a íÕ;j·bã@s ddlZddlZddlZddlZddlZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZddlmZmZmZdZdZdZdZ d Z!d d d d œZ"d d e#dgƒfdde#dgƒfgZ$ej%dd„ƒZ&dd„Z'dd„Z(dd„Z)Gdd„de*ƒZ+dd„Z,dNdd„Z-dd„Z.d d!„Z/d"d#„Z0dOd%d&„Z1d'd(„Z2e)d)d*„ƒZ3e)d+d,„ƒZ4e)d-d.„ƒZ5d/d0„Z6d1d2„Z7d3d4„Z8d5d6„Z9d7d8„Z:dPd9d:„Z;e)e,ej„Z>ejRóz/_get_effective_libcare_libs..) ÚlistrÚ LIBCARE_LIBSÚsetr Ú get_distroÚlowerÚ ExceptionÚLIBCARE_LIBS_BLACKLISTÚ startswith) ÚlibsZ distro_infoÚdistroÚversionÚ_Zbl_libsZversion_dottedZ bl_distroZ bl_versionrrrÚ_get_effective_libcare_libs;s    r+cCsgd¢tƒdœS)Nr)rr')r+rrrrÚget_userspace_mapUsþr,cGstjjtjd|g|¢RŽS)NÚ userspace)ÚosÚpathÚjoinrÚ PATCH_CACHE)ÚlibnameÚpartsrrrÚget_userspace_cache_path\sr4cs‡fdd„}|S)Ncsìzžˆ|i|¤ŽWz tdƒWStyT}z tjd |¡ddWYd}~Sd}~00Sz tdƒWqètyœ}z tjd |¡ddWYd}~qèd}~00nHz tdƒWn8tyä}z tjd |¡ddWYd}~n d}~000dS)NÚ clearcachez$Libcare cache clearing failed: '{0}'F©Ú print_msg)Úlibcare_clientr$r ÚlogerrorÚformat)ÚargsÚkwargsÚerr©ÚclblrrÚwrapperas *ú ,ü z$clear_libcare_cache..wrapperr©r?r@rr>rÚclear_libcare_cache`s rBcs0eZdZd‡fdd„ Zd dd„Zdd„Z‡ZS) ÚUserspacePatchLevelNcst||ƒ ||¡S©N)ÚsuperÚ__new__)Úclsr2ÚbuildidÚlevelÚbaseurl©Ú __class__rrrFoszUserspacePatchLevel.__new__cCs||_||_||_||_dSrD)rIr2rHrJ)Úselfr2rHrIrJrrrÚ__init__rszUserspacePatchLevel.__init__cGst|j|jt|ƒg|¢RŽSrD)r4r2rHÚstr)rMr3rrrÚ cache_pathxszUserspacePatchLevel.cache_path)N)N)Ú__name__Ú __module__Ú __qualname__rFrNrPÚ __classcell__rrrKrrCns rCcsdd„‰‡‡fdd„}|S)Nc SsÔd\}}z¤|durtƒ}i}g}t|ƒD],}| dd¡|| d¡<| | dg¡¡q(tj|dd}d  d d „| ¡Dƒ¡}d  t|ƒ¡}Wtj t |d d tj t |d d n"tj t |d d tj t |d d 0dS)z(KPT-1543 Save info about applied patches)ÚrUNúlatest-versionrUÚpackageÚpatchesÚcve)Ú cve_fieldÚ cSsg|]}d |¡‘qS)ú ©r0)rÚrecrrrr‰rzLrefresh_applied_patches_list..save_current_state..T)Ú ensure_dir) Ú _libcare_infoÚ_get_patches_infoÚgetÚextendrÚextract_unique_cvesr0ÚitemsÚsortedÚ atomic_writeÚLIBCARE_PATCHESÚLIBCARE_CVE_LIST)ÚinfoZversionsZcvesZpackagesZ all_patchesr^Zcves_setrrrÚsave_current_state}s  ÿz8refresh_applied_patches_list..save_current_statecs0d}zˆ|i|¤Ž}|Wˆ|ƒSˆ|ƒ0dSrDr)r;r<rj©r?rkrrr@sþz-refresh_applied_patches_list..wrapperrrArrlrÚrefresh_applied_patches_list|srmc Csâtjpd}t|ƒ}t| ¡ƒ}t t |d¡|||d¡}|dt  d|¡7}t |d¡}|rlt j   d||¡}i}|r€d|i|d <z t  tj¡|fd d i|¤Ž}Wn–tjyê|rÐtjd  ||¡d d YdStjt||ƒdd‚YnNty6} z4| jdkr |r tjd |¡dd‚‚WYd} ~ n d} ~ 00t |j¡tt  | !¡¡ƒ} |  dg¡} t" #| ¡s~t $d |¡¡‚t%||| d|  d¡ƒ} t&| dƒ} t||| dƒ}t j  '|¡rÐt j  (|¡dkrty:} z$| jdvr$t ,d¡‚‚WYd} ~ n d} ~ 00t||| ƒ}dd|d |d!g}t-j.|ddd"\}}}|rŒtjd# |||¡d$d‚t||d%ƒ}t j  /|¡s¾t j  0|¡r¾t |¡t  1| |d&¡t  2|d&|¡| S)'NÚmainÚuz latest.v1z?info=Úupdater'ÚtagsZStickyÚheadersÚ check_licenseFz;No libcare patchset available for {0} at tag {1}, skipping.r6T)Ú ignore_errorsiz8Invalid sticky patch tag {0}: server rejected the value.úinvalid lib sticky patch©ÚstatusrzkLatest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.rIrJz patch.tar.gzrZ patch_url)Úcheck_signatureÚ hash_checker)i“i‘zKC+ licence is requiredÚtarZxfz-Cz--no-same-owner©Ú catch_stdoutÚ catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}zpatches unpacking errorÚlatestz.tmp)3rÚPREFIXrÚstriprÚget_patch_server_urlÚ LIBNAME_MAPrbrZencoded_server_lib_infor.r/r0r Úwrap_with_cache_keyrÚ urlopen_authrÚNotFoundr Úloginfor:ÚshutilÚrmtreer4rÚcodeÚ KcareErrorrÚset_feature_flags_from_headersrrrÚnstrÚreadrÚhas_lc_capabilitiesÚCapabilitiesMismatchrCrOÚexistsÚgetsizeÚ fetch_urlÚ USE_SIGNATUREÚget_hash_checkerÚNoLibcareLicenseExceptionr Ú run_commandÚislinkÚisdirÚsymlinkÚrename)r2Úbuild_idÚ patch_levelÚtagÚprefixÚurlÚ cache_dstZ extra_kwargsÚresponseÚexÚmetaÚrequired_capabilitiesrIÚplevelZ patch_pathÚdstÚcmdr‰ÚstdoutÚstderrZ link_namerrrÚfetch_userspace_patchšs|      þþ   ÿÿ     ÿ  rªcCsL| t_|stƒtj|rdndd|r0tƒtj d|r@dnd¡dS)NÚFALSEÚYES)ÚLIBCARE_DISABLEDzlibcare service is ÚenabledÚdisabled) rr­Úlibcare_server_stoprÚ update_configÚlibcare_server_startr Úkcarelogrj)r®rrrÚset_libcare_statusæsr´cCs˜tjstj tj¡r^t tjddg¡t tjddg¡t tjddg¡t tjddg¡n6zt dd¡ddg}Wnt yˆYdS0t |¡dS)NÚstopúlibcare.socketúlibcare.serviceú reset-failedÚlibcareÚservice©z /usr/sbin/z/sbin/) rÚSKIP_SYSTEMCTL_CHECKr.r/rÚ SYSTEMCTLr r–Úfind_cmdr$©r§rrrr°ðs r°cCsàtjstj tj¡rœtjtjdddgddd\}}}|dkr@dSt tjddg¡t tjddg¡t tjd d g¡t tjd dg¡t tjd dg¡n@tƒr¦dSzt  d d ¡d d g}Wnt yÐYdS0t |¡dS)Nz is-activez--quietr·Tr{rrµr¶r¸r¹Ústartrºr») rr¼r.r/rr½r r–Úlibcare_server_startedr¾r$)r‰r*r§rrrr²s( ý  r²Tc súd dd„t|pgƒDƒ¡}ddg}ˆs6|dd|g7}z t|Ž}Wn8tyz}z tjd |¡d d ‚WYd}~n d}~00g}| d ¡D]0}|rŠz| t   |¡¡WqŠt y¸YqŠ0qŠd d „|Dƒ}|D]&}t ‡fdd„|d  ¡Dƒƒ|d<qÎ|S)Nú|css|]}d t |¡¡VqdS)z({0})N)r:ÚreÚescape)rÚprocrrrÚ $rz _libcare_info..rjz-jz-lz-rz/Gathering userspace libraries info error: '{0}'zuserspace libs info errorrvr[cSs$g|]}| d¡| d¡|dœ‘qS)ÚcommÚpid)rÇrÈr')Úpop)rÚlinerrrr:rz!_libcare_info..c3s&|]\}}d|vsˆs||fVqdS)ÚpatchlvlNr)rÚkÚv©ÚpatchedrrrÆ=rr')r0rfr8r$rrŠr:ÚsplitÚappendÚjsonÚloadsÚ ValueErrorÚdictre)rÏÚlimitZregexpr§Úlinesr=ÚresultrÊrrÎrr` s& * $r`c Csºtƒ}|D]0}|d ¡D]\}}| |d|df¡qq g}tƒ}|D]j}|D]`\}} t||t| ƒdƒ} tj | ¡rRt | dƒ } |  t   | ¡¡WdƒqR1s¨0YqRqJ|S)Nr'rHrËz info.jsonÚr) r!reÚaddr,r4rOr.r/ÚisfileÚopenrÑrÒÚload) rjrXr^r*ÚdatarØÚumapr r›rËZpatch_info_filenameÚfdrrrraBs   2racCs ttƒƒSrD)rar`rrrrÚlibcare_patch_info_basicRsrácCs"tƒ}|st d¡t d|i¡S©NzNo patched processes.rØ)rár r9rÒÚdumps©rØrrrÚlibcare_patch_infoWs råcCs"tƒ}|st d¡t d|i¡Srâ)r`r r9rÒrãrärrrÚ libcare_info_s ræcCs*i}tƒD]}| dd¡|| d¡<q |S)NrVrUrW)rárb)rØr^rrrÚ_libcare_versiongs rçcCs*tƒ ¡D]\}}| |¡r |Sq dS)NrU)rçrer&)r2rWr)rrrÚlibcare_versionns  rècCsd dd„|Dƒ¡dS)Nrcss|]}t |¡dVqdS)óN)rÚbstr)rÚprrrrÆvrz(libcare_client_format..rér])ÚparamsrrrÚlibcare_client_formatusrícCs,tD]}tj |¡r|Sqt d¡‚dS)NzLibcare socket is not found.)ÚLIBCARE_SOCKETr.r/rrrŠ)Zlibcare_socketrrrÚget_available_libcare_socketys  rïcGsÂtjrt d¡‚t tjtjd¡}| d¡d}z‚| t ƒ¡| tj ¡t |ƒ}t   dj|d¡| |¡| d¡}|s~qˆ||7}qn| dd ¡}t   d j|d ¡|W| ¡S| ¡0dS) NzLibcare is disabled.ré rzLibcare socket send: {cmd}r¿izutf-8Úreplacez!Libcare socket recieved: {result}rä)rr­rrŠÚsocketÚAF_UNIXÚ SOCK_STREAMÚ settimeoutÚconnectrïÚLIBCARE_SOCKET_TIMEOUTrír Úlogdebugr:ÚsendallÚrecvÚdecodeÚclose)rìÚsockÚresr§rÞrØrrrr8€s*        þr8c Cs|rx|D]j}td||ƒ}tj |¡s&qztdd|ƒWqtyp}z"tjd ||¡dd‚WYd}~qd}~00qdS|D]˜}ztdt|ƒƒWn8tyÊ}z tjd |¡d d‚WYd}~n d}~00z tdƒWq|ty}z tjd  |¡dd‚WYd}~q|d}~00q|dS) Nrqrpz --storagez3Userspace patch applying error (storage={0}): '{1}'zuserspace patch apply errorrvZstoragez(Userspace storage switching error: '{0}'zuserspace storage switch errorz%Userspace patch applying error: '{0}') r4r.r/r˜r8r$rrŠr:)rÖrr¦Z storage_pathr=rrrÚlibcare_patch_apply˜s,   þ* rÿc CsJz tdƒWn8tyD}z tjd |¡dd‚WYd}~n d}~00dS)NÚunloadz&Userspace patch unloading error: '{0}'zuserspace patch unload errorrv©r8r$rrŠr:©r=rrrÚlibcare_unload¼s rc CsFz tdƒWn4ty@}zt d |¡¡‚WYd}~n d}~00dS)z;Reload libcare-server plugin without restarting the server.ZrepluginzUserspace replugin error: '{0}'NrrrrrÚlibcare_repluginÆs rr¹c Csìtƒ|tjkrtjsdStƒ}|dur4t| ¡ƒ}g}|D]}| |  |g¡¡q<|slt   d  |¡¡dSt ||d\}}}} |rŽt d¡‚|s t   d¡dSt tj tjd¡¡tƒzt||dWn@tjy } z$t  t| ƒ¡t d¡‚WYd} ~ n d} ~ 00tƒ} t| ƒ} ttd d „| Dƒƒƒs8dSt  d j | d ¡t  d j | d¡tdd „|  ¡Dƒƒ} tdd „|  ¡Dƒƒ}| |}tdd „|  ¡Dƒƒ}t   dj t |ƒ|d¡|  !¡D] \}}t   d  |t |ƒ¡¡qÆ| S)z0Patch userspace processes to the latest version.NzNo such userspace patches: {0})rÖrz8There were errors while patches downloading (unpacking).zNo patches were found.r-©rz)There were errors while patches applying.css|]}|dVqdS)r'Nr)rÚitemrrrrÆrz&do_userspace_update..zPatched before: {before})ÚbeforezPatched after: {after})Úaftercss|]}|D] }|Vq qdSrDr©rrerÍrrrrÆ rcss|]}|D] }|Vq qdSrDrr rrrrÆ rcss|]}t|ƒVqdSrD)Úlen)rrÍrrrrÆrz…The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)ÚcountÚoverallz*Object `{0}` is patched for {1} processes.)"Úrotate_libcare_logsrÚUPDATE_MODE_AUTOrÚLIB_AUTO_UPDATEr,rÚkeysrcrbr r†r:Úcheck_userspace_updatesrrŠr Úrestore_selinux_contextr.r/r0r1rÿr9rOr`Ú_get_userspace_procsÚanyrør!ÚvaluesÚsumr re)ÚmoderÖrrßZprocess_filterZuserspace_patchÚfailedÚsomething_foundr*rr¢Z data_afterrZuniq_procs_afterZuniq_procs_beforeÚdiffr rÌrÍrrrÚdo_userspace_updateÏsV    þÿrcCsjz}z2t|ddƒd kr‚d}t t |ƒ¡WYd}~qLd}~00qLtjd d ||||fS) Ncsg|]}ˆ |¡‘qSr)rc)rr'©rÖrrrErz+check_userspace_updates..F)rÏrÖTrrrwrurr)r,rr`rr%rªrrr ÚlogwarnrOr…r•ÚAlreadyTrialedExceptionrŠÚgetattrr9rÚtouch_status_gap_file)rÖrrßZ data_beforerrrr"r^r2r›rËrØÚer¢rr&rrAs>    "& rc s^d}d}tjddd}|r‚ztj|tgdd\}}}Wn0tyf}zd}t|ƒ}WYd}~n d}~00|rtjd  |¡dd ntj d dd d ‰t j   ˆ¡s¤dSt jd }zˆt  ˆ¡}t d¡‰‡‡fdd„|Dƒ}dd„|Dƒ}|jddd} |D]8\}} | t j  | ¡7} | |krút  | ¡tj d| ¡qúWn"tyXtjddd Yn0dS)NrrUZ logrotateF)Ú raise_excT)r}rz5failed to run logrotate for libcare logs, stderr: {0}r6zlogrotate utility wasn't foundz/var/log/libcare/iz ^\d+\.log.*cs$g|]}ˆ |¡rtj ˆ|¡‘qSr)Úmatchr.r/r0)rÚfn©Zlibcare_log_directoryZ pidlog_rerrr‹rz'rotate_libcare_logs..cSsg|]}tj |¡|f‘qSr)r.r/Úgetctime)rÚfprrrrr)Úreversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfiles)r r¾r–ÚLIBCARE_LOGROTATE_CONFIGr$rOr r9r:r'r.r/r˜rÚ!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MBÚlistdirrÃÚcompileÚsortr‘Úremover³rjÚlogexc) Úrcr©Zlogrotate_pathr*r+Zmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_sizeÚfilepathrr/rr rs<       r cCsJzt dd¡ddg}Wnty*YdS0tj|ddd\}}}|dkS) zKAssume that whenever the service is not running, we did not patch anything.rºr»r¹rwFTr{r)r r¾r$r–)r§r‰r*rrrrÁœs  rÁ)NN)TN)N)NN)IrÒr.rÃr‡ròrUrrrrrrr r r r r rrrÚpy23rrrÚDictÚListÚOptionalÚSetÚTupleZLIBCARE_CLIENTrîrhrir3r‚r!r%Úcachedr+r,r4rBÚintrCrmrªr´r°r²r`rarárårærçrèrírïr8rÿÚlog_all_parent_processesrrÚtrack_update_statusÚskip_if_no_selinux_moduleÚUPDATE_MODE_MANUALrr#rr%rr rÁrrrrÚst@ þ  L  "    $ H   1*