File: //usr/libexec/kcare/python/kcarectl/__pycache__/__init__.cpython-38.pyc
U
n�h0& � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z) ddl m*Z*m+Z+m,Z, dd l-m.Z.m/Z/m0Z0m1Z1m2Z2 d
Z3d Z4d Z5d
Z6dZ7dZ8dZ9dZ:e�;dej<�Z=e�;d�Z>ej?�@d��r�e j?�Ad d� ejBdeCd� e"jJ�KejL� dd� ZMdd� ZNdd � ZOd d � ZPd d � ZQd�d!d"�ZRd#d$� ZSd%d&� ZTd'd(� ZUd)d*� ZVd+d,� ZWd-d.� ZXG d/d0� d0eY�ZZG d1d2� d2e*�Z[G d3d4� d4e*�Z\G d5d6� d6e*�Z]d7d8� Z^ed9d:� �Z_d�d;d<�Z`d=d>� Zad?d@� Zbi ZcdAdB� Zdede0je_fege dCd��sz8d dlhZid dljZkeijl�mekjn�eijl�mdD�k �r�eodE��W n eok
�r� Y n8X dFdG� Zpe0jqZrG dHdI� dIes�ZtG dJdK� dKe0jq�Zueue0_qdLdM� ZvejwfdNdO�ZxdPdQ� ZydRdS� ZzG dTdU� dUes�Z{dVdW� Z|dXdY� Z}d�d[d\�Z~d]d^� Zd_d`� Z�d�dadb�Z�dcdd� Z�dedf� Z�dgdh� Z�didj� Z�dkdl� Z�dmdn� Z�dodp� Z�dqdr� Z�dsdt� Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�ej�ejwfd�d��Z�d�d�� Z�ej�fd�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�dS )�� )�print_functionN)�ArgumentParser)�contextmanager)�datetime� )�auth� capabilities�config�config_handlers� constants�errors�fetch�
http_utils� ipv6_support�kcare�libcare� log_utils�platform_utils�
process_utils�selinux� server_info�serverid� update_utils�utils)�
KcareError�NotFound�SafeExceptionWrapper)� HTTPError�URLError�httplib�json_loads_nstr� urlencode�c Zv3)Z12hZ24hZ48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh)z latest.v3� latest.v2z /etc/sysconfig/kcare/sysctl.conf�
z$==BLACKLIST==
(.*)==END BLACKLIST==
z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C s@ t � } tj�t�r<ttd�}|D ]}| �|�� � q |�� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r5 �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistQ s
r7 c C sB |� d�}| r(d�|d | |d g�}nd�|d |d g�}|S )N�.r ���)�split�join)�ptype�filenameZ
name_partsr5 r5 r6 � _apply_ptype[ s
r> c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S �N)r> r � PATCH_BIN�
PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE�
PATCH_DONE)r< r5 r5 r6 � apply_ptyped s
rE c C s� t �� \} }}d}t|t�r`t|t�s`z d|jt�|j�|jf }W q� t t
fk
r\ Y q�X nNt|t t
t f�r�t|t�s�d| }n*t|t
�r�|jp�t|j�} |jp�d|j }t�� }tjt�� |d |d t| dt| ��|d�t�|d��t|dd�d �S )
N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z
agent_versionZpython_version�distroZdistro_version�error�details� tracebackrI ) �sys�exc_info�
isinstance�OSErrorr �errnor* �strerrorr= �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrL r �
get_distror �VERSIONZget_python_version�getattr�strr; rM Z format_tb)rX �value�tbZdetails_sanitizedrJ r5 r5 r6 � format_exception_without_detailsl s,
�ra c C sv t jr
d S t�t� �} t�t�t� | ���}t�
d�d | }t � |t
�� �}zt �|� W n tk
rp Y nX d S )Nz/api/kcarectl-tracez?trace=)r �UPDATE_FROM_LOCAL�json�dumpsra r �nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ
encoded_trace�urlZrequestr5 r5 r6 �send_exc� s rj c C s� t �� }|dkr t �|d� dS t �� t �� }|dkrBt �d� t �d� ttjd��&}t � |�
� d� t � |�
� d� W 5 Q R X |r�t � |� z
| � W n* t
k
r� tj�d� t �d� Y nX t �d� dS )z�
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
r N�ar � zWait exception)r* �fork�waitpid�setsid�_exitr1 r. r ZLOG_FILE�dup2�fileno�time�sleeprh r �kcarelog� exception)�funcrt �pid�fdr5 r5 r6 �
nohup_fork� s(
rz c C s� t j�tjd�} t j�| �rtt| d��H}z,t|�� �}|t j
t � � krRt || ��W n t
k
rh Y nX W 5 Q R X t�| t�� � dS )a Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
�.kcareprev.lockr( N)r* r+ r; r � PATCH_CACHEr, r. �int�readr �SUCCESS_TIMEOUTrs � PreviousPatchFailedException�
ValueErrorr � atomic_write�
timestamp_str)Zanchor_filepathZafile� timestampr5 r5 r6 � touch_anchor� s r� c C sx zt �t j�tjd�� W n tk
r. Y nX td| � tj �
� zt dd� W n t k
rr t
j�d� Y nX dS )z�
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
r{ �done��reasonzCannot send update info!N)r* �remover+ r; r r| rQ �register_actionr �get_loaded_modules�clear�get_latest_patch_levelrh r ru rv ��
state_datar5 r5 r6 �
commit_update� s
r� c C s( t jtj�tjd�t�| |d�d� d S )N�patchesrF )Z exclude_path) r �clean_directoryr* r+ r; r r| r �get_cache_path)�khashZplevelr5 r5 r6 � clear_cache� s r� c C s> t jpd}d�|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r �PREFIXr; r r| r* r+ )r� �fname�prefixZ
module_dirr2 r5 r5 r6 �get_current_level_path� s
r� c C s t jt| d�t|�dd� d S )N�latestT)Z
ensure_dir)r r� r� r^ )r� � patch_levelr5 r5 r6 �save_cache_latest� s r� c C sX t | d�}tj�|�rTz$tt|d��� �� �}t� | |�W S t
t fk
rR Y nX d S )Nr� r( ) r� r* r+ r, r} r. r~ �stripr �LegacyKernelPatchLevelr� rU )r� Zpath_with_latest�plr5 r5 r6 �get_cache_latest� s
r� c @ s e Zd ZdS )�CertificateErrorN)rG �
__module__� __qualname__r5 r5 r5 r6 r�
s r� c @ s e Zd Zdd� ZdS )�UnknownKernelExceptionc C s* t �| d�t�� d t�� t�� �� d S )N�LNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.r ) rh �__init__�formatr r[ �platform�releaser �get_kernel_hash��selfr5 r5 r6 r� s
��z UnknownKernelException.__init__N)rG r� r� r� r5 r5 r5 r6 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )�ApplyPatchErrorc sF t t| �j||� || _|| _|| _|| _t�� d | _ t
� � | _ d S �Nr ) �superr� r� �code�
freezer_style�level�
patch_filer r[ rJ r� r� )r� r� r� r� r� �args�kwargs�� __class__r5 r6 r� s zApplyPatchError.__init__c C s0 d� | j| j| j| j| jd�dd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})�, c S s g | ] }t |��qS r5 )r^ )�.0�ir5 r5 r6 �
<listcomp>) s z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rJ r� r; r� r� r5 r5 r6 �__str__" s �zApplyPatchError.__str__�rG r� r� r� r� �
__classcell__r5 r5 r� r6 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )r� c s" t t| �j||� || _|| _d S r? )r� r� r� r� �anchor)r� r� r� r� r� r� r5 r6 r� / s z%PreviousPatchFailedException.__init__c C s d}|� | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager5 r5 r6 r� 4 s �z$PreviousPatchFailedException.__str__r� r5 r5 r� r6 r� . s r� c
C s� t �� d�| � }z|t�|�}t�t�|�� ��}t |d �}|dkrRt�
d� n8|dkrft�
d� n$|dkrzt�
d� nt�
d �|�� |W S t k
r� } zt �
||� W 5 d }~X Y nX d
S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizerl z!No KernelCare license for that IPzUnknown error {0}r9 )r �get_registration_urlr� r �urlopenr � data_as_dictre r~ r} �
print_wrapperr r �print_cln_http_error)�keyri �response�resr� �er5 r5 r6 �!set_monitoring_key_for_ip_license= s
r� c
c s> t jrtjt jdd� z
d V W 5 t jr8tjt jdd� X d S )NT)�shell)r ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr5 r5 r5 r6 �
execute_hooksQ s
r� c C s� t � }|j}|j}t�� }| dkrht|�tjt� � t
� � |t t
�� �|d�}t�d� t�t�|�� njt�d� t�t|�� t�dt|� � t�tj� t�t� � � t�t
� � � t�|� t�t
�� � dS )a1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
rc )Z
updateCodeZ
autoUpdateZeffectiveKernelZ
realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_infor^ r � AUTO_UPDATEr � kcare_unamer� r� r} r Z
get_uptimer r� rc rd )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr5 r5 r6 � plugin_info] s.
�
r� c C sb t �� } ztdd�}W n" tk
r8 tjr0dnd Y S X | d krFdS | |krRdS t�� r^dS dS )N�infor� r � r rl )r �loaded_patch_levelr� r� r �IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)�
current_levelZlatest_patch_levelr5 r5 r6 �get_update_status� s r� c C s2 t �� d d� \} }| dkr*|�d�r*dS dS d S )Nrl Z
CloudLinuxz7.�extrarF )r r[ �
startswith)rJ �versionr5 r5 r6 �edf_fallback_ptype� s r� c C sl | j | jf}t�||�}t�|| j�| _| j�tj tj
d� |tkrZ| j� � dd� t|< | j rh| �
� dS )z�Function remembers IP address of host connected to
and uses it for later connections.
Replaces stdlib version of httplib.HTTPConnection.connect
r Nrl )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ
setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ
resolved_addrr5 r5 r6 �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr5 )r� r5 r5 r6 �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�SSLSockc C s || _ d| _d S r� )� _ssl_conn�_makefile_refs)r� r� r5 r5 r6 r� � s zSSLSock.__init__c G s& | j d7 _ tj| jf|�ddi�S )Nr r1 T)r� r� Z _fileobjectr� �r� r� r5 r5 r6 �makefile� s zSSLSock.makefilec C s | j s | jr | j�� d | _d S r? )r� r� r1 r� r5 r5 r6 r1 � s
z
SSLSock.closec G s | j j|� S r? )r� �sendallr� r5 r5 r6 r� � s zSSLSock.sendallN)rG r� r� r� r� r1 r� r5 r5 r5 r6 r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t j�| � tj�tjj�}|�tjjtjj B � t
j rJ|� tjj
t� n|� tjjt� |�� tj�|| j�}|�� | jp�| j}|�|�� � |�� t
j r�t|�� |� t|�| _d S r? ) r �HTTPConnection�connect�OpenSSLZSSLZContextZ
SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r �CHECK_SSL_CERTSZ
set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ
Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� ZctxZconnZ server_hostr5 r5 r6 r� � s z PyOpenSSLHTTPSConnection.connectN)rG r� r� r� r5 r5 r5 r6 r� � s r� c C s6 t jr&t�| |�}t�tj�|dd�S |dk}d|fd|fdfD ]�\}}tj ||||d�}|rhd�
|�}t�| t ||��d | }d } |s�|r�t |�| kr�|r�d
nd }
t
�d |
� q@zt�tj�|dd�W S tk
�r. } z@|s�|�r | jd
k�s| jdk�r t
�d�
| �� W Y �q@� W 5 d } ~ X Y q@X q@d S )NF��
check_license)z latest.v1r$ T)FF)� b64_encoding�secure_boot_info� perf_metricszinfo={0}�?iX zsecure boot infoz perf metricsz.Check-in URL param is too large, discarding %s)i� i� i� zCCheck-in request failed with error: {0}, retrying with reduced info)r rb r Zget_kernel_prefixed_urlr
Zwrap_with_cache_keyr � urlopen_authr Zencoded_server_infor� �stickyfy�lenr �logwarnr r� ) r� r� r� �moderi r� r� r� Z
request_paramZmax_url_lengthZ discard_info�exr5 r5 r6 �_fetch_patch_level_request s4 �
"r c C s> t �� }tjd k r$t �|ttj��S tD �]}z�t||| |�}t� |j
� t � t �
|�� ��� }tjd�| |�dd� |r�|�d�r�t|�}|�dg �}t�|�s�t�d��t �||d |d |d �W S t �|t|��W S tk
r� Y q( t k
�r0 } z|j d
k�r t d ��� W 5 d }~X Y q(X q(t � �d S ) Nz;fetch patch level, reason: {0}, kernel latest response: {1}F�Z print_msg�{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgrader� �baseurlr� )i� i� zKC licence is required) r r� r � PATCH_LEVELr� r} � PATCH_LATESTr r
Zset_config_from_patchserver�headers�update_all_kmod_paramsr re r~ r� r �loginfor� r� r r� r Zhas_kc_capabilitiesr �CapabilitiesMismatchZKernelPatchLevelr r r� r r� ) r� r r� r� r� r� Z latest_infoZrequired_capabilitiesr r5 r5 r6 �fetch_patch_level% s4
�" r c
C sB | � t|tj��}tj�d�|�� ztj |ddd� W dS t
k
rb tj�d�|�� Y dS t k
r� } z tj� d�|t
|��� W 5 d }~X Y nX | � t|tj�tj �}tj�d�|�� ztj |dd� W nd t
k
�r tj�d�|�� Y dS tk
�r< } z tj�d �|t
|��� W 5 d }~X Y nX dS )
NzProbing patch URL: {0}F�HEAD)r� �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1}r� z{0} is not available: {1})�file_urlr> r r@ r ru r� r� r r� r rh �debugr^ r ZSIGr )r� r< Zbin_urlr ri r5 r5 r6 � probe_patchF s( **r c C sF |t jkr| �t j�}n
| �|�}| �|�}tj||tjt� | �d�S )N)Z hash_checker)
r �KMOD_BINZkmod_urlr �
cache_pathr
Z fetch_urlr �
USE_SIGNATUREZget_hash_checker)r� �nameri Zdstr5 r5 r6 � fetch_and_verify_kernel_file_ s
r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd
d � Zd d
� ZdS )� PatchFetcherNc C s
|| _ d S r? )r� )r� r� r5 r5 r6 r� j s zPatchFetcher.__init__c C s t | j|�S r? )r r� )r� r r5 r5 r6 �_fetchm s zPatchFetcher._fetchc C sr | j �tj�}| j �tj�}| j �tj�}| j �tj�}tdd� ||||fD ��opt j
� |�dkopt j
� |�dkS )Nc s s | ]}t j�|�V qd S r? )r* r+ r, )r� r+ r5 r5 r6 � <genexpr>w s z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r r rD r@ rA r r �allr* r+ �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ
kmod_bin_pathr5 r5 r6 �is_patch_fetchedp s ��z PatchFetcher.is_patch_fetchedc C s0 | j d krtd��| j s | j S | �� r6t�d� | j S t�d� t| j tj�r�z tj | j �
t j �dd�}W n t
k
r~ Y n(X |j�dd �}|r�| j �t�|��| _ z| �t j � W n, t
k
r� td�| j t jp�d���Y nX | �t j� | �tj� | �� tj| j � t j �d d
d � t � tj � | j S ) Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r � KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�default� �wb�r )!r� r� r r r
rP r r� r r� r r r@ r r r� �upgrader re r r r� �
PATCH_TYPErA r r �extract_blacklistr� r rD r �restore_selinux_contextr| )r� �respr r5 r5 r6 � fetch_patch| s>
��
zPatchFetcher.fetch_patchc C sJ t | j�tj�d��� }|rFt�|�}|rFt� | j�tj
�|� d�� d S )Nr( r ) r. r� r r rA r~ � BLACKLIST_RE�searchr r� rB �group)r� ZbufZmor5 r5 r6 r' � s
z PatchFetcher.extract_blacklistc C s� |dkr dS zt |tj�}W n tk
r2 Y dS X |j�dd�}|rV|�t�|��}|� tj�}t
|d�� }t dd� |� � D ��}W 5 Q R X |D ]}t ||� q�t
�tj� dS )z�
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Nr r( c S s g | ] }|� � �qS r5 )r� )r� �fixupr5 r5 r6 r� � s z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r r rC r r r� r% r re r r. r) � readlinesr r( r r| )r� r� r) r Z fixups_fnamer3 �fixupsr. r5 r5 r6 � fetch_fixups� s zPatchFetcher.fetch_fixups)N) rG r� r� r� r r r* r' r1 r5 r5 r5 r6 r h s
(r c C s8 t � } t�| j� | jtjkr*t�d� n
t�d� d S )Nr r ) r� r r� �msgr� �PLI�PATCH_NEED_UPDATErN �exit)r� r5 r5 r6 � kcare_check� s
r6 c C s t � } t| �}z t�� }W n tk
r2 i }Y nX t�� }d}|d k r\t�|d �� d�}t�
� }t |� dg ��}t
dd� |D ��}t�� }|s�t�d� n
t�d� t�d �|�� t�d
�|�� |d kr�t�d �|�� |d kr�t�d
�|�� || d k�rt�d� t�d� d S )NZUnknown�tsz%Y-%m-%dr� c s s | ]}t |�d g ��V qdS )r� N)r r� )r� Zrecr5 r5 r6 r � s z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z
fromtimestamp�strftimer� r r� �sumr� r r� r� ) r� �
kcare_info� libcare_info�stateZ
latest_updateZeffective_versionZkernel_vulnerabilitiesZuserspace_vulnerabilitiesr� r5 r5 r6 �show_generic_info� s4
r> Fc
C s� z�t dtjd�}|st�|�tj�}t�t �
|�� � �}| r�g i }}|� d�D ]0}t�
|�}|rvd|krv|�|� qP|�|� qP||d< t�|�}t�|� W nR tk
r� } zt�||j� W Y �dS d}~X Y n tk
r� t�d� Y nX d S )
z�
Retrieve and output to STDOUT latest patch info, so it is easy to get
list of CVEs in use. More info at
https://cloudlinux.atlassian.net/browse/KCARE-952
:return: None
r� )r� �policy�
� kpatch-namer� r NzNo patches availabler )r� r �
POLICY_REMOTEr� r r rA r re r r� r~ r: r� �append�updaterc rd r� r r r� ri ) �is_jsonr� ri �
patch_infor� r2 �chunk�datar� r5 r5 r6 �kcare_latest_patch_info� s,
rI c C s� d| j i}| jd k r�t| �}g }|�d�D ]0}t�|�}|rPd|krP|�|� q*|�|� q*||d< t� � }|rx|d nd|d< |S )Nr� r@ rA r� r� �unknown)
r2 r� �_kcare_patch_infor: r r� rC rD r Z read_dumped_kernel_patch_level)r� r2 rF r� rG rH Zsaved_patch_levelr5 r5 r6 r8 s
r8 c C sP t �� }t �|| jtj�}tj�|�s.t d��t
|d�� � }|rLt �
d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.r( rF )r r� r� r� r rA r* r+ r, r r. r~ r+ �sub)r� r� r r� r5 r5 r6 rK ) s � rK c C sZ t � }| s>|jdkr t�|j� |jd kr.d S t�t|�� nt�tjt |�dd�� d S )Nr T)Z sort_keys)
r� r� r r� r2 r� rK rc rd r8 �rE r� r5 r5 r6 rF 7 s
rF c C s: t jd| g}t�|�}t�� }d}t�||�t�||�kS )Nz file-infozkpatch-build-time)r �
KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr5 r5 r6 �
is_same_patchC s
rR c C sL |dkr dS | r || k r dS | |kr(dS t �t �� |tj�}t|�sHdS dS )Nr FT)r r� r� r r@ rR )�
applied_level� new_levelrQ r5 r5 r6 �kcare_need_updateK s rU c C sp t jrltj�t�r t�ttj�s6tj �
d� t�� d S t j
dddtgdd�\} }}| dkrltj �
d� | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctl�-qz-pT�� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr* r+ r, �
SYSCTL_CONFIG�access�R_OKr ru �warningr� r r� )r� �_r5 r5 r6 �
update_sysctl] s r^ c s� t j�t�sttd��� t �tt j�s>tj �
d� t�� dS ttd��b}|� � }|�
d� |D ]$� t� fdd�| D ��s`|�� � q`|D ]}|�|d � q�|�� W 5 Q R X dS ) z*Update SYSCTL_CONFIG accordingly the editsrk zFile {0} has no read accessNzr+r c 3 s | ]}� � |�V qd S r? )r� )r� r( �r4 r5 r6 r y s z#edit_sysctl_conf.<locals>.<genexpr>�
)r* r+ r, rY r. r1 rZ r[ r ru r\ r� r/ �seek�any�write�truncate)r� rC Zsysctl�linesrk r5 r_ r6 �edit_sysctl_confh s
rf c C s& | D ] }t �|�rtd�|���qd S )NzDDetected '{0}' kernel module loaded. Please unload that module first)�CONFLICTING_MODULES_RE�matchr r� )r� �moduler5 r5 r6 �detect_conflicting_modules� s
rj c C s d� t�� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer5 r5 r5 r6 �get_kcare_kmod_link� s rk c
C sd t dd�} t�t�� | tj�}tj�|�s.d S t |d��"}|�
� dd � dkW 5 Q R � S Q R X d S )Nr� r� �rbi��s ~Module signature appended~
) r� r r� r� r r r* r+ r, r. r~ )r� Z kmod_fileZvfdr5 r5 r6 �kmod_is_signed� s
rm c s4 t �d�� � d krd S ddg} t� fdd�| D ��S )Nz
/proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ]}|� kV qd S r? r5 )r� r� �Z system_keysr5 r6 r � s z'kcare_certs_enrolled.<locals>.<genexpr>)r Z try_to_readrb )Z
kcare_keysr5 rn r6 �kcare_certs_enrolled� s
�ro c K s\ d| g}|� � D ]\}}|�d�||�� qtj|dd�\}}}|dkrXtd�| |���d S )Nz /sbin/insmodz{0}={1}TrW r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.)�itemsrC r� r r� r )Zkmodr� �cmdr� r_ r� r] r5 r5 r6 � load_kmod� s rr c C sP t �� r,t� dkrtd��t� dkr,td��t �� sDt �� sDt �� rLtd��d S )NFz4Secure boot is enabled. Not supported by KernelCare.z<Secure boot is enabled. No KernelCare certificates enrolled.zWYou are running inside a container. Kernelcare should be executed on host side instead.)r Zis_secure_bootrm r ro Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr5 r5 r5 r6 �check_compatibility� s
rs c C sP t �d�}t j|dgddd�d dk}|rL| dkrLt�d�| �� t�d� d S ) NZmodinfoZkmodlveT�rX � catch_stderrr ��freer� z3{0} patch type conflicts with kmodlve kernel moduler )r Zfind_cmdr� r �logerrorr� rN r5 )r< rq Z has_kmodlver5 r5 r6 � check_patch_type_compatibility� s
ry c C sL t �ddd| g�}g }|�d�D ]&}|�� r |�d�\}}}|�|� q |S )Nz
/sbin/modinfoz-FZparmr` �:)r rO r: r� � partitionrC )�
kcare_link�stdoutZavailable_paramsr4 Z
param_namer] r5 r5 r6 �get_kmod_available_params� s r~ c C sL t jr
dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rF )� kpatch_debugZ kmsg_outputZ kcore_outputZ
kdumps_dirZenable_crashreporter) r � KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErP �
KDUMPS_DIRr^ ZENABLE_CRASHREPORTERr5 r5 r5 r6 �make_kmod_new_params� s �r� c C sB t jr tj�t j�s t�t j� t� �� D ]\} }t| |� q*d S r? ) r r� r* r+ �exists�makedirsr� rp �update_kmod_param)Zparam�valr5 r5 r6 r � s r c C st d}t j�|| �}t j�|�s"d S z(t|d��}|�t|�� W 5 Q R X W n$ tk
rn tj �
d| |� Y nX d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r* r+ r; r� r. rc r^ rh r ru rK )Zkmod_param_nameZ param_valueZ params_rootZ
param_pathr3 r5 r5 r6 r� � s r� c s� t � }t�| |tj�}zt�||� W n tk
r> |}Y nX tj r`t
j � tj �s`t
�
tj � t� }t|�� t� fdd�|�� D ��}t|f|� t� d S )Nc 3 s" | ]\}}|� kr||fV qd S r? r5 )r� �k�v�Zavailable_kmod_paramsr5 r6 r � s z"load_kcare_kmod.<locals>.<genexpr>)rk r r� r r �shutil�copyrh r r� r* r+ r� r� r� r~ �dictrp rr �
update_depmod)r� r� r| Z
kcare_fileZ kmod_paramsr5 r� r6 �load_kcare_kmod� s
r� c C sX dg}| d k r |� d| g� tj|ddd�\}}}|rTtjd�d�|�||�dd� d S ) Nz /sbin/depmodz-aTrt z%Running of `{0}` failed with {1}: {2}� Fr )�extendr r� r rx r� r; )�unamerq r� r] �stderrr5 r5 r6 r� � s �r� c C s4 t jd| gdd�\}}}|dkr0td�| |���d S )Nz /sbin/rmmodTrW r z Unable to unload {0} kmod {1})r r� r r� )�modnamer� r] r5 r5 r6 � unload_kmod
s r� c C sP g }dg| D ]<}t �| |d�|��}tj�|�rt|� |�d�|�� q|S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r* r+ r� rr rC )r� r� r� Zloaded�mod�modpathr5 r5 r6 � apply_fixups s r� c C s@ | D ]6}z t |� W q tk
r8 tj�d| � Y qX qd S )Nz$Exception while unloading module %s.)r� rh r ru rv )r0 r� r5 r5 r6 �
remove_fixups s
r� c C s� | r
| }n6t jrt j}n(t� �|�r2d| t jdfS d| t jdfS dddddd�}|�� }||krj|| }ntd�|| t jd���|| t jdfS ) NZfreeze_conflictTr! FZ freeze_noneZ
freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3}))r Z PATCH_METHODr7 � intersection�upperr r� )�freezerr� r Zpatch_method_mapr5 r5 r6 �get_freezer_style" s$ �
r� rF c s� | ||d�� t d� � t�� }t�� }t|� t||�}t�| |tj�}t | |� d�
|tj t �
� t�|��} d|k}
|
o�t�| |�} |d k } | o�t|�o�t�| �}
� �|| d�� |
r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d
� � td� d }
|
�s<t d � � t| |� |�rHt� t d
� � t|| || |� t� t� d�
|t� � �� t � � t d� � t � fdd�tj!d� d S )N)r� Zfuturer �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�load�patchz5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S r? )r� r5 r� r5 r6 �<lambda>} r" z kcare_load.<locals>.<lambda>)rt )"r� r r� r� rj r� r� r r@ r� r� r& r r� Z parse_unameZis_kmod_version_changedrR Z kcare_update_effective_versionrD r� �kpatch_ctl_unpatchr� r� r� r� �kpatch_ctl_patchr^ r r
r� r Ztouch_status_gap_filerz r )r� r� r r� �
use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ
same_patchr0 r5 r� r6 �
kcare_loadA sZ
�
r� c C s� t jg}t�||tj�}tj�|�r2|� d|g� |� dd|g� |� d|d g� |�
| � t j |dd�\}}}|dkr�t
|||| ��d S )Nz-br� z-d�-mr TrW )r rN r r� r rB r* r+ r� r� rC r r� r� ) r� r� r� r� r� r� Zblacklist_filer� r] r5 r5 r6 r� � s
r� c C sZ t jtjdd| d gddd�\}}}|dkrVtjd�||�dd� td �|t| ����d S )
Nr� r� r Trt �4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}Fr �Error unpatching [{0}] {1}) r r� r rN r rx r� r r^ )r� r� r} r� r5 r5 r6 r� � s � r� c C s8 | |d< t t�� �|d< t�tj�tjd�t |�� d S )N�actionr7 z kcare.state)
r} rs r r� r* r+ r; r r| r^ )r� r� r5 r5 r6 r� � s r� c C sl d}t j�|�sd S t �|�D ]H}t j�||dd�}t j�|�sBq t �|�}|| kr t �|� t|� q d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r* r+ �isdir�listdirr; �islink�readlink�unlinkr� )� kmod_linkZ modules_path�entryZ
sym_link_pathZ target_pathr5 r5 r6 �update_weak_modules� s
r� c
C sB t �� }t� }z|�|� W n4 tk
rP } z|s@td�|���W 5 d }~X Y nX t �� }t| |�}t � �� d|k�r|d k }|r�t
t � � ||�}t j
tjdd|d gddd�\} }
} t|� | dkr�tjd�|
| �d d
� td �| t|����tjt�t�d td
�t�d� t� } tj � | ��r,t� | � t | � W 5 Q R X d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.r r� r� r Trt r� Fr r� r )�count�delay) r r� r r1 rh r r� r� r� r� r� r� r r� r rN r� r rx r^ r Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rk r* r+ r, r� r� )
r� �forcer� �pf�errr� r� Z need_unpatchr0 r� r} r� r� r5 r5 r6 � kcare_unload� sF ��
�
�
r� c C s8 t � }| rt|�S |jdkr"|jS |jd k r4t�� S d S r� )r� �_kcare_info_jsonr� r2 r� r rP rM r5 r5 r6 r; � s
r; c C sR d| j i}| jd k r>|�t�t�� �� |�t�|�d��� | j |d< t
� |�S )Nr� zkpatch-descriptionz kpatch-state) r2 r� rD r r� r rP Zparse_patch_descriptionr� r= rc rd )r� r2 r5 r5 r6 r� � s
r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r3 r r rl r� c C s" || _ || _|| _|| _|| _d S r? )r� r2 �
remote_lvlr� r= )r� r� r2 r� r� r= r5 r5 r6 r� � s
z PLI.__init__N)rG r� r� r
r4 �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r5 r5 r5 r6 r3 � s
r3 c C s� t �� } z�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nl tk
r� tj }t
j r�d
� t
j t
�� d t�� �}n d � t
�� d t�� t �� �}t||d d d �}Y nX |S )
Nr� r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingsr� Z unavailable)r r� r� rU r3 r4 r
r� r� r� r � STICKY_PATCHr� r r[ r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r2 r= r� r5 r5 r6 r� � sN
� � � �
��
�r� c
C s d}zZt �� }td|fd| fg�}t�� d�|� }t�|�}t� t�
|� � ��}t |d �W S t
k
r� } zt�||� W Y �dS d}~X Y nl tk
r� } zt�||� W Y �dS d}~X Y n: tk
� r� } zt�d�|�� W Y �d S d}~X Y nX dS )
z�
Request to tag server from ePortal. See KCARE-947 for more info
:param tag: String used to tag the server
:return: 0 on success, -1 on wrong server id, other values otherwise
N� server_id�tagz/tag_server.plain?{0}r� ������zInternal Error {0}���)r � get_serveridr! r r� r� r r� r r� re r~ r} r r r� r rh rx ) r� ri r� Zqueryr� r� r� ZueZeer5 r5 r6 �
tag_server1 s"
r� c C s� t �d�} t�d�| �� t}t�� ��}z:t� | |j
�}t � t �
| �|j
� t�|j
|� |j
}W n2 tk
r� } zt�d�|�� W 5 d }~X Y nX tjd|t�� gdd�\}}}|r�td�||���W 5 Q R X d S )Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)ru z Script failed with '{0}' {1})r rg r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler
Zfetch_signaturer Z save_to_filer r� Zcheck_gpg_signaturerh rx r r� r Zget_patch_serverr )Z
doctor_urlZdoctor_filenameZ
doctor_dstZ signaturer� r� r] r� r5 r5 r6 �kcdoctorL s
" r� c C sD t �d�t��} zt�| � W n tk
r4 Y dS X t�d� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r rg r� �EFFECTIVE_LATESTr r� r r r
)ri r5 r5 r6 �check_new_kc_version] s �r� c
C s t �� }t|�}|tjkp*|tjko*|dk}zt| |�}W n� tjk
r� } z,|dkrX� t �
t |�� t �
d� tj }W 5 d}~X Y n< t
k
r� } z |r�� nt j�d�|�� W 5 d}~X Y nX |tjkr�|} n@|} |dk�r|tj kr�t �|d�} n|tjk�r
|} ntd��| S )a�
Get patch level to apply.
:param reason: what was the source of request (update, info etc.)
:param policy: REMOTE -- get latest patch_level from patchserver,
LOCAL -- use cached latest,
LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:return: patch_level string
Nz#Using previously downloaded patcheszUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r rB ZPOLICY_LOCAL_FIRSTr r r r r r^ Z POLICY_LOCALrh ru r\ r� r� r )
r� r? r r� Z cached_levelZconsider_remote_exZ remote_levelr� r r� r5 r5 r6 r� j s2
$
r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdkrnt�� rnt jpXt }t
dd d
� |�f� t �
d � | �� ntd � | ���d S )
N�edfr! rF Zprober� �r& rv )zfs.enforce_symlinksifownerzfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernel)r r& r r r
�
update_configr Z is_cpanelZ FORCE_GID�
CPANEL_GIDrf r� r r
r )r< Zgidr5 r5 r6 �update_patch_type� s
�r� c
C st t �� ttj� |tjkr"t� ztd||d�}W nX t k
r� } z:|tj
tj fkrztj rzt
|�}tj�|� W Y �
dS � W 5 d}~X Y nX t�� }t|�}|�� t||d�s�t�d� dS z(tjtjddd� tjtjdd d� W n" tk
�r
tj�d
� Y nX t� � }|tj
k�s(tj �r\t � �( |� |� t |||| |tj kd � W 5 Q R X t�!|� t"||� dS ) ax
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:param policy: REMOTE -- download latest and patches from patchserver,
LOCAL -- use cached files,
LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases
:param freezer: freezer mode
rD )r� r? r N)rS rT z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r� )#r Zlog_all_parent_processesry r r& r rB r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� r^ r ru r\ r r� r r* rU r
r r� r� rh rv r� r� r� r1 r� Zdump_kernel_patch_levelr� ) r� r r? r� r� r2 r� r� r� r5 r5 r6 � do_update� s<
"
r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr<td��tjrHtjS | t j
krltjp\tj}tjphtj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzrelease-) r: �boolr r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r r� r� Zpatchsetr5 r5 r6 �
get_sticky� s* ���
r� c C s | d | S )Nr8 r5 )r� r� r5 r5 r6 � _stickyfy s r� c
C s t |�}|s| S |dkr"t|| �S t�� }|sDtj�d� t�d� z t �
t � � d�
|� �}W n: tk
r� } z t�||j� t�d� W 5 d}~X Y nX t�t�|�� ��}t|d �}|dkr�t|d | �S |d
kr�| S |d k� r�tj�d � t�d
� tj�d|d � t�d� dS )z�
Used to add sticky prefix to satisfy KCARE-953
:param file: name of the file to stickify
:return: stickified file.
�KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rl zEServer ID is not recognized. Please check if the server is registeredr9 zError: r� r� )r� r� r r� r ru r� rN r5 r r� r r� r� r r� ri r r� re r~ r} )�filer �sr� r� r� r� r� r5 r5 r6 r s2
r c
C s� g }| s dS | � d�}|d }|dd� }|�d�}||krLtdt| � ��|s`| �� |�� kS |dkrt|�d� n>|�d �s�|�d �r�|�t�|�� n|�t�|�� d
d �� |D ]}|�t�|�� q�t�
d d
� |� d tj �} | �
|�S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
Fr8 r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r: r� r� �repr�lowerrC r� �re�escape�replace�compiler; Z
IGNORECASErh )
Zdn�hostnameZ
max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr5 r5 r6 �_dnsname_match4 s(
r� c C s g }t | �� �D ]2}| �|�}|�� dkrdd� t|��d�D �}q| sPtd��g }|D ]*\}}|dkrXt||�rx d S |�|� qX|s�| � � j
}t||�r�d S |�|� t |�dkr�t d�
|d �tt|�����n*t |�dkr�t d
�
||d ���nt d ��d S )
NZsubjectAltNamec S s g | ]}|� � �d d��qS )rz r )r� r: )r� �itr5 r5 r6 r� l s z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}r� z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ
get_extensionZget_short_namer^ r: r� r� rC Z get_subjectZ
commonNamer r� r� r; �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� r_ Zcnr5 r5 r6 r� g s2
�
r� c C sn
t ddd�} | jdddd� | jdd d
dd� | jd d dd� | jd
dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCdd� | jdDdEdd� | jdFdGdd� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdd� | jdPdQdRtd dSdT� | jdUdVdd� | jdWdXdd� | �� }|jdYdZdRd� |jd[d\dd� |jd]d^dd� | jd_d`dRd dSda� | jdbdcddddSde� | jdfdgdh� | jdidjdd� | jdkdldmdndo� tj�s�| jdpdqdrdsdSdt� | jdudvdrdsdwdt� | jdxdydd� | jdzd{d|dd� | jd}ddd� | jd~dd�dd� | jd�d�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | �� }tj�t �
� � tj�s�t j d�g7 _ |j d k �rt
td |j �d�����tj ��rd�S d�S |j�s&|j�rBtj�r8tjt_ntjt_n|j�rRtjt_|j�szt� � d�k�rzt d�t j d�� d�S t j!}|j�r�t j"}n|j�r�t j#}t$�%|� |j&�r�t'�(� |j)�r�|j)d�k�r�t*|j)�t_+t j,tj+d�� nd t_+t j,dd�� |j-d k �r t j,|j-d�� |j-t_.|j/�r*dSt_0|j1�r8dSt_2|j3�rFdwt_4|j5�rTt5� |j6�rjt7�8d�t9� n8|j:�r�tj;d�k�r�tj<d�k�r�dntj<�p�d�|_=dw|_|j>�r�|j>t_?|j@�r�t7�8d�t9� d�t_?tj?�Ad��t_?tj?�r
tj?tBk�r
t$jC�Dd��Etj?d��FtB��� |jG�r$dwt_Hd�|jG t_I|j=�r6tJ|j=� tj;d�k�rdtK� t_;t7�8d��Etj;�p\d��t9� |jL�r�t'�MtNjL|jOd��� d S |jP�r�tPjPd�dwdwd��}t'�MtO�Q|�� d S tRtj;� |jS�r�tT� d S |jU�r�|jO�r�tUd�d�� ntU� d S |jV�r
t j,d�d�� d S |jW�r"t j,d�d�� d S |jX�r:t �Y|jX� d S |jZ�rLt[|jZ�S |j\�r\t]�\� |j^�r�tj;d�k�r|t j,d�d�� t]�^|j^|j_�S |j`�r�t]�`� d�k�r�d�S d�S |jad k �r�tb|ja�S |jc�r�t'�Mtjd� te|drd �d k �r�tf�g|jh� d�S tj� s.|ji�rtf�j� S |jk�r.tf�l� d k �r.t$�md�� |jn�rFtfjltjod�� n|jp�r`tf�q� t$�md�� |jr�rvt'�Mtf�s� � |jt�r�t'�Mtf�u� � |jv�r�tf�w� �r�t'�Mtf�x|jv�� |jyd k � r|jydk�r�tjz�p�t{tfj|�}� �}nd�d�� |jy�d��D �}tfjlt~|�d��d k � rt$�md�� |j� r.tfjltjod d�� |j�� rHt'�Mt�|jOd��� d}|j�� rdt7�8d�t9� d�}|j�� rr|j�}|j�� r�t�|tj�tj�d�� |j� r�t�|tj�d�� t$�md�� |j� r�t'�Mt���� � |j�� r�t�||j�d�� t$�md�� |j�
rdSt_�t���t���d�d��� t�|tjod�� |j��
r$t�|jOd�� |j��
r2t�� S |j��
rFt�|jOd�� |j��
rTt�� t�t j��d�k�
rjt�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrF Z
store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z
--app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz
--auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z
--nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz
--registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z
--nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz
--plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z
--server-infoz3Provides information about the host in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� rY r! �requiredz--check-compatibilityzCheck compatibility.z
--clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz
--edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r! r� rV z--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r� z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionrC z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� Zdestr� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez
--lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz
--lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr� zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr� r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledr� r r zPlease run as root)r� )r )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r! zMFlag --test has been deprecated and will be not available in future releases.r# �/z(Prefix `{0}` is not in expected one {1}.r� zfile:z+edf patches are deprecated. Fallback to {0})rE r )r� r� r� rc )r� ZYES)r� ZNOrw r� r� z Userspace patches are applied.r$ z Userspace patches are unloaded.c S s g | ]}|� � �� �qS r5 )r� r� )r� Zptchr5 r5 r6 r� � s zmain.<locals>.<listcomp>)�limit)r r� zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r r? zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentr} Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ
parse_args�__dict__rD r
Zget_config_settingsZFLAGSZ has_flagsr) �filterr: �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr� r* �getuid�printrN r� �loggingZINFOZWARNING�DEBUGr Zinitialize_loggingr� r Zclear_all_cacheZset_patch_levelr^ r r� Zset_sticky_patchr� Z nosignaturer Z
no_check_certr� r r� rs Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr& ZPREV_PATCH_TYPEZset_patch_typer� r� r# r� �EXPECTED_PREFIXru r\ r� r; Zlocalrb Z PATCH_SERVERr� r� Zapp_infor� r rc r rd rE Zdoctorr� r� Zenable_auto_updateZdisable_auto_updateZ
set_configZupdate_config_from_argsZset_monitoring_keyr� Z
unregisterr �registerZregister_autoretryr� r� r� r� r\ r] r Zset_libcare_statusr� Zuserspace_statusZget_userspace_update_statusZ
lib_updateZdo_userspace_updater
Zlib_auto_updater� Z
lib_unloadZlibcare_unloadZlib_infor< Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater� �listZ
USERSPACE_MAP�keys�sortedZuserspace_auto_updater� r; Znofreezer� Z smart_updater� r� Z
UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSrs rt �randomZuniformrF Zstatusr� Zlatest_patch_inforI Zcheckr6 r �argvr> )ZparserZexclusive_groupr� r� r� r� r� r5 r5 r6 �main� s~ �� � ��� ����� �� � � � � ���
r )N)N)F)F)N)rF F)rF F)r )�Z
__future__r rf rc r� r* r� r r� r� r� ZsslrN r� rs rM r� Zargparser �
contextlibr r rF r r r r
r r r
r r r r r r r r r r r r r r r Zpy23r r r r r! r� r� r r- r� r
rY r� r� ZDOTALLr+ rg r+ r� �insert�filterwarningsr ZAnyZDictZOptional�SetZTupleZUnionru ZsetLevelr� r7 r> rE ra rj rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r] Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z
StrictVersionZ __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r r� r r r r r6 r> rI r8 rK rF rR rU r^ rf rj rk rm ro rr rs ry r~ r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r; r� r3 r� r� r� r� rB r� r� r� r� r� r r� r� r r5 r5 r5 r6 �<module> s� T
&
4
! a #
?
, 2
.7 ,
3)