22

✏️ Editing: imunify-force-update.sh

#!/usr/bin/bash

set -o pipefail
set -o errexit

# Script to upgrade ImunifyAV and/or Imunify360
# bypassing gradual rollout

VERSION="1.3"
PACKAGES=''

PRODUCT_AV='imunify-antivirus'
PRODUCT_I360='imunify360-firewall'

IMUNIFY_ANTIVIRUS_PACKAGES="imunify-antivirus \
    ai-bolit \
    alt-common-release \
    alt-php-hyperscan \
    imunify-release \
    imunify-common \
    imunify-notifier \
    imunify-core \
    imunify-realtime-av \
    imunify-realtime-av-imrt2 \
    rustbolit \
    imunify-ui \
    imunify-wp-security \
    imunify360-venv \
    alt-php-internal \
    app-version-detector"

IMUNIFY360_FIREWALL_PACKAGES="imunify360-firewall \
    imunify-antivirus \
    ai-bolit \
    alt-common-release \
    alt-php-hyperscan \
    imunify-release \
    imunify-common \
    imunify-notifier \
    imunify-core \
    imunify-realtime-av \
    imunify-realtime-av-imrt2 \
    rustbolit \
    imunify-ui \
    imunify-wp-security \
    imunify360-venv \
    cloudlinux-backup-utils \
    imunify360-ossec \
    imunify360-pam \
    imunify360-php-i360 \
    imunify360-webshield-bundle \
    imunify360-unified-access-logger \
    alt-php-internal \
    app-version-detector"

IMUNIFY360_FIREWALL_RPM_ONLY_PACKAGES="imunify-auditd-log-reader \
    minidaemon"

IMUNIFY_ANTIVIRUS_RPM_ONLY_PACKAGES="minidaemon"

detect_cloudways_environment() {
    hostname=$(hostname -f)
    lowercase_hostname=$(echo "$hostname" | tr '[:upper:]' '[:lower:]')

if echo "$lowercase_hostname" | grep -Eq "\.cloudwaysapps\.com|cloudwaysstagingapps\.com"; then
        is_cloudways=true
    elif [ -f /usr/local/sbin/apm ]; then
        if /usr/local/sbin/apm info | grep -q "Cloudways"; then
            is_cloudways=true
        else
            is_cloudways=false
        fi
    else
        is_cloudways=false
    fi
}

detect_ostype()
{
    if [ ! -f /etc/os-release ]
    then
        OSTYPE=centos
    else
        source /etc/os-release
        if echo $ID $ID_LIKE | grep debian >/dev/null
        then
            OSTYPE=debian
        else
            OSTYPE=centos
        fi
    fi
}

detect_product_debian() {
    if dpkg -l "$PRODUCT_AV" 2>/dev/null | grep -E -q "^.i\s+${PRODUCT_AV}"; then
        PACKAGES="$IMUNIFY_ANTIVIRUS_PACKAGES"
    fi
    if dpkg -l "$PRODUCT_I360" 2>/dev/null | grep -E -q "^.i\s+${PRODUCT_I360}"; then
        PACKAGES="$IMUNIFY360_FIREWALL_PACKAGES"
    fi
}

detect_product_centos() {
    if rpm -q "${PRODUCT_AV}" >/dev/null; then
        PACKAGES="$IMUNIFY_ANTIVIRUS_PACKAGES \
            $IMUNIFY_ANTIVIRUS_RPM_ONLY_PACKAGES"
    fi
    if rpm -q "${PRODUCT_I360}" >/dev/null; then
        PACKAGES="$IMUNIFY360_FIREWALL_PACKAGES \
                 $IMUNIFY360_FIREWALL_RPM_ONLY_PACKAGES"
    fi
}

update_centos()
{
    yum -y update $PACKAGES --enablerepo="imunify360-rollout-*-bypass"
    if rpm -qi imunify-patchman &>/dev/null; then  # optional
        yum -y update imunify-patchman --setopt=obsoletes=0 --enablerepo="imunify360-rollout-*-bypass" || true
    fi
}

update_debian()
{
    if dpkg-query -s imunify-patchman &>/dev/null; then  # optional
        PACKAGES="$PACKAGES imunify-patchman"
    fi
    PACKAGES="$(dpkg-query -W -f='${binary:Package}\n' $PACKAGES 2>/dev/null || true)"
    # first enable rollout bypass repos
    APT_REPO_PATH="/etc/apt/sources.list.d/imunify-rollout-bypass.list"
    UPDATE_PARAMS=''
    cp "${APT_REPO_PATH}.disabled" $APT_REPO_PATH
    apt-get update
    # unhold packages before upgrade to allow update
    apt-mark unhold $PACKAGES 2>/dev/null || true
    # for silent mode
    # force save old config files. new files will be saved by dpkg
    if [ "$DEBIAN_FRONTEND" == "noninteractive" ]; then
       # see dpkg options https://man7.org/linux/man-pages/man1/dpkg.1.html
       # the same options as in the daily update cronjob
       </dev/null apt-get install --only-upgrade -y --allow-change-held-packages -o "Dpkg::Options::=--force-confdef" -o "Dpkg::Options::=--force-confold" $PACKAGES
    else  # interactive
       apt-get install --only-upgrade -y --allow-change-held-packages $PACKAGES
    fi
    if [ "$is_cloudways" = "true" ]; then
        echo "Cloudways environment detected, holding packages"
        apt-mark hold $PACKAGES 2>/dev/null || true
    fi
    rm $APT_REPO_PATH
}

detect_ostype
detect_product_${OSTYPE}
detect_cloudways_environment

if [ -z "$PACKAGES" ]; then
    echo "Neither ImunifyAV nor Imunify360 found installed"
    exit 1
fi

update_${OSTYPE}

MR SKB