/
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
__pycache__
/
Upload File
HOME
a ZS�i�4 � @ s d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z* ddl m+Z+m,Z,m-Z- dd l.m/Z/m0Z0m1Z1m2Z2m3Z3 d Z4d Z5d Z6d Z7dZ8dZ9dZ:dZ;e�<dej=�Z>e�<d�Z?ej@�Ad��r�e j@�Bd d� ejCdeDd� e#jK�LejM� dd� ZNdd� ZOdd � ZPd d � ZQd d � ZRd�d!d"�ZSd#d$� ZTd%d&� ZUd'd(� ZVd)d*� ZWd+d,� ZXd-d.� ZYG d/d0� d0eZ�Z[G d1d2� d2e+�Z\G d3d4� d4e+�Z]G d5d6� d6e+�Z^d7d8� Z_ed9d:� �Z`d�d;d<�Zad=d>� Zbd?d@� Zci ZddAdB� Zeeee1jf_gehe dCd��sz8d dliZjd dlkZlejjm�neljo�ejjm�ndD�k �r�epdE��W n ep�y� Y n80 dFdG� Zqe1jrZsG dHdI� dIet�ZuG dJdK� dKe1jr�Zveve1_rdLdM� Zwe jxfdNdO�ZydPdQ� ZzdRdS� Z{G dTdU� dUet�Z|dVdW� Z}dXdY� Z~d�d[d\�Zd]d^� Z�d_d`� Z�d�dadb�Z�dcdd� Z�dedf� Z�dgdh� Z�didj� Z�dkdl� Z�dmdn� Z�dodp� Z�dqdr� Z�dsdt� Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e%j�d�d�d���Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e j�e jxfd�d��Z�d�d�� Z�e%j�e)��d��e j�fd�d����Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�dS )�� )�print_functionN)�ArgumentParser)�contextmanager)�datetime� )�anomaly�auth� capabilities�config�config_handlers� constants�errors�fetch� http_utils� ipv6_support�kcare�libcare� log_utils�platform_utils� process_utils�selinux� server_info�serverid� update_utils�utils)� KcareError�NotFound�SafeExceptionWrapper)� HTTPError�URLError�httplib�json_loads_nstr� urlencode�c Zv3)Z12hZ24hZ48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh)z latest.v3� latest.v2z /etc/sysconfig/kcare/sysctl.conf� z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C s@ t � } tj�t�r<ttd�}|D ]}| �|�� � q |�� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r6 �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistR s r8 c C sB |� d�}| r(d�|d | |d g�}nd�|d |d g�}|S )N�.r ���)�split�join)�ptype�filenameZ name_partsr6 r6 r7 � _apply_ptype\ s r? c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S �N)r? r � PATCH_BIN� PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE� PATCH_DONE)r= r6 r6 r7 � apply_ptypee s rF c C s� t �� \} }}d}t|t�r^t|t�s^z d|jt�|j�|jf }W q� t t fyZ Y q�0 nNt|t t t f�r�t|t�s�d| }n*t|t �r�|jp�t|j�} |jp�d|j }t�� }tjt�� |d |d t| dt| ��|d�t�|d��t|dd�d �S ) N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z agent_versionZpython_version�distroZdistro_version�error�details� tracebackrJ ) �sys�exc_info� isinstance�OSErrorr �errnor+ �strerrorr> �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrM r � get_distror �VERSIONZget_python_version�getattr�strr< rN Z format_tb)rY �value�tbZdetails_sanitizedrK r6 r6 r7 � format_exception_without_detailsm s, �rb c C st t jr d S t�t� �} t�t�t� | ���}t� d�d | }t � |t �� �}zt �|� W n tyn Y n0 d S )Nz/api/kcarectl-tracez?trace=)r �UPDATE_FROM_LOCAL�json�dumpsrb r �nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ encoded_trace�urlZrequestr6 r6 r7 �send_exc� s rk c C s� t �� }|dkr t �|d� dS t �� t �� }|dkrBt �d� t �d� ttjd��0}t � |� � d� t � |� � d� W d � n1 s�0 Y |r�t � |� z | � W n( t y� tj�d� t �d� Y n0 t �d� dS )z� Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: r N�ar � zWait exception)r+ �fork�waitpid�setsid�_exitr2 r/ r ZLOG_FILE�dup2�fileno�time�sleepri r �kcarelog� exception)�funcru �pid�fdr6 r6 r7 � nohup_fork� s( . r{ c C s� t j�tjd�} t j�| �r�t| d��P}z,t|�� �}|t j t � � krRt || ��W n t yf Y n0 W d � n1 s|0 Y t�| t�� � dS )a Check the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. �.kcareprev.lockr) N)r+ r, r< r � PATCH_CACHEr- r/ �int�readr �SUCCESS_TIMEOUTrt � PreviousPatchFailedException� ValueErrorr � atomic_write� timestamp_str)Zanchor_filepathZafile� timestampr6 r6 r7 � touch_anchor� s $r� c C st zt �t j�tjd�� W n ty, Y n0 td| � tj � � zt dd� W n t yn t j�d� Y n0 dS )z� See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. r| �done��reasonzCannot send update info!N)r+ �remover, r< r r} rR �register_actionr �get_loaded_modules�clear�get_latest_patch_levelri r rv rw �� state_datar6 r6 r7 � commit_update� s r� c C s( t jtj�tjd�t�| |d�d� d S )N�patchesrG )Z exclude_path) r �clean_directoryr+ r, r< r r} r �get_cache_path)�khashZplevelr6 r6 r7 � clear_cache� s r� c C s> t jpd}d�|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r �PREFIXr< r r} r+ r, )r� �fname�prefixZ module_dirr3 r6 r6 r7 �get_current_level_path� s r� c C s t jt| d�t|�dd� d S )N�latestT)Z ensure_dir)r r� r� r_ )r� � patch_levelr6 r6 r7 �save_cache_latest� s r� c C sV t | d�}tj�|�rRz$tt|d��� �� �}t� | |�W S t t fyP Y n0 d S )Nr� r) ) r� r+ r, r- r~ r/ r �stripr �LegacyKernelPatchLevelr� rV )r� Zpath_with_latest�plr6 r6 r7 �get_cache_latest� s r� c @ s e Zd ZdS )�CertificateErrorN)rH � __module__� __qualname__r6 r6 r6 r7 r� s r� c s e Zd ZdZ� fdd�Z� ZS )�UnknownKernelExceptionzunknown kernelc s: d� t�� d t�� t�� �}tt| �j |fi |�� d S )N�LNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r ) �formatr r\ �platform�releaser �get_kernel_hash�superr� �__init__)�self�kwargs�msg�� __class__r6 r7 r� s �z UnknownKernelException.__init__)rH r� r� �statusr� � __classcell__r6 r6 r� r7 r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )�ApplyPatchErrorzpatch apply errorc sJ t t| �j|i |�� || _|| _|| _|| _t�� d | _ t � � | _ d S �Nr ) r� r� r� �code� freezer_style�level� patch_filer r\ rK r� r� )r� r� r� r� r� �argsr� r� r6 r7 r� s zApplyPatchError.__init__c C s0 d� | j| j| j| j| jd�dd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})�, c S s g | ] }t |��qS r6 )r_ )�.0�ir6 r6 r7 � <listcomp>, � z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rK r� r< r� �r� r6 r6 r7 �__str__% s �zApplyPatchError.__str__�rH r� r� r� r� r� r� r6 r6 r� r7 r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )r� zprevious patch failedc s& t t| �j|i |�� || _|| _d S r@ )r� r� r� r� �anchor)r� r� r� r� r� r� r6 r7 r� 4 s z%PreviousPatchFailedException.__init__c C s d}|� | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager6 r6 r7 r� 9 s �z$PreviousPatchFailedException.__str__r� r6 r6 r� r7 r� 1 s r� c C s� t �� d�| � }z|t�|�}t�t�|�� ��}t |d �}|dkrRt� d� n8|dkrft� d� n$|dkrzt� d� nt� d �|�� |W S t y� } zt � ||� W Y d }~n d }~0 0 d S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizerm z!No KernelCare license for that IPzUnknown error {0}r: )r �get_registration_urlr� r �urlopenr � data_as_dictrf r r~ � print_wrapperr r �print_cln_http_error)�keyrj �response�resr� �er6 r6 r7 �!set_monitoring_key_for_ip_licenseB s "r� c c sT t jrtjt jdd� z d V W t jrPtjt jdd� nt jrNtjt jdd� 0 d S )NT)�shell)r ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr6 r6 r6 r7 � execute_hooksV s �r� c C s� t � }|j}|j}t�� }| dkrht|�tjt� � t � � |t t �� �|d�}t�d� t�t�|�� njt�d� t�t|�� t�dt|� � t�tj� t�t� � � t�t � � � t�|� t�t �� � dS )a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: rd )Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_infor_ r � AUTO_UPDATEr � kcare_unamer� r� r~ r Z get_uptimer r� rd re )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr6 r6 r7 � plugin_infob s. � r� c C s` t �� } ztdd�}W n ty6 tjr.dnd Y S 0 | d u rDdS | |krPdS t�� r\dS dS )N�infor� r � r rm )r �loaded_patch_levelr� r� r �IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)� current_levelZlatest_patch_levelr6 r6 r7 �get_update_status� s r� c C s2 t �� d d� \} }| dkr*|�d�r*dS dS d S )Nrm Z CloudLinuxz7.�extrarG )r r\ � startswith)rK �versionr6 r6 r7 �edf_fallback_ptype� s r� c C sl | j | jf}t�||�}t�|| j�| _| j�tj tj d� |tvrZ| j� � dd� t|< | j rh| � � dS )z�Function remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect r Nrm )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ resolved_addrr6 r6 r7 �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr6 )r� r6 r6 r7 �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �SSLSockc C s || _ d| _d S r� )� _ssl_conn�_makefile_refs)r� r� r6 r6 r7 r� � s zSSLSock.__init__c G s( | j d7 _ tj| jg|�R ddi�S )Nr r2 T)r� r� Z _fileobjectr� �r� r� r6 r6 r7 �makefile� s zSSLSock.makefilec C s | j s | jr | j�� d | _d S r@ )r� r� r2 r� r6 r6 r7 r2 � s z SSLSock.closec G s | j j|� S r@ )r� �sendallr� r6 r6 r7 r� � s zSSLSock.sendallN)rH r� r� r� r� r2 r� r6 r6 r6 r7 r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t j�| � tj�tjj�}|�tjjtjj B � t j rJ|� tjj t� n|� tjjt� |�� tj�|| j�}|�� | jp�| j}|�|�� � |�� t j r�t|�� |� t|�| _d S r@ ) r �HTTPConnection�connect�OpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r �CHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� �ctxZconnZ server_hostr6 r6 r7 r� � s z PyOpenSSLHTTPSConnection.connectN)rH r� r� r� r6 r6 r6 r7 r� � s r� c C s� t jr&t�| |�}t�tj�|dd�S |dv}t jo6|}d|fd|fdfD �]h\}}t j |||d�} t j | |d�} |r�d� | �} t�| t ||��d | }d } |s�|r�t |�| kr�|r�d nd } t�d | � qJz~t�tj�|dd�} t j�rBt�| ��rBt�| �}t�|�}|�r&tjd� |�dd� ntjddd� |�rB|�� | W S t�y� } zN|�sh|�r�|jdv �s�|jdk�r�t�d� |�� W Y d }~qJ� W Y d }~qJd }~0 0 qJd S )NF�� check_license)z latest.v1r% T)FF)�secure_boot_info� perf_metrics)� b64_encodingzinfo={0}�?iX zsecure boot infoz perf metricsz.Check-in URL param is too large, discarding %sz:Automatic kernel anomaly report uploaded successfully: {0}�Z print_msg�$Failed to send kernel anomaly report)i� i� i� zCCheck-in request failed with error: {0}, retrying with reduced info)r rc r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr � urlopen_authZSEND_PERF_METRICSr Zencode_checkin_payloadr� �stickyfy�lenr �logwarnZ KERNEL_ANOMALY_REPORT_ENABLEr Zdetect_anomaly� prepare_kernel_anomaly_report�send_data_package�loginfo�remove_archiver r� )r� r� r� �moderj r Z perf_enabledr r ZsinfoZ request_paramZmax_url_lengthZ discard_infor3 � data_package� upload_name�exr6 r6 r7 �_fetch_patch_level_request sD � $ r c C s> t �� }tjd ur$t �|ttj��S tD �]}z�t||| |�}t� |j � t � t � |�� ��� }tjd�| |�dd� |r�|�d�r�t|�}|�dg �}t�|�s�t�d��t �||d |d |d �W S t �|t|��W S ty� Y q( t �y0 } z"|j d v �rt d ��� W Y d }~q(d }~0 0 q(t � �d S ) Nz;fetch patch level, reason: {0}, kernel latest response: {1}Fr �{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgrader� �baseurlr� )i� i� zKC licence is required) r r� r � PATCH_LEVELr� r~ � PATCH_LATESTr r Z set_feature_flags_from_headers�headers�update_all_kmod_paramsr rf r r� r r r� r� r! r� r Zhas_kc_capabilitiesr �CapabilitiesMismatchZKernelPatchLevelr r r� r r� ) r� r r� r� r� r� Z latest_infoZrequired_capabilitiesr r6 r6 r7 �fetch_patch_level: s4 �" r c C sB | � t|tj��}tj�d�|�� ztj |ddd� W dS t y` tj�d�|�� Y dS t y� } z$tj� d�|t |��� W Y d }~n d }~0 0 | � t|tj�tj �}tj�d�|�� ztj |dd� W nd t �y tj�d�|�� Y dS t�y< } z$tj�d �|t |��� W Y d }~n d }~0 0 dS ) NzProbing patch URL: {0}F�HEAD)r� �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1}r� z{0} is not available: {1})�file_urlr? r rA r rv r� r� r r r ri �debugr_ r ZSIGr )r� r= Zbin_urlr rj r6 r6 r7 � probe_patch[ s( ..r c C sF |t jkr| �t j�}n | �|�}| �|�}tj||tjt� | �d�S )N)Z hash_checker) r �KMOD_BINZkmod_urlr � cache_pathr Z fetch_urlr � USE_SIGNATUREZget_hash_checker)r� �namerj Zdstr6 r6 r7 � fetch_and_verify_kernel_filet s r$ c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )� PatchFetcherNc C s || _ d S r@ )r� )r� r� r6 r6 r7 r� s zPatchFetcher.__init__c C s t | j|�S r@ )r$ r� )r� r# r6 r6 r7 �_fetch� s zPatchFetcher._fetchc C sr | j �tj�}| j �tj�}| j �tj�}| j �tj�}tdd� ||||fD ��opt j � |�dkopt j � |�dkS )Nc s s | ]}t j�|�V qd S r@ )r+ r, r- )r� r, r6 r6 r7 � <genexpr>� r� z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r! r rE rA rB r r �allr+ r, �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr6 r6 r7 �is_patch_fetched� s ��z PatchFetcher.is_patch_fetchedc C s0 | j d u rtd��| j s | j S | �� r6t�d� | j S t�d� t| j tj�r�z tj | j � t j �dd�}W n t y| Y n(0 |j�dd �}|r�| j �t�|��| _ z| �t j � W n. t y� td�| j t jp�d�d d ��Y n0 | �t j� | �tj� | �� tj| j � t j �d d d � t � tj � | j S )Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r � KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�defaultzpatch level not found�r� r� �wb�r )!r� r� r* r r rQ r r� r r r r rA r r r� �upgrader rf r& r r� � PATCH_TYPErB r r �extract_blacklistr� r! rE r �restore_selinux_contextr} )r� �respr r6 r6 r7 � fetch_patch� s> �� zPatchFetcher.fetch_patchc C sJ t | j�tj�d��� }|rFt�|�}|rFt� | j�tj �|� d�� d S )Nr) r ) r/ r� r! r rB r � BLACKLIST_RE�searchr r� rC �group)r� ZbufZmor6 r6 r7 r2 � s z PatchFetcher.extract_blacklistc C s� |du r dS zt |tj�}W n ty0 Y dS 0 |j�dd�}|rT|�t�|��}|� tj�}t |d��&}t dd� |� � D ��}W d � n1 s�0 Y |D ]}t ||� q�t �tj� dS )z� Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nr+ r) c S s g | ] }|� � �qS r6 )r� )r� �fixupr6 r6 r7 r� � r� z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r$ r rD r r r� r0 r rf r! r/ r* � readlinesr r3 r r} )r� r� r4 r Z fixups_fnamer4 �fixupsr9 r6 r6 r7 � fetch_fixups� s 4 zPatchFetcher.fetch_fixups)N) rH r� r� r� r& r* r5 r2 r< r6 r6 r6 r7 r% } s )r% c C s8 t � } t�| j� | jtjkr*t�d� n t�d� d S )Nr r ) r� r r� r� r� �PLI�PATCH_NEED_UPDATErO �exit)r� r6 r6 r7 � kcare_check� s r@ c C sZ t � } t| �}z t�� }W n ty0 i }Y n0 t�� }d}|d urZt�|d �� d�}t� � }|� dg �}t t j|dd��}t |�}dd� |D �} t t j| d d��} td d � |D ��} || } t�� } | s�t �d � n t �d � t �d�|�� t �d�|�� |dk�r t �d�|�� | dk�r8t �d�| �� | dk�rLt �d� t �d� d S )NZUnknown�tsz%Y-%m-%dr� z kpatch-cve)Z cve_fieldc S s" g | ]}|� d g �D ]}|�qqS )r� )r� )r� �rec�patchr6 r6 r7 r� � r� z%show_generic_info.<locals>.<listcomp>Zcvec s s | ]}t |�d g ��V qdS )r� N)r r� )r� rB r6 r6 r7 r' � r� z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z fromtimestamp�strftimer� r� r r Zextract_unique_cves�sumr� r� r� )r� � kcare_info� libcare_info�stateZ latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countr� r6 r6 r7 �show_generic_info� s> rJ Fc C s� z�t dtjd�}|st�|�tj�}t�t � |�� � �}| r�g i }}|� d�D ]0}t� |�}|rvd|v rv|�|� qP|�|� qP||d< t�|�}t�|� W nN ty� } z t�||j� W Y d}~dS d}~0 ty� t�d� Y n0 d S ) z� Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None r� )r� �policy� � kpatch-namer� Nr zNo patches availabler )r� r � POLICY_REMOTEr� r r rB r rf r r r r; r� �append�updaterd re r� r r r� rj ) �is_jsonr� rj � patch_infor� r3 �chunk�datar� r6 r6 r7 �kcare_latest_patch_info s, rU c C s� d| j i}| jd ur�t| �}g }|�d�D ]0}t�|�}|rPd|v rP|�|� q*|�|� q*||d< t� � }|rx|d nd|d< |S )Nr� rL rM r� r� �unknown) r� r� �_kcare_patch_infor; r r� rO rP r Z read_dumped_kernel_patch_level)r� r3 rR r� rS rT Zsaved_patch_levelr6 r6 r7 rD 3 s rD c C sT t �� }t �|| jtj�}tj�|�s2t ddd��t |d�� � }|rPt � d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not foundr- r) rG )r r� r� r� r rB r+ r, r- r r/ r r6 �sub)r� r� r! r� r6 r6 r7 rW G s � rW c C sZ t � }| s>|jdkr t�|j� |jd u r.d S t�t|�� nt�tjt |�dd�� d S )Nr T)Z sort_keys) r� r� r r� r� r� rW rd re rD �rQ r� r6 r6 r7 rR V s rR c C s: t jd| g}t�|�}t�� }d}t�||�t�||�kS )Nz file-infozkpatch-build-time)r � KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr6 r6 r7 � is_same_patchb s r^ c C sL |dkr dS | r || k r dS | |kr(dS t �t �� |tj�}t|�sHdS dS )Nr FT)r r� r� r rA r^ )� applied_level� new_levelr] r6 r6 r7 �kcare_need_updatej s ra c C sp t jrltj�t�r t�ttj�s6tj � d� t�� d S t j dddtgdd�\} }}| dkrltj � d� | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctl�-qz-pT�� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr+ r, r- � SYSCTL_CONFIG�access�R_OKr rv �warningr� r r� )r� �_r6 r6 r7 � update_sysctl| s rj c s� t j�t�sttd��� t �tt j�s>tj � d� t�� dS ttd��l}|� � }|� d� |D ]$� t� fdd�| D ��s`|�� � q`|D ]}|�|d � q�|�� W d � n1 s�0 Y dS ) z*Update SYSCTL_CONFIG accordingly the editsrl zFile {0} has no read accessNzr+r c 3 s | ]}� � |�V qd S r@ )r� )r� r) �r5 r6 r7 r' � r� z#edit_sysctl_conf.<locals>.<genexpr>� )r+ r, r- re r/ r2 rf rg r rv rh r� r: �seek�any�write�truncate)r� rO Zsysctl�linesrl r6 rk r7 �edit_sysctl_conf� s rr c C s* | D ] }t �|�rtd�|�dd��qd S )NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel moduler- )�CONFLICTING_MODULES_RE�matchr r� )r� �moduler6 r6 r7 �detect_conflicting_modules� s �rv c C s d� t�� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer6 r6 r6 r7 �get_kcare_kmod_link� s rw c C sp t dd�} t�t�� | tj�}tj�|�s.d S t |d��$}|� � dd � dkW d � S 1 sb0 Y d S )Nr� r� �rbi��s ~Module signature appended~ ) r� r r� r� r r r+ r, r- r/ r )r� Z kmod_fileZvfdr6 r6 r7 �kmod_is_signed� s ry c s4 t �d�� � d u rd S ddg} t� fdd�| D ��S )Nz /proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ]}|� v V qd S r@ r6 )r� r� �Z system_keysr6 r7 r' � r� z'kcare_certs_enrolled.<locals>.<genexpr>)r Z try_to_readrn )Z kcare_keysr6 rz r7 �kcare_certs_enrolled� s �r{ c K s` d| g}|� � D ]\}}|�d�||�� qtj|dd�\}}}|dkr\td�| |�dd��d S ) Nz /sbin/insmodz{0}={1}Trc r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load errorr- )�itemsrO r� r r� r )Zkmodr� �cmdr� r` r� ri r6 r6 r7 � load_kmod� s �r~ c C sT t �� r,t� du rtd��t� du r,td��t �� sDt �� sDt �� rPtddd��d S )NFz4Secure boot is enabled. Not supported by KernelCare.z<Secure boot is enabled. No KernelCare certificates enrolled.zWYou are running inside a container. Kernelcare should be executed on host side instead.zrunning in containerr- )r Zis_secure_bootry r r{ Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr6 r6 r6 r7 �check_compatibility� s �r c C sP t �d�}t j|dgddd�d dk}|rL| dv rLt�d�| �� t�d� d S ) NZmodinfoZkmodlveT�rd � catch_stderrr ��freer� z3{0} patch type conflicts with kmodlve kernel moduler )r Zfind_cmdr� r �logerrorr� rO r? )r= r} Z has_kmodlver6 r6 r7 � check_patch_type_compatibility� s r� c C sL t �ddd| g�}g }|�d�D ]&}|�� r |�d�\}}}|�|� q |S )Nz /sbin/modinfoz-FZparmrl �:)r r[ r; r� � partitionrO )� kcare_link�stdoutZavailable_paramsr5 Z param_nameri r6 r6 r7 �get_kmod_available_params� s r� c C sL t jr dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rG )� kpatch_debugZ kmsg_outputZ kcore_outputZ kdumps_dirZenable_crashreporter) r � KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErQ � KDUMPS_DIRr_ ZENABLE_CRASHREPORTERr6 r6 r6 r7 �make_kmod_new_params� s �r� c C sB t jr tj�t j�s t�t j� t� �� D ]\} }t| |� q*d S r@ ) r r� r+ r, �exists�makedirsr� r| �update_kmod_param)Zparam�valr6 r6 r7 r � s r c C s� d}t j�|| �}t j�|�s"d S z<t|d�� }|�t|�� W d � n1 sR0 Y W n" ty� tj � d| |� Y n0 d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r+ r, r< r� r/ ro r_ ri r rv rL )Zkmod_param_nameZ param_valueZ params_rootZ param_pathr4 r6 r6 r7 r� s 0 r� c s� t � }t�| |tj�}zt�||� W n ty< |}Y n0 tj r^t j � tj �s^t � tj � t� }t|�� t� fdd�|�� D ��}t|fi |�� t� d S )Nc 3 s" | ]\}}|� v r||fV qd S r@ r6 )r� �k�v�Zavailable_kmod_paramsr6 r7 r' r� z"load_kcare_kmod.<locals>.<genexpr>)rw r r� r r �shutil�copyri r r� r+ r, r� r� r� r� �dictr| r~ � update_depmod)r� r� r� Z kcare_fileZ kmod_paramsr6 r� r7 �load_kcare_kmod s r� c C sX dg}| d ur |� d| g� tj|ddd�\}}}|rTtjd�d�|�||�dd� d S ) Nz /sbin/depmodz-aTr� z%Running of `{0}` failed with {1}: {2}� Fr )�extendr r� r r� r� r< )�unamer} r� ri �stderrr6 r6 r7 r� & s �r� c C s8 t jd| gdd�\}}}|dkr4td�| |�dd��d S )Nz /sbin/rmmodTrc r z Unable to unload {0} kmod {1}zkmod unload errorr- )r r� r r� )�modnamer� ri r6 r6 r7 � unload_kmod2 s r� c C sP g }dg| D ]<}t �| |d�|��}tj�|�rt|� |�d�|�� q|S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r+ r, r� r~ rO )r� r� r� Zloaded�mod�modpathr6 r6 r7 � apply_fixups8 s r� c C s> | D ]4}z t |� W q ty6 tj�d| � Y q0 qd S )Nz$Exception while unloading module %s.)r� ri r rv rw )r; r� r6 r6 r7 � remove_fixupsB s r� c C s� | r | }n6t jrt j}n(t� �|�r2d| t jdfS d| t jdfS dddddd�}|�� }||v rj|| }ntd�|| t jd�d d ��|| t jdfS ) NZfreeze_conflictTr, FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})z freezer style detection errorr- )r Z PATCH_METHODr8 � intersection�upperr r� )�freezerr� r Zpatch_method_mapr6 r6 r7 �get_freezer_styleJ s* � �r� rG c s� | ||d�� t d� � t�� }t�� }t|� t||�}t�| |tj�}t | |� d� |tj t � � t�|��} d|v } | o�t�| |�} |d u} | o�t|�o�t�| �} � �|| d�� | r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d � � td� d } | �s<t d � � t| |� |�rHt� t d � � t|| || |� t� t� d� |t� � �� t � � t d� � t � fdd�tj!d� d S )N)r� Zfuturer �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�loadrC z5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S r@ )r� r6 r� r6 r7 �<lambda>� r� z kcare_load.<locals>.<lambda>)ru )"r� r r� r� rv r� r� r rA r� r� r1 r r� Z parse_unameZis_kmod_version_changedr^ Z kcare_update_effective_versionrP r� �kpatch_ctl_unpatchr� r� r� r� �kpatch_ctl_patchrj r r r� r Ztouch_status_gap_filer{ r� )r� r� r r� � use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ same_patchr; r6 r� r7 � kcare_loadl sT � r� c C s� t jg}t�||tj�}tj�|�r2|� d|g� |� dd|g� |� d|d g� |� | � t j |dd�\}}}|dkr�t |||| ��d S )Nz-brC z-d�-mr Trc )r rZ r r� r rC r+ r, r� r� rO r r� r� ) r� r� r� r� r� r� Zblacklist_filer� ri r6 r6 r7 r� � s r� c C s^ t jtjdd| d gddd�\}}}|dkrZtjd�||�dd� td �|t| ��d d ��d S ) Nr� r� r Tr� �4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}Fr �Error unpatching [{0}] {1}� unpatch errorr- ) r r� r rZ r r� r� r r_ )r� r� r� r� r6 r6 r7 r� � s � r� c C s8 | |d< t t�� �|d< t�tj�tjd�t |�� d S )N�actionrA z kcare.state) r~ rt r r� r+ r, r< r r} r_ )r� r� r6 r6 r7 r� � s r� c C sl d}t j�|�sd S t �|�D ]H}t j�||dd�}t j�|�sBq t �|�}|| kr t �|� t|� q d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r+ r, �isdir�listdirr< �islink�readlink�unlinkr� )� kmod_linkZ modules_path�entryZ sym_link_pathZ target_pathr6 r6 r7 �update_weak_modules� s r� c C sb t �� }t� }z|�|� W n: tyV } z"|sBtd�|�dd��W Y d }~n d }~0 0 t �� }t| |�}t � �� d|v �r|d u}|r�t t � � ||�}t j tjdd|d gddd �\} } } t|� | dkr�tjd �| | �d d � td �| t|��dd��tjt�t�dtd�t�d� t� } tj � | ��r6t� | � t | � W d � n1 �sT0 Y d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval errorr- r r� r� r Tr� r� Fr r� r� r )�count�delay) r r� r% r< ri r r� r� r� r� r� r� r r� r rZ r� r r� r_ r Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rw r+ r, r- r� r� ) r� �forcer� �pf�errr� r� Z need_unpatchr; r� r� r� r� r6 r6 r7 � kcare_unload� sB �� � � r� c C s8 t � }| rt|�S |jdkr"|jS |jd ur4t�� S d S r� )r� �_kcare_info_jsonr� r� r� r r\ rY r6 r6 r7 rG s rG c C sR d| j i}| jd ur>|�t�t�� �� |�t�|�d��� | j |d< t � |�S )Nr� zkpatch-descriptionz kpatch-state) r� r� rP r r� r r\ Zparse_patch_descriptionr� rI rd re )r� r3 r6 r6 r7 r� s r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r= r r rm r� c C s" || _ || _|| _|| _|| _d S r@ )r� r� � remote_lvlr� rI )r� r� r� r� r� rI r6 r6 r7 r� $ s z PLI.__init__N)rH r� r� r r> �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r6 r6 r6 r7 r= s r= c C s� t �� } z�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nj ty� tj }t j r�d � t j t �� d t�� �}n d � t �� d t�� t �� �}t||d d d �}Y n0 |S ) Nr� r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingsr� Z unavailable)r r� r� ra r= r> r r� r� r� r � STICKY_PATCHr� r r\ r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r� rI r� r6 r6 r7 r� , sF � � � � ���r� c C s� d}zZt �� }td|fd| fg�}t�� d�|� }t�|�}t� t� |� � ��}t |d �W S t y� } zt�||� W Y d}~dS d}~0 ty� } zt�||� W Y d}~dS d}~0 t� y� } z t�d�|�� W Y d}~d S d}~0 0 dS ) z� Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise N� server_id�tagz/tag_server.plain?{0}r� ������zInternal Error {0}���)r � get_serveridr" r r� r� r r� r r� rf r r~ r r r� r ri r� ) r� rj r� Zqueryr� r� r� ZueZeer6 r6 r7 � tag_server^ s" r� c C s� t �d�} t�d�| �� t}t�� ��}z:t� | |j �}t � t � | �|j � t�|j |� |j }W n4 ty� } z t�d�|�� W Y d }~n d }~0 0 tjd|t�� gdd�\}}}|r�td�||�dd ��W d � n1 s�0 Y d S ) Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)r� z Script failed with '{0}' {1}zdoctor script failedr- )r rh r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler Zfetch_signaturer# Z save_to_filer r� Zcheck_gpg_signatureri r� r r� r Zget_patch_serverr )Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturer� r� ri r� r6 r6 r7 �kcdoctory s & r� c C sB t �d�t��} zt�| � W n ty2 Y dS 0 t�d� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r rh r� �EFFECTIVE_LATESTr r� r r r )rj r6 r6 r7 �check_new_kc_version� s �r� c C s t �� }t|�}|tjkp*|tjko*|du }zt| |�}W n� tjy� } z4|du rV� t � t |�� t � d� tj }W Y d}~nFd}~0 t y� } z&|r�� nt j�d�|�� W Y d}~n d}~0 0 |tjkr�|} n@|} |du �r|tj kr�t �|d�} n|tjk�r|} ntd��| S )a� Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string Nz#Using previously downloaded patcheszUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r rN ZPOLICY_LOCAL_FIRSTr r r r r r_ Z POLICY_LOCALri rv rh r� r� r ) r� rK r r� Z cached_levelZconsider_remote_exZ remote_levelr� r r� r6 r6 r7 r� � s2 ( r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdv rnt�� rnt jpXt }t dd d � |�f� t � d � | �� ntd � | �d d��d S )N�edfr, rG Zprober� �r1 r� )zfs.enforce_symlinksifownerzfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailabler- )r r1 r r r � update_configr Z is_cpanelZ FORCE_GID� CPANEL_GIDrr r� r r r )r= �gidr6 r6 r7 �update_patch_type� s �r� Zkernelc C s� t tj� |tjkrt� ztd||d�}W n^ ty� } zF|tjtj fv rttj rtt |�}t j �|� W Y d}~dS � W Y d}~n d}~0 0 t�� }t|�}|�� t||d�s�t �d� dS z(tjtjddd� tjtjdd d� W n t�y t j �d � Y n0 t�� }|tjk�s$tj�rnt � �2 |� |� t |||| |tj kd � W d � n1 �sd0 Y t� |� t ||� dS ) ax :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode rP )r� rK r N)r_ r` z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_n�patternz kmsg*.logz#Error during crash reporter cleanup)r� )!r� r r1 r rN r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� r_ r rv rh r r� r% r5 ra r r r� r� ri rw r� r� r� r< r� Zdump_kernel_patch_levelr� ) r� r rK r� r� r� r� r� r� r6 r6 r7 � do_update� s: 8 r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr@tddd��tjrLtjS | t j krptjp`tj}tjpltj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settingsr- zrelease-) rF �boolr r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r r� r� Zpatchsetr6 r6 r7 � get_sticky s, ��� r� c C s | d | S )Nr9 r6 )r� r� r6 r6 r7 � _stickyfy4 s r� c C s" t |�}|s| S |dkr"t|| �S t�� }|sDtj�d� t�d� z t � t � � d� |� �}W n< ty� } z$t�||j� t�d� W Y d}~n d}~0 0 t�t�|�� ��}t|d �}|dkr�t|d | �S |d kr�| S |d k�r tj�d � t�d � tj�d|d � t�d� dS )z� Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. �KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rm zEServer ID is not recognized. Please check if the server is registeredr: zError: r� r� )r� r� r r� r rv r� rO r? r r� r r� r� r r� rj r r� rf r r~ )�filer �sr� r� r� r� r� r6 r6 r7 r 8 s2 r c C s� g }| s dS | � d�}|d }|dd� }|�d�}||krLtdt| � ��|s`| �� |�� kS |dkrt|�d� n>|�d �s�|�d �r�|�t�|�� n|�t�|�� d d �� |D ]}|�t�|�� q�t� d d � |� d tj �} | � |�S )zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr9 r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r; r� r� �repr�lowerrO r� �re�escape�replace�compiler< � IGNORECASErt ) Zdn�hostnameZ max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr6 r6 r7 �_dnsname_matchd s( r� c C s g }t | �� �D ]2}| �|�}|�� dkrdd� t|��d�D �}q| sPtd��g }|D ]*\}}|dkrXt||�rx d S |�|� qX|s�| � � j }t||�r�d S |�|� t |�dkr�t d� |d �tt|�����n*t |�dkr�t d � ||d ���nt d ��d S ) NZsubjectAltNamec S s g | ]}|� � �d d��qS )r� r )r� r; )r� �itr6 r6 r7 r� � r� z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}r� z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ get_extensionZget_short_namer_ r; r� r� rO Z get_subjectZ commonNamer r� r� r< �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� r` Zcnr6 r6 r7 r� � s2 � r� c C s8 t ddd�} | jdddd� | jdd d dd� | jd d dd� | jd dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCddDdE� | jdFdGdd� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdd� | jdPdQdd� | jdRdSdd� | jdTdUdd� | jdVdWdd� | jdXdYdZtd d[d\� | jd]d^dd� | jd_d`dd� | �� }|jdadbdZd� |jdcdddd� |jdedfdd� | jdgdhdZd d[di� | jdjdkdldd[dm� | jdndodp� | jdqdrdd� | jdsdtdudvdw� tj�s�| jdxdydzd{d[d|� | jd}d~dzd{dd|� | jd�d�dd� | jd�d�d�dd� | jd�ddd� | jd�d�d�dd� | jd�d�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | �� }t�� tj�s t j d�g7 _ |j d u�r@t t d |j � d�����tj ��r<d�S d�S |j�sP|j�rltj�rbtjt_ntjt_n|j�r|tjt_|j�s�t�� d�k�r�td�t j d�� d�S t j }|j�r�t j }n|j�r�t j!}t"�#|� tj$�s�t�%� |j&�r�t'�(� |j)�r4|j)d�k�r"t*|j)�t_+tj,tj+d�� nd t_+tj,dd�� |j-d u�rVtj,|j-d�� |j-t_.|j/�rdd[t_0|j1�rrd[t_2|j3�r�dt_4|j5�r�t5� |j6�r�t7�8d�t9� n8|j:�r�tj;d�k�r�tj<d�k�r�dntj<�p�d�|_=d|_>|j?�r�|j?t_@|jA�rt7�8d�t9� d�t_@tj@�Bd��t_@tj@�rDtj@tCv�rDt"jD�Ed��Ftj@d��GtC��� |jH�r^dt_Id�|jH t_J|j=�rptK|j=� tj;d�k�r�tL� t_;t7�8d��Ftj;�p�d��t9� |jM�r�t'�NtOjM|jPd��� d S |jQ�r�tQjQd�ddd��}t'�NtP�R|�� d S tStj;� |jT�rtU� d S |jV�r�tW�XtQjQd�ddd���}d��F|jY�}|jZ�rDt'�N|� nRtW�[|�}|�rft"�\d��F|�� nt"j]d�dd�� |j^�r�t'�N|� n|�r�|�_� |j`�r�|jP�r�t`d�d�� nt`� d S |ja�r�tj,d�d�� d S |jb�r�tj,d�d�� d S |jc�rt�d|jc� d S |je�rtf|je�S |jg�r&th�g� |ji�rVtj;d�k�rFtj,d�d�� th�i|ji|jj�S |jk�rtth�k� d�k�rpd�S d�S |jld u�r�tm|jl�S |jn�r�t'�Ntjo� tp|dzd �d u�r�tq�r|js� d�S tj� s�|jt�r�tq�u� S |jv�r�tq�w� d u�r�t"�\d�� |jx� rtqjwtjyd�� n|jz� r*tq�{� t"�\d�� |j|� r@t'�Ntq�}� � |j~� rVt'�Ntq�� � |j�� rztq��� � rzt'�Ntq��|j��� |j�d u� r�|j�dk� r�tj�� p�t�tqj���� �}nd�d�� |j�� d��D �}tqjwt�|�d��d u� r�t"�\d�� |j�� r�tqjwtjyd d�� |j�� rt'�Nt�|jPd��� d} |j�� r.t7�8d�t9� d�} |j�� r<|j�} |j�� rVt�| tj�tj�d |j>� rvt�| tj�d�� t"�\dá |j� r�t'�Nt���� � |j�� r�t�| |j�dč t"�\dš |j� r�d[t_�t���t���d�dơ� t�| tjyd�� |j�� r�t�|jPd�� |j�� r�t�� S |j�� rt�|jPd�� |j�� r t�� t�t j��d�k� r4t�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrG Z store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z --app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz --auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z --nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz --registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z --nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--kernel-anomaly-reportzHSubmits a kernel anomaly report to CloudLinux for analysis and bug-fixesz --no-sendzSkip sending artifacts� save_only)r� r� �destz --keep-localz:Don't delete generated kernel anomaly report after sendingz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz --plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z --server-infoz3Provides information about the host in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� rZ r, �requiredz--check-compatibilityzCheck compatibility.z --clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz --edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r, r rb z--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionrO z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� r� r� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez --lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz --lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledr� r r zPlease run as root)r� )r )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r, zMFlag --test has been deprecated and will be not available in future releases.r$ �/z(Prefix `{0}` is not in expected one {1}.r� zfile:z+edf patches are deprecated. Fallback to {0})rQ r )r� r r z)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}r r rd )r� ZYES)r� ZNOr� r� r� z Userspace patches are applied.r/ z Userspace patches are unloaded.c S s g | ]}|� � �� �qS r6 )r� r� )r� Zptchr6 r6 r7 r� r� zmain.<locals>.<listcomp>)�limit)r r zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r rK zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentr~ Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_argsr Z set_settings_from_config_file�FLAGSZ has_flagsr* �filterr; �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr� r+ �getuid�printrO r� �logging�INFOZWARNING�DEBUGr Zinitialize_loggingZIGNORE_FEATURE_FLAGSZ set_feature_flags_from_cacher� r Zclear_all_cacheZset_patch_levelr_ r r� Zset_sticky_patchr� Z nosignaturer" Z no_check_certr� r� r� r Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr1 ZPREV_PATCH_TYPEZset_patch_typerP r� r� r$ r� �EXPECTED_PREFIXrv rh r� r< Zlocalrc Z PATCH_SERVERr� r� Zapp_infor� r rd r re rF Zdoctorr� Zkernel_anomaly_reportr r Z archive_pathr� r r r Z keep_localr r� Zenable_auto_updateZdisable_auto_updateZ set_configZupdate_config_from_argsZset_monitoring_keyr� Z unregisterr �registerZregister_autoretryr� r� r� r� r] r^ r Zset_libcare_statusr Zuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updateZlib_auto_updater� Z lib_unloadZlibcare_unloadZlib_inforH Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater �listZ USERSPACE_MAP�keys�sortedZuserspace_auto_updater� rG Znofreezer� Z smart_updater� r� Z UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSrt ru �randomZuniformrR r� r� Zlatest_patch_inforU Zcheckr@ r �argvrJ ) ZparserZexclusive_groupr� r� r� r Zlocal_path_messager r r� r6 r6 r7 �main� s| �������������� � � ����� � r )N)N)F)F)N)rG F)rG F)r )�Z __future__r rg rd r r+ r� r r� r� r� ZsslrO r� rt rN r Zargparser � contextlibr r rG r r r r r r r r r r r r r r r r r r r r r r r Zpy23r r r r! r" r� r� r r. r� r re r� r� �DOTALLr6 rs r, r� �insert�filterwarningsr �Any�Dict�Optional�Set�Tuple�Unionrv ZsetLevelr r8 r? rF rb rk r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r^ Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z StrictVersion� __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r r� r r r$ r% r@ rJ rU rD rW rR r^ ra rj rr rv rw ry r{ r~ r r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� Zlog_all_parent_processesr� rG r� r= r� r� r� r� rN r� r� Ztrack_update_statusr� r� r� r r� r� r r6 r6 r6 r7 �<module> s X & 4 -! b + " ? - 2 .6 , 3)