/
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
__pycache__
/
Upload File
HOME
a ZS�i�J � @ s� d dl Z d dlZd dlZd dlZd dlZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZ ddlmZmZmZ dZdZ dZ dZ d Z d d d d �Z g d �Z!d d� Z"g d �e"� d�Z#dd� Z$dd� Z%G dd� de&�Z'dd� Z(dHdd�Z)dd� Z*d d � Z+d d � Z,dId!d"�Z-d#d$� Z.e%d%d&� �Z/e%d'd(� �Z0e%d)d*� �Z1d+d,� Z2d-d.� Z3d/d0� Z4d1d2� Z5d3d4� Z6d5d6� Z7e%e(ej8d7d8� ���Z9ej8e�:d9�ej;e%e(e j<dfd:d;������Z=e%d<d=� �Z>d>d?� Z?d@dA� Z@dJdBdC�ZAdDdE� ZBdFdG� ZCdS )K� N� )�auth� capabilities�config�config_handlers� constants�errors�fetch� log_utils�platform_utils� process_utils�selinux� server_info� update_utils�utils)� HTTPError�json_loads_nstr�urlquotez!/usr/libexec/kcare/libcare-client)z/run/libcare/libcare.sockz/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotate�db)ZmysqldZmariadbdZpostgres)�libcZlibsslZnscdZlibmc C sr z t �� dd� \} }| �� } W n ty: tt� Y S 0 |�d�rNtt�S d| v rh|�d�rhtt�S tdg S )a Return libs list, excluding libnss_dns on distros with cross-library patches (libnss_dns + libresolv) already deployed: - EL7 (all distros): glibc-rh1296031.patch (CVE-2015-7547) - Ubuntu 16.04: revert-CVE-2015-5180.diff See LIBCARE-2943 for details. N� �7Zubuntuz16.Z libnss_dns)r � get_distro�lower� Exception�list� _LIBS_BASE� startswith)�name�version� r �-/usr/libexec/kcare/python/kcarectl/libcare.py�_get_userspace_lib_list- s r" )r �libsc G s t jjtjd| g|�R � S )N� userspace)�os�path�joinr � PATCH_CACHE)�libname�partsr r r! �get_userspace_cache_pathF s r+ c s � fdd�}|S )Nc s� z�� | i |��W z t d� W S tyT } z tjd�|�dd� W Y d }~S d }~0 0 S z t d� W q� ty� } z tjd�|�dd� W Y d }~q�d }~0 0 nHz t d� W n8 ty� } z tjd�|�dd� W Y d }~n d }~0 0 0 d S )N� clearcachez$Libcare cache clearing failed: '{0}'F�� print_msg)�libcare_clientr r �logerror�format)�args�kwargs�err��clblr r! �wrapperK s *� ,� z$clear_libcare_cache.<locals>.wrapperr �r6 r7 r r5 r! �clear_libcare_cacheJ s r9 c s0 e Zd Zd� fdd� Zd dd�Zdd� Z� ZS ) �UserspacePatchLevelNc s t | | ��| |�S �N)�super�__new__)�clsr) �buildid�level�baseurl�� __class__r r! r= Y s zUserspacePatchLevel.__new__c C s || _ || _|| _|| _d S r; )r@ r) r? rA )�selfr) r? r@ rA r r r! �__init__\ s z UserspacePatchLevel.__init__c G s t | j| jt| �g|�R � S r; )r+ r) r? �str)rD r* r r r! � cache_pathb s z UserspacePatchLevel.cache_path)N)N)�__name__� __module__� __qualname__r= rE rG � __classcell__r r rB r! r: X s r: c s dd� �� �fdd�}|S )Nc S s� d\}}z�| du rt � } i }g }t| �D ],}|�dd�||�d�< |�|�dg �� q(tj|dd�}d �d d � |�� D ��}d �t|��}W tj t |d d � tj t |d d � n"tj t |d d � tj t |d d � 0 dS )z(KPT-1543 Save info about applied patches)� rL N�latest-versionrL �package�patches�cve)� cve_field� c S s g | ]}d � |��qS )� �r' )�.0�recr r r! � <listcomp>s � zLrefresh_applied_patches_list.<locals>.save_current_state.<locals>.<listcomp>T)� ensure_dir) � _libcare_info�_get_patches_info�get�extendr �extract_unique_cvesr' �items�sorted� atomic_write�LIBCARE_PATCHES�LIBCARE_CVE_LIST)�infoZversionsZcvesZpackagesZ all_patchesrV Zcves_setr r r! �save_current_stateg s �z8refresh_applied_patches_list.<locals>.save_current_statec s0 d }z � | i |��}|W �|� S �|� 0 d S r; r )r2 r3 rd �r6 re r r! r7 y s �z-refresh_applied_patches_list.<locals>.wrapperr r8 r rf r! � refresh_applied_patches_listf s rg c C sD t jpd}t| �} t|�� �}t�t�| d�|| |d�}|dt� d|� 7 }t�| d�}zt � t j �|dd�}W n* tjy� tjt||�d d � � Y n0 t�|j� tt�|�� ��}|�d g �}t�|�s�t�d � | ���t |||d |�d��} t |d �} t||| d�} t j �!| ��r2t j �"| �dk�r�t�|d �}z t j#|| t j$t �%| �d� W n> t&�y� } z$| j'dv �r�t�(d��� W Y d } ~ n d } ~ 0 0 t||| �} dd| d| dg}t)j*|d d d�\}}}|�r�tj+d� |||�dd ��t||d �}t j �,|��s t j �-|��r t�|� t �.| |d � t �/|d |� d S ) N�main�uz latest.v1z?info=�updater# F)� check_licenseT)� ignore_errorsr zkLatest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.r@ rA z patch.tar.gzr Z patch_url)�check_signature� hash_checker)i� i� zKC+ licence is required�tarZxfz-Cz--no-same-owner�� catch_stdout� catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}zpatches unpacking error��status�latestz.tmp)0r �PREFIXr �stripr �get_patch_server_url� LIBNAME_MAPr\ r Zencoded_server_lib_infor �wrap_with_cache_keyr � urlopen_authr �NotFound�shutil�rmtreer+ r � set_feature_flags_from_headers�headersr �nstr�readr �has_lc_capabilities�CapabilitiesMismatchr1 r: rF r% r& �exists�getsize� fetch_url� USE_SIGNATURE�get_hash_checkerr �code�NoLibcareLicenseExceptionr � run_command� KcareError�islink�isdir�symlink�rename)r) �build_id� patch_level�prefix�url� cache_dst�response�meta�required_capabilitiesr@ �plevelZ patch_path�ex�dst�cmdr� �stdout�stderrZ link_namer r r! �fetch_userspace_patch� sV �� � r� c C sL | t _| st� tj| r dndd� | r0t� tj�d| r@dnd � d S )N�FALSE�YES)�LIBCARE_DISABLEDzlibcare service is �enabled�disabled) r r� �libcare_server_stopr � update_config�libcare_server_startr �kcarelogrd )r� r r r! �set_libcare_status� s r� c C s: zt �dd�ddg} W n ty* Y d S 0 t �| � d S )N�service�z /usr/sbin/z/sbin/�libcare�stop�r �find_cmdr r� �r� r r r! r� � s r� c C st t jstj�t j�r:t�t jddg� t�t jddg� n6zt�dd�ddg} W n t yd Y d S 0 t�| � d S )Nz reset-failedr� Zrestartzlibcare.socketr� r� �start) r �SKIP_SYSTEMCTL_CHECKr% r& r� � SYSTEMCTLr r� r� r r� r r r! r� � s r� Tc s� d� dd� t|pg �D ��}ddg}� s6|dd|g7 }z t|� }W n8 tyz } z tjd�|�d d ��W Y d }~n d }~0 0 g }|�d �D ]0}|r�z|�t � |�� W q� t y� Y q�0 q�d d � |D �}|D ]&}t � fdd�|d � � D ��|d< q�|S )N�|c s s | ]}d � |�V qdS )z({0})N)r1 )rU �procr r r! � <genexpr>� rX z _libcare_info.<locals>.<genexpr>rd z-jz-lz-rz/Gathering userspace libraries info error: '{0}'zuserspace libs info errorrs rR c S s$ g | ] }|� d �|� d�|d��qS )�comm�pid)r� r� r# )�pop)rU �liner r r! rW � rX z!_libcare_info.<locals>.<listcomp>c 3 s& | ] \}}d |v s� s||fV qdS )�patchlvlNr )rU �k�v��patchedr r! r� � rX r# )r' r` r/ r r r� r1 �split�append�json�loads� ValueError�dictr_ )r� �limitZregexpr� �linesr4 �resultr� r r� r! rZ � s& * $rZ c C s� t � }| D ]0}|d �� D ] \}}|�|d |d f� qq g }tD ]j}|D ]`\}}t||t|�d�} tj�| �rLt | d�� } |� t � | �� W d � qL1 s�0 Y qLqD|S )Nr# r? r� z info.json�r) �setr_ �add� USERSPACE_MAPr+ rF r% r& �isfile�openr� r� �load) rd rO rV �_�datar� r� r� r� Zpatch_info_filename�fdr r r! r[ � s 2r[ c C s t t� �S r; )r[ rZ r r r r! �libcare_patch_info_basic s r� c C s" t � } | st�d� t�d| i�S �NzNo patched processes.r� )r� r r0 r� �dumps�r� r r r! �libcare_patch_info s r� c C s" t � } | st�d� t�d| i�S r� )rZ r r0 r� r� r� r r r! � libcare_info s r� c C s* i } t � D ]}|�dd�| |�d�< q | S )NrM rL rN )r� r\ )r� rV r r r! �_libcare_version s r� c C s* t � �� D ]\}}| �|�r | S q dS )NrL )r� r_ r )r) rN r r r r! �libcare_version# s r� c C s d� dd� | D ��d S )NrX c s s | ]}t �|�d V qdS )� N)r �bstr)rU �pr r r! r� + rX z(libcare_client_format.<locals>.<genexpr>r� rT )�paramsr r r! �libcare_client_format* s r� c C s, t D ]} tj�| �r| S qt�d��d S )Nz Libcare socket is not found.)�LIBCARE_SOCKETr% r& r� r r� )Zlibcare_socketr r r! � get_available_libcare_socket. s r� c G s� t jrt�d��t�tjtjd�}|�d� d}z�|�t � � |�t j � t | �}t � dj| d�� |�|� |�d�}|s~q�||7 }qn|�dd �}t � d j|d �� |W |�� S |�� 0 d S ) NzLibcare is disabled.r � rX zLibcare socket send: {cmd}r� i zutf-8�replacez!Libcare socket recieved: {result}r� )r r� r r� �socket�AF_UNIX� SOCK_STREAM� settimeout�connectr� �LIBCARE_SOCKET_TIMEOUTr� r �logdebugr1 �sendall�recv�decode�close)r� �sock�resr� r� r� r r r! r/ 5 s* �r/ c C s� | D ]�}zt dt|�� W n8 tyR } z tjd�|�dd��W Y d }~n d }~0 0 z t d� W q ty� } z tjd�|�dd��W Y d }~qd }~0 0 qd S )NZstoragez(Userspace storage switching error: '{0}'z userspace storage switch errorrs rj z%Userspace patch applying error: '{0}'zuserspace patch apply error)r/ r+ r r r� r1 )r� r� r4 r r r! �libcare_patch_applyM s * r� c C sJ z t d� W n8 tyD } z tjd�| �dd��W Y d } ~ n d } ~ 0 0 d S )N�unloadz&Userspace patch unloading error: '{0}'z userspace patch unload errorrs )r/ r r r� r1 )r4 r r r! �libcare_unloadZ s r� r� c C s� t � | tjkrtjsdS |du r.tt�� �}g }|D ]}|�t� |g �� q6|sft � d� |�� dS t |d�\}}}}|r�t�d��|s�t � d� dS t�tj�tjd�� t � z t|� W n> tjy� } z$t �t|�� t�d��W Y d}~n d}~0 0 t� } t| �} ttdd � | D ����s*dS t � d j |d �� t � d j | d �� t dd � | � � D ��} t dd � |� � D ��} | | } t dd � | � � D ��}t � dj t | �|d�� | �!� D ] \}}t � d� |t |��� �q�| S )z0Patch userspace processes to the latest version.Nz No such userspace patches: {0}�r� z8There were errors while patches downloading (unpacking).zNo patches were found.r$ z)There were errors while patches applying.c s s | ]}|d V qdS )r# Nr )rU �itemr r r! r� � rX z&do_userspace_update.<locals>.<genexpr>zPatched before: {before})�beforezPatched after: {after})�afterc s s | ]}|D ] }|V q qd S r; r �rU r_ r� r r r! r� � rX c s s | ]}|D ] }|V q qd S r; r r� r r r! r� � rX c s s | ]}t |�V qd S r; )�len)rU r� r r r! r� � rX z�The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)�count�overallz*Object `{0}` is patched for {1} processes.)"�rotate_libcare_logsr �UPDATE_MODE_AUTOr �LIB_AUTO_UPDATEr r� �keysr] r\ r �loginfor1 �check_userspace_updatesr r� r �restore_selinux_contextr% r& r' r( r� r0 rF rZ �_get_userspace_procs�anyr� r� �values�sumr� r_ )�moder� Zprocess_filterZuserspace_patch�failed�something_foundr� r� r� Z data_afterr� Zuniq_procs_afterZuniq_procs_before�diffr� r� r� r r r! �do_userspace_updatee sT ��r c C sj z<zt � \} }}}W n tjy2 Y W t� dS 0 W t� nt� 0 | rNdS |rVdS tjdd�rfdS dS )N� r �.libcarestatus��filenamer r )r r r� r� r �status_gap_passed)r r� �libs_not_patchedr r r! �get_userspace_update_status� s �r c C s\ i }| D ]N}|d � � D ]<\}}|�d�r||vr:g ||< || �|d |d f� qq|S )Nr# r� r� r� )r_ r\ r� �rd r� r� r) rV r r r! r � s r c C sF t � }| D ]6}|d �� D ]$\}}|�||d |�dd�f� qq |S )Nr# r? r� r )r� r_ r� r\ r r r r! �_get_userspace_libs� s r c s, � s g � � fdd�t �� D � td� d�}t|�}d }}d}t|�D ]�}|\}}} z t||| � d}| dkrrd}W qF tjy� } z d}t� t | �� W Y d } ~ qFd } ~ 0 tj tj fy� Y qF tj y� � Y qF tj�y } z d}t�t | �� W Y d } ~ qFd } ~ 0 0 qFtjdd� ||||fS ) Nc s g | ]}� � |��qS r )r] )rU r# r� r r! rW � rX z+check_userspace_updates.<locals>.<listcomp>F)r� r� Tr r r )r� r rZ r r r� r r� r �logwarnrF r| r� �AlreadyTrialedExceptionr� r0 r �touch_status_gap_file) r� Z data_beforer� r r r rV r) r� r� �er� r r� r! r � s4 "& r c s^ d} d}t jddd�}|r�z t j|tgdd�\} }}W n0 tyf } zd} t|�}W Y d }~n d }~0 0 | r�tjd �|�dd � ntj d dd � d � t j � � �s�d S t jd }z�t �� �}t�d��� �fdd�|D �}dd� |D �}|jdd� d} |D ]8\}} | t j �| �7 } | |kr�t �| � tj�d| � q�W n" t�yX tjddd � Y n0 d S )Nr rL Z logrotateF)� raise_excT)rr r z5failed to run logrotate for libcare logs, stderr: {0}r- z logrotate utility wasn't foundz/var/log/libcare/i z ^\d+\.log.*c s$ g | ] }�� |�rtj�� |��qS r )�matchr% r& r' )rU �fn�Zlibcare_log_directoryZ pidlog_rer r! rW rX z'rotate_libcare_logs.<locals>.<listcomp>c S s g | ]}t j�|�|f�qS r )r% r& �getctime)rU �fpr r r! rW rX )�reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfiles)r r� r� �LIBCARE_LOGROTATE_CONFIGr rF r r0 r1 r r% r& r� r �!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MB�listdir�re�compile�sortr� �remover� rd �logexc) �rcr� Zlogrotate_pathr� r Zmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_size�filepathr r r! r� � s< r� c C sJ zt �dd�ddg} W n ty* Y dS 0 t j| ddd�\}}}|dkS ) zKAssume that whenever the service is not running, we did not patch anything.r� r� r� rt FTrp r r� )r� r� r� r r r! �libcare_server_started! s r+ )N)TN)N)Dr� r% r$ r} r� rL r r r r r r r r r r r r r r �py23r r r �Dict�List�TupleZLIBCARE_CLIENTr� rb rc r! ry r r" r� r+ r9 �intr: rg r� r� r� r� rZ r[ r� r� r� r� r� r� r� r/ r� �log_all_parent_processesr� �track_update_status�skip_if_no_selinux_module�UPDATE_MODE_MANUALr r r r r r� r+ r r r r! �<module> sp @ � 5 F "*