Warning: session_start(): Session cannot be started after headers have already been sent in /home/tvrreohg/public_html/manga.php on line 13
3
;j*:
@ s d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ ddl m,Z,m-Z-m.Z. dd l/m0Z0m1Z1m2Z2m3Z3m4Z4 d
Z5d Z6dZ7dZ8dZ9dZ:dZ;dZZ?ej=dZ@ejAjBdre jAjCd d ejDdeEd e$jFjGejH dd ZId d ZJd d ZKd!d" ZLd#d$ ZMdd%d&ZNd'd( ZOd)d* ZPd+d, ZQd-d. ZRd/d0 ZSd1d2 ZTG d3d4 d4eUZVG d5d6 d6e,ZWG d7d8 d8e,ZXG d9d: d:e,ZYd;d< ZZed=d> Z[dd?d@Z\dAdB Z]dCdD Z^i Z_dEdF Z`e`e2ja_bece dGds y8d dldZed dlfZgeejhjiegjjeejhjidHk rekdIW n ekk
r Y n8X dJdK Zle2jmZnG dLdM dMeoZpG dNdO dOe2jmZqeqe2_mdPdQ Zre jsfdRdSZtdTdU ZudVdW ZvG dXdY dYeoZwdZd[ Zxd\d] Zydd_d`Zzdadb Z{dcdd Z|ddedfZ}dgdh Z~didj Zdkdl Zdmdn Zdodp Zdqdr Zdsdt Zdudv Zdwdx Zdydz Zd{d| Zd}d~ Zdd Zdd Zdd Zdd ZdddZdd Zdd Zdd Zdd ZdddZdd Zdd Zdd Zdd Ze&jdddZdd Zdd ZG dd dZdd Zdd Zdd Zdd Ze je jsfddZdd Ze&je*jde jfddZdd Zdd Zdd ZdddZdd Zdd ZdS ) )print_functionN)ArgumentParser)contextmanager)datetime )anomalyauth capabilitiesconfigconfig_handlers constantsdoctorerrorsfetch
http_utils ipv6_supportkcarelibcare log_utilsplatform_utils
process_utilsselinux server_infoserverid update_utilsutils)
KcareErrorNotFoundSafeExceptionWrapper) HTTPErrorURLErrorhttplibjson_loads_nstr urlencodec Zv312h24h48htestz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh latest.v3 latest.v2z /etc/sysconfig/kcare/sysctl.conf
z$==BLACKLIST==
(.*)==END BLACKLIST==
z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/pythonignore)categoryc C sD t } tjjtr@ttd}x|D ]}| j|j q"W |j | S )Nr) setospathisfileFREEZER_BLACKLISTopenaddrstripclose)resultfline r; ./usr/libexec/kcare/python/kcarectl/__init__.pyget_freezer_blacklistS s
r= c C sB |j d}| r(dj|d | |d g}ndj|d |d g}|S )N.r r r? )splitjoin)ptypefilenameZ
name_partsr; r; r< _apply_ptype] s
rD c C sJ t | tjt_t | tjt_t | tjt_t | tjt_t | tjt_d S )N)rD r
PATCH_BIN
PATCH_INFOBLACKLIST_FILE FIXUPS_FILE
PATCH_DONE)rB r; r; r< apply_ptypef s
rJ c C s t j \} }}d}t|trbt|t rby d|jtj|j|jf }W q t t
fk
r^ Y qX nPt|t t
t frt|t rd| }n*t|t
r|jpt|j} |jpd|j }tj }tjtj |d |d t| dt| |djtj|dt|ddd S )
N z[Errno %i] %s: '%s'z%sr r __name__d attempts)Z
agent_versionZpython_versiondistroZdistro_versionerrordetails tracebackrN ) sysexc_info
isinstanceOSErrorr errnor0 strerrorrC AttributeError TypeErrorKeyErrorIOErrorr etypetypeinnerrQ r
get_distror VERSIONget_python_versiongetattrstrrA rR Z format_tb)r] valuetbZdetails_sanitizedrO r; r; r< format_exception_without_detailsn s*
rg c C sv t jr
d S tjt } tjtjtj | }tj
dd | }t j |t
j }yt j| W n tk
rp Y nX d S )Nz/api/kcarectl-tracez?trace=)r
UPDATE_FROM_LOCALjsondumpsrg r nstrbase64Zurlsafe_b64encodeZbstrget_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base Exception)ZtraceZ
encoded_traceurlZrequestr; r; r< send_exc s rp c C s t j }|dkr t j|d dS t j t j }|dkrBt jd t jd ttjd&}t j |j
d t j |j
d W dQ R X |rt j | y
| W n* t
k
r tjjd t jd Y nX t jd dS )z
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
r Nar zWait exception)r0 forkwaitpidsetsid_exitr7 r4 r ZLOG_FILEdup2filenotimesleeprn r kcarelog exception)funcrz pidfdr; r; r<
nohup_fork s(
r c C s t jjtjd} t jj| rtt| dH}y,t|j }|t j
t j krRt || W n t
k
rh Y nX W dQ R X tj| tj dS )a Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
z.kcareprev.lockr. N)r0 r1 rA r PATCH_CACHEr2 r4 intreadr
SUCCESS_TIMEOUTry PreviousPatchFailedException
ValueErrorr atomic_write
timestamp_str)Zanchor_filepathZafile timestampr; r; r< touch_anchor s r c C sx yt jt jjtjd W n tk
r. Y nX td| tj j
yt dd W n t k
rr t
jjd Y nX dS )z
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
z.kcareprev.lockdone)reasonzCannot send update info!N)r0 remover1 rA r r rV register_actionr get_loaded_modulesclearget_latest_patch_levelrn r r{ r| )
state_datar; r; r<
commit_update s
r c C s( t jtjjtjdtj| |dd d S )NpatchesrK )Z exclude_path) r clean_directoryr0 r1 rA r r r get_cache_path)khashZplevelr; r; r< clear_cache s r c C s> t jpd}dj|| g}tjd|f}|r2||f7 }tjj| S )Nnone-modules)r
PREFIXrA r r r0 r1 )r fnameprefixZ
module_dirr8 r; r; r< get_current_level_path s
r c C s t jt| dt|dd d S )NlatestT)Z
ensure_dir)r r r rd )r patch_levelr; r; r< save_cache_latest s r c C sV t | d}tjj|rRy"tt|dj j }tj | |S t
t fk
rP Y nX d S )Nr r. ) r r0 r1 r2 r r4 r stripr LegacyKernelPatchLevelr rZ )r Zpath_with_latestplr; r; r< get_cache_latest s
r c @ s e Zd ZdS )CertificateErrorN)rL
__module__ __qualname__r; r; r; r< r s r c s e Zd ZdZ fddZ ZS )UnknownKernelExceptionzunknown kernelc s6 dj tj d tj tj }tt| j |f| d S )NzLNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.r )
formatr r` platformreleaser get_kernel_hashsuperr __init__)selfkwargsmsg) __class__r; r< r s z UnknownKernelException.__init__)rL r r statusr
__classcell__r; r; )r r< r s r c s( e Zd ZdZ fddZdd Z ZS )ApplyPatchErrorzpatch apply errorc sF t t| j|| || _|| _|| _|| _tj d | _ t
j | _ d S )Nr ) r r r code
freezer_stylelevel
patch_filer r` rO r r )r r r r r argsr )r r; r< r s zApplyPatchError.__init__c C s0 dj | j| j| j| j| jdjdd | jD S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})z, c S s g | ] }t |qS r; )rd ).0ir; r; r<
- s z+ApplyPatchError.__str__..)r r r r rO r rA r )r r; r; r< __str__& s zApplyPatchError.__str__)rL r r r r r r r; r; )r r< r s r c s( e Zd ZdZ fddZdd Z ZS )r zprevious patch failedc s" t t| j|| || _|| _d S )N)r r r r anchor)r r r r r )r r; r< r 5 s z%PreviousPatchFailedException.__init__c C s d}|j | j| jS )NzIt seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r r r )r messager; r; r< r : s z$PreviousPatchFailedException.__str__)rL r r r r r r r; r; )r r< r 2 s r c C s t j dj| }yztj|}tjtj|j }t |d }|dkrRtj
d n8|dkrftj
d n$|dkrztj
d ntj
d j| |S t k
r } zt j
|| W Y d d }~X nX d
S ) Nz"/nagios/register_key.plain?key={0}r r zKey successfully registeredr zWrong key format or sizerr z!No KernelCare license for that IPzUnknown error {0}r? )r get_registration_urlr r urlopenr data_as_dictrk r r
print_wrapperr r print_cln_http_error)keyro responseresr er; r; r< !set_monitoring_key_for_ip_licenseC s
r c
c s> t jrtjt jdd z
d V W d t jr8tjt jdd X d S )NT)shell)r
ZBEFORE_UPDATE_COMMANDr run_commandZAFTER_UPDATE_COMMANDr; r; r; r<
execute_hooksW s
r c C s t }|j}|j}tj }| dkrht|tjtj t
j |t t
j |d}tjd tjtj| njtjd tjt| tjdt| tjtj tjtj tjt
j tj| tjt
j dS )a1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
ri )Z
updateCodeZ
autoUpdateZeffectiveKernelZ
realKernelZloadedPatchLevelZuptimelicensez --START--z LICENSE: N)_patch_level_infor applied_lvlr license_inford r
AUTO_UPDATEr kcare_unamer r r r Z
get_uptimer r ri rj )fmtpliZ update_codeZ loaded_plZlicense_info_resultZresultsr; r; r< plugin_infoc s,
r c C s^ t j } ytdd}W n tk
r4 tjr0dS dS X | d krBdS | |krNdS tj rZdS dS )Ninfo)r r r rr )r loaded_patch_levelr r r
IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)
current_levelZlatest_patch_levelr; r; r< get_update_status s r c C s2 t j d d \} }| dkr*|jdr*dS dS d S )Nrr Z
CloudLinuxz7.extrarK )r r`
startswith)rO versionr; r; r< edf_fallback_ptype s r c C sl | j | jf}tj||}tj|| j| _| jjtj tj
d |tkrZ| jj dd t|< | j rh| j
dS )zFunction remembers IP address of host connected to
and uses it for later connections.
Replaces stdlib version of httplib.HTTPConnection.connect
r Nrr )hostZportCONNECTION_STICKY_MAPgetsocketZcreate_connectionZtimeoutsockZ
setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername _tunnel_hostZ_tunnel)r ZaddrZ
resolved_addrr; r; r< sticky_connect s r ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr; )r r; r; r< dummy_verify_callback s r c @ s, e Zd Zdd Zdd Zdd Zdd Zd S )
SSLSockc C s || _ d| _d S )Nr ) _ssl_conn_makefile_refs)r r r; r; r< r s zSSLSock.__init__c G s& | j d7 _ tj| jf|ddiS )Nr r7 T)r r Z _fileobjectr )r r r; r; r< makefile s zSSLSock.makefilec C s" | j r | jr | jj d | _d S )N)r r r7 )r r; r; r< r7 s
z
SSLSock.closec G s | j j| S )N)r sendall)r r r; r; r< r s zSSLSock.sendallN)rL r r r r r7 r r; r; r; r< r s r c @ s e Zd Zdd ZdS )PyOpenSSLHTTPSConnectionc C s t jj| tjjtjj}|jtjjtjj B t
j rJ|j tjj
t n|j tjjt |j tjj|| j}|j | jp| j}|j|j |j t
j rt|j | t|| _d S )N) r! HTTPConnectionconnectOpenSSLZSSLZContextZ
SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r
CHECK_SSL_CERTSZ
set_verifyZ VERIFY_PEERr Z VERIFY_NONEZset_default_verify_pathsZ
Connectionr Zset_connect_stater r Zset_tlsext_host_nameencodeZ do_handshakematch_hostnameZget_peer_certificater )r ZctxZconnZ server_hostr; r; r< r s z PyOpenSSLHTTPSConnection.connectN)rL r r r r; r; r; r< r s r c C s t jr&tj| |}tjtj|ddS |dk}t jo6|}xrd|fd|fdgD ]Z\}}t j |||d} t j
| |d}
|rdj |
}
tj| t ||d |
}d
} |s|rt
|| kr|rd nd } tjd
j | qNyxtjtj|dd}
t jrJtj| rJtj| }tj|}|r.tjdj |dd ntjddd |rJ|j |
S tk
r } z>|sl|r|jdks|jdkrtjdj | wN W Y d d }~X qNX qNW d S )NF)
check_license latest.v1 latest.v2T)secure_boot_info perf_metrics) b64_encodingzinfo={0}?iX zsecure boot infoz perf metricsz/Check-in URL param is too large, discarding {0}z:Automatic kernel anomaly report uploaded successfully: {0}) print_msgz$Failed to send kernel anomaly report i zCCheck-in request failed with error: {0}, retrying with reduced info)r r )FF)r r )r
rh r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr urlopen_authZSEND_PERF_METRICSr Zencode_checkin_payloadr stickyfylenr logwarnZ KERNEL_ANOMALY_REPORT_ENABLEr Zdetect_anomaly prepare_kernel_anomaly_reportsend_data_packageloginforemove_archiver r )r r r modero r Z perf_enabledr r ZsinfoZ
request_paramZmax_url_lengthZ discard_infor8 data_package upload_nameexr; r; r< _fetch_patch_level_request sB
$r
c C s8 t j }tjd k r$t j|ttjS xtD ]}yt||| |}tj |j
t t j
|j j }tjdj| |dd |r|jdrt|}|jdg }tj|stjdt j||d |d |d S t j|t|S tk
r Y q, t k
r( } z |j d
krt d W Y d d }~X q,X q,W t d S )Nz;fetch patch level, reason: {0}, kernel latest response: {1}F)r {r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgrader baseurlr zKC licence is required)r r ) r r r
PATCH_LEVELr r PATCH_LATESTr
r Z set_feature_flags_from_headersheadersupdate_all_kmod_paramsr rk r r r r r r r" r r Zhas_kc_capabilitiesr CapabilitiesMismatchZKernelPatchLevelr r r r r ) r r r r r r Z latest_infoZrequired_capabilitiesr r; r; r< fetch_patch_level; s2
r c C s< | j t|tj}tjjdj| ytj |ddd dS t
k
r^ tjjdj| dS t k
r } z tjj dj|t
| W Y d d }~X nX | j t|tjtj }tjjdj| ytj |dd W nb t
k
r tjjdj| dS tk
r6 } z tjjd j|t
| W Y d d }~X nX dS )
NzProbing patch URL: {0}FHEAD)r methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1})r z{0} is not available: {1})file_urlrD r
rE r r{ r r r r r rn debugrd r ZSIGr )r rB Zbin_urlr ro r; r; r< probe_patch\ s( **r c C sF |t jkr| jt j}n
| j|}| j|}tj||tjtj | dS )N)Z hash_checker)
r KMOD_BINZkmod_urlr
cache_pathr Z fetch_urlr
USE_SIGNATUREZget_hash_checker)r namero Zdstr; r; r< fetch_and_verify_kernel_fileu s
r! c @ s> e Zd ZdddZdd Zdd Zdd Zd
d Zd d
ZdS ) PatchFetcherNc C s
|| _ d S )N)r )r r r; r; r< r s zPatchFetcher.__init__c C s t | j|S )N)r! r )r r r; r; r< _fetch s zPatchFetcher._fetchc C sr | j jtj}| j jtj}| j jtj}| j jtj}tdd ||||fD opt j
j |dkopt j
j |dkS )Nc s s | ]}t jj|V qd S )N)r0 r1 r2 )r r1 r; r; r< s z0PatchFetcher.is_patch_fetched..r ) r r r
rI rE rF r r allr0 r1 getsize)r Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ
kmod_bin_pathr; r; r< is_patch_fetched s z PatchFetcher.is_patch_fetchedc C s4 | j d krtd| j s | j S | j r6tjd | j S tjd t| j tjry tj | j j
t j dd}W n t
k
r~ Y n(X |jjdd }|r| j jtj|| _ y| jt j W n0 t
k
r tdj| j t jpdd d
Y nX | jt j | jtj | j tj| j j t j d d d
t j tj | j S )Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r z KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch leveldefaultzpatch level not found)r wb)r )!r r r' r r rU r r r r r r
rE r r r upgrader rk r# r r
PATCH_TYPErF r r extract_blacklistr r rI r restore_selinux_contextr )r respr r; r; r< fetch_patch s:
zPatchFetcher.fetch_patchc C sJ t | jjtjdj }|rFtj|}|rFtj | jjtj
|j d d S )Nr. r ) r4 r r r
rF r BLACKLIST_REsearchr r rG group)r ZbufZmor; r; r< r- s
z PatchFetcher.extract_blacklistc C s |dkr dS yt |tj}W n tk
r0 dS X |jjdd}|rT|jtj|}|j tj}t
|d }t dd |j D }W dQ R X x|D ]}t || qW t
jtj dS )z
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Nz KC-Base-Urlr. c S s g | ] }|j qS r; )r )r fixupr; r; r< r s z-PatchFetcher.fetch_fixups..)r! r
rH r r r r+ r rk r r4 r/ readlinesr r. r r )r r r/ r Z fixups_fnamer9 fixupsr4 r; r; r< fetch_fixups s
zPatchFetcher.fetch_fixups)N) rL r r r r# r' r0 r- r7 r; r; r; r< r" ~ s
)r" c C s8 t } tj| j | jtjkr*tjd n
tjd d S )Nr r ) r r r r r PLIPATCH_NEED_UPDATErS exit)r r; r; r< kcare_check s
r; c
C s\ t } t| }y tj }W n tk
r2 i }Y nX tj }d}|d k r\tj|d j d}tj
}|j dg }t t
j|dd}t |}dd |D } t t
j| d d}
td
d |D } || } tj }
|
st
jd n
t
jd
t
jdj| t
jdj| |dkr t
jdj| |
dkr:t
jdj|
| dkrNt
jd t
jd d S )NZUnknowntsz%Y-%m-%dr z
kpatch-cve)Z cve_fieldc S s" g | ]}|j d g D ]}|qqS )r )r )r recpatchr; r; r< r s z%show_generic_info..Zcvec s s | ]}t |jd g V qdS )r N)r r )r r= r; r; r< r$ s z$show_generic_info..z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r _kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z
fromtimestampZstrftimer r r r Zextract_unique_cvessumr r r )r
kcare_info libcare_infostateZ
latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countr r; r; r< show_generic_info s>
rD Fc C s yt dtjd}|st|jtj}tjt j
|j }| rg i }}x>|j dD ]0}tj
|}|rxd|krx|j| qR|j| qRW ||d< tj|}tj| W nJ tk
r } ztj||j dS d}~X n tk
r tjd Y nX d S )
z
Retrieve and output to STDOUT latest patch info, so it is easy to get
list of CVEs in use. More info at
https://cloudlinux.atlassian.net/browse/KCARE-952
:return: None
r )r policyz
z kpatch-namer r NzNo patches availabler )r r
POLICY_REMOTEr r r
rF r rk r r r r@ r appendupdateri rj r r r r ro ) is_jsonr ro
patch_infor r8 chunkdatar r; r; r< kcare_latest_patch_info s,
rM c C s d| j i}| jd k rt| }g }x>|jdD ]0}tj|}|rRd|krR|j| q,|j| q,W ||d< tj }|r||d nd|d< |S )Nr z
z kpatch-namer r unknown)
r r _kcare_patch_infor@ r r rG rH r Z read_dumped_kernel_patch_level)r r8 rJ r rK rL Zsaved_patch_levelr; r; r< r? 4 s
r? c C sT t j }t j|| jtj}tjj|s2t dddt
|dj }|rPt j
d|}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not found)r r. rK )r r r r r
rF r0 r1 r2 r r4 r r1 sub)r r r r r; r; r< rO H s rO c C sZ t }| s>|jdkr tj|j |jd kr.d S tjt| ntjtjt |dd d S )Nr T)Z sort_keys)
r r r r r r rO ri rj r? )rI r r; r; r< rJ W s
rJ c C s: t jd| g}tj|}tj }d}tj||tj||kS )Nz file-infozkpatch-build-time)r
KPATCH_CTLr check_outputr _patch_infoZget_patch_value)new_patch_filer Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr; r; r<
is_same_patchc s
rU c C sL |dkr dS | r || k r dS | |kr(dS t jt j |tj}t|sHdS dS )Nr FT)r r r r
rE rU )
applied_level new_levelrT r; r; r< kcare_need_updatek s rX c C sp t jrltjjto tjttjs6tj j
dj t d S t j
dddtgdd\} }}| dkrltj j
dj | d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctlz-qz-pT) catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r
ZUPDATE_SYSCTL_CONFIGr0 r1 r2
SYSCTL_CONFIGaccessR_OKr r{ warningr r r )r _r; r; r<
update_sysctl} s r_ c s t jjtsttdj t jtt js>tj j
dj t dS ttdj}|j }|j
d x,|D ]$ t fdd| D sb|j qbW x|D ]}|j|d qW |j W dQ R X dS ) z*Update SYSCTL_CONFIG accordingly the editsrq zFile {0} has no read accessNzr+r c 3 s | ]} j |V qd S )N)r )r r. )r: r; r< r$ s z#edit_sysctl_conf..
)r0 r1 r2 rZ r4 r7 r[ r\ r r{ r] r r5 seekanywritetruncate)r rG Zsysctllinesrq r; )r: r< edit_sysctl_conf s
rf c C s. x(| D ] }t j|rtdj|ddqW d S )NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel module)r )CONFLICTING_MODULES_REmatchr r )r moduler; r; r< detect_conflicting_modules s
rj c C s dj tj S )Nz /lib/modules/{0}/extra/kcare.ko)r r Zget_system_unamer; r; r; r< get_kcare_kmod_link s rk c
C sX t dd} tjtj | tj}tjj|s.d S t |d}|j
dd dkS Q R X d S )Nr )r rb s ~Module signature appended~
i) r r r r r r r0 r1 r2 r4 r )r Z kmod_fileZvfdr; r; r< kmod_is_signed s
rn c s4 t jd d krd S ddg} t fdd| D S )Nz
/proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ]}| kV qd S )Nr; )r r ) system_keysr; r< r$ s z'kcare_certs_enrolled..)r Z try_to_readrb )Z
kcare_keysr; )ro r< kcare_certs_enrolled s
rp c K sd d| g}x&|j D ]\}}|jdj|| qW tj|dd\}}}|dkr`tdj| |ddd S ) Nz /sbin/insmodz{0}={1}T)rY r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load error)r )itemsrG r r r r )Zkmodr cmdr re r r^ r; r; r< load_kmod s
rs c C sT t j r,t dkrtdt dkr,tdt j sDt j sDt j rPtdddd S )NFz4Secure boot is enabled. Not supported by KernelCare.z |}Y nX tj rbt
j j tj rbt
j
tj t }t| t fdd|j D }t|f| t d S )Nc 3 s" | ]\}}| kr||fV qd S )Nr; )r kv)available_kmod_paramsr; r< r$ ! s z"load_kcare_kmod..)rk r r r r shutilcopyrn r
r r0 r1 r r r r} dictrq rs
update_depmod)r r r{ Z
kcare_fileZ kmod_paramsr; )r r< load_kcare_kmod s
r c C sX dg}| d k r |j d| g tj|ddd\}}}|rTtjdjdj|||dd d S ) Nz /sbin/depmodz-aT)rY ru z%Running of `{0}` failed with {1}: {2} F)r )extendr r r rw r rA )unamerr r r^ stderrr; r; r< r ' s r c C s8 t jd| gdd\}}}|dkr4tdj| |ddd S )Nz /sbin/rmmodT)rY r z Unable to unload {0} kmod {1}zkmod unload error)r )r r r r )modnamer r^ r; r; r< unload_kmod3 s r c C sT g }xJdg| D ]<}t j| |dj|}tjj|rt| |jdj| qW |S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r r r0 r1 r rs rG )r r r ZloadedmodZmodpathr; r; r< apply_fixups9 s r c C sD x>| D ]6}y t | W q tk
r: tjjd| Y qX qW d S )Nz$Exception while unloading module %s.)r rn r r{ r| )r6 r r; r; r<
remove_fixupsC s
r c C s | r
| }n6t jrt j}n(t j|r2d| t jdfS d| t jdfS dddddd}|j }||krj|| }ntdj|| t jdd d
|| t jdfS ) NZfreeze_conflictTr( FZ freeze_noneZ
freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})z freezer style detection error)r )r
Z PATCH_METHODr= intersectionupperr r )freezerr r Zpatch_method_mapr; r; r< get_freezer_styleK s&
r rK c s | ||d t d tj }tj }t| t||}tj| |tj}t | | dj
|tj t j
tj|} d|k}
|
otj| |} |d k } | ot|otj| }
j|| d |
rt d d S | rt d t| ||}t d t| t d t| | r"t d
td d }
|
s z5Patch level {0} applied. Effective kernel version {1}waitc s t S )N)r r; )r r; r< s z kcare_load..)rz )"r r r r rj r r r
rE r r r, r r Z parse_unameZis_kmod_version_changedrU Z kcare_update_effective_versionrH r kpatch_ctl_unpatchr r r r kpatch_ctl_patchr_ r r r r Ztouch_status_gap_filer r )r r r r
use_anchorr r r r descriptionZ kmod_loadedr Z patch_loadedZ
same_patchr6 r; )r r<
kcare_loadm sR
r c C s t jg}tj||tj}tjj|r2|j d|g |j dd|g |j d|d g |j
| t j |dd\}}}|dkrt
|||| d S )Nz-br> z-dz-mr T)rY )r rQ r r r
rG r0 r1 r r rG r r r ) r r r r r r Zblacklist_filer r^ r; r; r< r s
r c C s^ t jtjdd| d gddd\}}}|dkrZtjdj||dd td j|t| d
d d S ) Nr z-mr T)rY ru z4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}F)r zError unpatching [{0}] {1}z
unpatch error)r ) r r r rQ r rw r r rd )r r r| r r; r; r< r s
r c C s8 | |d< t tj |d< tjtjjtjdt | d S )Nactionr< z kcare.state)
r ry r r r0 r1 rA r r rd )r r r; r; r< r s r c C sp d}t jj|sd S xVt j|D ]H}t jj||dd}t jj|sDq t j|}|| kr t j| t| q W d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r0 r1 isdirlistdirrA islinkreadlinkunlinkr ) kmod_linkZ modules_pathentryZ
sym_link_pathZ target_pathr; r; r< update_weak_modules s
r c
C sJ t j }t }y|j| W n8 tk
rT } z |sDtdj|ddW Y d d }~X nX t j }t| |}t d|kr|d k }|rt
t j ||}t j
tjdd|d gddd \} }
} t| | dkrtjd
j|
| d d td
j| t|ddtjtjtdtdtd t } tj j | r4tj | t | W d Q R X d S )NzUnable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval error)r r r z-mr T)rY ru z4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}F)r zError unpatching [{0}] {1}z
unpatch errorr )countdelay) r r r" r7 rn r r r r r r r r r r rQ r r rw rd r Zretryr Z check_excUNLOAD_RETRY_DELAYr rk r0 r1 r2 r r )
r forcer pferrr r Z need_unpatchr6 r r| r r r; r; r< kcare_unload s:
r c C s8 t }| rt|S |jdkr"|jS |jd k r4tj S d S )Nr )r _kcare_info_jsonr r r r rS )rI r r; r; r< rA s
rA c C sR d| j i}| jd k r>|jtjtj |jtj|jd | j |d< t
j |S )Nr zkpatch-descriptionz kpatch-state) r r rH r r r rS Zparse_patch_descriptionr rC ri rj )r r8 r; r; r< r s
r c @ s$ e Zd ZdZdZdZdZdd ZdS )r8 r r rr r c C s" || _ || _|| _|| _|| _d S )N)r r
remote_lvlr rC )r r r r r rC r; r; r< r % s
z PLI.__init__N)rL r r r r9 PATCH_UNAVALIABLEPATCH_NOT_NEEDEDr r; r; r; r< r8 s
r8 c C s t j } ytdd}| rJt| |r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |}W nl tk
r tj }t
j rd
j t
j t
j d tj }n d j t
j d tj t j }t||d d d }Y nX |S )
Nr )r z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingszLNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.Z unavailable)r r r rX r8 r9 r r r r r
STICKY_PATCHr r r` r r r )Zcurrent_patch_levelZnew_patch_levelr r rC r r; r; r< r - s8
r c C s d}yXt j }td|fd| fg}tj dj| }tj|}tj tj
|j }t |d S t
k
r } ztj|| d
S d}~X nZ tk
r } ztj|| d S d}~X n0 tk
r } ztjdj| d S d}~X nX dS )
z
Request to tag server from ePortal. See KCARE-947 for more info
:param tag: String used to tag the server
:return: 0 on success, -1 on wrong server id, other values otherwise
N server_idtagz/tag_server.plain?{0}r r zInternal Error {0} )r get_serveridr# r r r r r r r rk r r r r r r rn rw ) r ro r Zqueryr r r ZueZeer; r; r<
tag_server_ s"
r c C s t jd} tjdj| t}tj }y:tj | |j
}t j t j
| |j
tj|j
| |j
}W n2 tk
r } ztjdj| W Y d d }~X nX tjd|tj gdd\}}}|rtdj||dd W d Q R X d S )
Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)ru z Script failed with '{0}' {1}zdoctor script failed)r )r rm r Zlogdebugr KCDOCTORtempfileZNamedTemporaryFiler Zfetch_signaturer Z save_to_filer r Zcheck_gpg_signaturern rw r r r Zget_patch_serverr )Z
doctor_urlZdoctor_filenameZ
doctor_dstZ signaturer r r^ r r; r; r< kcdoctorz s
" r c C sB t jdjt} ytj| W n tk
r2 dS X tjd dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r rm r EFFECTIVE_LATESTr r r r r )ro r; r; r< check_new_kc_version s r c
C s t j }t|}|tjkp*|tjko*|dk}yt| |}W n tjk
r } z.|dkrX t j
t | t j
d tj }W Y dd}~X n< t
k
r } z |r nt jjdj| W Y dd}~X nX |tjkr|} n@|} |dkr|tj krt j|d} n|tjkr
|} ntd| S )a
Get patch level to apply.
:param reason: what was the source of request (update, info etc.)
:param policy: REMOTE -- get latest patch_level from patchserver,
LOCAL -- use cached latest,
LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:return: patch_level string
Nz#Using previously downloaded patcheszUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r r r rF ZPOLICY_LOCAL_FIRSTr r r r r rd Z POLICY_LOCALrn r{ r] r r r )
r rE r r Z cached_levelZconsider_remote_exZ remote_levelr r r r; r; r< r s2
$
r c C s | dkr d S | dkrdn| t _ttddt jrtjt jd t jdkrntj rnt jpXt }t
dd d j |f t j
d
j | ntdj | ddd S )Nedfr( rK Zprobe)r )r, rv r fs.enforce_symlinksifownerfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailable)r )rv r )r r )r
r, r r r
update_configr Z is_cpanelZ FORCE_GID
CPANEL_GIDrf r r r r )rB Zgidr; r; r< update_patch_type s
r Zkernelc $ C sh t tj |tjkrt ytd||d}W nR tk
r~ } z6|tjtj fkrltj
rlt |}t j
j| dS W Y dd}~X nX tj }|tjkrtj rdS t|}|j t||dst jd dS y(tjtjddd tjtjdd d W n" tk
r t j
jd
Y nX tj }t ( |j | t |||| |tj kd W dQ R X tj | t || dS ) ax
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:param policy: REMOTE -- download latest and patches from patchserver,
LOCAL -- use cached files,
LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases
:param freezer: freezer mode
rH )r rE r N)rV rW z%No updates are needed for this kernelr z kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r )!rx r
r, r rF r r r UPDATE_MODE_AUTOUPDATE_MODE_SMARTr rd r r{ r] r r r r" r0 rX r r r r rn r| r r r7 r Zdump_kernel_patch_levelr ) r r rE r r r r r r r; r; r< do_update s<
"
r c C s t ttjttjptjttjp$tjf}|dkr@tdddtjrLtjS | t j
krptjp`tj}tjpltj}n tj}tj}|r|S |rd| S d S )Nr zInvalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settings)r zrelease-) r@ boolr
r Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r UPDATE_MODE_MANUAL)r r r Zpatchsetr; r; r<
get_sticky s&
r c C s | d | S )Nr> r; )r r r; r; r< _stickyfy< s r c C s t |}|s| S |dkr"t|| S tj }|sDtjjd tjd y t j
t j dj
| }W n: tk
r } z tj||j tjd W Y dd}~X nX tjtj|j }t|d }|dkrt|d | S |d
kr| S |d k rtjjd tjd tjjd
|d tjd dS )z
Used to add sticky prefix to satisfy KCARE-953
:param file: name of the file to stickify
:return: stickified file.
KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr z!/sticky_patch.plain?server_id={0}r Nr r r r rr zEServer ID is not recognized. Please check if the server is registeredzError: r r r r r? r )r r r r r r{ r rS r: r r r r r r r ro r r rk r r )filer sr r r r r r; r; r< r @ s2
r c
C s g }| s dS | j d}|d }|dd }|jd}||krLtdt| |s`| j |j kS |dkrt|jd n>|jd s|jd r|jtj| n|jtj|j d
d x |D ]}|jtj| qW tj
d d
j | d tj } | j
|S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
Fr> r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r@ r r reprlowerrG r reescapereplacecompilerA Z
IGNORECASErh )
ZdnhostnameZ
max_wildcardsZpatspiecesZleftmostZ remainderZ wildcardsZfragZpatr; r; r< _dnsname_matchl s(
r c C s
g }xBt | j D ]2}| j|}|j dkrdd t|jdD }qW | sTtdg }x0|D ](\}}|dkr^t||r|d S |j| q^W |s| j j
}t||rd S |j| t |dkrt dj
|d jtt|n,t |dk rt d
j
||d nt d d S )
NZsubjectAltNamec S s g | ]}|j jd dqS )ry r )r r@ )r itr; r; r< r s z"match_hostname..,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}z, z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)rangeZget_extension_countZ
get_extensionZget_short_namerd r@ r r rG Z get_subjectZ
commonNamer r r rA mapr ) Zcertr Zsanr r Zdnsnamesr re Zcnr; r; r< r s0
r c C s t ddd} | jdddd | jdd d
dd | jd d dd | jd
dddd | jdddd | jdddd | jdddd | jdddd | jdddd | jd d d d | jd d dd | jd!d"dd | jd#d$dd | jd%d&dd | jd'd(d)d | jd*d+dd | jd,d-dd | jd.d/dd | jd0d1dd | jd2d3dd | jd4d5d6d | jd7d8d9d | jd:d;dd | jdd?dd | jd@dAdd | jdBdCdd | jdDdEddFdG | jdHdIdd | jdJdKdd | jdLdMdd | jdNdOdd | jdPdQdd | jdRdSdd | jdTdUdd | jdVdWdd | jdXdYdd | jdZd[d\td d]d^ | jd_d`dd | jdadbdd | j }|jdcddd\d |jdedfdd |jdgdhdd | jdidjd\d d]dk | jdldmdndd]do | jdpdqdr | jdsdtdd | jdudvdwdxdy tjs | jdzd{d|d}d]d~ | jddd|d}dd~ | jdddd | jddddd | jddddd | jdddd | jddddd | jddddd | jddddd | jdddddd | jdddd | jdddd | jddd6dd\d d]d | j }tj tjsFt j dg7 _ |j
d k rzt t d |j
j
djtj rvdS dS |js|jrtjrtjt_ntjt_n|jrtjt_|jstj dkrtdt j d dS t j }|jrt j }n|jrt j!}t"j#| tj$s tj% |j&r,t'j( |j)rn|j)dkr\t*|j)t_+tj,tj+d nd t_+tj,dd |j-d k rtj,|j-d |j-t_.|j/rd]t_0|j1rd]t_2|j3rdt_4|j5rt5 |j6rt7j8dt9 n8|j:rtj;dkrtj|j?r&|j?t_@|jAr@t7j8dt9 dt_@tj@jBdt_@tj@r~tj@tCkr~t"jDjEdjFtj@djGtC |jHrdt_Id|jH t_J|j=rtK|j= tj;dkrtL t_;t7j8djFtj;pdt9 |jMrt'jNtOjM|jPd d S |jQr$tQjQdddd}t'jNtPjR| d S tStj; |jTrJtTjUtV|jWd d S |jXrtYjZtQjQdddd}djF|j[}|j\rt'jN| nRtYj]|}|rt"j^djF| nt"j_ddd |j`rt'jN| n|r|ja |jbr |jPrtbdd ntb d S |jcrtj,dd d S |jdr0tj,dd d S |jerHtjf|je d S |jgrZth|jgS |jirjtjji |jkrtj;dkrtj,dd tjjk|jk|jlS |jmrtjjm dkrdS dS |jnd k rto|jnS |jprt'jNtjq tr|d|d d k rtsjt|ju dS tj
s|jv r d|jvini }|jw r2tsjx S |jy rVtsjzf |d k rVt"j^dă |j{ rvtsjzf dtj|i| n|j} rtsj~ t"j^dƃ |j rtsj t"j^dǃ |j rt'jNtsj |j rt'jNtsj |j rtsj rt'jNtsj|j |jd k
rj|jdk
r,tj
p(ttsj j } nddɄ |jj
dD } tsjzf dt| i|d k
rjt"j^dă |j
rtsjzf tj|d d˜| |j
rt'jNt|jPd d}
|j
rt7j8dt9 d}
|j
r|j}
|j
rt|
tjtjd |j> rt|
tjdύ t"j^dЃ |j r t'jNtj |j r>t|
|jdэ t"j^d҃ |j rld]t_tjtjddӃ t|
tj|dύ |j rt|jPd |j rt S |j rt|jPd |j rt tt jdk rt d S )NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr z--debugrK Z
store_true)helpr z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z
--app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez) into an isolated cache, leaving the default storage untouched. Use together with --lib-update or --userspace-update.)r r r r( r zlibcare-enabledr r r zPlease run as root)r )r )r zTFlag --edf-enabled has been deprecated and will be not available in future releases.r r( zMFlag --test has been deprecated and will be not available in future releases.r( /z(Prefix `{0}` is not in expected one {1}.r zfile:z+edf patches are deprecated. Fallback to {0})rI r )r r r )Zforce_fallbackz)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}z$Failed to send kernel anomaly report)r ri )r ZYES)r ZNOrv r )r, r z Userspace patches are applied.r z Userspace patches are unloaded.zLibcare plugin reloaded.c S s g | ]}|j j qS r; )r r )r Zptchr; r; r< r 5 s zmain..limit)r r zQFlag --nofreeze has been deprecated and will be not available in future releases.r )r rE )r zKernel is safe)r z=KernelCare protection disabled. Your kernel might not be safe< )r Z add_argumentr Z add_mutually_exclusive_groupr
ZLIBCARE_DISABLEDZ
parse_argsr Z set_settings_from_config_fileZFLAGSZ has_flagsr/ filterr@ issubsetquietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr r0 getuidprintrS r loggingZINFOZWARNINGDEBUGr Zinitialize_loggingZIGNORE_FEATURE_FLAGSZ set_feature_flags_from_cacher r Zclear_all_cacheZset_patch_levelrd r r Zset_sticky_patchr Z nosignaturer Z
no_check_certr r~ r rt Z edf_enabledwarningswarnDeprecationWarningZ edf_disabledr, ZPREV_PATCH_TYPEZset_patch_typerH r r r( r EXPECTED_PREFIXr{ r] r rA Zlocalrh Z PATCH_SERVERr r Zapp_infor r ri r rj rJ r
Zsend_doctor_reportr ZfallbackZkernel_anomaly_reportr r Z archive_pathr r r r Z
keep_localr r Zenable_auto_updateZdisable_auto_updateZ
set_configZupdate_config_from_argsZset_monitoring_keyr Z
unregisterr registerZregister_autoretryr r r r ra rc r Zset_libcare_statusr Zlib_tagZuserspace_statusZget_userspace_update_statusZ
lib_updateZdo_userspace_updateZlib_auto_updater Z
lib_unloadZlibcare_unloadZ lib_repluginZlibcare_repluginZlib_inforB Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater listZget_userspace_mapkeyssortedZuserspace_auto_updater rA Znofreezer Z smart_updater r Z
UPDATE_POLICYr r r r r r ZCHECK_CLN_LICENSE_STATUSry rz randomZuniformrJ r r Zlatest_patch_inforM Zcheckr; r argvrD ) ZparserZexclusive_groupr r r r
Zlocal_path_messager Z
lib_tag_kwr r r; r; r< main sr
r )r% r& r' r( )r) r* )N)N)F)F)N)rK F)rK F)r )Z
__future__r rl ri r r0 r r r r r ZsslrS r ry rR r Zargparser
contextlibr r rK r r r r
r r r
r r r r r r r r r r r r r r r r r Zpy23r r r! r" r# r r r r3 r r rZ r r ZDOTALLr1 rg r1 r insertfilterwarningsr r{ ZsetLevelr r= rD rJ rg rp r r r r r r r r r r r r r r r r r r r r r rc Zdistutils.versionZ distutilsZ OpenSSL.SSLr r Z
StrictVersionZ __version__ ImportErrorr ZHTTPSConnectionZPureHTTPSConnectionobjectr r r
r r r r! r" r; rD rM r? rO rJ rU rX r_ rf rj rk rn rp rs rt rx r} r r r r r r r r r r r r r r Zlog_all_parent_processesr rA r r8 r r r r rF r r Ztrack_update_statusr r r r r r r r; r; r; r< s \
&
4
-! b +
"
?
- 2
.= ,
3)