Your IP : 216.73.217.17
�
S�ic @ s� d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m Z m Z m
Z
m Z m Z m
Z
m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z e r� d d l m Z m Z m Z n d Z d3 Z d Z d
Z d Z! i d d
6d d 6d d 6Z" d d d d g Z# d � Z$ i d
d d g d 6e$ � d 6Z% d � Z& d � Z' d e( f d � � YZ) d � Z* d d � Z, d � Z- d � Z. d � Z/ e0 d d � Z1 d � Z2 e' d! � � Z3 e' d" � � Z4 e' d# � � Z5 d$ � Z6 d% � Z7 d& � Z8 d' � Z9 d( � Z: d) � Z; e' e* e j< d* � � � � Z= e j< e j> d+ � e j? e' e* e
j@ d d, � � � � � � ZA e' d- � � ZB d. � ZC d/ � ZD d d0 � ZE d1 � ZF d2 � ZG d S(4 i����Ni ( t autht capabilitiest configt config_handlerst constantst errorst fetcht log_utilst platform_utilst
process_utilst selinuxt server_infot update_utilst utils( t HTTPErrort json_loads_nstrt urlquote( t Dictt Listt Tuples! /usr/libexec/kcare/libcare-clients /run/libcare/libcare.socks /var/run/libcare.socks /var/cache/kcare/libcare_patchess /var/cache/kcare/libcare_cvelists& /etc/sysconfig/kcare/libcare.logrotatet dbt mysqldt mariadbdt postgrest libct libsslt nscdt libmc C s� y& t j � d \ } } | j � } Wn t k
r@ t t � SX| j d � rZ t t � Sd | k r | j d � r t t � St d g S( s Return libs list, excluding libnss_dns on distros with
cross-library patches (libnss_dns + libresolv) already deployed:
- EL7 (all distros): glibc-rh1296031.patch (CVE-2015-7547)
- Ubuntu 16.04: revert-CVE-2015-5180.diff
See LIBCARE-2943 for details.
i t 7t ubuntus 16.t
libnss_dns( R t
get_distrot lowert Exceptiont listt
_LIBS_BASEt
startswith( t namet version( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _get_userspace_lib_list- s
t libsc G s t j j t j d | | � S( Nt userspace( t ost patht joinR t PATCH_CACHE( t libnamet parts( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_userspace_cache_pathF s c s � f d � } | S( Nc sY z � | | � SWd y t d � Wn/ t k
rS } t j d j | � d t �n XXd S( Nt
clearcaches$ Libcare cache clearing failed: '{0}'t print_msg( t libcare_clientR! R t logerrort formatt False( t argst kwargst err( t clbl( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt wrapperK s ( ( R: R; ( ( R: s- /usr/libexec/kcare/python/kcarectl/libcare.pyt clear_libcare_cacheJ s
t UserspacePatchLevelc B s) e Z d d � Z d d � Z d � Z RS( c C s t | | � j | | � S( N( t supert __new__( t clsR. t buildidt levelt baseurl( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR? Y s c C s( | | _ | | _ | | _ | | _ d S( N( RB R. RA RC ( t selfR. RA RB RC ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt __init__\ s c G s t | j | j t | � | � S( N( R0 R. RA t str( RD R/ ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt
cache_pathb s N( t __name__t
__module__t NoneR? RE RG ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR= X s c s d � � � � f d � } | S( Nc S s d \ } } z� | d k r' t � } n i } g } xL t | � D]> } | j d d � | | j d � <| j | j d g � � q@ Wt j | d d �} d j g | j � D] } d j | � ^ q� � } d j t | � � } Wd t j
t | d
t �t j
t
| d
t �Xd S( s( KPT-1543 Save info about applied patchest s latest-versiont packaget patchest cve_fieldt cves
t Nt
ensure_dir( RK RK ( RJ t
_libcare_infot _get_patches_infot gett extendR
t extract_unique_cvesR, t itemst sortedt atomic_writet LIBCARE_PATCHESt Truet LIBCARE_CVE_LIST( t infot versionst cvest packagest all_patchest rect cves_set( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt save_current_stateg s 1c s/ d } z � | | � } | SWd � | � Xd S( N( RJ ( R7 R8 R] ( R: Rd ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR; y s
( ( R: R; ( ( R: Rd s- /usr/libexec/kcare/python/kcarectl/libcare.pyt refresh_applied_patches_listf s c
C s t j p d } t | � } t | j � � } t j t j | d � | | | d � } | d t j d | � 7} t j | d � } y" t
j t j
� | d t �} Wn3 t j k
r� t j t | | � d t �� n Xt j | j � t t j | j � � � } | j d g � } t j | � s?t j d
j | � � � n t | | | d | j d � � } t | d � }
t | | |
d
� } t! j" j# | � s�t! j" j$ | � d k r-t j | d � } y, t
j% | | d t j& d t
j' | � �Wq-t( k
r)} | j) d k r#t j* d � � n � q-Xn t | | |
� }
d d | d |
d g } t+ j, | d t d t �\ } } } | r�t j- d j | | | � d d �� n t | | d � } t! j" j. | � r�t! j" j/ | � r�t j | � n t! j0 |
| d � t! j1 | d | � d S(! Nt maint us latest.v1s ?info=t updateR( t
check_licenset
ignore_errorsR sk Latest LibCare patchset for {0} is incompatible with the current kernecare package version, please upgrade.RB RC s patch.tar.gzi t patch_urlt check_signaturet hash_checkeri� i� s KC+ licence is requiredt tart xfs -Cs --no-same-ownert catch_stdoutt catch_stderrs( Patches unpacking error: '{0}' '{1}' {2}t statuss patches unpacking errort latests .tmp( i� i� (2 R t PREFIXR t stripR
t get_patch_server_urlt LIBNAME_MAPRT R t encoded_server_lib_infoR t wrap_with_cache_keyR t urlopen_authR6 R t NotFoundt shutilt rmtreeR0 R[ R t set_feature_flags_from_headerst headersR t nstrt readR t has_lc_capabilitiest CapabilitiesMismatchR5 R= RF R* R+ t existst getsizet fetch_urlt
USE_SIGNATUREt get_hash_checkerR t codet NoLibcareLicenseExceptionR t run_commandt
KcareErrort islinkt isdirt symlinkt rename( R. t build_idt patch_levelt prefixt urlt cache_dstt responset metat required_capabilitiesRB t plevelt
patch_patht ext dstt cmdR� t stdoutt stderrt link_name( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt fetch_userspace_patch� sP '" "+,
$!%c C sj | t _ | s t � n t j d | r/ d n d � | rF t � n t j j d | r^ d n d � d S( Nt LIBCARE_DISABLEDt FALSEt YESs libcare service is t enabledt disabled( R R� t libcare_server_stopR t
update_configt libcare_server_startR t kcarelogR] ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt set_libcare_status� s
c C sE y t j d d � d d g } Wn t k
r3 d SXt j | � d S( Nt services
/usr/sbin/s /sbin/t libcaret stop( s
/usr/sbin/s /sbin/( R t find_cmdR! R� ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s
c C s� t j s t j j t j � rS t j t j d d g � t j t j d d g � nA y t j d d � d d g } Wn t k
r� d SXt j | � d S(
Ns reset-failedR� t restarts libcare.socketR� s
/usr/sbin/s /sbin/t start( s
/usr/sbin/s /sbin/(
R t SKIP_SYSTEMCTL_CHECKR* R+ R� t SYSTEMCTLR R� R� R! ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s
c sg d j d � t | p g � D� � } d d g } � sM | d d | g 7} n y t | � } Wn1 t k
r� } t j d j | � d d �� n Xg } xN | j d
� D]= } | r� y | j t j
| � � Wq� t k
r� q� Xq� q� Wg | D]3 } i | j d � d 6| j d � d 6| d
6^ q� } x8 | D]0 } t
� f d � | d
j � D� � | d
<q/W| S( Nt |c s s | ] } d j | � Vq d S( s ({0})N( R5 ( t .0t proc( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s R] s -js -ls -rs/ Gathering userspace libraries info error: '{0}'Rr s userspace libs info errors
t commt pidR( c 3 s4 | ]* \ } } d | k s" � r | | f Vq d S( t patchlvlN( ( R� t kt v( t patched( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s ( R, RX R3 R! R R� R5 t splitt appendt jsont loadst
ValueErrort popt dictRW ( R� t limitt regexpR� t linesR9 t resultt line( ( R� s- /usr/libexec/kcare/python/kcarectl/libcare.pyRR � s& % "
@
.c C s� t � } xJ | D]B } x9 | d j � D]' \ } } | j | d | d f � q' Wq Wg } x� t D]{ } xr | D]j \ } } t | | t | � d � } t j j | � rp t | d � � }
| j
t j |
� � Wd QXqp qp Wqc W| S( NR( RA R� s info.jsont r(
t setRW t addt
USERSPACE_MAPR0 RF R* R+ t isfilet openR� R� t load( R] RM Rb t _t dataR� R� R� R� t patch_info_filenamet fd( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyRS � s
#
'c C s
t t � � S( N( RS RR ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_info_basic s c C s3 t � } | s t j d � n t j i | d 6� S( Ns No patched processes.R� ( R� R R4 R� t dumps( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_info s c C s3 t � } | s t j d � n t j i | d 6� S( Ns No patched processes.R� ( RR R R4 R� R� ( R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_info s c C s= i } x0 t � D]% } | j d d � | | j d � <q W| S( Ns latest-versionRK RL ( R� RT ( R� Rb ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _libcare_version s #c C s7 x0 t � j � D] \ } } | j | � r | Sq Wd S( NRK ( R� RW R$ ( R. RL R& ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_version# s c C s d j d � | D� � d S( NRK c s s" | ] } t j | � d Vq d S( t N( R
t bstr( R� t p( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>+ s R� ( R, ( t params( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_client_format* s c C s: x$ t D] } t j j | � r | Sq Wt j d � � d S( Ns Libcare socket is not found.( t LIBCARE_SOCKETR* R+ R� R R� ( t libcare_socket( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_available_libcare_socket. s
c G s t j r t j d � � n t j t j t j d � } | j d � d } z� | j t � � | j t j
� t | � } t j
d j d | � � | j | � x- t r� | j d � } | s� Pn | | 7} q� W| j d d � } t j
d
j d | � � | SWd | j � Xd S( Ns Libcare is disabled.i i
RK s Libcare socket send: {cmd}R� i s utf-8t replaces! Libcare socket recieved: {result}R� ( R R� R R� t sockett AF_UNIXt SOCK_STREAMt
settimeoutt connectR� t LIBCARE_SOCKET_TIMEOUTR� R t logdebugR5 t sendallR[ t recvt decodet close( R� t sockt resR� R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR3 5 s(
c C s� x� | D]� } y t d t | � � Wn1 t k
rW } t j d j | � d d �� n Xy t d � Wq t k
r� } t j d j | � d d �� q Xq Wd S( Nt storages( Userspace storage switching error: '{0}'Rr s userspace storage switch errorRh s% Userspace patch applying error: '{0}'s userspace patch apply error( R3 R0 R! R R� R5 ( R� R� R9 ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_patch_applyM s
"c C sF y t d � Wn1 t k
rA } t j d j | � d d �� n Xd S( Nt unloads& Userspace patch unloading error: '{0}'Rr s userspace patch unload error( R3 R! R R� R5 ( R9 ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_unloadZ s R� c C sx t � | t j k r$ t j r$ d S| d k rE t t j � � } n g } x' | D] } | j t j
| g � � qR W| s� t j d j
| � � d St d | � \ } } } } | r� t j d � � n | s� t j d � d St j t j j t j d � � t � y t | � Wn8 t j k
rM} t j t | � � t j d � � n Xt � } t | � }
t t d � | D� � � s�d St j d j
d | � � t j d
j
d |
� � t d � |
j � D� � } t d
� | j � D� � } | | }
t d � |
j � D� � } t j d j
d t! |
� d | � � x9 |
j" � D]+ \ } } t j d j
| t! | � � � qEW| S( s0 Patch userspace processes to the latest version.s No such userspace patches: {0}R� s8 There were errors while patches downloading (unpacking).s No patches were found.R) s) There were errors while patches applying.c s s | ] } | d Vq d S( R( N( ( R� t item( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s s Patched before: {before}t befores Patched after: {after}t afterc s s" | ] } | D] } | Vq
q d S( N( ( R� RW R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s c s s" | ] } | D] } | Vq
q d S( N( ( R� RW R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s c s s | ] } t | � Vq d S( N( t len( R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pys <genexpr>� s s� The patches have been successfully applied to {count} newly discovered processes. The overall amount of applied patches is {overall}.t countt overalls* Object `{0}` is patched for {1} processes.N(# t rotate_libcare_logsR t UPDATE_MODE_AUTOR t LIB_AUTO_UPDATERJ R" R� t keysRU RT R t loginfoR5 t check_userspace_updatesR R� R
t restore_selinux_contextR* R+ R, R- R� R4 RF RR t _get_userspace_procst anyR� R� t valuest sumR� RW ( t modeR� t process_filtert userspace_patcht failedt something_foundR� R� R� t
data_afterR� t uniq_procs_aftert uniq_procs_beforet diffR� R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt do_userspace_updatee sP
#c C sn z5 y t � \ } } } } Wn t j k
r3 d SXWd t � X| rJ d S| rT d St j d d � rj d Sd S( Ni i t filenames .libcarestatusi i ( R� R R� R� R t status_gap_passed( R R� t libs_not_patched( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt get_userspace_update_status� s c C s� i } xy | D]q } xh | d j � D]V \ } } | j d � r$ | | k rX g | | <n | | j | d | d f � q$ q$ Wq
W| S( NR( R� R� R� ( RW RT R� ( R] R� R� R. Rb ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR � s
*c C se t � } xU | D]M } xD | d j � D]2 \ } } | j | | d | j d d � f � q' Wq W| S( NR( RA R� i ( R� RW R� RT ( R] R� R� R. Rb ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt _get_userspace_libs� s
.c
C sm | s5 g } g t j � D] } | j | � ^ q n t d t d | � } t | � } t } } t } x� t | � D]� } | \ } } }
y/ t | | |
� t } |
d k r� t } n Wqs t j
k
r� } t } t j t
| � � qs t j t j f k
rqs t j k
r� qs t j k
rH} t } t j t
| � � qs Xqs Wt j d d � | | | | f S( NR� R� i R s .libcarestatus( R� R RU RR R6 R R[ R R� R R� R t logwarnRF R{ R� t AlreadyTrialedExceptionR� R4 R t touch_status_gap_file(
R� R( t data_beforeR� R R R Rb R. R� R� t eR� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s4 )
c C s� d } d } t j d d t �} | r� y( t j | t g d t �\ } } } Wn% t k
rv } d } t | � } n X| r� t j d j
| � d t �q� n t j d d t �d
} t j
j | � s� d St j d } y� t j | � } t j d
� } g | D]* } | j | � rt j
j | | � ^ q}
g |
D] } t j
j | � | f ^ q:} | j d t � d }
xY | D]Q \ } } |
t j
j | � 7}
|
| k r{t j | � t j j d | � q{q{WWn$ t k
r�t j d d t �n Xd S( Ni RK t logrotatet raise_excRq i s5 failed to run logrotate for libcare logs, stderr: {0}R2 s logrotate utility wasn't founds /var/log/libcare/i i s ^\d+\.log.*t reverses% Removed %s because of logs size limits) Failed to cleanup libcare server logfilesi ( R R� R6 R� t LIBCARE_LOGROTATE_CONFIGR[ R! RF R R4 R5 R R* R+ R� R t! LIBCARE_PIDLOGS_MAX_TOTAL_SIZE_MBt listdirt ret compilet matchR, t getctimet sortR� t removeR� R] t logexc( t rcR� t logrotate_pathR� R t libcare_log_directoryt max_total_sizet log_filest pidlog_ret fnt pidlog_filest fpt pidlog_files_with_ctt
total_sizet filepath( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyR� � s< ("
7+
c C sb y t j d d � d d g } Wn t k
r3 t SXt j | d t d t �\ } } } | d k S(
sK Assume that whenever the service is not running, we did not patch anything.R� s
/usr/sbin/s /sbin/R� Rr Rp Rq i ( s
/usr/sbin/s /sbin/( R R� R! R6 R� R[ ( R� R� R� ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt libcare_server_started! s
$( s /run/libcare/libcare.socks /var/run/libcare.sock(H R� R* R R| R� RK R R R R R R R R R R R
R R R
t py23R R R R6 t typingR R R t LIBCARE_CLIENTR� RZ R\ R Rw R# R' R� R0 R< t intR= Re RJ R� R� R� R� R[ RR RS R� R� R� R� R� R� R� R3 R� t log_all_parent_processesR� t track_update_statust skip_if_no_selinux_modulet UPDATE_MODE_MANUALR R R R R� R� R2 ( ( ( s- /usr/libexec/kcare/python/kcarectl/libcare.pyt <module> sl ^
5
!F " *