­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ;j*: @sddlmZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlmZddlmZddlmZddlmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ddlm,Z,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2m3Z3m4Z4d Z5d Z6dZ7dZ8dZ9dZ:dZ;dZZ?ej=dZ@ejAjBdre jAjCddejDdeEde$jFjGejHddZIddZJdd ZKd!d"ZLd#d$ZMdd%d&ZNd'd(ZOd)d*ZPd+d,ZQd-d.ZRd/d0ZSd1d2ZTGd3d4d4eUZVGd5d6d6e,ZWGd7d8d8e,ZXGd9d:d:e,ZYd;d<ZZed=d>Z[dd?d@Z\dAdBZ]dCdDZ^iZ_dEdFZ`e`e2ja_bece dGdsy8ddldZeddlfZgeejhjiegjjeejhjidHkrekdIWnekk rYn8XdJdKZle2jmZnGdLdMdMeoZpGdNdOdOe2jmZqeqe2_mdPdQZrejsfdRdSZtdTdUZudVdWZvGdXdYdYeoZwdZd[Zxd\d]Zydd_d`ZzdadbZ{dcddZ|ddedfZ}dgdhZ~didjZdkdlZdmdnZdodpZdqdrZdsdtZdudvZdwdxZdydzZd{d|Zd}d~ZddZddZddZddZdddZddZddZddZddZdddZddZddZddZddZe&jdddZddZddZGdddZddZddZddZddZejejsfddZddZe&je*jdejfddZddZddZddZdddZddZddZdS))print_functionN)ArgumentParser)contextmanager)datetime)anomalyauth capabilitiesconfigconfig_handlers constantsdoctorerrorsfetch http_utils ipv6_supportkcarelibcare log_utilsplatform_utils process_utilsselinux server_infoserverid update_utilsutils) KcareErrorNotFoundSafeExceptionWrapper) HTTPErrorURLErrorhttplibjson_loads_nstr urlencodecZv312h24h48htestz./etc/sysconfig/kcare/freezer.modules.blacklistz/usr/libexec/kcare/kcdoctor.sh latest.v3 latest.v2z /etc/sysconfig/kcare/sysctl.conf z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/pythonignore)categorycCsDt}tjjtr@ttd}x|D]}|j|jq"W|j|S)Nr) setospathisfileFREEZER_BLACKLISTopenaddrstripclose)resultfliner;./usr/libexec/kcare/python/kcarectl/__init__.pyget_freezer_blacklistSs   r=cCsB|jd}|r(dj|d||dg}ndj|d|dg}|S)N.rrr?)splitjoin)ptypefilenameZ name_partsr;r;r< _apply_ptype]s  rDcCsJt|tjt_t|tjt_t|tjt_t|tjt_t|tjt_dS)N)rDr PATCH_BIN PATCH_INFOBLACKLIST_FILE FIXUPS_FILE PATCH_DONE)rBr;r;r< apply_ptypefs rJcCstj\}}}d}t|trbt|t rbyd|jtj|j|jf}Wqt t fk r^YqXnPt|t t t frt|t rd|}n*t|t r|jpt|j}|jpd|j}tj}tjtj|d|dt|dt||djtj|dt|ddd S) Nz[Errno %i] %s: '%s'z%srr__name__dattempts)Z agent_versionZpython_versiondistroZdistro_versionerrordetails tracebackrN)sysexc_info isinstanceOSErrorr errnor0strerrorrCAttributeError TypeErrorKeyErrorIOErrorretypetypeinnerrQr get_distror VERSIONget_python_versiongetattrstrrArRZ format_tb)r]valuetbZdetails_sanitizedrOr;r;r< format_exception_without_detailsns*  rgc Csvtjr dStjt}tjtjtj |}tj dd|}t j |t j}yt j|Wntk rpYnXdS)Nz/api/kcarectl-tracez?trace=)r UPDATE_FROM_LOCALjsondumpsrgrnstrbase64Zurlsafe_b64encodeZbstrget_patch_server_urlrZ http_requestrZget_http_auth_stringZ urlopen_base Exception)ZtraceZ encoded_traceurlZrequestr;r;r<send_excs rpcCstj}|dkr tj|ddStjtj}|dkrBtjdtjdttjd&}tj |j dtj |j dWdQRX|rt j |y |Wn*t k rtjjdtjdYnXtjddS)z Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: rNarzWait exception)r0forkwaitpidsetsid_exitr7r4r ZLOG_FILEdup2filenotimesleeprnrkcarelog exception)funcrzpidfdr;r;r< nohup_forks(      rcCstjjtjd}tjj|rtt|dH}y,t|j}|t j t j krRt ||Wnt k rhYnXWdQRXtj|tjdS)aCheck the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. z.kcareprev.lockr.N)r0r1rAr PATCH_CACHEr2r4intreadr SUCCESS_TIMEOUTryPreviousPatchFailedException ValueErrorr atomic_write timestamp_str)Zanchor_filepathZafile timestampr;r;r< touch_anchors   rcCsxytjtjjtjdWntk r.YnXtd|tj j yt ddWn t k rrt jjdYnXdS)z See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. z.kcareprev.lockdone)reasonzCannot send update info!N)r0remover1rAr rrVregister_actionrget_loaded_modulesclearget_latest_patch_levelrnrr{r|) state_datar;r;r< commit_updates  rcCs(tjtjjtjdtj||dddS)NpatchesrK)Z exclude_path) rclean_directoryr0r1rAr rrget_cache_path)khashZplevelr;r;r< clear_cachesrcCs>tjpd}dj||g}tjd|f}|r2||f7}tjj|S)Nnone-modules)r PREFIXrAr rr0r1)rfnameprefixZ module_dirr8r;r;r<get_current_level_paths    rcCstjt|dt|dddS)NlatestT)Z ensure_dir)rrrrd)r patch_levelr;r;r<save_cache_latestsrc CsVt|d}tjj|rRy"tt|djj}tj ||St t fk rPYnXdS)Nrr.) rr0r1r2rr4rstriprLegacyKernelPatchLevelrrZ)rZpath_with_latestplr;r;r<get_cache_latests   rc@s eZdZdS)CertificateErrorN)rL __module__ __qualname__r;r;r;r<r srcs eZdZdZfddZZS)UnknownKernelExceptionzunknown kernelc s6djtjdtjtj}tt|j |f|dS)NzLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r) formatrr`platformreleaserget_kernel_hashsuperr__init__)selfkwargsmsg) __class__r;r<rszUnknownKernelException.__init__)rLrrstatusr __classcell__r;r;)rr<rsrcs(eZdZdZfddZddZZS)ApplyPatchErrorzpatch apply errorcsFtt|j||||_||_||_||_tjd|_ t j |_ dS)Nr) rrrcode freezer_stylelevel patch_filerr`rOrr)rrrrrargsr)rr;r<rszApplyPatchError.__init__c Cs0dj|j|j|j|j|jdjdd|jDS)Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})z, cSsg|] }t|qSr;)rd).0ir;r;r< -sz+ApplyPatchError.__str__..)rrrrrOrrAr)rr;r;r<__str__&szApplyPatchError.__str__)rLrrrrrrr;r;)rr<rs rcs(eZdZdZfddZddZZS)rzprevious patch failedcs"tt|j||||_||_dS)N)rrrranchor)rrrrr)rr;r<r5sz%PreviousPatchFailedException.__init__cCsd}|j|j|jS)NzIt seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)rrr)rmessager;r;r<r:sz$PreviousPatchFailedException.__str__)rLrrrrrrr;r;)rr<r2s rcCstjdj|}yztj|}tjtj|j}t |d}|dkrRtj dn8|dkrftj dn$|dkrztj dntj d j||St k r}zt j ||WYdd}~XnXd S) Nz"/nagios/register_key.plain?key={0}rrzKey successfully registeredrzWrong key format or sizerrz!No KernelCare license for that IPzUnknown error {0}r?)rget_registration_urlrrurlopenr data_as_dictrkrr print_wrapperrrprint_cln_http_error)keyroresponseresrer;r;r<!set_monitoring_key_for_ip_licenseCs      rc cs>tjrtjtjddz dVWdtjr8tjtjddXdS)NT)shell)r ZBEFORE_UPDATE_COMMANDr run_commandZAFTER_UPDATE_COMMANDr;r;r;r< execute_hooksWs  rcCst}|j}|j}tj}|dkrht|tjtj t j |t t j|d}tjdtjtj|njtjdtjt|tjdt|tjtjtjtj tjt j tj|tjt jdS)a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: ri)Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptimelicensez --START--z LICENSE: N)_patch_level_infor applied_lvlr license_infordr AUTO_UPDATEr kcare_unamerrrrZ get_uptimerrrirj)fmtpliZ update_codeZ loaded_plZlicense_info_resultZresultsr;r;r< plugin_infocs,     rc Cs^tj}ytdd}Wntk r4tjr0dSdSX|dkrBdS||krNdStjrZdSdS)Ninfo)rrrrr)rloaded_patch_levelrrr IGNORE_UNKNOWN_KERNELrZstatus_gap_passed) current_levelZlatest_patch_levelr;r;r<get_update_statussrcCs2tjdd\}}|dkr*|jdr*dSdSdS)NrrZ CloudLinuxz7.extrarK)rr` startswith)rOversionr;r;r<edf_fallback_ptypesrcCsl|j|jf}tj||}tj||j|_|jjtj tj d|tkrZ|jj ddt|<|j rh|j dS)zFunction remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect rNrr)hostZportCONNECTION_STICKY_MAPgetsocketZcreate_connectionZtimeoutsockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername _tunnel_hostZ_tunnel)rZaddrZ resolved_addrr;r;r<sticky_connects  rZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.cGsdS)NTr;)rr;r;r<dummy_verify_callbacksrc@s,eZdZddZddZddZddZd S) SSLSockcCs||_d|_dS)Nr) _ssl_conn_makefile_refs)rrr;r;r<rszSSLSock.__init__cGs&|jd7_tj|jf|ddiS)Nrr7T)rrZ _fileobjectr)rrr;r;r<makefileszSSLSock.makefilecCs"|j r|jr|jjd|_dS)N)rrr7)rr;r;r<r7s z SSLSock.closecGs |jj|S)N)rsendall)rrr;r;r<rszSSLSock.sendallN)rLrrrrr7rr;r;r;r<rsrc@seZdZddZdS)PyOpenSSLHTTPSConnectioncCstjj|tjjtjj}|jtjjtjj Bt j rJ|j tjj tn|j tjjt|jtjj||j}|j|jp|j}|j|j|jt j rt|j|t||_dS)N)r!HTTPConnectionconnectOpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r CHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERrZ VERIFY_NONEZset_default_verify_pathsZ ConnectionrZset_connect_staterrZset_tlsext_host_nameencodeZ do_handshakematch_hostnameZget_peer_certificater)rZctxZconnZ server_hostr;r;r<rs  z PyOpenSSLHTTPSConnection.connectN)rLrrrr;r;r;r<rsrcCstjr&tj||}tjtj|ddS|dk}tjo6|}xrd|fd|fdgD]Z\}}t j |||d} t j | |d} |rdj | } tj|t ||d | }d } |s|rt || kr|rd nd } tjd j | qNyxtjtj|dd} tjrJtj| rJtj| }tj|}|r.tjdj |ddntjddd|rJ|j| Stk r}z>|sl|r|jdks|jdkrtjdj |wNWYdd}~XqNXqNWdS)NF) check_license latest.v1 latest.v2T)secure_boot_info perf_metrics) b64_encodingzinfo={0}?iXzsecure boot infoz perf metricsz/Check-in URL param is too large, discarding {0}z:Automatic kernel anomaly report uploaded successfully: {0}) print_msgz$Failed to send kernel anomaly reportizCCheck-in request failed with error: {0}, retrying with reduced info)rr)FF)rr)r rhrZget_kernel_prefixed_urlrZwrap_with_cache_keyr urlopen_authZSEND_PERF_METRICSrZencode_checkin_payloadrstickyfylenrlogwarnZKERNEL_ANOMALY_REPORT_ENABLErZdetect_anomalyprepare_kernel_anomaly_reportsend_data_packageloginforemove_archiverr)rrrmoderorZ perf_enabledrrZsinfoZ request_paramZmax_url_lengthZ discard_infor8 data_package upload_nameexr;r;r<_fetch_patch_level_requestsB       $r c Cs8tj}tjdk r$tj|ttjSxtD]}yt||||}tj |j t t j |jj}tjdj||dd|r|jdrt|}|jdg}tj|stjdtj||d|d|d Stj|t|Stk rYq,tk r(}z|jd krtd WYdd}~Xq,Xq,WtdS)Nz;fetch patch level, reason: {0}, kernel latest response: {1}F)r{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgraderbaseurlrzKC licence is required)rr) rrr PATCH_LEVELrr PATCH_LATESTr r Zset_feature_flags_from_headersheadersupdate_all_kmod_paramsrrkrrrrrrr"rr Zhas_kc_capabilitiesrCapabilitiesMismatchZKernelPatchLevelrrrrr) rr rrrrZ latest_infoZrequired_capabilitiesr r;r;r<fetch_patch_level;s2     rcCs<|jt|tj}tjjdj|ytj |ddddSt k r^tjjdj|dSt k r}ztjj dj|t |WYdd}~XnX|jt|tjtj}tjjdj|ytj |ddWnbt k rtjjdj|dStk r6}ztjjd j|t |WYdd}~XnXdS) NzProbing patch URL: {0}FHEAD)rmethodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1})rz{0} is not available: {1})file_urlrDr rErr{rrrrrrndebugrdr ZSIGr )rrBZbin_urlr ror;r;r< probe_patch\s(**rcCsF|tjkr|jtj}n |j|}|j|}tj||tjtj |dS)N)Z hash_checker) r KMOD_BINZkmod_urlr cache_pathrZ fetch_urlr USE_SIGNATUREZget_hash_checker)rnameroZdstr;r;r<fetch_and_verify_kernel_fileus    r!c@s>eZdZdddZddZddZdd Zd d Zd d ZdS) PatchFetcherNcCs ||_dS)N)r)rrr;r;r<rszPatchFetcher.__init__cCs t|j|S)N)r!r)rr r;r;r<_fetchszPatchFetcher._fetchcCsr|jjtj}|jjtj}|jjtj}|jjtj}tdd||||fDopt j j |dkopt j j |dkS)Ncss|]}tjj|VqdS)N)r0r1r2)rr1r;r;r< sz0PatchFetcher.is_patch_fetched..r) rrr rIrErFr rallr0r1getsize)rZpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr;r;r<is_patch_fetchedszPatchFetcher.is_patch_fetchedcCs4|jdkrtd|js|jS|jr6tjd|jStjdt|jtjrytj |jj t j dd}Wnt k r~Yn(X|jjdd}|r|jjtj||_y|jt j Wn0t k rtdj|jt jpdd d YnX|jt j|jtj|jtj|jjt jd d d tjtj |jS)Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr)rz KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch leveldefaultzpatch level not found)rwb)r )!rrr'rrrUrrrrrr rErrrupgraderrkr#rr PATCH_TYPErFr rextract_blacklistrrrIrrestore_selinux_contextr)rresprr;r;r< fetch_patchs:      zPatchFetcher.fetch_patchcCsJt|jjtjdj}|rFtj|}|rFtj |jjtj |j ddS)Nr.r) r4rrr rFr BLACKLIST_REsearchrrrGgroup)rZbufZmor;r;r<r-s  zPatchFetcher.extract_blacklistcCs|dkr dSyt|tj}Wntk r0dSX|jjdd}|rT|jtj|}|j tj}t |d}t dd|j D}WdQRXx|D]}t||qWt jtjdS)z Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nz KC-Base-Urlr.cSsg|] }|jqSr;)r)rfixupr;r;r<rsz-PatchFetcher.fetch_fixups..)r!r rHrrrr+rrkrr4r/ readlinesrr.r r)rrr/rZ fixups_fnamer9fixupsr4r;r;r< fetch_fixupss    zPatchFetcher.fetch_fixups)N) rLrrrr#r'r0r-r7r;r;r;r<r"~s   )r"cCs8t}tj|j|jtjkr*tjdn tjddS)Nrr) rrrrrPLIPATCH_NEED_UPDATErSexit)rr;r;r< kcare_checks    r;c Cs\t}t|}y tj}Wntk r2i}YnXtj}d}|dk r\tj|dj d}tj }|j dg}t t j|dd}t |}dd|D} t t j| d d} td d |D} || } tj} | st jd n t jd t jdj|t jdj||dkr t jdj|| dkr:t jdj| | dkrNt jdt jddS)NZUnknowntsz%Y-%m-%drz kpatch-cve)Z cve_fieldcSs"g|]}|jdgD]}|qqS)r)r)rrecpatchr;r;r<rsz%show_generic_info..Zcvecss|]}t|jdgVqdS)rN)rr)rr=r;r;r<r$sz$show_generic_info..z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}rz* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r_kcare_patch_info_jsonrZlibcare_patch_info_basicrrZ get_staterZ fromtimestampZstrftimerrrrZextract_unique_cvessumrrr)r kcare_info libcare_infostateZ latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countrr;r;r<show_generic_infos>         rDFc Csytdtjd}|st|jtj}tjt j |j }|rgi}}x>|j dD]0}tj |}|rxd|krx|j|qR|j|qRW||d<tj|}tj|WnJtk r}ztj||jdSd}~Xntk rtjdYnXd S) z Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None r)rpolicyz z kpatch-namerrNzNo patches availabler)rr POLICY_REMOTErrr rFrrkrrrr@rappendupdaterirjrrrrro) is_jsonrro patch_inforr8chunkdatarr;r;r<kcare_latest_patch_infos,      rMcCsd|ji}|jdk rt|}g}x>|jdD]0}tj|}|rRd|krR|j|q,|j|q,W||d<tj }|r||dnd|d<|S)Nrz z kpatch-namerrunknown) rr_kcare_patch_infor@rrrGrHrZread_dumped_kernel_patch_level)rr8rJrrKrLZsaved_patch_levelr;r;r<r?4s     r?cCsTtj}tj||jtj}tjj|s2t dddt |dj }|rPt j d|}|S)NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not found)rr.rK)rrrrr rFr0r1r2rr4rr1sub)rrrrr;r;r<rOHs  rOcCsZt}|s>|jdkr tj|j|jdkr.dStjt|ntjtjt |dddS)NrT)Z sort_keys) rrrrrrrOrirjr?)rIrr;r;r<rJWs   rJcCs:tjd|g}tj|}tj}d}tj||tj||kS)Nz file-infozkpatch-build-time)r KPATCH_CTLr check_outputr _patch_infoZget_patch_value)new_patch_filerZnew_patch_infoZcurrent_patch_infoZbuild_time_labelr;r;r< is_same_patchcs   rUcCsL|dkr dS|r||krdS||kr(dStjtj|tj}t|sHdSdS)NrFT)rrrr rErU) applied_level new_levelrTr;r;r<kcare_need_updateks rXcCsptjrltjjtotjttjs6tj j dj tdSt j dddtgdd\}}}|dkrltj j dj |dS) Nz-File {0} does not exist or has no read accessz /sbin/sysctlz-qz-pT) catch_stdoutrz%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr0r1r2 SYSCTL_CONFIGaccessR_OKrr{warningrrr)r_r;r;r< update_sysctl}sr_c stjjtsttdjtjttjs>tj j dj tdSttdj}|j }|j dx,|D]$tfdd|Dsb|jqbWx|D]}|j|dqW|jWdQRXdS) z*Update SYSCTL_CONFIG accordingly the editsrqzFile {0} has no read accessNzr+rc3s|]}j|VqdS)N)r)rr.)r:r;r<r$sz#edit_sysctl_conf.. )r0r1r2rZr4r7r[r\rr{r]rr5seekanywritetruncate)rrGZsysctllinesrqr;)r:r<edit_sysctl_confs     rfcCs.x(|D] }tj|rtdj|ddqWdS)NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel module)r)CONFLICTING_MODULES_REmatchrr)rmoduler;r;r<detect_conflicting_moduless   rjcCsdjtjS)Nz/lib/modules/{0}/extra/kcare.ko)rrZget_system_unamer;r;r;r<get_kcare_kmod_linksrkc CsXtdd}tjtj|tj}tjj|s.dSt |d}|j dddkSQRXdS)Nr)rrbs~Module signature appended~ i) rrrrr rr0r1r2r4r)rZ kmod_fileZvfdr;r;r<kmod_is_signeds    rncs4tjddkrdSddg}tfdd|DS)Nz /proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c3s|]}|kVqdS)Nr;)rr) system_keysr;r<r$sz'kcare_certs_enrolled..)rZ try_to_readrb)Z kcare_keysr;)ror<kcare_certs_enrolleds  rpcKsdd|g}x&|jD]\}}|jdj||qWtj|dd\}}}|dkr`tdj||dddS) Nz /sbin/insmodz{0}={1}T)rYrzLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load error)r)itemsrGrrrr)Zkmodrcmdrrerr^r;r;r< load_kmods rscCsTtjr,tdkrtdtdkr,tdtjsDtjsDtjrPtddddS)NFz4Secure boot is enabled. Not supported by KernelCare.z|}YnXtj rbt j j tj  rbt j tj t}t|tfdd|jD}t|f|tdS)Nc3s"|]\}}|kr||fVqdS)Nr;)rkv)available_kmod_paramsr;r<r$!sz"load_kcare_kmod..)rkrrr rshutilcopyrnr rr0r1rrrr}dictrqrs update_depmod)rrr{Z kcare_fileZ kmod_paramsr;)rr<load_kcare_kmods   rcCsXdg}|dk r|jd|gtj|ddd\}}}|rTtjdjdj|||dddS) Nz /sbin/depmodz-aT)rYruz%Running of `{0}` failed with {1}: {2} F)r)extendrrrrwrrA)unamerrrr^stderrr;r;r<r's rcCs8tjd|gdd\}}}|dkr4tdj||dddS)Nz /sbin/rmmodT)rYrzUnable to unload {0} kmod {1}zkmod unload error)r)rrrr)modnamerr^r;r;r< unload_kmod3srcCsTg}xJdg|D]<}tj||dj|}tjj|rt||jdj|qW|S)NZvmlinuxz fixup_{0}.koz fixup_{0})rrrr0r1rrsrG)rrrZloadedmodZmodpathr;r;r< apply_fixups9s rc CsDx>|D]6}y t|Wqtk r:tjjd|YqXqWdS)Nz$Exception while unloading module %s.)rrnrr{r|)r6rr;r;r< remove_fixupsCs   rcCs|r |}n6tjrtj}n(tj|r2d|tjdfSd|tjdfSdddddd}|j}||krj||}ntdj||tjdd d ||tjdfS) NZfreeze_conflictTr(FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})zfreezer style detection error)r)r Z PATCH_METHODr= intersectionupperrr)freezerrrZpatch_method_mapr;r;r<get_freezer_styleKs&  rrKcs|||dtdtj}tj}t|t||}tj||tj}t ||dj |tj t j tj|} d|k} | otj||} |dk } | ot|otj| } j|| d| rtddS| rtdt|||}tdt|td t|| r"td tdd } | sz5Patch level {0} applied. Effective kernel version {1}waitcstS)N)rr;)rr;r<szkcare_load..)rz)"rrrrrjrrr rErrr,rrZ parse_unameZis_kmod_version_changedrUZkcare_update_effective_versionrHrkpatch_ctl_unpatchrrrrkpatch_ctl_patchr_rrrrZtouch_status_gap_filerr)rrr r use_anchorrrrr descriptionZ kmod_loadedrZ patch_loadedZ same_patchr6r;)rr< kcare_loadmsR              rc Cstjg}tj||tj}tjj|r2|j d|g|j dd|g|j d|dg|j |t j |dd\}}}|dkrt ||||dS)Nz-br>z-dz-mrT)rY)r rQrrr rGr0r1rrrGrrr) rrrrrrZblacklist_filerr^r;r;r<rs  rcCs^tjtjdd|dgddd\}}}|dkrZtjdj||ddtd j|t|d d dS) Nrz-mrT)rYruz4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}F)rzError unpatching [{0}] {1}z unpatch error)r) rrr rQrrwrrrd)rrr|rr;r;r<rs  rcCs8||d<ttj|d<tjtjjtjdt |dS)Nactionr<z kcare.state) rryrrr0r1rAr rrd)rrr;r;r<rsrcCspd}tjj|sdSxVtj|D]H}tjj||dd}tjj|sDq tj|}||kr tj|t|q WdS)Nz/usr/lib/modules/z weak-updateszkcare.ko) r0r1isdirlistdirrAislinkreadlinkunlinkr) kmod_linkZ modules_pathentryZ sym_link_pathZ target_pathr;r;r<update_weak_moduless    rc CsJtj}t}y|j|Wn8tk rT}z|sDtdj|ddWYdd}~XnXtj}t||}t d|kr|dk }|rt tj ||}t j tjdd|dgddd \} } } t|| dkrtjd j| | d d td j| t|ddtjtjtdtdtdt} tjj| r4tj| t| WdQRXdS)NzUnable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval error)rrrz-mrT)rYruz4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}F)rzError unpatching [{0}] {1}z unpatch errorr)countdelay) rrr"r7rnrrrrrrrrrr rQrrrwrdrZretryrZ check_excUNLOAD_RETRY_DELAYrrkr0r1r2rr) rforcerpferrrrZ need_unpatchr6rr|rrr;r;r< kcare_unloads:    rcCs8t}|rt|S|jdkr"|jS|jdk r4tjSdS)Nr)r_kcare_info_jsonrrrrrS)rIrr;r;r<rAs  rAcCsRd|ji}|jdk r>|jtjtj|jtj|jd|j |d<t j |S)Nrzkpatch-descriptionz kpatch-state) rrrHrrrrSZparse_patch_descriptionrrCrirj)rr8r;r;r<rs    rc@s$eZdZdZdZdZdZddZdS)r8rrrrrcCs"||_||_||_||_||_dS)N)rr remote_lvlrrC)rrrrrrCr;r;r<r%s z PLI.__init__N)rLrrrr9PATCH_UNAVALIABLEPATCH_NOT_NEEDEDrr;r;r;r<r8s r8c Cstj}ytdd}|rJt||r6tjdd}}}qxtjdd}}}n.|dkrftjdd}}}ntjd d}}}t|||||}Wnltk rtj }t j rd j t j t jdtj}nd j t jdtjtj}t||ddd }YnX|S) Nr)rz*Update available, run 'kcarectl --update'.ZappliedzThe latest patch is applied.rz(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingszLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.Z unavailable)rrrrXr8r9rrrrr STICKY_PATCHrrr`rrr)Zcurrent_patch_levelZnew_patch_levelrrrCrr;r;r<r-s8   rc Csd}yXtj}td|fd|fg}tjdj|}tj|}tj tj |j }t |dSt k r}ztj||d Sd}~XnZtk r}ztj||d Sd}~Xn0tk r}ztjdj|d Sd}~XnXdS) z Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise N server_idtagz/tag_server.plain?{0}rrzInternal Error {0})r get_serveridr#rrrrrrrrkrrrrrr rnrw) rrorZqueryrrrZueZeer;r;r< tag_server_s"    rcCstjd}tjdj|t}tj}y:tj ||j }tj t j ||j tj|j ||j }Wn2tk r}ztjdj|WYdd}~XnXtjd|tjgdd\}}}|rtdj||dd WdQRXdS) Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)ruzScript failed with '{0}' {1}zdoctor script failed)r)rrmrZlogdebugrKCDOCTORtempfileZNamedTemporaryFilerZfetch_signaturer Z save_to_filerrZcheck_gpg_signaturernrwrrrZget_patch_serverr)Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturerrr^rr;r;r<kcdoctorzs   "rc CsBtjdjt}ytj|Wntk r2dSXtjddS)Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) rrmrEFFECTIVE_LATESTrrr rr)ror;r;r<check_new_kc_versionsrc Cstj}t|}|tjkp*|tjko*|dk}yt||}Wntjk r}z.|dkrXt j t |t j dtj }WYdd}~Xn<t k r}z |rnt jjdj|WYdd}~XnX|tjkr|} n@|} |dkr|tj krtj|d} n|tjkr |} ntd| S)a Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string Nz#Using previously downloaded patcheszUnable to send data: {0}rz9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)rrrr rFZPOLICY_LOCAL_FIRSTrrrrrrdZ POLICY_LOCALrnr{r]rrr) rrEr rZ cached_levelZconsider_remote_exZ remote_levelrr rr;r;r<rs2  $    rcCs|dkr dS|dkrdn|t_ttddtjrtjtjdtjdkrntjrntjpXt }t dd d j |ft j d j |ntdj |dddS)Nedfr(rKZprobe)r)r,rvrfs.enforce_symlinksifownerfs.symlinkown_gidzfs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailable)r)rvr)rr)r r,rrr update_configrZ is_cpanelZ FORCE_GID CPANEL_GIDrfrrrr)rBZgidr;r;r<update_patch_types rZkernelc $Cshttj|tjkrtytd||d}WnRtk r~}z6|tjtj fkrltj rlt |}t j j|dSWYdd}~XnXtj}|tjkrtj rdSt|}|jt||dst jddSy(tjtjdddtjtjdd dWn"tk rt j jd YnXtj}t(|j|t|||||tj kd WdQRXtj|t ||dS) ax :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode rH)rrEr N)rVrWz%No updates are needed for this kernelrz kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r)!rxr r,r rFrrrUPDATE_MODE_AUTOUPDATE_MODE_SMARTrrdrr{r]rrrr"r0rXrrrrrnr|rrr7rZdump_kernel_patch_levelr) rr rErrrrrrr;r;r< do_updates<      " rcCstttjttjptjttjp$tjf}|dkr@tdddtjrLtjS|t j krptjp`tj}tjpltj}n tj}tj}|r|S|rd|SdS)NrzInvalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settings)rzrelease-) r@boolr rZ UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETrr UPDATE_MODE_MANUAL)r rrZpatchsetr;r;r< get_stickys&  rcCs |d|S)Nr>r;)rrr;r;r< _stickyfy<srcCs t|}|s|S|dkr"t||Stj}|sDtjjdtjdyt j t j dj |}Wn:tk r}ztj||jtjdWYdd}~XnXtjtj|j}t|d}|dkrt|d |S|d kr|S|d krtjjd tjdtjjd |dtjddS)z Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyrz!/sticky_patch.plain?server_id={0}rNrrrrrrzEServer ID is not recognized. Please check if the server is registeredzError: rrrrr?r)rrrrrr{rrSr:rrrrrrrrorrrkrr)filer srrrrrr;r;r<r@s2       rc Csg}|s dS|jd}|d}|dd}|jd}||krLtdt||s`|j|jkS|dkrt|jdn>|jd s|jd r|jtj|n|jtj|j d d x|D]}|jtj|qWtj d d j |dtj } | j |S)zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr>rrN*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r@rrreprlowerrGrreescapereplacecompilerAZ IGNORECASErh) ZdnhostnameZ max_wildcardsZpatspiecesZleftmostZ remainderZ wildcardsZfragZpatr;r;r<_dnsname_matchls(     rc Cs g}xBt|jD]2}|j|}|jdkrddt|jdD}qW|sTtdg}x0|D](\}}|dkr^t||r|dS|j|q^W|s|j j }t||rdS|j|t |dkrt dj |d jtt|n,t |dkrt d j ||d nt d dS) NZsubjectAltNamecSsg|]}|jjddqS)ryr)rr@)ritr;r;r<rsz"match_hostname..,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSrz(hostname {0} doesn't match either of {1}z, zhostname {0} doesn't match {1}rz=no appropriate commonName or subjectAltName fields were found)rangeZget_extension_countZ get_extensionZget_short_namerdr@rrrGZ get_subjectZ commonNamerrrrAmapr) ZcertrZsanrrZdnsnamesrreZcnr;r;r<rs0       rc Cs tddd}|jdddd|jdd d dd|jd d dd|jd dddd|jdddd|jdddd|jdddd|jdddd|jdddd|jdddd|jdd dd|jd!d"dd|jd#d$dd|jd%d&dd|jd'd(d)d|jd*d+dd|jd,d-dd|jd.d/dd|jd0d1dd|jd2d3dd|jd4d5d6d|jd7d8d9d|jd:d;dd|jdd?dd|jd@dAdd|jdBdCdd|jdDdEddFdG|jdHdIdd|jdJdKdd|jdLdMdd|jdNdOdd|jdPdQdd|jdRdSdd|jdTdUdd|jdVdWdd|jdXdYdd|jdZd[d\tdd]d^|jd_d`dd|jdadbdd|j}|jdcddd\d|jdedfdd|jdgdhdd|jdidjd\dd]dk|jdldmdndd]do|jdpdqdr|jdsdtdd|jdudvdwdxdytjs|jdzd{d|d}d]d~|jddd|d}dd~|jdddd|jddddd|jddddd|jdddd|jddddd|jddddd|jddddd|jdddddd|jdddd|jdddd|jddd6dd\dd]d|j}tjtjsFtj dg7_ |j dk rzt t d|j j djtj rvdSdS|js|jrtjrtjt_ntjt_n|jrtjt_|jstjdkrtdtjddStj}|jrtj }n|jrtj!}t"j#|tj$stj%|j&r,t'j(|j)rn|j)dkr\t*|j)t_+tj,tj+dndt_+tj,dd|j-dk rtj,|j-d|j-t_.|j/rd]t_0|j1rd]t_2|j3rdt_4|j5rt5|j6rt7j8dt9n8|j:rtj;dkrtj|j?r&|j?t_@|jAr@t7j8dt9dt_@tj@jBdt_@tj@r~tj@tCkr~t"jDjEdjFtj@djGtC|jHrdt_Id|jHt_J|j=rtK|j=tj;dkrtLt_;t7j8djFtj;pdt9|jMrt'jNtOjM|jPddS|jQr$tQjQdddd}t'jNtPjR|dStStj;|jTrJtTjUtV|jWddS|jXrtYjZtQjQdddd}djF|j[}|j\rt'jN|nRtYj]|}|rt"j^djF|nt"j_ddd|j`rt'jN|n|r|ja|jbr|jPrtbddntbdS|jcrtj,dddS|jdr0tj,dddS|jerHtjf|jedS|jgrZth|jgS|jirjtjji|jkrtj;dkrtj,ddtjjk|jk|jlS|jmrtjjmdkrdSdS|jndk rto|jnS|jprt'jNtjqtr|d|ddk rtsjt|judStj s|jv rd|jvini}|jw r2tsjxS|jy rVtsjzf|dk rVt"j^dă|j{ rvtsjzfdtj|i|n|j} rtsj~t"j^dƃ|j rtsjt"j^dǃ|j rt'jNtsj|j rt'jNtsj|j rtsj rt'jNtsj|j|jdk rj|jdk r,tj p(ttsjj} nddɄ|jj dD} tsjzfdt| i|dk rjt"j^dă|j rtsjzftj|dd˜||j rt'jNt|jPdd} |j rt7j8dt9d} |j r|j} |j rt| tjtjd΍|j> rt| tjdύt"j^dЃ|j rt'jNtj|j r>t| |jdэt"j^d҃|j rld]t_tjtjddӃt| tj|dύ|j rt|jPd|j rtS|j rt|jPd|j rtttjdk rtdS)NZkcarectlz)Manage KernelCare patches for your kernel)Zprogrz--debugrKZ store_true)helprz-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z --app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez) into an isolated cache, leaving the default storage untouched. Use together with --lib-update or --userspace-update.)rrrr(rzlibcare-enabledrrrzPlease run as root)r)r)rzTFlag --edf-enabled has been deprecated and will be not available in future releases.rr(zMFlag --test has been deprecated and will be not available in future releases.r(/z(Prefix `{0}` is not in expected one {1}.rzfile:z+edf patches are deprecated. Fallback to {0})rIr)rrr)Zforce_fallbackz)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}z$Failed to send kernel anomaly report)rri)rZYES)rZNOrvr)r,rzUserspace patches are applied.r zUserspace patches are unloaded.zLibcare plugin reloaded.cSsg|]}|jjqSr;)rr)rZptchr;r;r<r5szmain..limit)r rzQFlag --nofreeze has been deprecated and will be not available in future releases.r)r rE)r zKernel is safe)rz=KernelCare protection disabled. Your kernel might not be safe<)rZ add_argumentrZadd_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_argsr Zset_settings_from_config_fileZFLAGSZ has_flagsr/filterr@issubsetquietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORrZ PRINT_DEBUGrr0getuidprintrSrloggingZINFOZWARNINGDEBUGrZinitialize_loggingZIGNORE_FEATURE_FLAGSZset_feature_flags_from_cacherrZclear_all_cacheZset_patch_levelrdrrZset_sticky_patchrZ nosignaturerZ no_check_certrr~rrtZ edf_enabledwarningswarnDeprecationWarningZ edf_disabledr,ZPREV_PATCH_TYPEZset_patch_typerHrrr(rEXPECTED_PREFIXr{r]rrAZlocalrhZ PATCH_SERVERrrZapp_inforrrirrjrJr Zsend_doctor_reportrZfallbackZkernel_anomaly_reportrrZ archive_pathrrrrZ keep_localrrZenable_auto_updateZdisable_auto_updateZ set_configZupdate_config_from_argsZset_monitoring_keyrZ unregisterrregisterZregister_autoretryrrrrrarcrZset_libcare_statusrZlib_tagZuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updateZlib_auto_updaterZ lib_unloadZlibcare_unloadZ lib_repluginZlibcare_repluginZlib_inforBZlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updaterlistZget_userspace_mapkeyssortedZuserspace_auto_updaterrAZnofreezerZ smart_updaterrZ UPDATE_POLICYrrrrrrZCHECK_CLN_LICENSE_STATUSryrzrandomZuniformrJrrZlatest_patch_inforMZcheckr;rargvrD) ZparserZexclusive_grouprrrr Zlocal_path_messager Z lib_tag_kwrrr;r;r<mainsr                                               r)r%r&r'r()r)r*)N)N)F)F)N)rKF)rKF)r)Z __future__rrlrirr0rrrrrZsslrSrryrRrZargparser contextlibrrrKrrr r r r r rrrrrrrrrrrrrrrrrZpy23rr r!r"r#rrrr3rrrZrrZDOTALLr1rgr1rinsertfilterwarningsrr{ZsetLevelrr=rDrJrgrprrrrrrrrrrrrrrrrrrrrrrcZdistutils.versionZ distutilsZ OpenSSL.SSLrrZ StrictVersionZ __version__ ImportErrorrZHTTPSConnectionZPureHTTPSConnectionobjectrrr rrrr!r"r;rDrMr?rOrJrUrXr_rfrjrkrnrprsrtrxr}rrrrrrrrrrrrrrZlog_all_parent_processesrrArr8rrrrrFrrZtrack_update_statusrrrrrrrr;r;r;r<s    \    &    4  -! b +             " ?   -  2 .= , 3)