Edit File: cldiaglib.cpython-37.pyc
B 5/9e�� � @ s d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl m Z d dl mZ d dlZd dlZd dlmZ d dlmZmZmZmZ d dlZd dlmZm Z d d l m Z m Z d d l m!Z!m"Z" d d l#m$Z$ d d l%m&Z& d d l'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0 d dl1m2Z2m3Z3 d dl m4Z4 d dl5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z; dZ<dZ=dZ>dZ?dZ@dZAdZBdZCd eC� �ZDd ZEd ZFd ZGd ZHe d!d"d#g�ZId$d%d%d%d%d%d%d%d%d&� ZJd'd(d)d(d(d(d(d(d(d&� ZKeL� ZMd*d+eKd,�eMd-< d.d/eJd,�eMd0< d1ZNd2ZOd3d4� ZPd�d6d7�ZQd�d9d:�ZRd;d<� ZSd=d>� ZTd?d@� ZUePdA�dBdC� �ZVeeWeeX f dD�dEdF�ZYdGdH� ZZePdI�dJdK� �Z[eXeXeIdL�dMdN�Z\ePdO�eTeZdPdQ� ���Z]ePdR�eTeZdSdT� ���Z^ePdU�eTeZdVdW� ���Z_ePdX�eTeZdYdZ� ���Z`ePd[�d\d]� �ZaePd^�eUd_d`� ��Zbdadb� ZcePdc�ddde� �ZdePdf�dgdh� �ZeePdi�djdk� �ZfePdl�eUdmdn� ��ZgePdo�dpdq� �ZhePdr�eUdsdt� ��ZiePdu�eTdvdw� ��ZjePdx�eTdydz� ��Zkd{Zld|Zmd}d~dd�d�d�gZnd�d�d�gZod�d�� Zpd�d�� Zqd�d�� ZrePd��d�d�� �ZsePd��d�d�� �ZtePd��d�d�� �Zud�d�� ZveXeeX d��d�d��ZwexdD�d�d��ZyexdD�d�d��ZzeXexd��d�d��Z{eeX dD�d�d��Z|d�d�� Z}d�d�� Z~ePd��eTd�d�� ��Zd�d�d��Z�eWdD�d�d��Z�eee dD�d�d��Z�eee dd��d�d��Z�ePd��eUd�d�� ��Z�ePd��eUeIdD�d�d����Z�dS )�� )�print_function)�absolute_importN)� namedtuple)�Path)�wraps)�AnyStr�List�Optional�Tuple)�Feature�is_panel_feature_supported)�DEFAULT_JWT_ES_TOKEN_PATH�DISABLE_CMT_FILE)�is_cl_solo_edition�CLEditionDetectionError)�jwt_token_check)�LimitsValidator)�ExternalProgramFailed� service_is_enabled_and_present� run_command�process_is_running�is_litespeed_running�demote)�is_cmt_disabled�is_client_enabled)� WhmApiRequest� WhmApiError)� is_ubuntu)�get_pkg_version)�ClPwd�drop_privileges)� get_hidepid_typing_from_mounts�OK�FAILED�SKIPPED�INTERNAL_TEST_ERRORz/https://docs.cloudlinux.com/command-line_tools/Z disabled_cldiag_cron_checkersZ cldiag_cronz5https://docs.cloudlinux.com/cloudlinux-os-plus/#faq-2z Link to FAQ and troubleshooting zWPlease write to support https://cloudlinux.zendesk.com/ if you can't resolve the issue.zCentralized Monitoringz;This checker is not supported on CloudLinux OS Solo editionzAThis checker is not supported in environments without LVE support� ChkResult�res�msgz /usr/local/apache/bin/suexecz/usr/sbin/suexec) �cPanelZ cPanel_ea4� DirectAdminZPleskZ ISPManagerZ InterWorxzH-SphereZ HostingNG�Unknownz/opt/suphp/sbin/suphpz/usr/sbin/suphpz/usr/local/suphp/sbin/suphpZSuPHPzdetect.get_suPHP_status())�name�status_function�location�suphpZSuEXECzdetect.get_suEXEC_status()�suexecz/var/lve/cldiag_userZ cldiaguserc s � fdd�}|S )Nc s � | _ | S )N)� pretty_name)�func)�name_of_checker� � cldiaglib.py� decoratoru s z pretty_name.<locals>.decoratorr4 )r3 r6 r4 )r3 r5 r1 t s r1 Fc C s� d}d}|r,dd� | D �}||d< t �|�S g }xX| D ]P\}}}|� d|j� d|j� �} |dk r|| � d |� d |� d |� d �} |�| � q6W d �|d|� d�g �}|S )z2 Formatter of output from all of checkers z)Command for disabling this cron checker: z cldiag --disable-cron-checkersc S s i | ]\}}}|� � |�qS r4 )�_asdict)�.0�checker_pretty_name�_� chk_resultr4 r4 r5 � <dictcomp>� s z _formatter.<locals>.<dictcomp>Z total_errorsz: z: N� z "� �"z z There are z errors found.)�json�dumpsr' r( �append�join) �dataZ error_count�to_jsonr( Zcmd_tmpr' r9 Zchecker_public_namer; Zchecker_resultr4 r4 r5 � _formatter{ s rF Tc C s� t | �r| g} g }d}x�| D ]x}y |� }W n0 tk rZ } zttt|��}W d d }~X Y nX |jttfkrr|d7 }|�|jt |d�r�|j nd |f� q W t |||�}|r�t |� t |� ||fS )Nr � � public_name)�callable� Exceptionr& r% �reprr' r# rB r1 �hasattrrH rF �print�exit) ZcheckersrE Zdo_exitZresults�errors�fr; �er' r4 r4 r5 �runner� s( rR c C s0 yt | �S tk r* td�| �� dS X d S )Nz,WARNING missing {} function in cldetectlib.F)�eval�AttributeErrorrM �format)r2 r4 r4 r5 �wrapper� s rV c s t � �� fdd��}|S )Nc s@ yt dd�}W n tk r& d}Y nX |r6ttt�S � | |�S )NT)�skip_jwt_checkF)r r r& r$ �SKIPPED_ON_SOLO_MSG)�args�kwargsZis_solo_edition)rP r4 r5 �checker� s z(skip_checker_on_cl_solo.<locals>.checker)r )rP r[ r4 )rP r5 �skip_checker_on_cl_solo� s r\ c s t � �� fdd��}|S )Nc s t tj�sttt�S � | |�S )N)r r ZLVEr& r$ �SKIPPED_WITHOUT_LVE_MSG)rY rZ )rP r4 r5 r[ � s z'skip_check_without_lve.<locals>.checker)r )rP r[ r4 )rP r5 �skip_check_without_lve� s r^ z Check cagefsc C s t td�S )NzuCagefs version is too old. Please run cagefsctl --sanity-check directly or upgrade it to have full cldiag integration)r& r$ r4 r4 r4 r5 �fake_cagefs_checker� s r_ )�returnc C s� t � d�} dt � dt� d�}d}ddlm} |� }|dk rJ|d sJd |fS |dkrjt� \}}}|sj||fS t� rxd |fS t� s�d | fS d S ) am Check that a server is cl+, enabled and CM isn't disabled locally The function returns True if the client has CL+ license, didn't disable CM localy and activated CM on https://cm.cloudlinux.com. The function also returns True if we can't read or parse JWT token, because we want to continue and show to client CM related errors z. is not activated on https://cm.cloudlinux.comzThe z& is disabled localy by creating file "r? z The server has no CL+ licenser )� get_client_data_from_jwt_tokenNZcl_plusF)TN)� cm_full_namer �clsummary.cl_summary_utilsra r r r )Zcm_is_not_activated_msgZcm_is_disabled_localy_msgZno_cl_plus_license_msgra � jwt_tokenZis_valid�messager: r4 r4 r5 �_is_cmt_allowed_for_server� s rf c s t � �� fdd��}|S )zi Decorator: Skip check if a server isn't cl+, disabled and CM is disabled locally c s& t � \}}|r� | |�S tt|�S dS )z$ Decorated function N)rf r& r$ )rY rZ �resultre )rP r4 r5 �decorated_function� s z@skip_if_cmt_not_used_enabled_allowed.<locals>.decorated_function)r )rP rh r4 )rP r5 �$skip_if_cmt_not_used_enabled_allowed� s ri zCheck existing JWT tokenc C s� d} dt � dt� dt� dt� �}d}ddlm} tj�t �r�t � \}}}|rd|� }t t d |� d ��S ||krvt t d �S |d }t t |� d|� ��S nt t || �S d S )z% Check an existing JWT token zR Absence of JWT token is normal for the clients with volume license like GoDaddy. z$Please check for JWT token in path "zr". %sTry running "rhn_check" for getting a new token if it is absent. Server can't collect and send statistics to z( if you don't have a correct JWT token. z. z"JWT token doesn't have CL+ servicer )ra zJWT token is valid: "r? z The server has no CL+ license� N)r rb �cl_plus_doc_msg�write_to_support_msgrc ra �os�path�existsr r& r" r$ r# )Ztoken_is_absent_msgZmain_msgZtoken_is_not_cl_plusra rg re r: rd r4 r4 r5 �check_jwt_token s( rp )� service_name�process_file_pathr` c C s� t | �\}}yt|d�}W n tk r2 d}Y nX |rR|rR|rRttd| � d��S g }|sd|�d� |sr|�d� |s�|�d� ttd�|�� dt� d | � d t � d t � � �S d S ) z� Check that a service is present, enabled and active :param service_name: name of a service :param process_file_path: path to a file which is run by a service Fz Service "z " is present, enabled and activezService is not present.zService is not enabled.zService is not active.r> z1 The server can't collect and send statistics to z if service z$ isn't present, enabled and active. z. N) r r �FileNotFoundErrorr& r" rB r# rC rb rk rl )rq rr Z is_presentZ is_enabledZ is_activeZmessagesr4 r4 r5 �_check_service_state5 s& rt z=Check service `cl_plus_sender` is present, enabled and activec C s ddl m} d}t|| �S )zL Check that service `cl_plus_sender` is present, enabled and active r )�CL_PLUS_SENDER_FILE_PATHZcl_plus_sender)rc ru rt )ru rq r4 r4 r5 � check_cl_plus_sender_serviceY s rv z<Check service `node_exporter` is present, enabled and activec C sH d} d}t j�t j�| d��s4t j�t j�| d��r:d}nd}t||�S )a Check that service `node_exporter` or `cl_node_exporter` is present, enabled and active Since it was renamed node_exporter -> cl_node_exporter let`s handle both cases: - old `node_exporter` service - renamed `cl_node_exporter` service z&/usr/share/cloudlinux/cl_plus/service/z+/usr/share/cloudlinux/cl_plus/node_exporterZcl_node_exporterzcl_node_exporter.serviceZ node_exporter)rm rn ro rC rt )Zbase_service_pathrr rq r4 r4 r5 �check_node_exporter_servicef s rw z7Check service `lvestats` is present, enabled and activec C s d} d}t | |�S )zF Check that service `lvestats` is present, enabled and active Zlvestatsz'/usr/share/lve-stats/lvestats-server.py)rt )rq rr r4 r4 r5 �check_lvestats_service} s rx zeCheck that the server has the minimal required packages for correct working of Centralized Monitoringc C sF x:dD ]2} t | �dkrttd| � dt� dt� dt� ��S qW ttd�S )zD Check that the server has minimal required packages for CM )zcl-end-server-toolszcl-node-exporterNz!System doesn't have the package "z". It's required for zA feature to work and it usually installed automatically by cron. z. zVSystem has the minimal required packages for correct working of Centralized Monitoring)r r& r# rb rk rl r" )Z package_namer4 r4 r5 �check_cmt_packages� s "ry zACheck control panel and it's configuration (for DirectAdmin only)c C s� d� td �} t�� t�� }|dkr0ttd�S d� |tj�}tdd�sz|dkrzt� � rftt |d �S tt |d | �S n tt |�S d S ) NzY Fixing the issue will provide CloudLinux support on your control panel. See details: {}z#diag-cpr+ zCan't detect contol panelz Control Panel - {}; Version {};T)rW r* z File "options.conf" is finez1 File "options.conf" has no line "cloudlinux=yes") rU �cldiag_doc_link�detectZgetCP� getCPNamer& r$ Z CP_VERSIONr Zda_check_optionsr" r# )�fix_motivationZcp_nameZres_msgr4 r4 r5 � check_cp_diag� s r~ zDCheck fs.enforce_symlinksifowner is correctly enabled in sysctl confc C s� d� td �} t�� r ttd�S y t�� }W n< tk rh } z d}ttd� t t |�|���S d }~X Y nX |dkr�ttd| �S tt d� |��S ) Nz� Fixing that issue makes server more secure against symlink attacks and enables protection of PHP configs or other sensitive files. See details: {}z#symlinksifownerz$Not supported for OpenVZ environmentz+To see full error run /sbin/sysctl --systemzlSome parameter in sysctl config has wrong configuration. Error: {} It`s recommended to fix it and try again � z fs.enforce_symlinksifowner = 2z fs.enforce_symlinksifowner = {}) rU rz r{ � is_openvzr& r$ Zget_symlinksifownerr r# �get_short_error_message�strr" )r} Zsymlinks_if_ownerrQ � detailed_outr4 r4 r5 �check_symlinksifowner� s r� c C s� | d � � }td | }d�||�}tj�d�s:ttd�S t| d �sZttd�| d ��S t � | d �}|d kr�ttd �| d ��S |s�tt d | �S tt d �S ) Nr, z#check-z� Fix that issue to be sure that users run their sites inside CageFS and provide stable work of sites that are using apache {} module. This may improve server security See details: {}z/usr/sbin/cagefsctlzCagefs is not installedr- z{} is not enabledr. zgUnable to check {} module binary for custom control panel. This feature may be added in future updates.zBinary without CageFS jail zbinary has jail) �lowerrz rU rm rn ro r& r$ rV r{ Zcheck_binary_has_jailr# r" )ZparamsZ module_name�linkr} Zhas_jailr4 r4 r5 � binary_check� s r� z Check suexec has cagefs jailc C s( t �� rt� rttd�S ttd �S d S )NzUCurrent PHP selector uses LiteSpeed, which doesn't require the patches in suEXEC bin.r0 )r{ �detect_litespeedr r& r$ r� �BINARY_CHECK_PARAMETERSr4 r4 r4 r5 � check_suexec� s r� zCheck suphp has cagefs jailc C s t td �S )Nr/ )r� r� r4 r4 r4 r5 � check_suphp� s r� zCheck usepam in sshd configc C sH d� td �} t�� }|d kr(ttd�S |r6ttd�S ttd| �S d S )NziFix the issue to provide correct work of pam_lve module with sshd and CageFS ssh sessions See details: {}z #check-usepamz!Unable to run "/usr/sbin/sshd -T"zConfig is finez3There is "usepam no" in "/usr/sbin/sshd -T" output )rU rz r{ Zcheck_SSHd_UsePAMr& r$ r" r# )r} Z check_resultr4 r4 r5 � check_use_pam� s r� z*Check the validity of LVE limits on serverc C sF d} d| }d}t � }|�� }|dkr0tt|�S tt|d | �S dS )z Validate lve limits z6https://docs.cloudlinux.com/lve-limits-validation.htmlz'Invalid LVE limits on server. See doc: zValid LVE limits on server.Nr= )r Zvalidate_existing_limitsr& r" r# )�doc_link�failed_message�passed_messageZlimits_validatorrg r4 r4 r5 �check_lve_limits s r� z$Check compatibility for PHP Selectorc sn d} d� td �}t� }|r&ttd�S tj�d�s<ttd�S t� � rXt � rXtt | d �S dddd �� d }d }tj�|��rty(t |d �}d d� |� � D �}|�� W n< tk r� } z d|t|�f }tt|| �S d }~X Y nX x@|D ]"} | �d�r�| �d�d �� } P q�W d| }tt|| �S x0|D ](} | �d| ��r(| �d�d �� }�q(W |dk�rtd| }tt|| �S t�� } | d k �r�d| k�r�tt|d �S d| k� d< d| k� d < d | k� d < t� d � d g��s�tt|d �S � d �s� d �r2|d k�r2d!|d"�� fd#d$�� D ��f } tt | | �S d%|d k�rBd&n|d"�� fd'd$�� D ��f }tt|| �S )(z� 1. mod_ruid not present 2. suphp 3. mod_lsapi 4. suexec and (fcgi or cgi) 5. litespeed 6. do not support other zIt looks ok [%s]z�Looks like your PHP handler doesn't support CloudLinux PHP Selector and as a result does not work http://docs.cloudlinux.com/index.html?compatiblity_matrix.html [%s] Please, see: {} and try to fix issue to have working selectorz#check-phpselectorz-PHP Selector is not supported. Skipping checkz/etc/cpanel/ea4/is_ea4z+It is not cPanel with EA4, can diag nothingZ LitespeedF)r0 r/ �lsapiNz/etc/cpanel/ea4/php.conf�rc S s g | ] }|� � �qS r4 )�strip)r8 �xr4 r4 r5 � <listcomp>A s z%check_phpselector.<locals>.<listcomp>zCan not read %s (%s)zdefault:�:rG z)%s config should have default php versionz%s:)�cgi�fcgir/ r� z*doesn't support %s handler in ea4/php.confZ ruid2_modulez�It looks like you use mod_ruid. CloudLinux PHP Selector doesn't work properly with it. How to delete mod_ruid and install mod_suexec in cPanel https://docs.cloudlinux.com/cloudlinux_os_components/#installation-5Z suphp_moduler/ Z lsapi_moduler� Z suexec_moduler0 zyIt looks like you do not have mod_suphp or mod_suexec installed. CloudLinux PHP Selector doesn't work properly without it)r/ r� r� r� zphp.conf:%s with %sz, c 3 s | ]}� | r|V qd S )Nr4 )r8 �s)�statusr4 r5 � <genexpr>i s z$check_phpselector.<locals>.<genexpr>z`Some unknown php handler, perhaps we don't support it [found handler: %s and apache modules: %s]�-c 3 s | ]}� | r|V qd S )Nr4 )r8 �module)r� r4 r5 r� m s )rU rz r r& r$ rm rn ro r{ r� r r" �open� readlines�close�IOErrorr� r# � startswith�splitr� Zget_apache_modules�anyrC ) Z ok_prefixZ fail_prefixZ is_ubuntu_osZhandlerZ conf_path�fd�configrQ �err�lineZ default_ver�modulesZcurrentr4 )r� r5 �check_phpselector sn r� zCheck fs.symlinkown_gidc C s" d� td �} ttd�}d| }d}t�� r6ttd�S t�� tj}yt � |� W n t k rr ttd� |��S X yt t |��� �� �}W n4 tk r� } zttd� |t|���S d }~X Y nX tj|kr�|S yt�|�j}W n t k � r� g }Y nX |�r||k�r|S tt|� ||��S ) Nz~Fix the issue to provide symlink protection for apache user and as a result make your Web Server more secure. See details: {}z#check-symlinkowngidz>Web-server user is protected by Symlink Owner Match Protectionz@Web-server user '{}' is not in protected group specified in {}. z/proc/sys/fs/symlinkown_gidz$Not supported for OpenVZ environmentz<There is no web-server user [{}] in system. Nothing to checkz%Can't read GID from {} with error: {})rU rz r& r" r{ r� r$ Zget_apache_gidZ APACHE_UNAME�pwd�getpwnam�KeyError�intr� �readr� rJ r# rK Z APACHE_GID�grpZgetgrgidZgr_mem)r} Zok_resZ warn_msg_tplZsymlinkown_gid_fileZ apache_unameZcurrent_symlinkown_gidrQ Z grp_membersr4 r4 r5 �check_symlinkowngidq s@ r� z&Check existence of all user's packagesc sl d�d} d}ddddg� dd d d g}g �t �� d kr>ttd �S t�| �sRttd�S tj�|�rht�|��tj |tj tj | dd�}|� � \}}|j }|dkr�d� |�}tt|�S y.dd� |�� �d�D �}�fdd�|D �}W n4 tk �r } zd� | �}tt|�S d} ~ X Y nX �fdd�t���D ��� �fdd�|D �} | �r^d� d �| ��}tt|�S ttd �S dS ) zL Return user's packages that do not exist in /var/cpanel/packages/ z/var/cpanel/packages/z/var/cpanel/users/z/var/cpanel/suspended/Z undefined�defaultz#cPanel Ticket System temporary userZCustomz /bin/grepz-ezPLAN=z-rr) z should be run on cPanel onlyzno users on this serverT)�stdout�stderr�cwd�textr z!error getting user's packages: {}c S s6 g | ].}|� d �d � d�d |� d �d �� f�qS )�=r r� rG )r� r� )r8 Zplanr4 r4 r5 r� � s z9check_existence_of_all_users_packages.<locals>.<listcomp>r= c s g | ]\}}|� kr||f�qS r4 r4 )r8 �userZpkg)�suspended_usersr4 r5 r� � s z$error processing user's packages: {}Nc s& g | ] }t j�t j�� |��r|�qS r4 )rm rn �isfilerC )r8 �package)�packages_dir_pathr4 r5 r� � s c s, g | ]$\}}|� kr|�krd � ||��qS )z{}: {})rU )r8 r� r� )�excluded_packages_names�exists_packagesr4 r5 r� � s z�Found some nonexistent user's packages. List of "user: package" separated by semicolon: {}. If you want to apply package limits for those users - assign existing packages to them, otherwise limits will be applied incorrectly or not applied at all.z; z(nonexistent user's packages aren't found)r{ r| r& r$ rm �listdirrn ro � subprocess�Popen�PIPE� communicate� returncoderU r# r� r� rJ rC r" ) Zusers_dir_pathZsuspended_dir_pathZ user_plan_cmd�processZstd_outZstd_errZret_coder( Zall_users_packagesrQ Znot_exists_users_packagesr4 )r� r� r� r� r5 �%check_existence_of_all_users_packages� sN r� z$Check all resellers's packages filesc C s� t �� dkrttd�S G dd� d�} ddlm} y&| � � |� �� W dQ R X ttd�S tk r� } ztt t |��S d}~X Y nX dS ) zT Check reseller packages files reading on any errors Caused by LU-2374 r* z!should be run on DirectAdmin onlyc @ s e Zd ZdZdd� Zdd� ZdS )z7check_da_resellers_packages_files.<locals>.HiddenPrintsz= Redirect stdout to /dev/null to hide output c S s t j| _ttjd�t _d S )N�w)�sysr� �_original_stdoutr� rm �devnull)�selfr4 r4 r5 � __enter__� s zAcheck_da_resellers_packages_files.<locals>.HiddenPrints.__enter__c S s t j�� | jt _d S )N)r� r� r� r� )r� �exc_typeZexc_valZexc_tbr4 r4 r5 �__exit__� s z@check_da_resellers_packages_files.<locals>.HiddenPrints.__exit__N)�__name__� __module__� __qualname__�__doc__r� r� r4 r4 r4 r5 � HiddenPrints� s r� r )r* Nz6all resellers packages are written in correct encoding) r{ r| r& r$ Z clcontrollibr* Zlist_resellers_packagesr" rJ r# r� )r� r* rQ r4 r4 r5 �!check_da_resellers_packages_files� s r� z /etc/cl.selector/defaults.cfgz/etc/cl.selector/php.confZ DirectiveZDefault�Type�CommentZRangeZRemark�value�list�boolc C s� g } d}d}t td��}|�� }W dQ R X xt|D ]l}|�d�r@q0t|�� �dkr�d}y | | W n | �g � Y nX | | �|�� � q0|s0d}|d7 }q0W | S )zL Parse php.conf and split it into blocks by empty line :return: r Tr� N�#FrG )r� � PHP_CONF_PATHr� r� �lenr� rB )Z line_blocksZ block_indexZ new_blockZconfrD r� r4 r4 r5 �parse_php_conf s& r� c C s� d}d}xv| D ]n}|� d�}|d �� tkrDd}|d dt| � }|d �� dkr|d �� tkrd}|d d t| � }qW ||gS ) NTrj r� r Fr= zBlock %s has wrong param r� rG z Block %s has wrong directive )r� r� �PARAM_NAME_LIST�block_to_string�TYPES)�blockrg r( r� Z line_partsr4 r4 r5 � check_block- s r� c C s& d}x | D ]}|t |� d }q W |S )Nr= )r� )r� Z res_stringr� r4 r4 r5 r� < s r� z"Checking /etc/cl.selector/php.confc C s� d} d� | �}d}d}tj�t�s0ttdt �S t� }x0|D ](}t|�\}}|oR|}|r<|d | }q<W |sztt || �S tt d�S d S )Nz7https://docs.cloudlinux.com/custom_php_ini_options.htmlz�To fix the issue provide valid format for /etc/cl.selector/php.conf file. It is used for PHP Selector and invalid format lead to directives misconfiguration and as a result misconfiguration of selector Please, read more about php.conf file in {}Trj zFile %s does not exist r= �Ok) rU rm rn ro r� r& r$ r� r� r# r" )Zphp_ini_doc_linkr} rg r( Zblocksr� Zr1Zmsg1r4 r4 r5 �check_php_confC s r� z&Checking /etc/cl.selector/defaults.cfgc C s� d� td �} tj�t�s(ttdt �S y tj d dd�}|� t� W n, t k rp } ztt t |��S d }~X Y nX y|�dd�}W n& tjtjfk r� tt d| �S X x�|�� D ]�}|�d�r�|d d � }y|�|d �}W n tjk � r� d }Y nX y|�|d �}W n tjk �r( d }Y nX ||k�rP|dk�rPtt d� || ��S |r�d|kr�|�d�}x$|D ] } | �sltj�d| � �qlW q�W ttd�S )Nz�Details: this config file is used by php selector and stores it`s global options, so it is important to keep needed configurations and valid syntax for PHP modules settings to avoid selector`s misconfiguration See details: {}z#cldiagz%s does not existF)� interpolation�strict�versionsZphpz!Default php version is undefined � �stateZenabler� rj Zdisabledz%Default php version {} is disabled {}�,z0Warning: Modules list for version %s is strange r" )rU rz rm rn ro �DEFAULTS_CFG_PATHr& r$ � configparser� ConfigParserr� rJ r# r� �getZ NoOptionErrorZNoSectionError�sectionsr� r� r� r� �writer" ) r} Z defaults_cfgrQ Zdefault_php_versionZsectionZ php_versionr� r� Z module_namesr, r4 r4 r5 �check_defaults_cfgZ sF r� z Checking domains compatibilityc C sD t �� dkrttd�S d} d}t� }|d kr6tt|�S tt| �S d S )Nr) z should be run on cPanel onlyz�Some domains/subdomains don't use PHP Selector because they have a non-system default version (in MultiPHP Manager) or PHP_FPM enabled. You can find their list on domains tab and pass control to PHP Selector if necessary.r� )r{ r| r& r$ � domains_compatibility_checkerr" r# )r� r� rg r4 r4 r5 �check_domains_compatibility� s r� c C sl y t d��� } t d��� }W n tk r0 d S X x4| �d�D ]&}|�d�|�d�ks`|�d�r>dS q>W d S )NZphp_get_vhost_versionsZ php_get_system_default_versionr� �versionZphp_fpmzIncompatible version)r Zcallr r� )ZdomainsZsystem_versionZdomainr4 r4 r5 r� � s r� )�dirpathr` c C s| t j�| �sdS d| � �}tj|�d�tjtjdd�}|jdkrDdS y |j�d�d �d�d }W n t k rv dS X |S ) zZ Get mountpoint for dirpath directory from output of df -h {dirpath} utility. Nzdf -h r> T)r� r� r� r r= rG ���) rm rn �isdirr� �runr� r� r� r� � IndexError)r� Zget_mountpoint_cmdr� Z mounted_onr4 r4 r5 �get_dir_mountpoint� s r� c C sR d} t j�d�rNtd��0}x(|D ] }|�d�r t|�d�d �} q W W dQ R X | S )z[ Returns maximum uid from /etc/login.defs If file does not exist returns 60000 i`� z/etc/login.defszUID_MAX r> r� N)rm rn r� r� r� r� r� )�max_uidrP r� r4 r4 r5 � get_max_uid� s r� c C s" d} t | �d�dd�}t|�}|S )z Returns min cagefs uid z!/usr/sbin/cagefsctl --get-min-uidr> T)Zconvert_to_str)r r� r� )Zget_min_uid_cmdr� �min_uidr4 r4 r5 � get_min_uid� s r� )�usernamer` c C s� t � }t� }||k r.td| � d|� d|� ���t|d�}| |�� krN|�| �S |�� s\|}n.|}|�� }x t||�D ]}||krt|}P qtW ||kr�td| � d|� d���d|� d| � �}t|� d �d d �\}} } |d kr�t| ��|S ) z� Creates user with max available uid that greater than min cagefs uid and less than max system uid. Does nothing if user already exists. z Can't create z user: min_uid z is greater than max_uid )r� z user: uid z is too bigz#/usr/sbin/useradd -s /bin/false -u z -m r> T)Zreturn_full_outputr ) r� r� rJ r �get_user_full_dictZget_uidZ get_uid_dict�ranger r� ) r� r� r� ZclpwdZ custom_uidZused_uids_dictZ_uidZ useradd_cmdr� r: r� r4 r4 r5 �useradd� s, r c C sD y&t td��} | �� }W dQ R X |�� S ttfk r> Y nX dS )zS Retrive cldiag username from file :return: username from file or None r� N)r� �_CLDIAG_USERNAME_FILEr� r� �OSErrorr� )rP Zcontentr4 r4 r5 �get_username_from_file� s r c C sv t � } t�d�}| �� }xX|�� D ]L\}}|�|�s6q"y d|� �}t|�d�� W q" tt t fk rl Y q"X q"W dS )z3 Remove all trash cldiag users from system z^cldiaguser_[a-f0-9]{21}$z/usr/sbin/userdel -r r> N) r �re�compiler �items�matchr r� r r� r )Zcl_pwdZ re_patternZ users_dictr� r: Z userdel_cmdr4 r4 r5 � remove_all_trash_cldiag_users s r c C s: d} | dg}y t |�}W n tk r, dS X |s6dS dS )z\ Detect quota is activated :return: True/False - quotas activated/not activated z/usr/sbin/repquotaz-nvaFT)r r )Z_REPQUOTA_PATH�cmdr� r4 r4 r5 �is_quota_active s r zGChecking if /var/cagefs is located on partition with disk quota enabledc C s� d} d}d}d}d}t d�}|dks<tj�d�r<tj�|�sFttd�S tj�d �s\ttd �S t� sltt|�S d}d }tj�t �r�t � }|dk r�y t � |�}|j |j } } W n tk r� Y q�X d }nt� |�sLd �tt�� j�dd� }t|� t � |�}|j |j } } y$tt d��} | �|� W dQ R X W n ttfk �rJ Y nX |� d| � �} |� d|� d|� �} |� d|� d|� �}�yz�d| d }d|� d|� d�}tt � � �}t ||�}tj�|��s�t | � d�� t | � d�� t j!d|gt j"t j#d d |t$| | �tj%dd i�d �}|�&� \}}t'|��@ |�(� �sLd |k�rLtt)| �S |�(� �s`t|��n|�*� W dQ R X W dt |� d�� X W n t+k �r� tt|�S X tt|�S ) a� Checker for check if /var/cagefs is located on partition with disk quota enabled. Algorithm for check: we trying to set cldiaguser's quota to 1 inode (so that this user can't create any file if the quota activated on this partition). Then we change uid of process to cldiaguser's uid, and try to create file with his permissions. If we can't create file (Disk quota exceeded) then it's alright and disc quota enabled. Else we warn user to enable quota on that partition. z3/var/cagefs located on partition with quota enabledz�Details: /var/cagefs located on partition with quota disabled. Please, activate quota for /var/cagefs for better security. See details: https://docs.cloudlinux.com/cloudlinux_os_components/#installation-and-update-2zYQuotas seems unworkable on this server. Please correctly setup quotas to run this checkerz/usr/sbin/cagefsctlz/usr/sbin/setquotaz /var/cagefsNzCagefs is not installedz /usr/share/cagefs-skeleton/binzCagefs is not initializedFTz{}_{}� r� z --cpetc z -u z 0 0 1 1 z 0 0 0 0 z%02d�d z /var/cagefs/�/z/etc/cl.selector/r> z /bin/touch�LC_ALL�C)r� r� r� Zstart_new_sessionr� Z preexec_fn�envzDisk quota exceeded),r� rm rn r� r� r& r$ r r# r r r� r� Zpw_uidZpw_gidr� r rU �_CLDIAG_TEST_USENAME_PREFIX�uuidZuuid4�hexr r� r� r r� r� �randomr r r� r� r� r� ZSTDOUTr �environr� r ro r" �unlinkr )Z ok_messager� Zquota_unworkable_messageZ cagefsctlZsetquotaZcagefs_mountpointr� Zis_testuser_existsZuser_pwZuser_uidZuser_gidrP Zcreate_cagefs_dir_cmdZset_quota_limit_cmdZreset_quota_limit_cmd�prefixZ tempfile_dirZ tempfile_nameZtempfile_full_path�pr� r: r4 r4 r5 �!check_cagefs_partition_disk_quota# s� r � c C sN | � d�}t|�|krJd�|d|d � dg || d d� |g �S | S )a. Handles error message making it shorter, if it is bigger than max limit :param error: error message to make shorter :param detailed_out: way for user to get full error manually :param max_error_lines: max lines for error :return: initial error (less than 10 lines) short error r= Nr z...)r� r� rC )�errorr� Zmax_error_linesZ error_linesr4 r4 r5 r� � s * r� c C s t jt jdddd�} | S )zY Return true if automatic cldiag email notifications about problems enabled. Z ENABLE_CLDIAGr� T)Z separatorZ default_val)r{ Zget_boolean_param�CL_CONFIG_FILE)Z enable_cldiagr4 r4 r5 � is_email_notification_enabled� s r c C s` y0t jddtdid�} | �tj� | �tt�}W n t jk rF g S X dd� |� � � d�D �S )zc Get list of disabled cldiag checkers which run by cron from /etc/sysconfig/cloudlinux NFrj )r� r� �defaultsc S s g | ]}|r|� � �qS r4 )r� )r8 �itemr4 r4 r5 r� � s z6get_list_of_disabled_cron_checkers.<locals>.<listcomp>r� ) r� r� � cron_cldiag_checkers_param_namer� r{ r r� �cron_cldiag_section_name�Errorr� r� )r� rg r4 r4 r5 �"get_list_of_disabled_cron_checkers� s r% )�disabled_cron_cherkersr` c C s� y~t jddd�}|�tj� t|�� kr2|�t� t� }| rF| � |� |� tt d� | �� t tjd��}|�|� W dQ R X W n\ t jttfk r� } z6tdtj� d|� d�� td � tt� t�d � W dd}~X Y nX dS ) z` Set list of disabled cldiag checker which run by cron in /etc/sysconfig/cloudlinux NF)r� r� r� zw+z3Can't set list of disabled cron checkers to config"z " because "r? z:Please check config's existence, integrity and permissionsrG )r� r� r� r{ r r# r� Z add_sectionr% �extend�setr" rC r� r� r$ r� r rM rl r� rN )r& r� Zcurrent_disabled_checkersrP r� r4 r4 r5 �"set_list_of_disabled_cron_checkers� s* r) z!Check mount with hidepid=2 optionc C sJ d} d| � �}d}d}t j�d�s,tt|�S t� dkr@tt|�S tt|�S )z7 Check if system mounted with hidepid=2 option zWhttps://docs.cloudlinux.com/cloudlinux_os_kernel/#remounting-procfs-with-hidepid-optionz�Details: hidepid protection disabled. Please, mount system with hidepid=2 for better security. Read more about hidepid option here: zhidepid protection enabledzCagefs is not installedz/usr/sbin/cagefsctlr )rm rn r� r& r$ r! r# r" )Zhidepid_doc_linkr} r� Zskipped_messager4 r4 r5 � check_hidepid� s r* z Check user's low PMEM limitsc C s0 d} d| }d}t �� }|r&tt|�S tt|�S )z7 Checks low PMEM limits availability on server z5https://docs.cloudlinux.com/limits/#limits-validationzLSome user(s) on server has low PMEM LVE limit (lower than 512 MB). See doc: z Check low PMEM limits passed)r Zis_low_pmem_limit_presentr& r# r" )r� r� r� rg r4 r4 r5 �check_low_pmem_limits� s r+ )F)FT)r )�Z __future__r r r� r� r� r@ rm r r� r� � collectionsr Zpathlibr r r � functoolsr �typingr r r r Z cldetectlibr{ Zclcommon.cpapir r Zclcommon.lib.constsr r Zclcommon.lib.cleditionr r Zclcommon.lib.jwt_tokenr Zcllimits_validatorr Zclcommon.utilsr r r r r r Zclcommon.lib.cmt_utilsr r Zclcommon.lib.whmapi_libr r r Zclsentry.utilsr Zclcommon.clpwdr r Zcl_proc_hidepidr! r" r# r$ r% rz r" r# Zcl_plus_doc_linkrk rl rb rX r] r& Z SUEXEC_PATHZ SUPHP_PATH�dictr� r r r1 rF rR rV r\ r^ r_ r� r� rf ri rp rt rv rw rx ry r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r% r) r* r+ r4 r4 r4 r5 �<module> s #'! Z-E ") !c