� X d S ) NzLibcare is disabled.r � r� zLibcare socket send: {cmd})r� i zutf-8�replacez!Libcare socket recieved: {result})r� )r r� r r� �socket�AF_UNIX� SOCK_STREAM� settimeout�connectr� �LIBCARE_SOCKET_TIMEOUTr� r �logdebugr5 �sendall�recv�decode�close)r� �sock�resr� r� r� r% r% r& r3 5 s( r3 c C s� x�| D ]�}yt dt|�� W n6 tk rR } ztjdj|�dd��W Y d d }~X nX y t d� W q tk r� } ztjdj|�dd��W Y d d }~X qX qW d S )NZstoragez(Userspace storage switching error: '{0}'z userspace storage switch error)rp rf z%Userspace patch applying error: '{0}'zuserspace patch apply error)r3 r0 r r r� r5 )r� r� r8 r% r% r& �libcare_patch_applyM s & r� c C sH y t d� W n6 tk rB } ztjdj| �dd��W Y d d } ~ X nX d S )N�unloadz&Userspace patch unloading error: '{0}'z userspace patch unload error)rp )r3 r r r� r5 )r8 r% r% r& �libcare_unloadZ s r� r� c C s� t � | tjkr tj r dS |dkr0ttj� �}g }x |D ]}|jtj |g �� q:W |slt j dj |�� dS t |d�\}}}}|r�tjd��|s�t j d� dS tjtjjtjd�� t � y t|� W n> tjk �r } z t jt|�� tjd��W Y dd}~X nX t� } t| �} ttdd � | D ����s0dS t j d j |d �� t j d j | d �� t dd � | j � D ��} t dd � |j � D ��} | | } t dd � | j � D ��}t j dj t | �|d�� x,| j!� D ] \}}t j dj |t |��� �q�W | S )z0Patch userspace processes to the latest version.Nz No such userspace patches: {0})r� z8There were errors while patches downloading (unpacking).zNo patches were found.r) z)There were errors while patches applying.c s s | ]}|d V qdS )r( Nr% )rS �itemr% r% r& r� � s z&do_userspace_update.<locals>.<genexpr>zPatched before: {before})�beforezPatched after: {after})�afterc s s | ]}|D ] }|V q qd S )Nr% )rS r\ r� r% r% r& r� � s c s s | ]}|D ] }|V q qd S )Nr% )rS r\ r� r% r% r& r� � s c s s | ]}t |�V qd S )N)�len)rS r� r% r% r& r� � s z�The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)�count�overallz*Object `{0}` is patched for {1} processes.)"�rotate_libcare_logsr �UPDATE_MODE_AUTOr �LIB_AUTO_UPDATEr r� �keysrZ rY r �loginfor5 �check_userspace_updatesr r� r �restore_selinux_contextr* r+ r, r- r� r4 rF rW �_get_userspace_procs�anyr� r� �values�sumr� r\ )�moder� Zprocess_filterZuserspace_patch�failed�something_foundr� r� r� Z data_afterr� Zuniq_procs_afterZuniq_procs_beforeZdiffr� r� r� r% r% r& �do_userspace_updatee sP r c C s\ z.yt � \} }}}W n tjk r* dS X W d t� X | r@dS |rHdS tjdd�rXdS dS )N� r z.libcarestatus)�filenamer r )r� r r� r� r �status_gap_passed)r r� �libs_not_patchedr% r% r& �get_userspace_update_status� s r c C sd i }xZ| D ]R}xL|d j � D ]<\}}|jd�r ||kr>g ||< || j|d |d f� q W q W |S )Nr( r� r� r� )r\ rY r� )ra r� r� r. rT r% r% r& r� � s "r� c C sN t � }xB| D ]:}x4|d j� D ]$\}}|j||d |jdd�f� q W q W |S )Nr( r@ r� r )r� r\ r� rY )ra r� r� r. rT r% r% r& �_get_userspace_libs� s $r c s0 � s g � � fdd�t j� D � td� d�}t|�}d }}d}x�t|�D ]�}|\}}} y t||| � d}| dkrtd}W qH tjk r� } zd}tj t | �� W Y d d } ~ X qH tj tj fk r� Y qH tj k r� � Y qH tjk �r } zd}tjt | �� W Y d d } ~ X qHX qHW tjdd� ||||fS ) Nc s g | ]}� j |��qS r% )rZ )rS r( )r� r% r& rU � s z+check_userspace_updates.<locals>.<listcomp>F)r� r� Tr z.libcarestatus)r )r� r� rW r� r r� r r� r �logwarnrF rx r� �AlreadyTrialedExceptionr� r4 r �touch_status_gap_file) r� Z data_beforer� r r r rT r. r� r� �er� r% )r� r& r� � s4 $ r� c sf d} d}t jddd�}|r�y t j|tgdd�\} }}W n. tk rd } zd} t|�}W Y d d }~X nX | r�tjd j|�dd � ntj d dd � d � t j j � �s�d S t jd }y�t j� �}tjd��� �fdd�|D �}dd� |D �}|jdd� d} xD|D ]<\}} | t j j| �7 } | |k� r�t j| � tjjd| � � q�W W n$ tk �r` tjddd � Y nX d S )Nr rL Z logrotateF)� raise_excT)ro r z5failed to run logrotate for libcare logs, stderr: {0})r2 z logrotate utility wasn't foundz/var/log/libcare/i r z ^\d+\.log.*c s$ g | ] }�j |�rtjj� |��qS r% )�matchr* r+ r, )rS �fn)�libcare_log_directory� pidlog_rer% r& rU s z'rotate_libcare_logs.<locals>.<listcomp>c S s g | ]}t jj|�|f�qS r% )r* r+ �getctime)rS �fpr% r% r& rU s )�reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfilesi )r r� r� �LIBCARE_LOGROTATE_CONFIGr rF r r4 r5 r r* r+ r� r �!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MB�listdir�re�compile�sortr� �remover� ra �logexc) �rcr� Zlogrotate_pathr� r Zmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_size�filepathr% )r r r& r� � s< r� c C sJ yt jdd �ddg} W n tk r* dS X t j| ddd�\}}}|d kS ) zKAssume that whenever the service is not running, we did not patch anything.r� � /usr/sbin/�/sbin/r� rp FT)rn ro r )r! r" )r r� r r� )r� r� r� r% r% r& �libcare_server_started! s r# )r r )N)TN)N)Ar� r* r ry r� rL r r r r r r r r r r r r r r �py23r r r ZLIBCARE_CLIENTr� r_ r` r ru r! r' r� r0 r; �intr< rc r� r� r� r� rW rX r� r� r� r� r� r� r� r3 r� �log_all_parent_processesr� �track_update_status�skip_if_no_selinux_module�UPDATE_MODE_MANUALr r r� r r� r� r# r% r% r% r& �<module> sf @ 5 F "*
SAVE
CANCEL