dbfdg 3 whD@sddlZddlZddlZddlZddlZddlmZddlmZddlmZddlm Z ddlm Z ddlm Z dd lm Z dd lm Z dd lmZdd lmZdd lmZddlmZddlmZmZmZdZdXZdZdZdZddddddZdddgddgddgd Zd!d"Zd#d$ZGd%d&d&eZ d'd(Z!dYd)d*Z"d+d,Z#d-d.Z$d/d0Z%dZd2d3Z&d4d5Z'd6d7Z(ed8d9Z)ed:d;Z*dd?Z,d@dAZ-dBdCZ.dDdEZ/dFdGZ0ee!dHdIZ1ej2ee!ej3dfdJdKZ4edLdMZ5dNdOZ6dPdQZ7d[dRdSZ8dTdUZ9dVdWZ:dS)\N) constants)config)config_handlers) log_utils) process_utils)utils)auth)errors)selinux)fetch) update_utils) server_info)json_loads_nstrurlquote HTTPErrorz!/usr/libexec/kcare/libcare-client/run/libcare/libcare.sock/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotatedbqemu)mysqldmariadbdpostgreszqemu-kvmzqemu-system-x86_64rrrzqemu-kvmzqemu-system-x86_64libcZlibssl)rrlibscGstjjtjd|f|S)N userspace)ospathjoinr PATCH_CACHE)libnamepartsr"-/usr/libexec/kcare/python/kcarectl/libcare.pyget_userspace_cache_path.sr$csfdd}|S)NcsVz ||Sy tdWn6tk rN}ztjdj|ddWYdd}~XnXXdS)N clearcachez$Libcare cache clearing failed: '{0}'F) print_msg)libcare_client Exceptionrlogerrorformat)argskwargserr)clblr"r#wrapper3s   z$clear_libcare_cache..wrapperr")r.r/r")r.r#clear_libcare_cache2s r0cs0eZdZdfdd Zd ddZddZZS) UserspacePatchLevelNcst||j||S)N)super__new__)clsr buildidlevelbaseurl) __class__r"r#r3AszUserspacePatchLevel.__new__cCs||_||_||_||_dS)N)r6r r5r7)selfr r5r6r7r"r"r#__init__DszUserspacePatchLevel.__init__cGst|j|jt|f|S)N)r$r r5str)r9r!r"r"r# cache_pathJszUserspacePatchLevel.cache_path)N)N)__name__ __module__ __qualname__r3r:r< __classcell__r"r")r8r#r1@s r1csddfdd}|S)NcSsd \}}z|dkrt}i}g}xLt|D]@}|jdd||jd<x$|jdgD]}|j|jdqRWq*Wdjdd |jD}dj|}Wdtjt|d d tjt |d d XdS) z(KPT-1543 Save info about applyed patchesNzlatest-versionpackagepatchesZcve cSsg|]}dj|qS) )r).0recr"r"r# [szLrefresh_applied_patches_list..save_current_state..T) ensure_dir)rArA) _libcare_info_get_patches_infogetappendritemsr atomic_writeLIBCARE_PATCHESLIBCARE_CVE_LIST)infoZversionsZcvesZpackagesZ cves_listrGpatchr"r"r#save_current_stateOsz8refresh_applied_patches_list..save_current_statec s"d}z||}|S|XdS)Nr")r+r,rR)r.rTr"r#r/as  z-refresh_applied_patches_list..wrapperr")r.r/r")r.rTr#refresh_applied_patches_listNsrUcCs$tjpd}t|}t|j}tjtj|d|||d}|dtj tj d|7}tj|d}yt j t j|dd}Wn,tjk rtjt||d d YnXtj|jttj|j}t|||d |jd }t|d } t||| d } tjj|  stjj| dkrtj|d}yt j || tj!t j"|dWn<t#k r~} z| j$dkrltj%dWYdd} ~ XnXt||| } dd| d| dg} t&j'| d d d\}}}|rtj(dj)|||t||d}tjj*| rtjj+|rtj|tj,| |dtj-|d|dS)Nmainuz latest.v1z?info=updaterF) check_licenseT) ignore_errorsr6r7z patch.tar.gzrZ patch_url)Zcheck_signature hash_checkerzKC+ licence is requiredtarZxfz-Cz--no-same-owner) catch_stdout catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}latestz.tmp)r\r]).rPREFIXrstriprget_patch_server_url LIBNAME_MAPrLrZencode_server_lib_infoZserver_lib_infor wrap_with_cache_keyr urlopen_authr NotFoundshutilrmtreer$rset_config_from_patchserverheadersrnstrreadr1r;rrexistsgetsize fetch_url USE_SIGNATUREget_hash_checkerrcodeNoLibcareLicenseExceptionr run_command KcareErrorr*islinkisdirsymlinkrename)r build_id patch_levelprefixurl cache_dstresponsemetar6plevelZ patch_pathexdstcmdrtstdoutstderrZ link_namer"r"r#fetch_userspace_patchlsD     "     rcCsL| t_|sttj|rdndd|r0ttjjd|r@dnddS)NFALSEYES)LIBCARE_DISABLEDzlibcare service is enableddisabled) rrlibcare_server_stopr update_configlibcare_server_startrkcarelogrR)rr"r"r#set_libcare_statussrc Cs:ytjddddg}Wntk r*dSXtj|dS)Nservice /usr/sbin//sbin/libcarestop)rr)rfind_cmdr(rv)rr"r"r#rs rc Csttjstjjtjr:tjtjddgtjtjddgn6ytjdd ddg}Wnt k rddSXtj|dS) Nz reset-failedrZrestartzlibcare.socketr /usr/sbin//sbin/start)rr) rSKIP_SYSTEMCTL_CHECKrrro SYSTEMCTLrrvrr()rr"r"r#rsrTcsdjddt|pgD}ddg}s6|dd|g7}y t|}Wn2tk rt}ztjdj|WYdd}~XnXg}x@|jd D]2}|ry|jt j |Wqt k rYqXqWd d |D}x.|D]&}t fd d|d j D|d <qW|S)N|css|]}dj|VqdS)z({0})N)r*)rFprocr"r"r# sz _libcare_info..rRz-jz-lz-rz/Gathering userspace libraries info error: '{0}'rDcSs$g|]}|jd|jd|dqS)commpid)rrr)pop)rFliner"r"r#rHsz!_libcare_info..c3s(|] \}}d|ks r||fVqdS)patchlvlNr")rFkv)patchedr"r#rsr)rsortedr'r(r rwr*splitrMjsonloads ValueErrordictrN)rlimitZregexprlinesr-resultrr")rr#rJs& "  &rJc Cst}x<|D]4}x.|djD]\}}|j|d|dfqWq Wg}xbtD]Z}xT|D]L\}}t||t|d} tjj| rXt | d} |j t j | WdQRXqXWqNW|S)Nrr5rz info.jsonr) setrNadd USERSPACE_MAPr$r;rrisfileopenrMrload) rRrCrG_datarrr|rZpatch_info_filenamefdr"r"r#rKs    "rKcCs ttS)N)rKrJr"r"r"r#libcare_patch_info_basicsrcCs"t}|stjdtjd|iS)NzNo patched processes.r)rrr)rdumps)rr"r"r#libcare_patch_infos rcCs"t}|stjdtjd|iS)NzNo patched processes.r)rJrr)rr)rr"r"r# libcare_infos rcCs.i}x$tD]}|jdd||jd<q W|S)Nzlatest-versionrArB)rrL)rrGr"r"r#_libcare_versions rcCs*x$tjD]\}}|j|r |Sq WdS)NrA)rrN startswith)r rBversionr"r"r#libcare_versions rcCsdjdd|DdS)Ncss|]}tj|dVqdS)N)rbstr)rFpr"r"r#r sz(libcare_client_format..r)r)paramsr"r"r#libcare_client_format srcCs,xtD]}tjj|r|SqWtjddS)NzLibcare socket is not found.)LIBCARE_SOCKETrrror rw)Zlibcare_socketr"r"r#get_available_libcare_socket s  rc Gstjrtjdtjtjtjd}|jdd}z||jt |jtj t |}t j dj|d|j|x|jd}|sP||7}qpW|jdd }t j d j|d |S|jXdS) NzLibcare is disabled.r rzLibcare socket send: {cmd})rizutf-8replacez!Libcare socket recieved: {result})r)rrr rwsocketAF_UNIX SOCK_STREAM settimeoutconnectrLIBCARE_SOCKET_TIMEOUTrrlogdebugr*sendallrecvdecodeclose)rsockresrrrr"r"r#r's(        r'cCsx|D]}ytdt|Wn2tk rN}ztjdj|WYdd}~XnXy tdWqtk r}ztjdj|WYdd}~XqXqWdS)NZstoragez(Userspace storage switching error: '{0}'rXz%Userspace patch applying error: '{0}')r'r$r(r rwr*)rrr-r"r"r#libcare_patch_apply,s " rcCsDy tdWn2tk r>}ztjdj|WYdd}~XnXdS)Nunloadz&Userspace patch unloading error: '{0}')r'r(r rwr*)r-r"r"r#libcare_unload9s rcCstjt|tjkr$tj r$dS|dkr8ttj }g}x|D]}|j tj |gqBW|stt j dj|dSt|d\}}}}|rtjd|st j ddStjtjjtjdty t|Wn>tjk r }zt jt|tjdWYdd}~XnXt} t| } ttdd | Ds8dSt jd j|d t jd j| d tdd | j D} tdd |j D} | | } t!dd | j D}t j djt"| |dx,| j#D] \}}t j dj|t"|qW| S)z0Patch userspace processes to the latest version.NzNo such userspace patches: {0})rz:There was an errors while patches downloading (unpacking).zNo patches were found.rz+There was an errors while patches applying.css|]}|dVqdS)rNr")rFitemr"r"r#rtsz&do_userspace_update..zPatched before: {before})beforezPatched after: {after})aftercss|]}|D] }|Vq qdS)Nr")rFrNrr"r"r#r{scss|]}|D] }|Vq qdS)Nr")rFrNrr"r"r#r|scss|]}t|VqdS)N)len)rFrr"r"r#rszThe patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)countoverallz*Object `{0}` is patched for {1} processes.)$rlog_all_parent_processesrotate_libcare_logsrUPDATE_MODE_AUTOrLIB_AUTO_UPDATElistrkeysextendrLrloginfor*check_userspace_updatesr rwr restore_selinux_contextrrrrrr)r;rJ_get_userspace_procsanyrrvaluessumrrN)moderZprocess_filterZuserspace_patchfailedsomething_foundrrrZ data_afterrZuniq_procs_afterZuniq_procs_beforeZdiffrrrr"r"r#do_userspace_updateBsR     rc CsNyt\}}}}Wntjk r(dSX|r2dS|r:dStjddrJdSdS)Nrz.libcarestatus)filenamer)rr rwr status_gap_passed)rrlibs_not_patchedr"r"r#get_userspace_update_statussrcCsdi}xZ|D]R}xL|djD]<\}}|jdr||kr>g||<||j|d|dfqWq W|S)Nrrrr)rNrLrM)rRrrr rGr"r"r#rs  "rcCsNt}xB|D]:}x4|djD]$\}}|j||d|jddfqWq W|S)Nrr5rr)rrNrrL)rRrrr rGr"r"r#_get_userspace_libss  $rc ssgfddtjDtdd}t|}d}}d}xt|D]}|\}}} y t||| d}| dkrtd}WqHtjtjfk rYqHtj k rYqHtj k r} zd}t j t | WYdd} ~ XqHXqHWtjdd||||fS) Ncsg|]}j|qSr")r)rFr)rr"r#rHsz+check_userspace_updates..F)rrTrz.libcarestatus)r)rrrJrrrr rhruAlreadyTrialedExceptionrwrr)r;r touch_status_gap_file) rZ data_beforerrrrrGr r|rrr")rr#rs.   $ rc sfd}d}tjddd}|rytj|tgdd\}}}Wn.tk rd}zd}t|}WYdd}~XnX|rtjd j|dd ntj d dd d t j j sdSt jd}yt j}tjdfdd|D}dd|D}|jddd} xD|D]<\}} | t j j| 7} | |krt j| tjjd| qWWn$tk r`tjddd YnXdS)NrrAZ logrotateF) raise_excT)r`rz5failed to run logrotate for libcare logs, stderr: {0})r&zlogrotate utility wasn't foundz/var/log/libcare/irz ^\d+\.log.*cs$g|]}j|rtjj|qSr")matchrrr)rFfn)libcare_log_directory pidlog_rer"r#rHsz'rotate_libcare_logs..cSsg|]}tjj||fqSr")rrgetctime)rFfpr"r"r#rHs)reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfilesi)rrrvLIBCARE_LOGROTATE_CONFIGr(r;rr)r*logwarnrrryr!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MBlistdirrecompilesortrpremoverrRlogexc) rcrZlogrotate_pathreZmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_sizefilepathr")rrr#rs<       rc CsJytjdd ddg}Wntk r*dSXtj|ddd\}}}|d kS) zKAssume that whenever the service is not running, we did not patch anything.r /usr/sbin//sbin/rstatusFT)r_r`r)rr)rrr(rv)rrtrr"r"r#libcare_server_starteds r)rr)N)TN)N);rr rirrrArrrrrrr r r r r rpy23rrrZLIBCARE_CLIENTrrPrQrrerr$r0intr1rUrrrrrJrKrrrrrrrr'rrskip_if_no_selinux_moduleUPDATE_MODE_MANUALrrrrrrrr"r"r"r#st              -     G   *