Edit File: secureio.cpython-37.pyc
B � e�C � @ sZ d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlm Z d dl m Z d dl Z d dl mZmZmZmZmZmZmZmZmZmZ e�d�Zye�d �ZW n ek r� e�d �ZY nX eZ eZ G d d � d e�Z ee �Z ej Z eeege _!ee _"ej#Z#eege#_!ee#_"ej$Z$ege$_!ee$_"ej%Z%ege%_!e e%_"ej&Z&ege&_!de&_"ej'Z'ege'_!ee'_"ej(Z)eege)_!ee)_"egej*_!dej*_"ej+Z+ege+_!ee+_"ej,Z,eeege,_!ee,_"eeeegej-_!eej-_"eeeeegej._!eej._"eeeeeegej/_!eej/_"eeeeegej0_!eej0_"ej1Z1eege1_!ee1_"ej2Z2eege2_!ee2_"d a3dZ4dZ5dZ6dd� Z(dd� Z7dd� Z8dd� Z*dDdd�Z-dEdd �Z.dFd d �Z/dGd d �Z0dHd!d"�Z9dId$d%�Z:dJd'd(�Z;dKd)d*�Z<dLd+d,�Z=d-d.� Z>d/d0� Z?da@d1d2� ZAe e5d3�ZBd4d5� ZCdaDdMd6d7�ZEd8d9� ZFdNd:d;�ZGd<d=� ZHd>d?� ZIejJd@dA� �ZKejJdBdC� �ZLdS )O� )�print_function)�absolute_import)�divisionN)�ClPwd)�drop_user_privileges) �cdll�c_long� Structure�c_ushort�c_ubyte�c_char�POINTER�c_int�c_void_p�c_char_pz libc.so.6zlibsecureio.so.0z liblve.so.0c @ s2 e Zd Zdefdefdefdefded fgZdS )�DIRENTRYZd_inoZd_offZd_reclenZd_type�d_name� N) �__name__� __module__� __qualname__�ino_t�off_tr r r Z_fields_� r r ��/builddir/build/BUILDROOT/alt-python27-cllib-3.3.5-1.el8.cloudlinux.x86_64/opt/alt/python37/lib/python3.7/site-packages/secureio.pyr # s r Tz/var/log/cagefs-update.logi� Fc C s t �| t jt jB �S )N)�os�open�O_RDONLY� O_NOFOLLOW)�pathr r r �open_not_symlink� s r c C s t �t| �d�S )N�r)r �fdopenr )r r r r �open_file_not_symlink� s r# c C sd t �| �}t|�}|s td��t|� g }x$t|�}|s:P |j}|�|j� q,W t|� t |� |S )z:Returns list of entries of directory pointed by descriptorzfdopendir error) r �dup� fdopendir� Exception� rewinddir�readdir�contents�appendr �closedir)�fdZfd2ZdirpZdirlistZentryp�entryr r r �flistdir� s r. c C s0 | d k r,yt �| � W n tk r* Y nX d S )N)r �close�OSError)r, r r r �closefd� s r1 c C sL |dkr d}t �| �� |||�� �}|dkr0|S |dk rH|d| dd� dS )z{Sets permissions to directory (in secure manner) Returns descriptor if successful Returns None if error has occuredN���r z.Error: failed to set permissions of directory FT)�liblve�set_perm_dir_secure�encode)r �perm� parent_pathr, �loggerr r r r4 � s r4 c C sN |dkr d}t �| �� ||||�� �}|dkr2|S |dk rJ|d| dd� dS )zSets owner and group of directory (in secure manner) Returns descriptor if successful Returns None if error has occuredNr2 r z(Error: failed to set owner of directory FT)r3 �set_owner_dir_securer5 )r �uid�gidr7 r, r8 r r r r9 � s r9 c C sP |dkr d}t �| �� |||||�� �}|dkr4|S |dk rL|d| dd� dS )z�Creates directory if it does not exist, sets permissions/owner otherwise Returns descriptor if successful Returns None if error has occuredNr2 r z#Error : failed to create directory FT)r3 �create_dir_securer5 )r r6 r: r; r7 r, r8 r r r r< � s r< c C s6 t �| �� ||||�� �}|r2|r2|d| dd� |S )zeRecursive directory creation function Returns 0 if successful Returns -1 if error has occuredz#Error : failed to create directory FT)r3 �makedirs_securer5 )r r6 r: r; r7 r8 Zresr r r r= � s r= c C s� |dkr|dk s |dk r(|dkr(t d��|dk o6|dk }|rFt||� y&t| �}|�� }|�� |rjt� |S ttfk r� } z<|r�t� td| d t |� t d|� |s�� t � d� W dd}~X Y nX dS )z read file not following symlinksNzEread_file_secure: uid and gid should be both null or be both not nullzError: failed to read z : � ) r& � set_user_permr# � readlinesr/ � set_root_permr0 �IOError�logging�str� SILENT_FLAG�sys�exit) �filenamer: r; Z exit_on_error� write_log� drop_perm� file_object�content�er r r �read_file_secure s& rN � c C s t j�|�}|rt||� yttjd|d�\}} t �|d�} | �d�| �� |sr|dk rr|dk rrt |||�rrt d��t ||�r�t d��| � � W n� t t fk �r: } z�y | � � W n Y nX yt � |� W n Y nX yt �| � W n Y nX |�rt� td| d t| ��d d � td |� d S d} ~ X Y nB tk �rz } z"td t| � td� t�d� W dd} ~ X Y nX d} yt �| |� W nl t k �r� } zLd } td| d t| � td|� yt �| � W n t k �r� Y nX W dd} ~ X Y nX |�r t� | S )z!Returns True if error has occuredZcagefs_)�prefix�dir�w� Nz fchown failedz fchmod failedz Error : failed to write file z : ZErrnozErr codeTzError: r> Fz$Error: failed to rename tempfile to )r r �dirnamer? �tempfile�mkstempr" �write�join�fchownr0 �fchmodr/ rB �unlinkrA rC rD �replacerE r& rF rG �rename) rL Zini_pathr: r; rJ r6 rI �dirpathr, � temp_pathrK rM �errorr r r �write_file_secure! s\ & ra rS c C s� |dk r t �� }t|ddd� t j�|�}d\}} y>tj|||d�\}} t j|ddd ��} | �| � W dQ R X W n| t t fk r� |dks�| dkr�� yt � |� W n t t fk r� Y nX yt � | � W n t t fk r� Y nX � Y nX y t � | |� t �| |� W nH t t tfk �rR yt � | � W n t t fk �rJ Y nX � Y nX |dk �r�t �� } t �| � t �t �� � | d k�r�t �|� dS ) aP Safely write string content to a file :param content: str :param dest_path: str -> path to a file :param perm: int -> permissions for the file :param prefix: str -> add to temporary file name :param suffix: str -> add to temporary file name :param as_user: str -> name of the user to drop privileges to NTF)Zeffective_or_realZset_env)NN)rP �suffixrQ rR �surrogateescape)�errorsr )r � getgroupsr r rT rU rV r" rW rB r0 r/ r[ �chmodr] � TypeError�getuid�seteuid�setegid�getgid� setgroups) rL Z dest_pathr6 rP rb Zas_userZ old_groupsr^ r, r_ Zf_tempZruidr r r �write_file_via_tempfileX sJ rm c C sN yt �|� W nT tfk rb } z4|rNtdt|� d t|� � t�d� ndS W d d }~X Y nX t| |�}yt �|� W nH tfk r� } z(|r�td|t|�� t�d� ndS W d d }~X Y nX yt � | � W nX tfk �r, } z6|�rtdt| � d t|� � t�d� ndS W d d }~X Y nX | dk�r>da n t � � d a d S ) Nzfailed to set egid to z: r> r2 z'failed to set supplementary groups to :zfailed to set euid to r TF) r rj r0 � print_errorrD rF rG � get_groupsrl ri � root_flagr3 �enable_quota_capability)r: r; rG rM �groupsr r r r? � s4 r? c C s yt �d� W nF tfk rT } z&| r@tdt|�� t�d� ndS W d d }~X Y nX yt �d� W nF tfk r� } z&| r�tdt|�� t�d� ndS W d d }~X Y nX tdd�}yt � |� W nJ tfk �r } z(| r�td|t|�� t�d� ndS W d d }~X Y nX da d S )Nr zfailed to set euid to 0 :r> r2 z Error: failed to set egid to 0 :z.Error: failed to set supplementary groups to :T) r ri r0 rn rD rF rG rj ro rl rp )rG rM rr r r r rA � s. rA c G s> t ddtjd� x | D ]}t |dtjd� qW t tjd� d S )NzError:� )�end�file)ru )�printrF �stderr)�args�ar r r rn � s rn c C s� t � }t� }t� }xb|D ]Z}|| j}xJ|D ]B}y|| j}W n tk rT w,Y nX || kr,|�|| j� q,W qW |�|� t|�S )z$Returns supplementary groups for uid) � get_grp_dict� get_pwd_dict�setZgr_memZpw_uid�KeyError�addZgr_gid�list) r: r; �grZpwrr �group�members�userZ member_uidr r r ro � s ro c C s0 t d kr,i a t�� } x| D ]}|t |j< qW t S )N)�grp_dict�grpZgetgrallZgr_name)r� �liner r r rz � s rz )Zmin_uidc C s t �� S )N)�clpwdZ get_user_dictr r r r r{ � s r{ c C s� |s|rt | � |r�t}ts,t� \}}t� y@td krVt�d�}ttdd�at�|� t� | � t� d� W n@ t t fk r� } z t dtt |�� t�d� W d d }~X Y nX |s�t||� d S )N� rR r> � z writing to )rv rp �get_permrA �log_filer �umaskr �LOGFILErW r0 rB rn rD rF rG r? ) �msgZsilent�verboserI Zroot_flag_savedr: r; Z umask_savedrM r r r rC s( rC c C sZ yt �� } t �� }W n< tfk rP } z tdt|�� t�d� W d d }~X Y nX | |fS )Nzfailed to get (euid,egid)r> )r �geteuid�getegidr0 rn rD rF rG )r: r; rM r r r r� s r� c C s | r t �� S t �� S )z� Set CAP_SYS_RESOURCE capability :param bool clear: Set on if it's true, set off otherwise :return: 0 for success, -1 otherwise :rtype: int )r3 �disable_quota_capabilityrq )�clearr r r �set_capability* s r� c C s t �| � t� S )a Change effective uid of current process and set CAP_SYS_RESOURCE capbality to prevent "Disk quota exceeded" error :param int euid: User ID to set it as current effective UID :return: 0 if capability was set successfuly, -1 otherwise :rtype: int )r ri r� )r: r r r � change_uid6 s r� c C s | st �� nt �� dS )zZ Disable quota kernel check to allow us to write more than user can by quota. N)r3 rq r� )�enabledr r r �_set_quota_checks_statusC s r� c c s& t dd� z d V W d t dd� X d S )NF)r� T)r� r r r r � disable_quotaN s r� c c s& t �| �}z d V W d t �|� X d S )N)r r� )Z umask_valueZ saved_umaskr r r � set_umaskW s r� )NN)NN)NN)N)NNTT)TrO T)rS rS N)T)T)FTT)F)MZ __future__r r r r� rF rU � contextlibZclcommonr Zclcommon.clpwdr r Zctypesr r r r r r r r r r Z LoadLibraryZlibcr3 r0 r r r Z DIRENTRY_PrY ZargtypesZrestyperZ r% r( r' r+ r Z_open_not_symlinkr1 Z check_dir�isdirr4 r9 r< r= Zget_path_from_descriptorZ is_subdirrp r� ZMIN_UIDrE r# r. rN ra rm r? rA rn ro r� rz r� r{ r� rC r� r� r� r� �contextmanagerr� r� r r r r �<module> s� 0 8 5 ' "