­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ;jb@s ddlZddlZddlZddlZddlZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZddlmZmZmZdZdOZdZd Zd Zd d d d Zd dedgfddedgfgZej ddZ!ddZ"ddZ#ddZ$Gddde%Z&ddZ'dPddZ(dd Z)d!d"Z*d#d$Z+dQd&d'Z,d(d)Z-e$d*d+Z.e$d,d-Z/e$d.d/Z0d0d1Z1d2d3Z2d4d5Z3d6d7Z4d8d9Z5dRd:d;Z6e$e'ej7dd?Z9ej7ej:d@ej;e$e'e jdEdFZ?dGdHZ@dSdIdJZAdKdLZBdMdNZCdS)TN)auth capabilitiesconfigconfig_handlers constantserrorsfetch log_utilsplatform_utils process_utilsselinux server_info update_utilsutils) HTTPErrorjson_loads_nstrurlquotez!/usr/libexec/kcare/libcare-client/run/libcare/libcare.sock/var/run/libcare.sockz /var/cache/kcare/libcare_patchesz /var/cache/kcare/libcare_cvelistz&/etc/sysconfig/kcare/libcare.logrotatedb)mysqldmariadbdpostgresZubuntuz16. libnss_dnsz7.c sttj}ty tj}|dj}|d}Wn0tk r`xtD]\}}}|OqFWYn>X|d}x2tD]*\}}}|dks||krp|j |rp|PqpWfdd|DS)Nrr.csg|]}|kr|qSr).0lib) blacklistedr-/usr/libexec/kcare/python/kcarectl/libcare.py Rsz/_get_effective_libcare_libs..) listr LIBCARE_LIBSsetr get_distrolower ExceptionLIBCARE_LIBS_BLACKLIST startswith) libsZ distro_infodistroversion_Zbl_libsZversion_dottedZ bl_distroZ bl_versionr)rr _get_effective_libcare_libs;s   r.cCsdddgtdS)Nrrr)rr*)r.rrrr get_userspace_mapUsr/cGstjjtjd|f|S)N userspace)ospathjoinr PATCH_CACHE)libnamepartsrrr get_userspace_cache_path\sr7csfdd}|S)NcsVz ||Sy tdWn6tk rN}ztjdj|ddWYdd}~XnXXdS)N clearcachez$Libcare cache clearing failed: '{0}'F) print_msg)libcare_clientr'r logerrorformat)argskwargserr)clblrr wrapperas   z$clear_libcare_cache..wrapperr)r@rAr)r@r clear_libcare_cache`s rBcs0eZdZdfdd Zd ddZddZZS) UserspacePatchLevelNcst||j||S)N)super__new__)clsr5buildidlevelbaseurl) __class__rr rEoszUserspacePatchLevel.__new__cCs||_||_||_||_dS)N)rHr5rGrI)selfr5rGrHrIrrr __init__rszUserspacePatchLevel.__init__cGst|j|jt|f|S)N)r7r5rGstr)rKr6rrr cache_pathxszUserspacePatchLevel.cache_path)N)N)__name__ __module__ __qualname__rErLrN __classcell__rr)rJr rCns rCcsddfdd}|S)NcSsd \}}z|dkrt}i}g}x8t|D],}|jdd||jd<|j|jdgq*Wtj|dd}djd d |jD}djt|}Wdtj t |d d tj t |d d XdS)z(KPT-1543 Save info about applied patchesNzlatest-versionpackagepatchescve) cve_field cSsg|]}dj|qS) )r3)rrecrrr r!szLrefresh_applied_patches_list..save_current_state..T) ensure_dir)rSrS) _libcare_info_get_patches_infogetextendrextract_unique_cvesr3itemssorted atomic_writeLIBCARE_PATCHESLIBCARE_CVE_LIST)infoZversionsZcvesZpackagesZ all_patchesrZZcves_setrrr save_current_state}sz8refresh_applied_patches_list..save_current_statec s"d}z||}|S|XdS)Nr)r=r>rf)r@rgrr rAs  z-refresh_applied_patches_list..wrapperr)r@rAr)r@rgr refresh_applied_patches_list|srhc"Cstjpd}t|}t|j}tjtj|d|||d}|dtj d|7}tj|d}|rlt j j d||}i}|rd|i|d <y t jtj|fd d i|}Wntjk r|rtjd j||d d dStjt||ddYnLtk r4} z.| jdkr"|r"tjdj|ddWYdd} ~ XnXtj|jttj |j!} | jdg} t"j#| s|tj$dj|t%||| d| jd} t&| d} t||| d}t j j'| st j j(|dkr:tj| d}yt j)||tj*t j+| dWn<tk r8} z| jd(kr&tj,dWYdd} ~ XnXt||| }dd |d!|d"g}t-j.|ddd#\}}}|rtjd$j|||d%dt||d&}t j j/| rt j j0|rtj|t j1| |d't j2|d'|| S))Nmainuz latest.v1z?info=updater*tagsZStickyheaders check_licenseFz;No libcare patchset available for {0} at tag {1}, skipping.)r9T) ignore_errorsiz8Invalid sticky patch tag {0}: server rejected the value.zinvalid lib sticky patch)statusrzkLatest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.rHrIz patch.tar.gzrZ patch_url)check_signature hash_checkerzKC+ licence is requiredtarZxfz-Cz--no-same-owner) catch_stdout catch_stderrz(Patches unpacking error: '{0}' '{1}' {2}zpatches unpacking errorlatestz.tmp)rsrt)3rPREFIXrstriprget_patch_server_url LIBNAME_MAPr^rZencoded_server_lib_infor1r2r3r wrap_with_cache_keyr urlopen_authrNotFoundr loginfor<shutilrmtreer7rcode KcareErrorrset_feature_flags_from_headersrmrnstrreadrhas_lc_capabilitiesCapabilitiesMismatchrCrMexistsgetsize fetch_url USE_SIGNATUREget_hash_checkerNoLibcareLicenseExceptionr run_commandislinkisdirsymlinkrename)r5build_id patch_leveltagprefixurl cache_dstZ extra_kwargsresponseexmetarequired_capabilitiesrHplevelZ patch_pathdstcmdrstdoutstderrZ link_namerrr fetch_userspace_patchsr          "     rcCsL| t_|sttj|rdndd|r0ttjjd|r@dnddS)NFALSEYES)LIBCARE_DISABLEDzlibcare service is enableddisabled) rrlibcare_server_stopr update_configlibcare_server_startr kcarelogrf)rrrr set_libcare_statussrc Cstjstjjtjr^tjtjddgtjtjddgtjtjddgtjtjddgn6ytjdd ddg}Wnt k rdSXtj|dS) Nstopzlibcare.socketzlibcare.servicez reset-failedlibcareservice /usr/sbin//sbin/)rr) rSKIP_SYSTEMCTL_CHECKr1r2r SYSTEMCTLr rfind_cmdr')rrrr rsrc Cstjstjjtjrtjtjdddgddd\}}}|dkr@dStjtjddgtjtjddgtjtjd d gtjtjd dgtjtjd dgn@trdSytj d dd d g}Wnt k rdSXtj|dS)Nz is-activez--quietzlibcare.serviceT)rvrwrrzlibcare.socketz reset-failedrstartr /usr/sbin//sbin/)rr) rrr1r2rrr rlibcare_server_startedrr')rr-rrrr rs& rTcsdjddt|pgD}ddg}s6|dd|g7}y t|}Wn6tk rx}ztjdj|d d WYdd}~XnXg}x@|jd D]2}|ry|jt j |Wqt k rYqXqWd d |D}x.|D]&}t fdd|dj D|d<qW|S)N|css|]}djtj|VqdS)z({0})N)r<reescape)rprocrrr $sz _libcare_info..rfz-jz-lz-rz/Gathering userspace libraries info error: '{0}'zuserspace libs info error)rprXcSs$g|]}|jd|jd|dqS)commpid)rrr*)pop)rlinerrr r!:sz!_libcare_info..c3s(|] \}}d|ks r||fVqdS)patchlvlNr)rkv)patchedrr r=sr*)r3rbr:r'rrr<splitappendjsonloads ValueErrordictra)rlimitZregexprlinesr?resultrr)rr r\ s& &  &r\c Cst}x<|D]4}x.|djD]\}}|j|d|dfqWq Wg}t}xb|D]Z}xT|D]L\}} t||t| d} tjj| r^t | d} |j t j | WdQRXq^WqTW|S)Nr*rGrz info.jsonr) r$raaddr/r7rMr1r2isfileopenrrload) rfrUrZr-datarumaprrrZpatch_info_filenamefdrrr r]Bs    "r]cCs ttS)N)r]r\rrrr libcare_patch_info_basicRsrcCs"t}|stjdtjd|iS)NzNo patched processes.r)rr r;rdumps)rrrr libcare_patch_infoWs rcCs"t}|stjdtjd|iS)NzNo patched processes.r)r\r r;rr)rrrr libcare_info_s rcCs.i}x$tD]}|jdd||jd<q W|S)Nzlatest-versionrSrT)rr^)rrZrrr _libcare_versiongs rcCs*x$tjD]\}}|j|r |Sq WdS)NrS)rrar))r5rTr,rrr libcare_versionns rcCsdjdd|DdS)Ncss|]}tj|dVqdS)N)rbstr)rprrr rvsz(libcare_client_format..r)r3)paramsrrr libcare_client_formatusrcCs,xtD]}tjj|r|SqWtjddS)NzLibcare socket is not found.)LIBCARE_SOCKETr1r2rrr)Zlibcare_socketrrr get_available_libcare_socketys  rc Gstjrtjdtjtjtjd}|jdd}z||jt |jtj t |}t j dj|d|j|x|jd}|sP||7}qpW|jdd }t j d j|d |S|jXdS) NzLibcare is disabled.r rzLibcare socket send: {cmd})rizutf-8replacez!Libcare socket recieved: {result})r)rrrrsocketAF_UNIX SOCK_STREAM settimeoutconnectrLIBCARE_SOCKET_TIMEOUTrr logdebugr<sendallrecvdecodeclose)rsockresrrrrrr r:s(        r:cCs|rzxp|D]h}td||}tjj|s(q ytdd|Wq tk rp}ztjdj||ddWYdd}~Xq Xq WdSx|D]}ytdt|Wn6tk r}ztjdj|d dWYdd}~XnXy tdWqtk r}ztjd j|ddWYdd}~XqXqWdS) Nrlrkz --storagez3Userspace patch applying error (storage={0}): '{1}'zuserspace patch apply error)rpZstoragez(Userspace storage switching error: '{0}'zuserspace storage switch errorz%Userspace patch applying error: '{0}') r7r1r2rr:r'rrr<)rrrZ storage_pathr?rrr libcare_patch_applys*     & rcCsHy tdWn6tk rB}ztjdj|ddWYdd}~XnXdS)Nunloadz&Userspace patch unloading error: '{0}'zuserspace patch unload error)rp)r:r'rrr<)r?rrr libcare_unloads rcCsDy tdWn2tk r>}ztjdj|WYdd}~XnXdS)z;Reload libcare-server plugin without restarting the server.ZrepluginzUserspace replugin error: '{0}'N)r:r'rrr<)r?rrr libcare_replugins rrcCst|tjkrtj rdSt}|dkr6t|j}g}x|D]}|j|j |gq@W|srt j dj |dSt ||d\}}}} |rtjd|st j ddStjtjjtjdtyt||dWn>tjk r} zt jt| tjdWYdd} ~ XnXt} t| } ttd d | Ds.zPatched before: {before})beforezPatched after: {after})aftercss|]}|D] }|Vq qdS)Nr)rrarrrr r scss|]}|D] }|Vq qdS)Nr)rrarrrr r scss|]}t|VqdS)N)len)rrrrr rszThe patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.)countoverallz*Object `{0}` is patched for {1} processes.)"rotate_libcare_logsrUPDATE_MODE_AUTOrLIB_AUTO_UPDATEr/r"keysr_r^r rr<check_userspace_updatesrrr restore_selinux_contextr1r2r3r4rr;rMr\_get_userspace_procsanyrr$valuessumrra)moderrrZprocess_filterZuserspace_patchfailedsomething_foundr-rrZ data_afterrZuniq_procs_afterZuniq_procs_beforeZdiffrrrrrr do_userspace_updatesR    r cCs\z.yt\}}}}Wntjk r*dSXWdtX|r@dS|rHdStjddrXdSdS)Nrz.libcarestatus)filenamer)rrrrrstatus_gap_passed)r r-libs_not_patchedrrr get_userspace_update_statuss rcCsdi}xZ|D]R}xL|djD]<\}}|jdr||kr>g||<||j|d|dfqWq W|S)Nr*rrr)rar^r)rfrrr5rZrrr r.s  "rcCsNt}xB|D]:}x4|djD]$\}}|j||d|jddfqWq W|S)Nr*rGrr)r$rarr^)rfrrr5rZrrr _get_userspace_libs9s  $rcs\s$t}gfdd|jDtdd}t|}d}}d}xt|D]}|\} } } y2t| | | |d} |r|| dkr|wNd}| dkrd}WqNtjk r} zd}tj t | WYdd} ~ XqNtj tj fk rYqNtj k rYqNtjk r>}z,t|ddd krd}tjt |WYdd}~XqNXqNWtjd d ||||fS) Ncsg|]}j|qSr)r_)rr*)rrr r!Esz+check_userspace_updates..F)rrT)rrrpzinvalid lib sticky patchz.libcarestatus)r)r/rr\rrrrrr logwarnrMrrAlreadyTrialedExceptionrgetattrr;rtouch_status_gap_file)rrrZ data_beforerr r rrZr5rrrerr)rr rAs>   $ rc sfd}d}tjddd}|rytj|tgdd\}}}Wn.tk rd}zd}t|}WYdd}~XnX|rtjd j|dd ntj d dd d t j j sdSt jd}yt j}tjdfdd|D}dd|D}|jddd} xD|D]<\}} | t j j| 7} | |krt j| tjjd| qWWn$tk r`tjddd YnXdS)NrrSZ logrotateF) raise_excT)rwrz5failed to run logrotate for libcare logs, stderr: {0})r9zlogrotate utility wasn't foundz/var/log/libcare/irz ^\d+\.log.*cs$g|]}j|rtjj|qSr)matchr1r2r3)rfn)libcare_log_directory pidlog_rerr r!sz'rotate_libcare_logs..cSsg|]}tjj||fqSr)r1r2getctime)rfprrr r!s)reversez%Removed %s because of logs size limitz)Failed to cleanup libcare server logfilesi)r rrLIBCARE_LOGROTATE_CONFIGr'rMr r;r<rr1r2rr!LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MBlistdirrcompilesortrremoverrflogexc) rcrZlogrotate_pathr-rZmax_total_sizeZ log_filesZ pidlog_filesZpidlog_files_with_ctZ total_sizefilepathr)rrr rrs<       rc CsJytjdd ddg}Wntk r*dSXtj|ddd\}}}|d kS) zKAssume that whenever the service is not running, we did not patch anything.r /usr/sbin//sbin/rrpFT)rvrwr)r+r,)r rr'r)rrr-rrr rs r)rr)NN)TN)N)NN)Drr1rrrrSrrrrrrr r r r r rrrpy23rrrZLIBCARE_CLIENTrrdrer"r|r$r(cachedr.r/r7rBintrCrhrrrrr\r]rrrrrrrr:rlog_all_parent_processesrrtrack_update_statusskip_if_no_selinux_moduleUPDATE_MODE_MANUALr rrrrrrrrrr sh@  L  "    $ H   1*