PATH:
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
__pycache__
/
Editing: __init__.cpython-36.pyc
3 @�i�4 � @ s d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z* ddl m+Z+m,Z,m-Z- dd l.m/Z/m0Z0m1Z1m2Z2m3Z3 d Z4d Z5d�Z6dZ7dZ8d�Z9dZ:dZ;ej<dej=�Z>ej<d�Z?ej@jAd��r�e j@jBd d� ejCdeDd� e#jEjFejG� dd � ZHd d � ZId d � ZJd!d"� ZKd#d$� ZLd�d%d&�ZMd'd(� ZNd)d*� ZOd+d,� ZPd-d.� ZQd/d0� ZRd1d2� ZSG d3d4� d4eT�ZUG d5d6� d6e+�ZVG d7d8� d8e+�ZWG d9d:� d:e+�ZXd;d<� ZYed=d>� �ZZd�d?d@�Z[dAdB� Z\dCdD� Z]i Z^dEdF� Z_e_e1j`_aebe dGd��sy8d dlcZdd dleZfedjgjhefji�edjgjhdH�k �r�ejdI��W n ejk �r� Y n8X dJdK� Zke1jlZmG dLdM� dMen�ZoG dNdO� dOe1jl�Zpepe1_ldPdQ� Zqe jrfdRdS�ZsdTdU� ZtdVdW� ZuG dXdY� dYen�ZvdZd[� Zwd\d]� Zxd�d_d`�Zydadb� Zzdcdd� Z{d�dedf�Z|dgdh� Z}didj� Z~dkdl� Zdmdn� Z�dodp� Z�dqdr� Z�dsdt� Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e%j�d�d�d���Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e j�e jrfd�d��Z�d�d�� Z�e%j�e)j�d��e j�fd�d����Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�dS )�� )�print_functionN)�ArgumentParser)�contextmanager)�datetime� )�anomaly�auth� capabilities�config�config_handlers� constants�errors�fetch� http_utils� ipv6_support�kcare�libcare� log_utils�platform_utils� process_utils�selinux� server_info�serverid� update_utils�utils)� KcareError�NotFound�SafeExceptionWrapper)� HTTPError�URLError�httplib�json_loads_nstr� urlencode�c Zv3�12h�24h�48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh� latest.v3� latest.v2z /etc/sysconfig/kcare/sysctl.conf� z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C sD t � } tjjt�r@ttd�}x|D ]}| j|j� � q"W |j� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r: �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistR s r< c C sB |j d�}| r(dj|d | |d g�}ndj|d |d g�}|S )N�.r r ���r> )�split�join)�ptype�filenameZ name_partsr: r: r; � _apply_ptype\ s rC c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S )N)rC r � PATCH_BIN� PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE� PATCH_DONE)rA r: r: r; � apply_ptypee s rI c C s t j� \} }}d}t|t�rbt|t� rby d|jtj|j�|jf }W q� t t fk r^ Y q�X nPt|t t t f�r�t|t� r�d| }n*t|t �r�|jp�t|j�} |jp�d|j }tj� }tjtj� |d |d t| dt| ��|djtj|d��t|dd�d �S ) N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z agent_versionZpython_version�distroZdistro_version�error�details� tracebackrM ) �sys�exc_info� isinstance�OSErrorr �errnor/ �strerrorrB �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrP r � get_distror �VERSION�get_python_version�getattr�strr@ rQ Z format_tb)r\ �value�tbZdetails_sanitizedrN r: r: r; � format_exception_without_detailsm s* rf c C sv t jr d S tjt� �} tjtjtj | ���}tj d�d | }t j |t j� �}yt j|� W n tk rp Y nX d S )Nz/api/kcarectl-tracez?trace=)r �UPDATE_FROM_LOCAL�json�dumpsrf r �nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ encoded_trace�urlZrequestr: r: r; �send_exc� s ro c C s� t j� }|dkr t j|d� dS t j� t j� }|dkrBt jd� t jd� ttjd��&}t j |j � d� t j |j � d� W dQ R X |r�t j |� y | � W n* t k r� tjjd� t jd� Y nX t jd� dS )z� Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: r N�ar � zWait exception)r/ �fork�waitpid�setsid�_exitr6 r3 r ZLOG_FILE�dup2�fileno�time�sleeprm r �kcarelog� exception)�funcry �pid�fdr: r: r; � nohup_fork� s( r c C s� t jjtjd�} t jj| �rtt| d��H}y,t|j� �}|t j t j � krRt || ��W n t k rh Y nX W dQ R X tj| tj� � dS )a Check the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. z.kcareprev.lockr- N)r/ r0 r@ r � PATCH_CACHEr1 r3 �int�readr �SUCCESS_TIMEOUTrx � PreviousPatchFailedException� ValueErrorr � atomic_write� timestamp_str)Zanchor_filepathZafile� timestampr: r: r; � touch_anchor� s r� c C sx yt jt jjtjd�� W n tk r. Y nX td| � tj j � yt dd� W n t k rr t jjd� Y nX dS )z� See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. z.kcareprev.lock�done)�reasonzCannot send update info!N)r/ �remover0 r@ r r� rU �register_actionr �get_loaded_modules�clear�get_latest_patch_levelrm r rz r{ )� state_datar: r: r; � commit_update� s r� c C s( t jtjjtjd�tj| |d�d� d S )N�patchesrJ )Z exclude_path) r �clean_directoryr/ r0 r@ r r� r �get_cache_path)�khashZplevelr: r: r; � clear_cache� s r� c C s> t jpd}dj|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r �PREFIXr@ r r� r/ r0 )r� �fname�prefixZ module_dirr7 r: r: r; �get_current_level_path� s r� c C s t jt| d�t|�dd� d S )N�latestT)Z ensure_dir)r r� r� rc )r� � patch_levelr: r: r; �save_cache_latest� s r� c C sV t | d�}tjj|�rRy"tt|d�j� j� �}tj | |�S t t fk rP Y nX d S )Nr� r- ) r� r/ r0 r1 r� r3 r� �stripr �LegacyKernelPatchLevelr� rY )r� Zpath_with_latest�plr: r: r; �get_cache_latest� s r� c @ s e Zd ZdS )�CertificateErrorN)rK � __module__� __qualname__r: r: r: r; r� s r� c s e Zd ZdZ� fdd�Z� ZS )�UnknownKernelExceptionzunknown kernelc s6 dj tj� d tj� tj� �}tt| �j |f|� d S )NzLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r ) �formatr r_ �platform�releaser �get_kernel_hash�superr� �__init__)�self�kwargs�msg)� __class__r: r; r� s z UnknownKernelException.__init__)rK r� r� �statusr� � __classcell__r: r: )r� r; r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )�ApplyPatchErrorzpatch apply errorc sF t t| �j||� || _|| _|| _|| _tj� d | _ t j � | _ d S )Nr ) r� r� r� �code� freezer_style�level� patch_filer r_ rN r� r� )r� r� r� r� r� �argsr� )r� r: r; r� s zApplyPatchError.__init__c C s0 dj | j| j| j| j| jdjdd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})z, c S s g | ] }t |��qS r: )rc )�.0�ir: r: r; � <listcomp>, s z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rN r� r@ r� )r� r: r: r; �__str__% s zApplyPatchError.__str__)rK r� r� r� r� r� r� r: r: )r� r; r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )r� zprevious patch failedc s" t t| �j||� || _|| _d S )N)r� r� r� r� �anchor)r� r� r� r� r� )r� r: r; r� 4 s z%PreviousPatchFailedException.__init__c C s d}|j | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager: r: r; r� 9 s z$PreviousPatchFailedException.__str__)rK r� r� r� r� r� r� r: r: )r� r; r� 1 s r� c C s� t j� dj| � }yztj|�}tjtj|j� ��}t |d �}|dkrRtj d� n8|dkrftj d� n$|dkrztj d� ntj d j|�� |S t k r� } zt j ||� W Y d d }~X nX d S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizerq z!No KernelCare license for that IPzUnknown error {0}r> )r �get_registration_urlr� r �urlopenr � data_as_dictrj r� r� � print_wrapperr r �print_cln_http_error)�keyrn �response�resr� �er: r: r; �!set_monitoring_key_for_ip_licenseB s r� c c s> t jrtjt jdd� z d V W d t jr8tjt jdd� X d S )NT)�shell)r ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr: r: r: r; � execute_hooksV s r� c C s� t � }|j}|j}tj� }| dkrht|�tjtj � t j � |t t j� �|d�}tjd� tjtj|�� njtjd� tjt|�� tjdt|� � tjtj� tjtj � � tjt j � � tj|� tjt j� � dS )a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: rh )Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_inforc r � AUTO_UPDATEr � kcare_unamer� r� r� r Z get_uptimer r� rh ri )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr: r: r; � plugin_infob s, r� c C s^ t j� } ytdd�}W n tk r4 tjr0dS dS X | d krBdS | |krNdS tj� rZdS dS )N�info)r� r � r rq )r �loaded_patch_levelr� r� r �IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)� current_levelZlatest_patch_levelr: r: r; �get_update_status� s r� c C s2 t j� d d� \} }| dkr*|jd�r*dS dS d S )Nrq Z CloudLinuxz7.�extrarJ )r r_ � startswith)rN �versionr: r: r; �edf_fallback_ptype� s r� c C sl | j | jf}tj||�}tj|| j�| _| jjtj tj d� |tkrZ| jj � dd� t|< | j rh| j � dS )z�Function remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect r Nrq )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ resolved_addrr: r: r; �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr: )r� r: r: r; �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �SSLSockc C s || _ d| _d S )Nr )� _ssl_conn�_makefile_refs)r� r� r: r: r; r� � s zSSLSock.__init__c G s& | j d7 _ tj| jf|�ddi�S )Nr r6 T)r� r� Z _fileobjectr� )r� r� r: r: r; �makefile� s zSSLSock.makefilec C s" | j r | jr | jj� d | _d S )N)r� r� r6 )r� r: r: r; r6 � s z SSLSock.closec G s | j j|� S )N)r� �sendall)r� r� r: r: r; r� � s zSSLSock.sendallN)rK r� r� r� r� r6 r� r: r: r: r; r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t jj| � tjjtjj�}|jtjjtjj B � t j rJ|j tjj t� n|j tjjt� |j� tjj|| j�}|j� | jp�| j}|j|j� � |j� t j r�t|j� |� t|�| _d S )N) r �HTTPConnection�connect�OpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r �CHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� ZctxZconnZ server_hostr: r: r; r� � s z PyOpenSSLHTTPSConnection.connectN)rK r� r� r� r: r: r: r; r� � s r� c C s� t jr&tj| |�}tjtj�|dd�S |dk}t jo6|}�xld|fd|fdgD �]T\}}t j |||d�} t j | |d�} |r�dj | �} tj| t ||��d | }d } |s�|r�t |�| kr�|r�d nd } tjd | � qNyvtjtj�|dd�} t jo�tj| ��rDtj| �}tj|�}|�r(tjdj |�dd� ntjddd� |�rD|j� | S tk �r� } z>|�sf|�r�|jdk�s~|jdk�r�tjdj |�� wN� W Y d d }~X qNX qNW d S )NF)� check_license� latest.v1� latest.v2T)�secure_boot_info� perf_metrics)� b64_encodingzinfo={0}�?iX zsecure boot infoz perf metricsz.Check-in URL param is too large, discarding %sz:Automatic kernel anomaly report uploaded successfully: {0})� print_msgz$Failed to send kernel anomaly report� � i� zCCheck-in request failed with error: {0}, retrying with reduced info)r� r� )FF)r� r� )r rg r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr � urlopen_authZSEND_PERF_METRICSr Zencode_checkin_payloadr� �stickyfy�lenr �logwarnZ KERNEL_ANOMALY_REPORT_ENABLEr Zdetect_anomaly� prepare_kernel_anomaly_report�send_data_package�loginfo�remove_archiver r� )r� r� r� �modern r� Z perf_enabledr� r� ZsinfoZ request_paramZmax_url_lengthZ discard_infor7 � data_package� upload_name�exr: r: r; �_fetch_patch_level_request sB $r c C s8 t j� }tjd k r$t j|ttj��S �xtD � ]�}y�t||| |�}tj |j � t � t j |j� �j� }tjdj| |�dd� |r�|jd�r�t|�}|jdg �}tj|�s�tjd��t j||d |d |d �S t j|t|��S tk r� Y q, t k �r( } z |j d k�rt d ��� W Y d d }~X q,X q,W t � �d S )Nz;fetch patch level, reason: {0}, kernel latest response: {1}F)r� �{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgrader� �baseurlr� � � zKC licence is required)r r ) r r� r � PATCH_LEVELr� r� � PATCH_LATESTr r Z set_feature_flags_from_headers�headers�update_all_kmod_paramsr rj r� r� r r r� r� r! r� r Zhas_kc_capabilitiesr �CapabilitiesMismatchZKernelPatchLevelr r r� r r� ) r� r r� r� r� r� Z latest_infoZrequired_capabilitiesr r: r: r; �fetch_patch_level: s2 r c C s< | j t|tj��}tjjdj|�� ytj |ddd� dS t k r^ tjjdj|�� dS t k r� } z tjj dj|t |��� W Y d d }~X nX | j t|tj�tj �}tjjdj|�� ytj |dd� W nb t k � r� tjjdj|�� dS tk �r6 } z tjjd j|t |��� W Y d d }~X nX dS ) NzProbing patch URL: {0}F�HEAD)r� �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1})r� z{0} is not available: {1})�file_urlrC r rD r rz r� r� r r r rm �debugrc r ZSIGr )r� rA Zbin_urlr rn r: r: r; � probe_patch[ s( **r c C sF |t jkr| jt j�}n | j|�}| j|�}tj||tjtj | �d�S )N)Z hash_checker) r �KMOD_BINZkmod_urlr � cache_pathr Z fetch_urlr � USE_SIGNATUREZget_hash_checker)r� �namern Zdstr: r: r; � fetch_and_verify_kernel_filet s r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )� PatchFetcherNc C s || _ d S )N)r� )r� r� r: r: r; r� s zPatchFetcher.__init__c C s t | j|�S )N)r r� )r� r r: r: r; �_fetch� s zPatchFetcher._fetchc C sr | j jtj�}| j jtj�}| j jtj�}| j jtj�}tdd� ||||fD ��opt j j |�dkopt j j |�dkS )Nc s s | ]}t jj|�V qd S )N)r/ r0 r1 )r� r0 r: r: r; � <genexpr>� s z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r r rH rD rE r r �allr/ r0 �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr: r: r; �is_patch_fetched� s z PatchFetcher.is_patch_fetchedc C s4 | j d krtd��| j s | j S | j� r6tjd� | j S tjd� t| j tj�r�y tj | j j t j �dd�}W n t k r~ Y n(X |jjdd �}|r�| j jtj|��| _ y| jt j � W n0 t k r� tdj| j t jp�d�d d ��Y nX | jt j� | jtj� | j� tj| j j t j �d d d � t j tj � | j S )Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r z KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�defaultzpatch level not found)r� � �wb)r )!r� r� r& r r rT r r� r r r r rD r r r� �upgrader rj r" r r� � PATCH_TYPErE r r �extract_blacklistr� r rH r �restore_selinux_contextr� )r� �respr r: r: r; � fetch_patch� s: zPatchFetcher.fetch_patchc C sJ t | jjtj�d�j� }|rFtj|�}|rFtj | jjtj �|j d�� d S )Nr- r ) r3 r� r r rE r� � BLACKLIST_RE�searchr r� rF �group)r� ZbufZmor: r: r; r, � s z PatchFetcher.extract_blacklistc C s� |dkr dS yt |tj�}W n tk r0 dS X |jjdd�}|rT|jtj|��}|j tj�}t |d�� }t dd� |j � D ��}W dQ R X x|D ]}t ||� q�W t jtj� dS )z� Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nz KC-Base-Urlr- c S s g | ] }|j � �qS r: )r� )r� �fixupr: r: r; r� � s z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r r rG r r r� r* r rj r r3 r. � readlinesr r- r r� )r� r� r. r Z fixups_fnamer8 �fixupsr3 r: r: r; � fetch_fixups� s zPatchFetcher.fetch_fixups)N) rK r� r� r� r" r& r/ r, r6 r: r: r: r; r! } s )r! c C s8 t � } tj| j� | jtjkr*tjd� n tjd� d S )Nr r ) r� r r� r� r� �PLI�PATCH_NEED_UPDATErR �exit)r� r: r: r; � kcare_check� s r: c C s\ t � } t| �}y tj� }W n tk r2 i }Y nX tj� }d}|d k r\tj|d �j d�}tj � }|j dg �}t t j|dd��}t |�}dd� |D �} t t j| d d��} td d � |D ��} || } tj� } | s�t jd � n t jd � t jdj|�� t jdj|�� |dk�r t jdj|�� | dk�r:t jdj| �� | dk�rNt jd� t jd� d S )NZUnknown�tsz%Y-%m-%dr� z kpatch-cve)Z cve_fieldc S s" g | ]}|j d g �D ]}|�qqS )r� )r� )r� �rec�patchr: r: r; r� � s z%show_generic_info.<locals>.<listcomp>Zcvec s s | ]}t |jd g ��V qdS )r� N)r r� )r� r< r: r: r; r# � s z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z fromtimestampZstrftimer� r� r r Zextract_unique_cves�sumr� r� r� )r� � kcare_info� libcare_info�stateZ latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countr� r: r: r; �show_generic_info� s> rC Fc C s� y�t dtjd�}|st�|jtj�}tjt j |�j � �}| r�g i }}x>|j d�D ]0}tj |�}|rxd|krx|j|� qR|j|� qRW ||d< tj|�}tj|� W nJ tk r� } ztj||j� dS d}~X n tk r� tjd� Y nX d S ) z� Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None r� )r� �policyz z kpatch-namer� r NzNo patches availabler )r� r � POLICY_REMOTEr� r r rE r rj r r r� r? r� �append�updaterh ri r� r r r� rn ) �is_jsonr� rn � patch_infor� r7 �chunk�datar� r: r: r; �kcare_latest_patch_info s, rL c C s� d| j i}| jd k r�t| �}g }x>|jd�D ]0}tj|�}|rRd|krR|j|� q,|j|� q,W ||d< tj � }|r||d nd|d< |S )Nr� z z kpatch-namer� r� �unknown) r� r� �_kcare_patch_infor? r r� rF rG r Z read_dumped_kernel_patch_level)r� r7 rI r� rJ rK Zsaved_patch_levelr: r: r; r> 3 s r> c C sT t j� }t j|| jtj�}tjj|�s2t ddd��t |d�j � }|rPt j d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not found)r� r- rJ )r r� r� r� r rE r/ r0 r1 r r3 r� r0 �sub)r� r� r r� r: r: r; rN G s rN c C sZ t � }| s>|jdkr tj|j� |jd kr.d S tjt|�� ntjtjt |�dd�� d S )Nr T)Z sort_keys) r� r� r r� r� r� rN rh ri r> )rH r� r: r: r; rI V s rI c C s: t jd| g}tj|�}tj� }d}tj||�tj||�kS )Nz file-infozkpatch-build-time)r � KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr: r: r; � is_same_patchb s rT c C sL |dkr dS | r || k r dS | |kr(dS t jt j� |tj�}t|�sHdS dS )Nr FT)r r� r� r rD rT )� applied_level� new_levelrS r: r: r; �kcare_need_updatej s rW c C sp t jrltjjt�o tjttj�s6tj j dj t�� d S t j dddtgdd�\} }}| dkrltj j dj | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctlz-qz-pT)� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr/ r0 r1 � SYSCTL_CONFIG�access�R_OKr rz �warningr� r r� )r� �_r: r: r; � update_sysctl| s r^ c s� t jjt�sttd�j� t jtt j�s>tj j dj t�� dS ttd��j}|j � }|j d� x,|D ]$� t� fdd�| D ��sb|j� � qbW x|D ]}|j|d � q�W |j� W dQ R X dS ) z*Update SYSCTL_CONFIG accordingly the editsrp zFile {0} has no read accessNzr+r c 3 s | ]}� j |�V qd S )N)r� )r� r- )r9 r: r; r# � s z#edit_sysctl_conf.<locals>.<genexpr>� )r/ r0 r1 rY r3 r6 rZ r[ r rz r\ r� r4 �seek�any�write�truncate)r� rF Zsysctl�linesrp r: )r9 r; �edit_sysctl_conf� s re c C s. x(| D ] }t j|�rtdj|�dd��qW d S )NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel module)r� )�CONFLICTING_MODULES_RE�matchr r� )r� �moduler: r: r; �detect_conflicting_modules� s ri c C s dj tj� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer: r: r: r; �get_kcare_kmod_link� s rj c C sX t dd�} tjtj� | tj�}tjj|�s.d S t |d��}|j � dd � dkS Q R X d S )Nr� )r� �rb� s ~Module signature appended~ i��) r� r r� r� r r r/ r0 r1 r3 r� )r� Z kmod_fileZvfdr: r: r; �kmod_is_signed� s rm c s4 t jd�� � d krd S ddg} t� fdd�| D ��S )Nz /proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ]}|� kV qd S )Nr: )r� r� )� system_keysr: r; r# � s z'kcare_certs_enrolled.<locals>.<genexpr>)r Z try_to_readra )Z kcare_keysr: )rn r; �kcare_certs_enrolled� s ro c K sd d| g}x&|j � D ]\}}|jdj||�� qW tj|dd�\}}}|dkr`tdj| |�dd��d S ) Nz /sbin/insmodz{0}={1}T)rX r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load error)r� )�itemsrF r� r r� r )Zkmodr� �cmdr� rd r� r] r: r: r; � load_kmod� s rr c C sT t j� r,t� dkrtd��t� dkr,td��t j� sDt j� sDt j� rPtddd��d S )NFz4Secure boot is enabled. Not supported by KernelCare.z<Secure boot is enabled. No KernelCare certificates enrolled.zWYou are running inside a container. Kernelcare should be executed on host side instead.zrunning in container)r� )r Zis_secure_bootrm r ro Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr: r: r: r; �check_compatibility� s rs c C sP t jd�}t j|dgddd�d dk}|rL| d krLtjdj| �� tjd � d S ) NZmodinfoZkmodlveT)rX � catch_stderrr �freer� z3{0} patch type conflicts with kmodlve kernel moduler )ru r� )r Zfind_cmdr� r �logerrorr� rR r9 )rA rq Z has_kmodlver: r: r; � check_patch_type_compatibility� s rw c C sP t jddd| g�}g }x4|jd�D ]&}|j� r"|jd�\}}}|j|� q"W |S )Nz /sbin/modinfoz-FZparmr_ �:)r rQ r? r� � partitionrF )� kcare_link�stdoutZavailable_paramsr9 Z param_namer] r: r: r; �get_kmod_available_params� s r| c C sL t jr dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rJ )� kpatch_debugZ kmsg_outputZ kcore_outputZ kdumps_dirZenable_crashreporter) r � KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErT � KDUMPS_DIRrc ZENABLE_CRASHREPORTERr: r: r: r; �make_kmod_new_params� s r� c C sH t jr"tjjt j� r"tjt j� x t� j� D ]\} }t| |� q.W d S )N) r r r/ r0 �exists�makedirsr� rp �update_kmod_param)Zparam�valr: r: r; r � s r c C st d}t jj|| �}t jj|�s"d S y(t|d��}|jt|�� W d Q R X W n$ tk rn tj j d| |� Y nX d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r/ r0 r@ r� r3 rb rc rm r rz rO )Zkmod_param_nameZ param_valueZ params_rootZ param_pathr8 r: r: r; r� s r� c s� t � }tj| |tj�}ytj||� W n tk r> |}Y nX tj rbt j j tj � rbt j tj � t� }t|�� t� fdd�|j� D ��}t|f|� t� d S )Nc 3 s" | ]\}}|� kr||fV qd S )Nr: )r� �k�v)�available_kmod_paramsr: r; r# s z"load_kcare_kmod.<locals>.<genexpr>)rj r r� r r �shutil�copyrm r r r/ r0 r� r� r� r| �dictrp rr � update_depmod)r� r� rz Z kcare_fileZ kmod_paramsr: )r� r; �load_kcare_kmod s r� c C sX dg}| d k r |j d| g� tj|ddd�\}}}|rTtjdjdj|�||�dd� d S ) Nz /sbin/depmodz-aT)rX rt z%Running of `{0}` failed with {1}: {2}� F)r� )�extendr r� r rv r� r@ )�unamerq r� r] �stderrr: r: r; r� & s r� c C s8 t jd| gdd�\}}}|dkr4tdj| |�dd��d S )Nz /sbin/rmmodT)rX r z Unable to unload {0} kmod {1}zkmod unload error)r� )r r� r r� )�modnamer� r] r: r: r; � unload_kmod2 s r� c C sT g }xJdg| D ]<}t j| |dj|��}tjj|�rt|� |jdj|�� qW |S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r/ r0 r� rr rF )r� r� r� Zloaded�modZmodpathr: r: r; � apply_fixups8 s r� c C sD x>| D ]6}y t |� W q tk r: tjjd| � Y qX qW d S )Nz$Exception while unloading module %s.)r� rm r rz r{ )r5 r� r: r: r; � remove_fixupsB s r� c C s� | r | }n6t jrt j}n(t� j|�r2d| t jdfS d| t jdfS dddddd�}|j� }||krj|| }ntdj|| t jd�d d ��|| t jdfS ) NZfreeze_conflictTr' FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})z freezer style detection error)r� )r Z PATCH_METHODr< � intersection�upperr r� )�freezerr� r Zpatch_method_mapr: r: r; �get_freezer_styleJ s& r� rJ c s� | ||d�� t d� � tj� }tj� }t|� t||�}tj| |tj�}t | |� dj |tj t j � tj|��} d|k} | o�tj| |�} |d k } | o�t|�o�tj| �} � j|| d�� | r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d � � td� d } | �s<t d � � t| |� |�rHt� t d � � t|| || |� t� tj dj |tj � �� t j � t d� � t � fdd�tj!d� d S )N)r� Zfuturer �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�loadr= z5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S )N)r� r: )r� r: r; �<lambda>� s z kcare_load.<locals>.<lambda>)ry )"r� r r� r� ri r� r� r rD r� r� r+ r r� Z parse_unameZis_kmod_version_changedrT Z kcare_update_effective_versionrG r� �kpatch_ctl_unpatchr� r� r� r� �kpatch_ctl_patchr^ r r r� r Ztouch_status_gap_filer r� )r� r� r r� � use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ same_patchr5 r: )r� r; � kcare_loadl sR r� c C s� t jg}tj||tj�}tjj|�r2|j d|g� |j dd|g� |j d|d g� |j | � t j |dd�\}}}|dkr�t |||| ��d S )Nz-br= z-dz-mr T)rX )r rP r r� r rF r/ r0 r� r� rF r r� r� ) r� r� r� r� r� r� Zblacklist_filer� r] r: r: r; r� � s r� c C s^ t jtjdd| d gddd�\}}}|dkrZtjdj||�dd� td j|t| ��d d ��d S ) Nr� z-mr T)rX rt z4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}F)r� zError unpatching [{0}] {1}z unpatch error)r� ) r r� r rP r rv r� r rc )r� r� r{ r� r: r: r; r� � s r� c C s8 | |d< t tj� �|d< tjtjjtjd�t |�� d S )N�actionr; z kcare.state) r� rx r r� r/ r0 r@ r r� rc )r� r� r: r: r; r� � s r� c C sp d}t jj|�sd S xVt j|�D ]H}t jj||dd�}t jj|�sDq t j|�}|| kr t j|� t|� q W d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r/ r0 �isdir�listdirr@ �islink�readlink�unlinkr� )� kmod_linkZ modules_path�entryZ sym_link_pathZ target_pathr: r: r; �update_weak_modules� s r� c C sJ t j� }t� }y|j|� W n8 tk rT } z |sDtdj|�dd��W Y d d }~X nX t j� }t| |�}t � �� d|k�r|d k }|r�t t j � ||�}t j tjdd|d gddd �\} } } t|� | dkr�tjd j| | �d d � td j| t|��dd��tjtjt�dtd�t�d� t� } tj j | ��r4tj | � t | � W d Q R X d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval error)r� r r� z-mr T)rX rt z4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}F)r� zError unpatching [{0}] {1}z unpatch errorr )�count�delay) r r� r! r6 rm r r� r� r� r� r� r� r r� r rP r� r rv rc r Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rj r/ r0 r1 r� r� ) r� �forcer� �pf�errr� r� Z need_unpatchr5 r� r{ r� r� r: r: r; � kcare_unload� s: r� c C s8 t � }| rt|�S |jdkr"|jS |jd k r4tj� S d S )Nr )r� �_kcare_info_jsonr� r� r� r rR )rH r� r: r: r; r@ s r@ c C sR d| j i}| jd k r>|jtjtj� �� |jtj|jd��� | j |d< t j |�S )Nr� zkpatch-descriptionz kpatch-state) r� r� rG r r� r rR Zparse_patch_descriptionr� rB rh ri )r� r7 r: r: r; r� s r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r7 r r rq r� c C s" || _ || _|| _|| _|| _d S )N)r� r� � remote_lvlr� rB )r� r� r� r� r� rB r: r: r; r� $ s z PLI.__init__N)rK r� r� r r8 �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r: r: r: r; r7 s r7 c C s� t j� } y�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nl tk r� tj }t j r�d j t j t j� d tj� �}n d j t j� d tj� t j� �}t||d d d �}Y nX |S ) Nr� )r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingszLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.Z unavailable)r r� r� rW r7 r8 r r� r� r� r � STICKY_PATCHr� r r_ r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r� rB r� r: r: r; r� , s8 r� c C s� d}yXt j� }td|fd| fg�}tj� dj|� }tj|�}tj tj |j � ��}t |d �S t k r� } ztj||� d S d}~X nZ tk r� } ztj||� d S d}~X n0 tk r� } ztjdj|�� d S d}~X nX dS ) z� Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise N� server_id�tagz/tag_server.plain?{0}r� r� � zInternal Error {0}� ���������)r � get_serveridr" r r� r� r r� r r� rj r� r� r r r� r rm rv ) r� rn r� Zqueryr� r� r� ZueZeer: r: r; � tag_server^ s" r� c C s� t jd�} tjdj| �� t}tj� ��}y:tj | |j �}t j t j | �|j � tj|j |� |j }W n2 tk r� } ztjdj|�� W Y d d }~X nX tjd|tj� gdd�\}}}|r�tdj||�dd ��W d Q R X d S ) Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)rt z Script failed with '{0}' {1}zdoctor script failed)r� )r rl r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler Zfetch_signaturer Z save_to_filer r� Zcheck_gpg_signaturerm rv r r� r Zget_patch_serverr )Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturer� r� r] r� r: r: r; �kcdoctory s " r� c C sB t jdjt��} ytj| � W n tk r2 dS X tjd� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r rl r� �EFFECTIVE_LATESTr r� r r r )rn r: r: r; �check_new_kc_version� s r� c C s t j� }t|�}|tjkp*|tjko*|dk}yt| |�}W n� tjk r� } z.|dkrX� t j t |�� t j d� tj }W Y dd}~X n< t k r� } z |r�� nt jjdj|�� W Y dd}~X nX |tjkr�|} n@|} |dk�r|tj kr�t j|d�} n|tjk�r |} ntd��| S )a� Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string Nz#Using previously downloaded patcheszUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r rE ZPOLICY_LOCAL_FIRSTr r r r r rc Z POLICY_LOCALrm rz r\ r� r� r ) r� rD r r� Z cached_levelZconsider_remote_exZ remote_levelr� r r� r: r: r; r� � s2 $ r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdkrntj� rnt jpXt }t dd d j |�f� t j d j | �� ntdj | �dd��d S )N�edfr' rJ Zprobe)r� )r+ ru r� �fs.enforce_symlinksifowner�fs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailable)r� )ru r� )r� r� )r r+ r r r � update_configr Z is_cpanelZ FORCE_GID� CPANEL_GIDre r� r r r )rA Zgidr: r: r; �update_patch_type� s r� Zkernelc $ C sd t tj� |tjkrt� ytd||d�}W nR tk r~ } z6|tjtj fkrltj rlt |�}t j j|� dS � W Y dd}~X nX tj� }t|�}|j� t||d�s�t jd� dS y(tjtjddd� tjtjdd d� W n tk r� t j jd � Y nX tj� }|tjk�stj�rLt � �( |j |� t |||| |tj kd � W dQ R X tj |� t ||� dS ) ax :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode rG )r� rD r N)rU rV z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r� )!rw r r+ r rE r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� rc r rz r\ r r� r! r/ rW r r r� r rm r{ r� r� r� r6 r� Zdump_kernel_patch_levelr� ) r� r rD r� r� r� r� r� r� r: r: r; � do_update� s: " r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr@tddd��tjrLtjS | t j krptjp`tj}tjpltj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settings)r� zrelease-) r? �boolr r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r r� r� Zpatchsetr: r: r; � get_sticky s& r� c C s | d | S )Nr= r: )r� r� r: r: r; � _stickyfy4 s r� c C s t |�}|s| S |dkr"t|| �S tj� }|sDtjjd� tjd� y t j t j � dj |� �}W n: tk r� } z tj||j� tjd� W Y dd}~X nX tjtj|j� ��}t|d �}|dkr�t|d | �S |d kr�| S |d k� r�tjjd � tjd� tjjd |d � tjd� dS )z� Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. �KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rq zEServer ID is not recognized. Please check if the server is registeredzError: r� r� r� r� r> r� )r� r� r r� r rz r� rR r9 r r� r r� r� r r� rn r r� rj r� r� )�filer �sr� r� r� r� r� r: r: r; r 8 s2 r c C s� g }| s dS | j d�}|d }|dd� }|jd�}||krLtdt| � ��|s`| j� |j� kS |dkrt|jd� n>|jd �s�|jd �r�|jtj|�� n|jtj|�j d d �� x |D ]}|jtj|�� q�W tj d d j |� d tj �} | j |�S )zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr= r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r? r� r� �repr�lowerrF r� �re�escape�replace�compiler@ Z IGNORECASErg ) Zdn�hostnameZ max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr: r: r; �_dnsname_matchd s( r� c C s g }xBt | j� �D ]2}| j|�}|j� dkrdd� t|�jd�D �}qW | sTtd��g }x0|D ](\}}|dkr^t||�r|d S |j|� q^W |s�| j � j }t||�r�d S |j|� t |�dkr�t dj |d jtt|�����n,t |�dk� r�t d j ||d ���nt d ��d S ) NZsubjectAltNamec S s g | ]}|j � jd d��qS )rx r )r� r? )r� �itr: r: r; r� � s z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}z, z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ get_extensionZget_short_namerc r? r� r� rF Z get_subjectZ commonNamer r� r� r@ �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� rd Zcnr: r: r; r� � s0 r� c C s8 t ddd�} | jdddd� | jdd d dd� | jd d dd� | jd dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCddDdE� | jdFdGdd� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdd� | jdPdQdd� | jdRdSdd� | jdTdUdd� | jdVdWdd� | jdXdYdZtd d[d\� | jd]d^dd� | jd_d`dd� | j� }|jdadbdZd� |jdcdddd� |jdedfdd� | jdgdhdZd d[di� | jdjdkdldd[dm� | jdndodp� | jdqdrdd� | jdsdtdudvdw� tj�s�| jdxdydzd{d[d|� | jd}d~dzd{dd|� | jd�d�dd� | jd�d�d�dd� | jd�ddd� | jd�d�d�dd� | jd�d�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | j� }tj� tj�s t j d�g7 _ |j d k �r@t t d |j j d����jtj ��r<d�S d�S |j�sP|j�rltj�rbtjt_ntjt_n|j�r|tjt_|j�s�tj� d�k�r�td�t j d�� d�S t j }|j�r�t j }n|j�r�t j!}t"j#|� tj$�s�tj%� |j&�r�t'j(� |j)�r4|j)d�k�r"t*|j)�t_+tj,tj+d�� nd t_+tj,dd�� |j-d k �rVtj,|j-d�� |j-t_.|j/�rdd[t_0|j1�rrd[t_2|j3�r�dt_4|j5�r�t5� |j6�r�t7j8d�t9� n8|j:�r�tj;d�k�r�tj<d�k�r�dntj<�p�d�|_=d|_>|j?�r�|j?t_@|jA�rt7j8d�t9� d�t_@tj@jBd��t_@tj@�rDtj@tCk�rDt"jDjEd�jFtj@d�jGtC��� |jH�r^dt_Id�|jH t_J|j=�rptK|j=� tj;d�k�r�tL� t_;t7j8d�jFtj;�p�d��t9� |jM�r�t'jNtOjM|jPd��� d S |jQ�r�tQjQd�ddd��}t'jNtPjR|�� d S tStj;� |jT�rtU� d S |jV�r�tWjXtQjQd�ddd���}d�jF|jY�}|jZ�rDt'jN|� nRtWj[|�}|�rft"j\d�jF|�� nt"j]d�dd�� |j^�r�t'jN|� n|�r�|j_� |j`�r�|jP�r�t`d�d�� nt`� d S |ja�r�tj,d�d�� d S |jb�r�tj,d�d�� d S |jc�rtjd|jc� d S |je�rtf|je�S |jg�r&thjg� |ji�rVtj;d�k�rFtj,d�d�� thji|ji|jj�S |jk�rtthjk� d�k�rpd�S d�S |jld k �r�tm|jl�S |jn�r�t'jNtjo� tp|dzd �d k �r�tqjr|js� d�S tj� s�|jt�r�tqju� S |jv�r�tqjw� d k �r�t"j\d�� |jx� rtqjwtjyd�� n|jz� r*tqj{� t"j\d�� |j|� r@t'jNtqj}� � |j~� rVt'jNtqj� � |j�� rztqj�� � rzt'jNtqj�|j��� |j�d k � r�|j�dk� r�tj�� p�t�tqj�j�� �}nd�d�� |j�j d��D �}tqjwt�|�d��d k � r�t"j\d�� |j�� r�tqjwtjyd d�� |j�� rt'jNt�|jPd��� d} |j�� r.t7j8d�t9� d�} |j�� r<|j�} |j�� rVt�| tj�tj�d |j>� rvt�| tj�d�� t"j\dà |j� r�t'jNt�j�� � |j�� r�t�| |j�dč t"j\dŃ |j� r�d[t_�t�j�t�j�d�dƃ� t�| tjyd�� |j�� r�t�|jPd�� |j�� r�t�� S |j�� rt�|jPd�� |j�� r t�� t�t j��d�k� r4t�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrJ Z store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z --app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz --auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z --nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz --registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z --nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--kernel-anomaly-reportzHSubmits a kernel anomaly report to CloudLinux for analysis and bug-fixesz --no-sendzSkip sending artifacts� save_only)r� r� �destz --keep-localz:Don't delete generated kernel anomaly report after sendingz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz --plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z --server-infoz3Provides information about the host in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� r] r' �requiredz--check-compatibilityzCheck compatibility.z --clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz --edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r' r� z-qz--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r� z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionrF z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� r� r� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez --lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz --lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr� zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr� r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledr� r r zPlease run as root)r� )r )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r' zMFlag --test has been deprecated and will be not available in future releases.r' �/z(Prefix `{0}` is not in expected one {1}.r� zfile:z+edf patches are deprecated. Fallback to {0})rH r )r� r� r� z)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}z$Failed to send kernel anomaly report)r� rh )r� ZYES)r� ZNOru r� )r+ z Userspace patches are applied.)r z Userspace patches are unloaded.c S s g | ]}|j � j� �qS r: )r� r� )r� Zptchr: r: r; r� s zmain.<locals>.<listcomp>)�limit)r r� zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r rD zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentr� Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_argsr Z set_settings_from_config_fileZFLAGSZ has_flagsr. �filterr? �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr� r/ �getuid�printrR r� �loggingZINFOZWARNING�DEBUGr Zinitialize_loggingZIGNORE_FEATURE_FLAGSZ set_feature_flags_from_cacher� r Zclear_all_cacheZset_patch_levelrc r r� Zset_sticky_patchr� Z nosignaturer Z no_check_certr� r} r~ rs Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr+ ZPREV_PATCH_TYPEZset_patch_typerG r� r� r' r� �EXPECTED_PREFIXrz r\ r� r@ Zlocalrg Z PATCH_SERVERr� r� Zapp_infor� r rh r ri rI Zdoctorr� Zkernel_anomaly_reportr r Z archive_pathr� r r r Z keep_localr r� Zenable_auto_updateZdisable_auto_updateZ set_configZupdate_config_from_argsZset_monitoring_keyr� Z unregisterr �registerZregister_autoretryr� r� r� r� r` rb r Zset_libcare_statusr� Zuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updateZlib_auto_updater� Z lib_unloadZlibcare_unloadZlib_inforA Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater� �listZ USERSPACE_MAP�keys�sortedZuserspace_auto_updater� r@ Znofreezer� Z smart_updater� r� Z UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSrx ry �randomZuniformrI r� r� Zlatest_patch_inforL Zcheckr: r �argvrC ) ZparserZexclusive_groupr� r� r� r Zlocal_path_messager r� r� r: r: r; �main� sP r )r$ r% r& r' )r( r) )N)N)F)F)N)rJ F)rJ F)r )�Z __future__r rk rh r� r/ r� r r� r� r� ZsslrR r� rx rQ r� Zargparser � contextlibr r rJ r r r r r r r r r r r r r r r r r r r r r r r Zpy23r r r r! r" r� r� r� r2 r� r rY r� r� ZDOTALLr0 rf r0 r� �insert�filterwarningsr� rz ZsetLevelr� r< rC rI rf ro r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z StrictVersionZ __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r r� r r r r! r: rC rL r> rN rI rT rW r^ re ri rj rm ro rr rs rw r| r� r r� r� r� r� r� r� r� r� r� r� r� r� Zlog_all_parent_processesr� r@ r� r7 r� r� r� r� rE r� r� Ztrack_update_statusr� r� r� r r� r� r r: r: r: r; �<module> s X & 4 -! b + " ? - 2 .6 , 3)
SAVE
CANCEL