HEX
Server: LiteSpeed
System: Linux premium69.web-hosting.com 4.18.0-553.44.1.lve.el8.x86_64 #1 SMP Thu Mar 13 14:29:12 UTC 2025 x86_64
User: swifizcd (1555)
PHP: 8.2.30
Disabled: NONE
Upload Files
File: //opt/cloudlinux/venv/lib64/python3.11/site-packages/clcagefslib/__pycache__/domain.cpython-311.pyc
�

r`�ihT��T�ddlZddlZddlZddlZddlZddlZddlmZddlm	Z	ddl
mZmZddl
mZmZddl
mZddlmZddlmZdd	lmZd
dlmZd
dlmZd
d
lmZmZmZd
dl m!Z!d
dl"m#Z#d
dl$m%Z%d
dl&m'Z'm(Z(d
dl)m*Z*m+Z+d�Z,d�Z-de.dzfd�Z/de.de0fd�Z1d�Z2dZ3dZ4dgZ5ddd�Z6d �Z7d!�Z8d"�Z9de.fd#�Z:ej;d
�$��d%���Z<d&�Z=d'�Z>d(�Z?d)�Z@d*�ZAd+�ZBd,e.fd-�ZCd,e.fd.�ZDd,e.fd/�ZEd0�ZFd1e.fd2�ZGd3�ZHdeIfd4�ZJde.fd5�ZKdeIfd6�ZLd7�ZMd8�ZNd:de.d1e.dzfd9�ZOdS);�N)�defaultdict)�Path)�setup_mount_dir_cagefs�CAGEFSCTL_TOOL)�cpusers�is_panel_feature_supported)�docroot)�Feature)�NoDomain)�PyLve�)�user_exists)�UserNotFoundError)�admin_config�config�
jail_utils)�DOCROOTS_ISOLATED_BASE)�write_jail_mounts_config)�reload_processes_with_docroots)�start_monitoring_service�stop_monitoring_service)�trigger_xray_ini_regeneration�trigger_ssa_ini_regenerationc�T�tj�tj��S�N)�os�path�isfiler�WEBSITE_ISOLATION_MARKER���Fopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/domain.py�(is_website_isolation_allowed_server_wider#%s��
�7�>�>�,�?�@�@�@r!c�T�tj�tj��Sr)rrrr�"WEBSITE_ISOLATION_AVAILABLE_MARKERr r!r"�&is_website_isolation_feature_availabler&)s��
�7�>�>�,�I�J�J�Jr!�returnc�.�tj�tj��}tj�tj��}|r8|r6t
jd��tj	tjd���dS|rdS|rdSdS)uReturn the current user mode for website isolation.

    Returns:
        ``"allow_all"`` – all users allowed, denied dir lists exceptions.
        ``"deny_all"``  – no users allowed, allowed dir lists exceptions.
        ``None``        – not initialised yet.
    z�Both site-isolation.users.allowed and site-isolation.users.denied directories exist. Removing allowed directory, treating as allow_all mode.T��
ignore_errors�	allow_all�deny_allN)
rr�isdirr�ISOLATION_DENIED_DIR�ISOLATION_ALLOWED_DIR�logging�warning�shutil�rmtree)�
has_denied�has_alloweds  r"�get_isolation_user_moder6-s�������|�@�A�A�J��'�-�-�� B�C�C�K���k����
Y�	
�	
�	
�	�
�l�8��M�M�M�M��{����{����z��4r!�userc��tj�tj��sdSt��}|dkr tjtj|��S|dkrtjtj|��SdS)uCheck whether *user* is allowed to use website isolation.

    Combines the global marker with the two-mode user model:
    * **allow_all** – allowed unless the user is in the denied directory.
    * **deny_all**  – denied unless the user is in the allowed directory.
    Fr+r,)	rrrrrr6�user_in_dirr.r/)r7�modes  r"�%is_website_isolation_allowed_for_userr;Fsw���7�>�>�,�?�@�@���u�"�$�$�D��{����+�L�,M�t�T�T�T�T��z����'��(J�D�Q�Q�Q��5r!c�j�tj�tj��s�tt
t��ddd���ttj��}|j	�
dd���|���tj
gd�dd���dSdS)	zCSet up mount directories and the global marker if not already done.�*TF)�prefix�remount_cagefs�remount_in_background)�parents�exist_ok)z/usr/bin/systemctlztry-restartzclwpos_monitoring.service)�capture_output�textN)rrrrrr�strrr�parent�mkdir�touch�
subprocess�run)�marker_paths r"�"_ensure_isolation_mount_and_markerrLWs���
�7�>�>�,�?�@�@�

���&�'�'���u�	
�	
�	
�	
��<�@�A�A���� � ��� �=�=�=���������N�N�N���	
�	
�	
�	
�	
�	
�

�

r!z/etc/cagefs/proxy.commandsz<CAGEFSCTL_USER:noproceed:nolve=root:/usr/sbin/cagefsctl-userz/usr/sbin/cagefsctl-userz(/usr/share/lve-utils/lvd-registry-helperz&/usr/share/lve-utils/lvd-limits-helper)�LVD_REGISTRY_HELPER�LVD_LIMITS_HELPERc���d}|���D]S\}}||vr�
tj�|��s�*|r|�d��s|dz
}||�d|�d�z
}d}�T||fS)aKAppend missing proxy entries to *content*, return (new_content, added).

    Each entry in *entries* is a ``{KEY: path}`` dict.  An entry is added
    only when its KEY is not yet present AND the binary exists on disk.
    Returns the (possibly updated) content string and a bool indicating
    whether any entries were added.
    F�
�=T)�itemsrr�exists�endswith)�content�entries�added�key�binarys     r"�_add_proxy_entriesrZws���
�E��}�}�������V��'�>�>���w�~�~�f�%�%�	���	�7�+�+�D�1�1�	��t�O�G��c�&�&�F�&�&�&�&������E�>�r!c���d}|���D]e\�}�|vr�
tj�|��r�*|�d���}�fd�|D��}d�|��}d}�f||fS)z�Remove proxy entries whose binaries no longer exist on disk.

    Returns the (possibly updated) content string and a bool indicating
    whether any entries were removed.
    FT)�keependsc�D��g|]}|���d����|��S)rQ)�
startswith)�.0�lrXs  �r"�
<listcomp>z)_remove_proxy_entries.<locals>.<listcomp>�s0���A�A�A�q�����i�i�i�)@�)@�A��A�A�Ar!�)rRrrrS�
splitlines�join)rUrV�removedrY�linesrXs     @r"�_remove_proxy_entriesrg�s�����G��}�}�������V��g����
�7�>�>�&�!�!�	���"�"�D�"�1�1��A�A�A�A�E�A�A�A���'�'�%�.�.������G��r!c��	ttdd���5}|���}ddd��n#1swxYwYn#t$rd}YnwxYwd}d|vrEt	jdt��|r|�d	��s|d	z
}|td	zz
}d
}t|t��\}}|rt	jdt��d
}t|t��\}}|rt	jdt��d
}|sdStj�
t��}tj|d
�
��tj|d���\}}	tj|dd���5}|�|��ddd��n#1swxYwYtj|t��n##t($rtj|���wxYwd	�t.��d	z���}t3jt6ddg|t2jt2jd���t3jt6dgt2jt2jd���dS)a�Register the ``cagefsctl-user`` proxyexec alias if not already present.

    Appends the ``CAGEFSCTL_USER`` entry to ``/etc/cagefs/proxy.commands``
    and runs ``cagefsctl --update-list`` to pull the required binaries into
    the CageFS skeleton.  This is a no-op when the entry already exists.

    Also registers/unregisters the LVD helper binaries
    (``lvd-registry-helper``, ``lvd-limits-helper``) depending on whether
    they are present on disk.
    �rzutf-8)�encodingNrbF�CAGEFSCTL_USERz Registering cagefsctl-user in %srPTzRegistering LVD helpers in %sz"Removing stale LVD helpers from %s)rBz.proxy.commands.)�dirr>�wz--wait-lockz
--update-list)�input�stdout�stderr�checkz--update-wrappers)rorprq)�open�PROXY_COMMANDS_PATH�read�FileNotFoundErrorr0�inforT�CAGEFSCTL_USER_PROXY_ENTRYrZ�LVD_PROXY_ENTRIESrgrr�dirname�makedirs�tempfile�mkstemp�fdopen�write�replace�
BaseException�unlinkrd�CAGEFSCTL_USER_BINARIES�encoderIrJr�DEVNULL)	�frU�changedrWre�	proxy_dir�fd�tmp_path�update_lists	         r"�ensure_proxyexec_commandr��s���
�%�s�W�
=�
=�
=�	���f�f�h�h�G�	�	�	�	�	�	�	�	�	�	�	����	�	�	�	����������������G��w�&�&���7�9L�M�M�M��	�7�+�+�D�1�1�	��t�O�G��-��4�4����'��1B�C�C�N�G�U�����4�6I�J�J�J���,�W�6G�H�H��G�W�����9�;N�O�O�O����������� 3�4�4�I��K�	�D�)�)�)�)��#�	�:L�M�M�M�L�B���
�Y�r�3��
1�
1�
1�	�Q�
�G�G�G����	�	�	�	�	�	�	�	�	�	�	����	�	�	�	�
�
�8�0�1�1�1�1������
�	�(����
������9�9�4�5�5��<�D�D�F�F�K��N�	���8���!��!�������N�	�,�-��!��!��	�����s^�A�:�A�>�A�>�A�A�A�'G�>F �G� F$�$G�'F$�(G� G&c��t��t��}|dkrNd}tjtjtjd���tjtj	d���nMd}tjtj	tjd���tjtjd���|S)uFlip the isolation user mode without modifying any per-user state.

    Unlike :func:`allow_website_isolation_server_wide` and
    :func:`deny_website_isolation_server_wide`, this function only flips
    the mode indicator directories.  It does **not** clean up existing
    user isolation or alter the per-user exception lists.

    * ``allow_all`` → ``deny_all``
    * ``deny_all``  → ``allow_all``
    * not initialised → ``allow_all``

    Returns:
        The new mode after toggling (``"allow_all"`` or ``"deny_all"``).
    r+r,T�r:rBr))
rLr6rrzrr/�DIR_MODEr2r3r.)�current�new_modes  r"�toggle_isolation_user_moder��s���'�(�(�(�%�'�'�G��+�����
��L�6�\�=R�]a�b�b�b�b��
�l�7�t�L�L�L�L�L���
��L�5�L�<Q�\`�a�a�a�a��
�l�8��M�M�M�M��Or!)�maxsizec��	t��}n#ttf$rYdSwxYw|���sdS|���S)z;Check if the running kernel supports per-domain LVE limits.F)r�AttributeError�OSError�
initialize�domains_supported)�pys r"�_domain_limits_supportedr��sb���
�W�W�����G�$�����u�u������=�=�?�?���u�
���!�!�!s��&�&c��ttj��sdSt��sdSt	jdd|gdd���dS)z;Create LVP infrastructure for user via lvectl (idempotent).N�/usr/sbin/lvectlzallow-domain-limitsT�rqrC�rr
�LVEr�rIrJ��usernames r"�_allow_domain_limitsr�
s_��%�g�k�2�2����#�%�%�����N�&�(=�x�H��d�4�4�4�4�4�4r!c��ttj��sdSt��sdSt	jdd|gdd���dS)z1Tear down LVP infrastructure for user via lvectl.Nr�zdeny-domain-limitsTr�r�r�s r"�_deny_domain_limitsr�s_��%�g�k�2�2����#�%�%�����N�&�(<�h�G��d�4�4�4�4�4�4r!c��ttj��sdSt��sdSt	jdd|gdd���dS)z0Register domain LVE under user's LVP via lvectl.Nr�zenable-domain-limitsTr�r��r7�domains  r"�_register_domain_lver�!s_��%�g�k�2�2����#�%�%�����N�	�3�V�<��4������r!c��ttj��sdSt��sdSt	jdd|gdd���dS)z!Unregister domain LVE via lvectl.Nr�zdisable-domain-limitsTr�r�r�s  r"�_unregister_domain_lver�-s_��%�g�k�2�2����#�%�%�����N�	�4�f�=��4������r!c��t��t��tjtjtjd���tjtj	d���t��D]S}t|��s�	t|���##tjtf$rt!jd|��Y�PwxYwdS)u@Switch to *allow_all* mode – all users are allowed by default.Tr�r)z5Failed to enable domain limits for user %s, skipping.N)rLr�rrzrr.r�r2r3r/rrr�rI�CalledProcessErrorr�r0�	exceptionr�s r"�#allow_website_isolation_server_wider�9s���&�(�(�(������K��1��8M�X\�]�]�]�]�
�M�,�4�D�I�I�I�I��I�I�
�
���8�$�$�	��	� ��*�*�*�*���-�w�7�	�	�	���G��
�
�
�
�
�	����
�
s�	B�+C�Cc��t��t��D]S}t|��s�	t|���##tjtf$rtjd|��Y�PwxYwt��tjtj
tjd���tjtjd���dS)u�Switch to *deny_all* mode – no users are allowed by default.

    Disables domain isolation for every user and switches the mode.
    z6Failed to disable domain limits for user %s, skipping.Tr�r)N)�_cleanup_all_users_isolationrrr�rIr�r�r0r�rLrrzrr/r�r2r3r.r�s r"�"deny_website_isolation_server_wider�Os���
!�"�"�"��I�I�
�
���8�$�$�	��	���)�)�)�)���-�w�7�	�	�	���H��
�
�
�
�
�	����'�(�(�(��K��2��9N�Y]�^�^�^�^�
�M�,�3�4�H�H�H�H�H�Hs�A�+A.�-A.r�c��t��t��t��}|dkr tjtj|��np|dkr tjtj|��nJtj	tjtj
d���tjtj|��t|��dS)u;Allow website isolation for *username* (mode-aware).

    * **allow_all** – removes *username* from the denied directory.
    * **deny_all**  – adds *username* to the allowed directory.
    * **not initialised** – sets up infrastructure in *deny_all* mode
      with *username* as the first allowed user.
    r+r,Tr�N)rLr�r6r�remove_user_from_dirr.�add_user_to_dirr/rrzr�r��r�r:s  r"� allow_website_isolation_for_userr�is���'�(�(�(�����"�$�$�D��{����)�,�*K�X�V�V�V�V�	
��	�	��$�\�%G��R�R�R�R�	��L�6�\�=R�]a�b�b�b�b��$�\�%G��R�R�R���"�"�"�"�"r!c���t��}|dkr tjtj|��n%|dkrtjtj|��t
|��t|��dS)u�Deny website isolation for *username* (mode-aware).

    * **allow_all** – adds *username* to the denied directory.
    * **deny_all**  – removes *username* from the allowed directory.

    Also disables all domain isolation for the user.
    r+r,N)r6rr�r.r�r/�_cleanup_user_isolationr�r�s  r"�deny_website_isolation_for_userr��sx��#�$�$�D��{����$�\�%F��Q�Q�Q�Q�	
��	�	��)�,�*L�h�W�W�W��H�%�%�%���!�!�!�!�!r!c��t|��sdStj|��}|jsdSd�|jD��}tj|d���t|d���t
|t|��������|�	��D]2\}}|�tjd|���tj
||���3dS)z4Remove all domain isolation state for a single user.Nc�.�i|]}|t|����Sr ��_get_docroot_or_none)r_�ds  r"�
<dictcomp>z+_cleanup_user_isolation.<locals>.<dictcomp>�s0�����'(����"�"���r!)r)�user_config��filter_by_docrootsz|Unable to detect document root for domain %s, configuration cleanup failed. Contact CloudLinux support if the error repeats.)rr�load_user_config�enabled_websites�save_user_configrr�list�valuesrRr0�errorr�remove_website_token_directory)r��user_cfg�domain_docroot_mapr�r	s     r"r�r��s"���x� � �����&�x�0�0�H��$������,4�,E�������H�T�2�2�2�2��X�4�8�8�8�8�"��T�*<�*C�*C�*E�*E�%F�%F�����)�.�.�0�0�	E�	E�
��7��?��M�(��	
�
�
�
��1�(�G�D�D�D�D�	E�	Er!c���tt����D]7}	t|���#t$rt	jd|��Y�4wxYwt��}|st
��dSdS)z9Remove domain isolation state for every user that has it.z:Unable to disable website isolation for user %s, skipping.N)r��#users_with_enabled_domain_isolationr��	Exceptionr0r�r)r��
users_lefts  r"r�r��s����<�>�>�?�?����	�#�H�-�-�-�-���	�	�	���L��
�
�
�
�
�	����
5�6�6�J��"��!�!�!�!�!�"�"s�/�A�Ar�c�^�	t|��dS#ttf$rYdSwxYw)Nr)�get_domain_docrootr�
IndexError)r�s r"r�r��sA���!�&�)�)�!�,�,���j�!�����t�t����s��,�,c��t��sdS	tj|��}n#t$rYdSwxYwtj�|��S)NF)r#r�get_jail_config_pathrrrrS)r7�domains_config_paths  r"�is_isolation_enabledr��se��3�5�5���u��(�=�d�C�C���������u�u�����
�7�>�>�-�.�.�.s�'�
5�5c�p�d�t��D��}i}|D]}t|��}|r|||<�|S)Nc�N�g|]"}t|���t|��� |��#Sr )rr�)r_�us  r"raz7users_with_enabled_domain_isolation.<locals>.<listcomp>�s1��P�P�P�1�[��^�^�P�8L�Q�8O�8O�P�Q�P�P�Pr!)r�#get_websites_with_enabled_isolation)�users�user_domain_pairsr7�domains_with_isolations    r"r�r��sV��P�P��	�	�P�P�P�E����=�=��!D�T�!J�!J��!�	=�&<��d�#���r!c��t|��stjd|��gStj|��jS)Nz=User %s not found, cannot get websites with enabled isolation)rr0r1rr�r�)r7s r"r�r��sG���t������K�T�	S�	S�	S��	��"�4�(�(�9�9r!c��t��}tt��}|���D]S\}}|D]K}	t	|��d}n#t
tf$rY�,wxYw||�|���L�T|S)z�
    Returns pairs user: set(docroots) for all users with website isolation enabled
    Used by monitoring service to watch docroots changes to load actual list of docroot paths
    instead of stale storage
    r)r�r�setrRr�rr��add)�users_with_isolation�pairsr7�domainsr��drs      r"�!get_docroots_of_isolated_websitesr��s���?�@�@������E�-�3�3�5�5� � �
��g��	 �	 �F�
�'��/�/��2�����j�)�
�
�
���
�����$�K�O�O�B�����	 ��Ls�A�A+�*A+c�t�t|��stjd|��dStj|��}||jvr|j�|��t|��d}tj	||��tj
||��tj||��tj
ddd|gd���t||��t|t!|��g���t#��t%||��t'|��t)||��dS)	Nz2User %s not found, cannot enable website isolationr�	cagefsctlz--rebuild-alt-php-iniz--domainT)rqr�)rr0r1rr�r��appendr�r�create_website_token_directory� create_overlay_storage_directoryr�rIrJrrr�rrrr�)r7r�r��
document_roots    r"�enable_website_isolationr��sK���t������@�$�	H�	H�	H����)�$�/�/�K�
�[�1�1�1��$�+�+�F�3�3�3�
'�v�.�.�q�1�M��-�d�M�B�B�B��/��m�D�D�D�
��D�+�.�.�.��N�K�!8�*�f�M�UY�Z�Z�Z�Z��T�;�/�/�/�"�4�=Q�RX�=Y�=Y�<Z�[�[�[�[�����"�$��/�/�/� ��&�&�&���v�&�&�&�&�&r!c��t|��stjd|��dStj|��}t||��g}|jD]�}t|��}|�tjd|���)|�|��	tj
||��tj||���j#t$r }tj
d||��Yd}~��d}~wwxYwt||���dS)NzDUser %s not found, cannot regenerate website isolation configurationzdUnable to find document root for domain %s, please contact CloudLinux support if the issue persists.z8Unable to recreate token/storage for domain=%s, Error=%sr�)rr0r1rr�rr�r�r�rr�r�r�r�r)r7r��document_rootsr�r��es      r"�"regenerate_isolation_configurationr�s>���t������R�TX�	Z�	Z�	Z����)�$�/�/�K��T�;�/�/�/��N��.����,�V�4�4�
�� ��O�K��
�
�
�

����m�,�,�,�	��5�d�M�J�J�J��7��m�L�L�L�L���	�	�	��M�T�V\�^_�`�`�`��H�H�H�H�����	����#�4�N�K�K�K�K�K�Ks�*B>�>
C(�C#�#C(c���t|��stjd|��dStj|��}d}g}|�-t|j��}d�|jD��}g|_n6||jvr-|g}t|��g}|j�|��tj	||��t||��|r.t||���|D]}|��tj
||���|D]D}	t||���#tjt"f$rtjd|��Y�AwxYwt'��}|st)��dSdS)Nz3User %s not found, cannot disable website isolationc�,�g|]}t|����Sr r�)r_�websites  r"raz-disable_website_isolation.<locals>.<listcomp>@s.��
�
�
�.5� ��)�)�
�
�
r!r�z1Failed to unregister domain LVE for %s, skipping.)rr0r1rr�r�r�r��remover�rrrr�r�rIr�r�r�r�r)r7r�r��reload_docroots�domains_to_unregisterr�r�r�s        r"�disable_website_isolationr�5s����t������A�4�	I�	I�	I����)�$�/�/�K��O���
�~� $�[�%A� B� B��
�
�9D�9U�
�
�
��(*��$�$�	�;�/�	/�	/�!'���/��7�7�8���$�+�+�F�3�3�3�
��D�+�.�.�.��T�;�/�/�/��K�&�t��P�P�P�P�,�	K�	K�M��$���5�d�M�J�J�J�J�
"�H�H��	H�"�4��+�+�+�+���-�w�7�	H�	H�	H���C�Q�
H�
H�
H�
H�
H�	H����
?�@�@���"��!�!�!�!�!�"�"s�>D�+D=�<D=r)P�	functoolsr0rr2rIr{�collectionsr�pathlibr�clcommon.clcagefsrr�clcommon.cpapirrr	r��clcommon.constr
�clcommon.cpapi.cpapiexceptionsr�lve_utils.pylve_wrapperr�fsr�
exceptionsr�webisolationrrr�webisolation.configr� webisolation.jail_config_builderr�webisolation.phpr�webisolation.servicerr�webisolation.triggersrrr#r&rEr6�boolr;rLrsrwr�rxrZrgr�r��	lru_cacher�r�r�r�r�r�r�r�r�r�r�r�r��dictr�r�r�r�r�r�r r!r"�<module>rs8����������	�	�	�	�
�
�
�
���������#�#�#�#�#�#�������D�D�D�D�D�D�D�D�>�>�>�>�>�>�>�>�8�8�8�8�8�8�"�"�"�"�"�"�3�3�3�3�3�3�)�)�)�)�)�)�������)�)�)�)�)�)�:�:�:�:�:�:�:�:�:�:�7�7�7�7�7�7�F�F�F�F�F�F�<�<�<�<�<�<�S�S�S�S�S�S�S�S�^�^�^�^�^�^�^�^�A�A�A�K�K�K���t������2��������"
�
�
�$3��[�����
F�A�������*���&@�@�@�F�C�����:���Q����
"�
"� ��
"�4�4�4�4�4�4�	�	�	�	�	�	����,I�I�I�4#�s�#�#�#�#�."�c�"�"�"�"�&E�c�E�E�E�E�8"�"�"�������/�/�/��T�����:�c�:�:�:�:��4�����$ '� '� '�FL�L�L�>'"�'"�C�'"��t��'"�'"�'"�'"�'"�'"r!