| Current File : //usr/libexec/kcare/python/kcarectl/__pycache__/__init__.cpython-36.pyc |
3
��wh � @ st d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lm Z dd
lm Z ddlm Z ddlm Z ddlm Z ddlm!Z! ddlm"Z" ddlm#Z# ddlm$Z$ ddlm%Z% ddlm&Z& ddlm'Z' ddlm(Z( ddl)m*Z*m+Z+m,Z,m-Z-m.Z. ddl&m/Z/m0Z0m1Z1 dZ2d Z3d�Z4d!Z5d"Z6d�Z7d$Z8d%Z9ej:d&ej;�Z<ej:d'�Z=ej>j?d(��re j>j@d d(� ejAd)eBd*� ejCjDejE� d+d,� ZFd-d.� ZGd/d0� ZHd1d2� ZId3d4� ZJd�d5d6�ZKd7d8� ZLd9d:� ZMd;d<� ZNd=d>� ZOd?d@� ZPdAdB� ZQG dCdD� dDeR�ZSG dEdF� dFe0�ZTG dGdH� dHe0�ZUG dIdJ� dJe0�ZVdKdL� ZWedMdN� �ZXd�dOdP�ZYdQdR� ZZdSdT� Z[i Z\dUdV� Z]e]e,j^__e`e dWd��s�y8d dlaZbd dlcZdebjejfedjg�ebjejfdX�k �rHehdY��W n ehk
�r` Y n8X dZd[� Zie,jjZkG d\d]� d]el�ZmG d^d_� d_e,jj�Znene,_jd`da� Zoejpfdbdc�Zqddde� Zrdfdg� ZsG dhdi� diel�Ztdjdk� Zudldm� Zvd�dodp�Zwdqdr� Zxdsdt� Zyd�dudv�Zzdwdx� Z{dydz� Z|d{d|� Z}d}d~� Z~dd�� Zd�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�ej�ejpfd�d��Z�d�d�� Z�ej�fd�d��Z�d�d�� Z�d�dÄ Z�d�dń Z�d�d�dDŽZ�d�dɄ Z�d�d˄ Z�dS )�� )�print_functionN)�ArgumentParser)�datetime)�contextmanager� )�config)� constants)� log_utils)�utils)�
process_utils)�platform_utils)�
http_utils)� ipv6_support)�auth)�serverid)�config_handlers)�libcare)�selinux)�fetch)� update_utils)�errors)�kcare)� server_info)�URLError� HTTPError�httplib� urlencode�json_loads_nstr)�SafeExceptionWrapper�
KcareError�NotFound�c Zv2�12h�24h�48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh� latest.v2z /etc/sysconfig/kcare/sysctl.conf�
z$==BLACKLIST==
(.*)==END BLACKLIST==
z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C sD t � } tjjt�r@ttd�}x|D ]}| j|j� � q"W |j� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r7 �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistL s
r9 c C sB |j d�}| r(dj|d | |d g�}ndj|d |d g�}|S )N�.r r ���r; )�split�join)�ptype�filenameZ
name_partsr7 r7 r8 � _apply_ptypeV s
r@ c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S )N)r@ r � PATCH_BIN�
PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE�
PATCH_DONE)r> r7 r7 r8 � apply_ptype_ s
rF c C s t j� \} }}d}t|t�rbt|t� rby d|jtj|j�|jf }W q� t t
fk
r^ Y q�X nPt|t t
t f�r�t|t� r�d| }n*t|t
�r�|jp�t|j�} |jp�d|j }tj� }tjtj� |d |d t| dt| ��|djtj|d��t|dd�d �S )
N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z
agent_versionZpython_version�distroZdistro_version�error�details� tracebackrJ ) �sys�exc_info�
isinstance�OSErrorr �errnor, �strerrorr? �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrM r �
get_distror �VERSION�get_python_version�getattr�strr= rN Z format_tb)rY �value�tbZdetails_sanitizedrK r7 r7 r8 � format_exception_without_detailsg s*
rc c C sv t jr
d S tjt� �} tjtjtj | ���}tj
d�d | }t j |t
j� �}yt j|� W n tk
rp Y nX d S )Nz/api/kcarectl-tracez?trace=)r �UPDATE_FROM_LOCAL�json�dumpsrc r
�nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr
Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ
encoded_trace�urlZrequestr7 r7 r8 �send_exc� s rl c C s� t j� }|dkr t j|d� dS t j� t j� }|dkrBt jd� t jd� ttjd��&}t j |j
� d� t j |j
� d� W dQ R X |r�t j |� y
| � W n* t
k
r� tjjd� t jd� Y nX t jd� dS )z�
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
r N�ar � zWait exception)r, �fork�waitpid�setsid�_exitr3 r0 r ZLOG_FILE�dup2�fileno�time�sleeprj r �kcarelog� exception)�funcrv �pid�fdr7 r7 r8 �
nohup_fork� s(
r| c C s� t jjtjd�} t jj| �rtt| d��H}y,t|j� �}|t j
t j � krRt || ��W n t
k
rh Y nX W dQ R X tj| tj� � dS )a Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
z.kcareprev.lockr* N)r, r- r= r � PATCH_CACHEr. r0 �int�readr �SUCCESS_TIMEOUTru � PreviousPatchFailedException�
ValueErrorr
� atomic_write�
timestamp_str)Zanchor_filepathZafile� timestampr7 r7 r8 � touch_anchor� s r� c C sx yt jt jjtjd�� W n tk
r. Y nX td| � tj j
� yt dd� W n t k
rr t
jjd� Y nX dS )z�
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
z.kcareprev.lock�done)�reasonzCannot send update info!N)r, �remover- r= r r} rR �register_actionr �get_loaded_modules�clear�get_latest_patch_levelrj r rw rx )�
state_datar7 r7 r8 �
commit_update� s
r� c C s( t jtjjtjd�tj| |d�d� d S )N�patchesrG )Z exclude_path) r
�clean_directoryr, r- r= r r} r �get_cache_path)�khashZplevelr7 r7 r8 � clear_cache� s r� c C s> t jpd}dj|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r �PREFIXr= r r} r, r- )r� �fname�prefixZ
module_dirr4 r7 r7 r8 �get_current_level_path� s
r� c C s t jt| d�t|�dd� d S )N�latestT)Z
ensure_dir)r
r� r� r` )r� � patch_levelr7 r7 r8 �save_cache_latest� s r� c C sV t | d�}tjj|�rRy"tt|d�j� j� �}tj | |�S t
t fk
rP Y nX d S )Nr� r* ) r� r, r- r. r~ r0 r �stripr �LegacyKernelPatchLevelr� rV )r� Zpath_with_latest�plr7 r7 r8 �get_cache_latest� s
r� c @ s e Zd ZdS )�CertificateErrorN)rH �
__module__� __qualname__r7 r7 r7 r8 r� s r� c @ s e Zd Zdd� ZdS )�UnknownKernelExceptionc C s* t j| djtj� d tj� tj� �� d S )NzLNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.r ) rj �__init__�formatr r\ �platform�releaser �get_kernel_hash)�selfr7 r7 r8 r� s z UnknownKernelException.__init__N)rH r� r� r� r7 r7 r7 r8 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )�ApplyPatchErrorc sF t t| �j||� || _|| _|| _|| _tj� d | _ t
j � | _ d S )Nr ) �superr� r� �code�
freezer_style�level�
patch_filer r\ rK r� r� )r� r� r� r� r� �args�kwargs)� __class__r7 r8 r� s zApplyPatchError.__init__c C s0 dj | j| j| j| j| jdjdd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})z, c S s g | ] }t |��qS r7 )r` )�.0�ir7 r7 r8 �
<listcomp>! s z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rK r� r= r� )r� r7 r7 r8 �__str__ s zApplyPatchError.__str__)rH r� r� r� r� �
__classcell__r7 r7 )r� r8 r� s r� c s$ e Zd Z� fdd�Zdd� Z� ZS )r� c s" t t| �j||� || _|| _d S )N)r� r� r� r� �anchor)r� r� r� r� r� )r� r7 r8 r� ' s z%PreviousPatchFailedException.__init__c C s d}|j | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager7 r7 r8 r� , s z$PreviousPatchFailedException.__str__)rH r� r� r� r� r� r7 r7 )r� r8 r� & s r� c C s� t j� dj| � }yrtj|�}tjtj|j� ��}t |d �}|dkrPt
d� n2|dkrbt
d� n |dkrtt
d� nt
d j|�� |S t k
r� } zt j
||� W Y d d }~X nX d
S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizern z!No KernelCare license for that IPzUnknown error {0}r; )r �get_registration_urlr� r
�urlopenr
� data_as_dictrg r r~ �printr r �print_cln_http_error)�keyrk �response�resr� �er7 r7 r8 �!set_monitoring_key_for_ip_license5 s
r� c
c s> t jrtjt jdd� z
d V W d t jr8tjt jdd� X d S )NT)�shell)r ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr7 r7 r7 r8 �
execute_hooksI s
r� c C s� t � }|j}|j}tj� }| dkrdt|�tjtj � t
j � |t t
j� �|d�}td� ttj|�� nZtd� tt|�� tdt|� � ttj� ttj � � tt
j � � t|� tt
j� � dS )a1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
re )Z
updateCodeZ
autoUpdateZeffectiveKernelZ
realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_infor` r � AUTO_UPDATEr � kcare_unamer� r� r~ r Z
get_uptimer� re rf )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr7 r7 r8 � plugin_infoU s,
r� c C s^ t j� } ytdd�}W n tk
r4 tjr0dS dS X | d krBdS | |krNdS tj� rZdS dS )N�info)r� r � r rn )r �loaded_patch_levelr� r� r �IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)�
current_levelZlatest_patch_levelr7 r7 r8 �get_update_status� s r� c C s2 t j� d d� \} }| dkr*|jd�r*dS dS d S )Nrn Z
CloudLinuxz7.�extrarG )r r\ �
startswith)rK �versionr7 r7 r8 �edf_fallback_ptype� s r� c C sl | j | jf}tj||�}tj|| j�| _| jjtj tj
d� |tkrZ| jj � dd� t|< | j rh| j
� dS )z�Function remembers IP address of host connected to
and uses it for later connections.
Replaces stdlib version of httplib.HTTPConnection.connect
r Nrn )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ
setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ
resolved_addrr7 r7 r8 �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr7 )r� r7 r7 r8 �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�SSLSockc C s || _ d| _d S )Nr )� _ssl_conn�_makefile_refs)r� r� r7 r7 r8 r� � s zSSLSock.__init__c G s& | j d7 _ tj| jf|�ddi�S )Nr r3 T)r� r� Z _fileobjectr� )r� r� r7 r7 r8 �makefile� s zSSLSock.makefilec C s" | j r | jr | jj� d | _d S )N)r� r� r3 )r� r7 r7 r8 r3 � s
z
SSLSock.closec G s | j j|� S )N)r� �sendall)r� r� r7 r7 r8 r� � s zSSLSock.sendallN)rH r� r� r� r� r3 r� r7 r7 r7 r8 r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t jj| � tjjtjj�}|jtjjtjj B � t
j rJ|j tjj
t� n|j tjjt� |j� tjj|| j�}|j� | jp�| j}|j|j� � |j� t
j r�t|j� |� t|�| _d S )N) r �HTTPConnection�connect�OpenSSLZSSLZContextZ
SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r �CHECK_SSL_CERTSZ
set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ
Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� ZctxZconnZ server_hostr7 r7 r8 r� � s z PyOpenSSLHTTPSConnection.connectN)rH r� r� r� r7 r7 r7 r8 r� � s r� c C s� t jr&tj| |�}tjtj�|dd�S x�d D ]�}tj ||d�}tj| t
||��d | }d}|rxt |�|krxt j
d� q,ytjtj�|dd�S tk
r� } z2|r�|jd
ks�|jd
kr�t j
d j|�� w,� W Y d d }~X q,X q,W d S )NF)�
check_licenseT)�secure_boot_info�?iX z<Check-in URL param is too large, discarding secure boot info� � i� zJCheck-in request failed with error: {0}, retrying without secure boot info)TF)r� r� )r rd r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr � urlopen_authr Zbased_server_info�stickyfy�lenr Zlogwarnr r� r� ) r� r� r� �moderk r� Z
request_paramZmax_url_length�exr7 r7 r8 �_fetch_patch_level_request� s"
r� c C s t j� }tjd k r$t j|ttj��S x�tD ]�}y�t||| |�}tj |j
� t � t j
|j� �j� }tjdj| |�dd� |r�|jd�r�t|�}t j||d |d |d �S t j|t|��S tk
r� Y q* tk
�r } z|jd kr�td
��� W Y d d }~X q*X q*W t� �d S ) Nz;fetch patch level, reason: {0}, kernel latest response: {1}F)� print_msg�{r� �baseurlr� � � zKC licence is required)r� r )r r� r � PATCH_LEVELr� r~ � PATCH_LATESTr� r Zset_config_from_patchserver�headers�update_all_kmod_paramsr
rg r r� r �loginfor� r� r ZKernelPatchLevelr r r� r r� )r� r� r� r� r� r� Z latest_infor� r7 r7 r8 �fetch_patch_level s*
r c C s< | j t|tj��}tjjdj|�� ytj |ddd� dS t
k
r^ tjjdj|�� dS t k
r� } z tjj dj|t
|��� W Y d d }~X nX | j t|tj�tj �}tjjdj|�� ytj |dd� W nb t
k
� r� tjjdj|�� dS tk
�r6 } z tjjd j|t
|��� W Y d d }~X nX dS )
NzProbing patch URL: {0}F�HEAD)r� �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1})r� z{0} is not available: {1})�file_urlr@ r rA r rw r� r� r r� r rj �debugr` r ZSIGr )r� r> Zbin_urlr� rk r7 r7 r8 � probe_patch. s( **r c C sF |t jkr| jt j�}n
| j|�}| j|�}tj||tjtj | �d�S )N)Z hash_checker)
r �KMOD_BINZkmod_urlr �
cache_pathr Z fetch_urlr �
USE_SIGNATUREZget_hash_checker)r� �namerk Zdstr7 r7 r8 � fetch_and_verify_kernel_fileG s
r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd
d � Zd d
� ZdS )� PatchFetcherNc C s
|| _ d S )N)r� )r� r� r7 r7 r8 r� R s zPatchFetcher.__init__c C s t | j|�S )N)r r� )r� r r7 r7 r8 �_fetchU s zPatchFetcher._fetchc C sr | j jtj�}| j jtj�}| j jtj�}| j jtj�}tdd� ||||fD ��opt j
j |�dkopt j
j |�dkS )Nc s s | ]}t jj|�V qd S )N)r, r- r. )r� r- r7 r7 r8 � <genexpr>_ s z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r
r rE rA rB r r �allr, r- �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ
kmod_bin_pathr7 r7 r8 �is_patch_fetchedX s z PatchFetcher.is_patch_fetchedc C s0 | j d krtd��| j s | j S | j� r6tjd� | j S tjd� t| j tj�r�y tj | j j
t j �dd�}W n t
k
r~ Y n(X |jjdd �}|r�| j jtj|��| _ y| jt j � W n, t
k
r� tdj| j t jp�d���Y nX | jt j� | jtj� | j� tj| j j t j �d d
d � t j tj � | j S ) Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r z KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�default� �wb)r� )!r� r� r r r rQ r r� r r� r r rA r r r� �upgrader
rg r r r� �
PATCH_TYPErB r r �extract_blacklistr� r
rE r �restore_selinux_contextr} )r� �respr� r7 r7 r8 � fetch_patchd s8
zPatchFetcher.fetch_patchc C sJ t | jjtj�d�j� }|rFtj|�}|rFtj | jjtj
�|j d�� d S )Nr* r ) r0 r� r
r rB r � BLACKLIST_RE�searchr
r� rC �group)r� ZbufZmor7 r7 r8 r � s
z PatchFetcher.extract_blacklistc C s� |dkr dS yt |tj�}W n tk
r0 dS X |jjdd�}|rT|jtj|��}|j tj�}t
|d�� }t dd� |j � D ��}W dQ R X x|D ]}t ||� q�W t
jtj� dS )z�
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Nz KC-Base-Urlr* c S s g | ] }|j � �qS r7 )r� )r� �fixupr7 r7 r8 r� � s z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r r rD r r r� r r
rg r
r0 r+ � readlinesr r r r} )r� r� r r� Z fixups_fnamer5 �fixupsr# r7 r7 r8 � fetch_fixups� s
zPatchFetcher.fetch_fixups)N) rH r� r� r� r r r r r& r7 r7 r7 r8 r P s
(r c C s6 t � } t| j� | jtjkr(tjd� n
tjd� d S )Nr r )r� r� �msgr� �PLI�PATCH_NEED_UPDATErO �exit)r� r7 r7 r8 � kcare_check� s
r+ c C s t � } t| �}y tj� }W n tk
r2 i }Y nX tj� }d}|d k r\tj|d �j d�}tj
� }t |j dg ��}t
dd� |D ��}tj� }|s�td� ntd� td j|�� td
j|�� |d kr�td j|�� |d kr�td
j|�� || d k�rtd� td� d S )NZUnknown�tsz%Y-%m-%dr� c s s | ]}t |jd g ��V qdS )r� N)r� r� )r� Zrecr7 r7 r8 r � s z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z
fromtimestampZstrftimer� r� r� �sumr� r� r� ) r� �
kcare_info� libcare_info�stateZ
latest_updateZeffective_versionZkernel_vulnerabilitiesZuserspace_vulnerabilitiesr� r7 r7 r8 �show_generic_info� s4
r2 Fc C s� y�t dtjd�}|st�|jtj�}tjt j
|�j � �}| r�g i }}x>|j d�D ]0}tj
|�}|rxd|krx|j|� qR|j|� qRW ||d< tj|�}t|� W nH tk
r� } ztj||j� dS d}~X n tk
r� td� Y nX d S )
z�
Retrieve and output to STDOUT latest patch info, so it is easy to get
list of CVEs in use. More info at
https://cloudlinux.atlassian.net/browse/KCARE-952
:return: None
r� )r� �policyz
z kpatch-namer� r NzNo patches availabler )r� r �
POLICY_REMOTEr� r r rB r
rg r r� r r< r� �append�updatere rf r� r r r� rk ) �is_jsonr� rk �
patch_infor� r4 �chunk�datar� r7 r7 r8 �kcare_latest_patch_info� s,
r; c C s� d| j i}| jd k r�t| �}g }x>|jd�D ]0}tj|�}|rRd|krR|j|� q,|j|� q,W ||d< tj � }|r||d nd|d< |S )Nr� z
z kpatch-namer� r� �unknown)
r' r� �_kcare_patch_infor< r
r� r5 r6 r Z read_dumped_kernel_patch_level)r� r4 r8 r� r9 r: Zsaved_patch_levelr7 r7 r8 r- � s
r- c C sP t j� }t j|| jtj�}tjj|�s.t d��t
|d�j � }|rLt j
d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.r* rG )r r� r� r� r rB r, r- r. r r0 r r �sub)r� r� r
r� r7 r7 r8 r= s r= c C sT t � }| s:|jdkr t|j� |jd kr,d S tt|�� nttjt|�dd�� d S )Nr T)Z sort_keys) r� r� r� r' r� r= re rf r- )r7 r� r7 r7 r8 r8 s
r8 c C s: t jd| g}tj|�}tj� }d}tj||�tj||�kS )Nz file-infozkpatch-build-time)r �
KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr7 r7 r8 �
is_same_patch+ s
rC c C sL |dkr dS | r || k r dS | |kr(dS t jt j� |tj�}t|�sHdS dS )Nr FT)r r� r� r rA rC )�
applied_level� new_levelrB r7 r7 r8 �kcare_need_update3 s rF c C sp t jrltjjt�o tjttj�s6tj j
dj t�� d S t j
dddtgdd�\} }}| dkrltj j
dj | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctlz-qz-pT)� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr, r- r. �
SYSCTL_CONFIG�access�R_OKr rw �warningr� r r� )r� �_r7 r7 r8 �
update_sysctlE s rM c s� t jjt�sttd�j� t jtt j�s>tj j
dj t�� dS ttd��j}|j � }|j
d� x,|D ]$� t� fdd�| D ��sb|j� � qbW x|D ]}|j|d � q�W |j� W dQ R X dS ) z*Update SYSCTL_CONFIG accordingly the editsrm zFile {0} has no read accessNzr+r c 3 s | ]}� j |�V qd S )N)r� )r� r* )r6 r7 r8 r a s z#edit_sysctl_conf.<locals>.<genexpr>�
)r, r- r. rH r0 r3 rI rJ r rw rK r� r$ �seek�any�write�truncate)r� r5 Zsysctl�linesrm r7 )r6 r8 �edit_sysctl_confP s
rT c C s* x$| D ] }t j|�rtdj|���qW d S )NzDDetected '{0}' kernel module loaded. Please unload that module first)�CONFLICTING_MODULES_RE�matchr r� )r� �moduler7 r7 r8 �detect_conflicting_modulesi s
rX c C s dj tj� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer7 r7 r7 r8 �get_kcare_kmod_linko s rY c
C sX t dd�} tjtj� | tj�}tjj|�s.d S t |d��}|j
� dd � dkS Q R X d S )Nr� )r� �rb� s ~Module signature appended~
i��) r� r r� r� r r r, r- r. r0 r )r� Z kmod_fileZvfdr7 r7 r8 �kmod_is_signeds s
r\ c K s` d| g}x&|j � D ]\}}|jdj||�� qW tj|dd�\}}}|dkr\tdj| |���d S )Nz /sbin/insmodz{0}={1}T)rG r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.)�itemsr5 r� r r� r )Zkmodr� �cmdr� ra r� rL r7 r7 r8 � load_kmod| s r_ c C s< t j� rt� rtd��t j� s0t j� s0t j� r8td��d S )Nz4Secure boot is enabled. Not supported by KernelCare.zWYou are running inside a container. Kernelcare should be executed on host side instead.)r Zis_secure_bootr\ r Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr7 r7 r7 r8 �check_compatibility� s r` c C sP t jd�}t j|dgddd�d dk}|rL| d
krLtjdj| �� tjd � d S ) NZmodinfoZkmodlveT)rG � catch_stderrr �freer� z3{0} patch type conflicts with kmodlve kernel moduler )rb r� )r Zfind_cmdr� r �logerrorr� rO r* )r> r^ Z has_kmodlver7 r7 r8 � check_patch_type_compatibility� s
rd c C sP t jddd| g�}g }x4|jd�D ]&}|j� r"|jd�\}}}|j|� q"W |S )Nz
/sbin/modinfoz-FZparmrN �:)r r@ r< r� � partitionr5 )�
kcare_link�stdoutZavailable_paramsr6 Z
param_namerL r7 r7 r8 �get_kmod_available_params� s ri c C sL t jr
dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rG )� kpatch_debugZ kmsg_outputZ kcore_outputZ
kdumps_dirZenable_crashreporter) r � KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErQ �
KDUMPS_DIRr` ZENABLE_CRASHREPORTERr7 r7 r7 r8 �make_kmod_new_params� s
rm c C sH t jr"tjjt j� r"tjt j� x t� j� D ]\} }t| |� q.W d S )N) r rl r, r- �exists�makedirsrm r] �update_kmod_param)Zparam�valr7 r7 r8 r � s r c C st d}t jj|| �}t jj|�s"d S y(t|d��}|jt|�� W d Q R X W n$ tk
rn tj j
d| |� Y nX d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r, r- r= rn r0 rQ r` rj r rw rL )Zkmod_param_nameZ param_valueZ params_rootZ
param_pathr5 r7 r7 r8 rp � s rp c s� t � }tj| |tj�}ytj||� W n tk
r> |}Y nX tj rbt
j j tj � rbt
j
tj � t� }t|�� t� fdd�|j� D ��}t|f|� t� d S )Nc 3 s" | ]\}}|� kr||fV qd S )Nr7 )r� �k�v)�available_kmod_paramsr7 r8 r � s z"load_kcare_kmod.<locals>.<genexpr>)rY r r� r r �shutil�copyrj r rl r, r- rn ro rm ri �dictr] r_ �
update_depmod)r� r� rg Z
kcare_fileZ kmod_paramsr7 )ru r8 �load_kcare_kmod� s
rz c C sX dg}| d k r |j d| g� tj|ddd�\}}}|rTtjdjdj|�||�dd� d S ) Nz /sbin/depmodz-aT)rG ra z%Running of `{0}` failed with {1}: {2}� F)r� )�extendr r� r rc r� r= )�unamer^ r� rL �stderrr7 r7 r8 ry � s ry c C s4 t jd| gdd�\}}}|dkr0tdj| |���d S )Nz /sbin/rmmodT)rG r z Unable to unload {0} kmod {1})r r� r r� )�modnamer� rL r7 r7 r8 � unload_kmod� s r� c C sT g }xJdg| D ]<}t j| |dj|��}tjj|�rt|� |jdj|�� qW |S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r, r- rn r_ r5 )r� r� r� Zloaded�modZmodpathr7 r7 r8 � apply_fixups� s r� c C sD x>| D ]6}y t |� W q tk
r: tjjd| � Y qX qW d S )Nz$Exception while unloading module %s.)r� rj r rw rx )r% r� r7 r7 r8 �
remove_fixups� s
r� c C s� | r
| }n6t jrt j}n(t� j|�r2d| t jdfS d| t jdfS dddddd�}|j� }||krj|| }ntdj|| t jd���|| t jdfS ) NZfreeze_conflictTr FZ freeze_noneZ
freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3}))r Z PATCH_METHODr9 � intersection�upperr r� )�freezerr� r Zpatch_method_mapr7 r7 r8 �get_freezer_style� s"
r� rG c s� | ||d�� t d� � tj� }tj� }t|� t||�}tj| |tj�}t | |� dj
|tj t j
� tj|��} d|k}
|
o�tj| |�} |d k } | o�t|�o�tj| �}
� j|| d�� |
r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d
� � td� d }
|
�s<t d � � t| |� |�rHt� t d
� � t|| || |� t� tj dj
|tj � �� t j � t d� � t � fdd�tj!d� d S )N)r� Zfuturer� �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�load�patchz5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S )N)r� r7 )r� r7 r8 �<lambda>V s z kcare_load.<locals>.<lambda>)rv )"r� r r� r� rX r� r� r rA r� r� r r
r� Z parse_unameZis_kmod_version_changedrC Z kcare_update_effective_versionr6 r� �kpatch_ctl_unpatchr� r� rz r� �kpatch_ctl_patchrM r r r� r Ztouch_status_gap_filer| r� )r� r� r� r� �
use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ
same_patchr% r7 )r� r8 �
kcare_load sR
r� c C s� t jg}tj||tj�}tjj|�r2|j d|g� |j dd|g� |j d|d g� |j
| � t j |dd�\}}}|dkr�t
|||| ��d S )Nz-br� z-dz-mr T)rG )r r? r r� r rC r, r- rn r| r5 r r� r� ) r� r� r� r� r� r� Zblacklist_filer� rL r7 r7 r8 r� Y s
r� c C sZ t jtjdd| d gddd�\}}}|dkrVtjdj||�dd� td j|t| ����d S )
Nr� z-mr T)rG ra z4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}F)r� zError unpatching [{0}] {1}) r r� r r? r rc r� r r` )r� r� rh r~ r7 r7 r8 r� f s
r� c C s8 | |d< t tj� �|d< tjtjjtjd�t |�� d S )N�actionr, z kcare.state)
r~ ru r
r� r, r- r= r r} r` )r� r� r7 r7 r8 r� p s r� c C sp d}t jj|�sd S xVt j|�D ]H}t jj||dd�}t jj|�sDq t j|�}|| kr t j|� t|� q W d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r, r- �isdir�listdirr= �islink�readlink�unlinkry )� kmod_linkZ modules_path�entryZ
sym_link_pathZ target_pathr7 r7 r8 �update_weak_modulesv s
r� c
C sB t j� }t� }y|j|� W n4 tk
rP } z|s@tdj|���W Y d d }~X nX t j� }t| |�}t � �� d|k�r|d k }|r�t
t j � ||�}t j
tjdd|d gddd�\} }
} t|� | dkr�tjdj|
| �d d
� td j| t|����tjtjt�d td
�t�d� t� } tj j | ��r,tj | � t | � W d Q R X d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.r r� z-mr T)rG ra z4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}F)r� zError unpatching [{0}] {1}r )�count�delay) r r� r r& rj r r� r� r� r� r� r� r r� r r? r� r rc r` r
Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rY r, r- r. r� r� )
r� �forcer� �pf�errr� r� Z need_unpatchr% r� rh r~ r� r7 r7 r8 � kcare_unload� s8
r� c C s8 t � }| rt|�S |jdkr"|jS |jd k r4tj� S d S )Nr )r� �_kcare_info_jsonr� r' r� r rA )r7 r� r7 r7 r8 r/ � s
r/ c C sR d| j i}| jd k r>|jtjtj� �� |jtj|jd��� | j |d< t
j |�S )Nr� zkpatch-descriptionz kpatch-state) r' r� r6 r
r� r rA Zparse_patch_descriptionr� r1 re rf )r� r4 r7 r7 r8 r� � s
r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r( r r rn r� c C s" || _ || _|| _|| _|| _d S )N)r� r' �
remote_lvlr� r1 )r� r� r' r� r� r1 r7 r7 r8 r� � s
z PLI.__init__N)rH r� r� r r) �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r7 r7 r7 r8 r( � s
r( c C s� t j� } y�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nl tk
r� tj }t
j r�d
j t
j t
j� d tj� �}n d j t
j� d tj� t j� �}t||d d d �}Y nX |S )
Nr� )r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingszLNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.Z unavailable)r r� r� rF r( r) r r� r� r� r � STICKY_PATCHr� r r\ r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r' r1 r� r7 r7 r8 r� � s8
r� c C s� d}yXt j� }td|fd| fg�}tj� dj|� }tj|�}tj tj
|j � ��}t |d �S t
k
r� } ztj||� d
S d}~X nZ tk
r� } ztj||� d S d}~X n0 tk
r� } ztjdj|�� d S d}~X nX dS )
z�
Request to tag server from ePortal. See KCARE-947 for more info
:param tag: String used to tag the server
:return: 0 on success, -1 on wrong server id, other values otherwise
N� server_id�tagz/tag_server.plain?{0}r� r� � zInternal Error {0}� ���������)r � get_serveridr r r� r� r
r� r
r� rg r r~ r r r� r rj rc ) r� rk r� Zqueryr� r� r� ZueZeer7 r7 r8 �
tag_server
s"
r� c C s� t jd�} tjdj| �� t}tj� ��}y:tj | |j
�}t j t j
| �|j
� tj|j
|� |j
}W n2 tk
r� } ztjdj|�� W Y d d }~X nX tjd|tj� gdd�\}}}|r�tdj||���W d Q R X d S )Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)ra z Script failed with '{0}' {1})r
ri r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler Zfetch_signaturer Z save_to_filer
r� Zcheck_gpg_signaturerj rc r r� r Zget_patch_serverr )Z
doctor_urlZdoctor_filenameZ
doctor_dstZ signaturer� r� rL r~ r7 r7 r8 �kcdoctor% s
" r� c C sB t jdjt��} ytj| � W n tk
r2 dS X tjd� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r
ri r� �EFFECTIVE_LATESTr
r� r r r )rk r7 r7 r8 �check_new_kc_version6 s r� c C s� t j� }t|�}|tjkp*|tjko*|dk}yt| |�}W n< tk
rv } z |rT� ntj j
dj |�� W Y dd}~X nX |tjkr�|}n<|}|dkr�|tj kr�t j
|d�}n|tjkr�|}ntd��|S )a�
Get patch level to apply.
:param reason: what was the source of request (update, info etc.)
:param policy: REMOTE -- get latest patch_level from patchserver,
LOCAL -- use cached latest,
LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:return: patch_level string
NzUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r r4 ZPOLICY_LOCAL_FIRSTr rj r rw rK r� Z POLICY_LOCALr� r ) r� r3 r� r� Z cached_levelZconsider_remote_exZ remote_levelr� r� r7 r7 r8 r� C s& $
r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdkrntj� rnt jpXt }t
dd d j |�f� t j
d
j | �� ntdj | ���d S )N�edfr rG Zprobe)r� )r rb r� �fs.enforce_symlinksifowner�fs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernel)rb r� )r� r� )r r r r r �
update_configr Z is_cpanelZ FORCE_GID�
CPANEL_GIDrT r� r r r )r> Zgidr7 r7 r8 �update_patch_typeh s
r� c $ C sn t j� ttj� |tjkr"t� ytd||d�}W nR t k
r� } z6|tj
tj fkrttj rtt
|�}tjj|� dS � W Y dd}~X nX tj� }t|�}|j� t||d�s�tjd� dS y(tjtjddd� tjtjdd d� W n" tk
�r tjjd
� Y nX tj � }|tj
k�s"tj �rVt � �( |j |� t |||| |tj kd � W dQ R X tj!|� t"||� dS ) ax
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:param policy: REMOTE -- download latest and patches from patchserver,
LOCAL -- use cached files,
LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases
:param freezer: freezer mode
r6 )r� r3 r� N)rD rE z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r� )#r Zlog_all_parent_processesrd r r r r4 r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� r` r rw rK r r� r r rF r r
r� rl rj rx r� r� r� r& r� Zdump_kernel_patch_levelr� ) r� r� r3 r� r� r' r� r� r� r7 r7 r8 � do_update~ s<
"
r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr<td��tjrHtjS | t j
krltjp\tj}tjphtj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzrelease-) r. �boolr r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r� r� r� Zpatchsetr7 r7 r8 �
get_sticky� s$
r� c C s | d | S )Nr: r7 )r� r� r7 r7 r8 � _stickyfy� s r� c C s t |�}|s| S |dkr"t|| �S tj� }|sDtjjd� tjd� y t j
t j � dj
|� �}W n: tk
r� } z tj||j� tjd� W Y dd}~X nX tjtj|j� ��}t|d �}|dkr�t|d | �S |d
kr�| S |d k� r�tjjd � tjd� tjjd
|d � tjd� dS )z�
Used to add sticky prefix to satisfy KCARE-953
:param file: name of the file to stickify
:return: stickified file.
�KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rn zEServer ID is not recognized. Please check if the server is registeredzError: r� r� r� r� r; r� )r� r� r r� r rw r� rO r* r
r� r r� r� r r� rk r
r� rg r r~ )�filer� �sr� r� r� r� r� r7 r7 r8 r� � s2
r� c
C s� g }| s dS | j d�}|d }|dd� }|jd�}||krLtdt| � ��|s`| j� |j� kS |dkrt|jd� n>|jd �s�|jd �r�|jtj|�� n|jtj|�j d
d �� x |D ]}|jtj|�� q�W tj
d d
j |� d tj �} | j
|�S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
Fr: r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r< r� r� �repr�lowerr5 r� �re�escape�replace�compiler= Z
IGNORECASErV )
Zdn�hostnameZ
max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr7 r7 r8 �_dnsname_match s(
r� c C s
g }xBt | j� �D ]2}| j|�}|j� dkrdd� t|�jd�D �}qW | sTtd��g }x0|D ](\}}|dkr^t||�r|d S |j|� q^W |s�| j � j
}t||�r�d S |j|� t |�dkr�t dj
|d jtt|�����n,t |�dk� r�t d
j
||d ���nt d ��d S )
NZsubjectAltNamec S s g | ]}|j � jd d��qS )re r )r� r< )r� �itr7 r7 r8 r� < s z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}z, z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ
get_extensionZget_short_namer` r< r� r� r5 Z get_subjectZ
commonNamer� r� r� r= �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� ra Zcnr7 r7 r8 r� 7 s0
r� c C s$
t ddd�} | jdddd� | jdd d
dd� | jd d dd� | jd
dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCdd� | jdDdEdd� | jdFdGdd� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdPtd dQdR� | jdSdTdd� | jdUdVdd� | j� }|jdWdXdPd� |jdYdZdd� |jd[d\dd� | jd]d^dPd dQd_� | jd`dadbddQdc� | jdddedf� | jdgdhdd� | jdidjdkdldm� tj�s�| jdndodpdqdQdr� | jdsdtdpdqdudr� | jdvdwdd� | jdxdydzdd� | jd{ddd� | jd|d}d~dd� | jdd�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | j� }tjjt j
� � tj�s�t j d�g7 _ |j d k �rt
td |j jd����jtj ��rd�S d�S |j�s|j�r2tj�r(tjt_ntjt_n|j�rBtjt_|j�sjtj � d�k�rjt d�t j d�� d�S t j!}|j�r�t j"}n|j�r�t j#}t$j%|� |j&�r�t'j(� |j)�r�|j)d�k�r�t*|j)�t_+t j,tj+d�� nd t_+t j,dd�� |j-d k �r t j,|j-d�� |j-t_.|j/�rdQt_0|j1�r(dQt_2|j3�r6dut_4|j5�rDt5� |j6�rZt7j8d�t9� n8|j:�r�tj;d�k�r�tj<d�k�r~dntj<�p�d�|_=du|_|j>�r�|j>t_?|j@�r�t7j8d�t9� d�t_?tj?jAd��t_?tj?�r�tj?tBk�r�t$jCjDd�jEtj?d�jFtB��� |jG�rdut_Hd�|jG t_I|j=�r&tJ|j=� tj;d�k�rTtK� t_;t7j8d�jEtj;�pLd��t9� |jL�rrt tMjL|jNd��� d S tOtj;� |jP�r�tQ� d S |jR�r�|jN�r�tRd�d�� ntR� d S |jS�r�t j,d�d�� d S |jT�r�t j,d�d�� d S |jU�r�t jV|jU� d S |jW�rtX|jW�S |jY�r tZjY� |j[�rNtj;d�k�r>t j,d�d�� tZj[|j[|j\�S |j]�rltZj]� d�k�rhd�S d�S |j^d k �r�t_|j^�S |j`�r�t tja� tb|dpd �d k �r�tcjd|je� d�S tj�s�|jf�r�tcjg� S |jh�r�tcji� d k �r�t$jjd�� |jk�rtcjitjld�� n|jm�r tcjn� t$jjd�� |jo�r4t tcjp� � |jq�rHt tcjr� � |js�rjtcjt� �rjt tcju|js�� |jvd k �r�|jvdk�r�tjw�p�txtcjyjz� �}nd�d�� |jvjd��D �}tcjit{|�d��d k �r�t$jjd�� |j|�r�tcjitjld d�� |j}� r t t~|jNd��� d}|j� r t7j8d�t9� d�}|j�� r*|j�}|j�� rDt�|tj�tj�d�� |j� rdt�|tj�d�� t$jjd�� |j� rxt t�j�� � |j�� r�t�||j�d�� t$jjd�� |j� r�dQt_�t�j�t�j�d�d��� t�|tjld�� |j�� r�t�|jNd�� |j�� r�t�� S |j�� r�t�|jNd�� |j��
r
t�� t�t j��d�k�
r t�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrG Z
store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z
--app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz
--auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z
--nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz
--registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z
--nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz
--plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� rZ r �requiredz--check-compatibilityzCheck compatibility.z
--clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz
--edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r r� z-qz--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r� z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionr5 z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� Zdestr� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez
--lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz
--lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr� zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr� r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledr� r r zPlease run as root)r� )r )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r zMFlag --test has been deprecated and will be not available in future releases.r% �/z(Prefix `{0}` is not in expected one {1}.r{ zfile:z+edf patches are deprecated. Fallback to {0})r7 re )r� ZYES)r� ZNOrb r� )r z Userspace patches are applied.)r� z Userspace patches are unloaded.c S s g | ]}|j � j� �qS r7 )r� r� )r� Zptchr7 r7 r8 r� � s zmain.<locals>.<listcomp>)�limit)r� r� zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r� r3 zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentr~ Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ
parse_args�__dict__r6 r Zget_config_settingsZFLAGSZ has_flagsr+ �filterr< �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr
Z PRINT_DEBUGr} r, �getuidr� rO r~ �loggingZINFOZWARNING�DEBUGr Zinitialize_loggingr� r
Zclear_all_cacheZset_patch_levelr` r r� Zset_sticky_patchr� Z nosignaturer Z
no_check_certr� rj rk r` Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr ZPREV_PATCH_TYPEZset_patch_typer� r� r% r� �EXPECTED_PREFIXrw rK r� r= Zlocalrd Z PATCH_SERVERr� r� Zapp_infor re rF Zdoctorr� r� Zenable_auto_updateZdisable_auto_updateZ
set_configZupdate_config_from_argsZset_monitoring_keyr� Z
unregisterr �registerZregister_autoretryr� r� r� r� r] r_ r Zset_libcare_statusr� Zuserspace_statusZget_userspace_update_statusZ
lib_updateZdo_userspace_updater Zlib_auto_updater� Z
lib_unloadZlibcare_unloadZlib_infor0 Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater� �listZ
USERSPACE_MAP�keys�sortedZuserspace_auto_updater� r/ Znofreezer� Z smart_updater� r� Z
UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSru rv �randomZuniformr8 Zstatusr� Zlatest_patch_infor; Zcheckr+ r� �argvr2 )ZparserZexclusive_groupr� r� r� r� r7 r7 r8 �main` s
r� )r" r# r$ r% )r& )N)N)F)F)N)rG F)rG F)r )�Z
__future__r rh re r� r, r� r� r� rv r� ZsslrO r� ru rN r� Zargparser r �
contextlibr rG r r r r
r r r
r r r r r r r r r r r Zpy23r r r r r r r r r� r� r� r/ r� r rH r� r� ZDOTALLr rU r- r� �insert�filterwarningsr� rw ZsetLevelr� r9 r@ rF rc rl r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r_ Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z
StrictVersionZ __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r� r� r r r r r+ r2 r; r- r= r8 rC rF rM rT rX rY r\ r_ r` rd ri rm r rp rz ry r� r� r� r� r� r� r� r� r� r� r/ r� r( r� r� r� r� r4 r� r� r� r� r� r� r� r� r� r7 r7 r7 r8 �<module> s
&
4
a #
?
, 2
%7 ,
3)