Current File : //proc/227033/root/opt/alt/python37/lib/python3.7/site-packages/__pycache__/secureio.cpython-37.pyc
B
`�1b�C � @ sZ d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlm Z d dl
m Z d dl Z d dl
mZmZmZmZmZmZmZmZmZmZ e�d�Zye�d �ZW n ek
r� e�d
�ZY nX eZ eZ G d d � d e�Z ee �Z ej Z eeege _!ee _"ej#Z#eege#_!ee#_"ej$Z$ege$_!ee$_"ej%Z%ege%_!e e%_"ej&Z&ege&_!de&_"ej'Z'ege'_!ee'_"ej(Z)eege)_!ee)_"egej*_!dej*_"ej+Z+ege+_!ee+_"ej,Z,eeege,_!ee,_"eeeegej-_!eej-_"eeeeegej._!eej._"eeeeeegej/_!eej/_"eeeeegej0_!eej0_"ej1Z1eege1_!ee1_"ej2Z2eege2_!ee2_"d
a3dZ4dZ5dZ6dd� Z(dd� Z7dd� Z8dd� Z*dDdd�Z-dEdd �Z.dFd d �Z/dGd d �Z0dHd!d"�Z9dId$d%�Z:dJd'd(�Z;dKd)d*�Z<dLd+d,�Z=d-d.� Z>d/d0� Z?da@d1d2� ZAe e5d3�ZBd4d5� ZCdaDdMd6d7�ZEd8d9� ZFdNd:d;�ZGd<d=� ZHd>d?� ZIejJd@dA� �ZKejJdBdC� �ZLdS )O� )�print_function)�absolute_import)�divisionN)�ClPwd)�drop_user_privileges)
�cdll�c_long� Structure�c_ushort�c_ubyte�c_char�POINTER�c_int�c_void_p�c_char_pz libc.so.6zlibsecureio.so.0z liblve.so.0c @ s2 e Zd Zdefdefdefdefded fgZdS )�DIRENTRYZd_inoZd_offZd_reclenZd_type�d_name� N) �__name__�
__module__� __qualname__�ino_t�off_tr
r r Z_fields_� r r �9/opt/alt/python37/lib/python3.7/site-packages/secureio.pyr # s
r Tz/var/log/cagefs-update.logi� Fc C s t �| t jt jB �S )N)�os�open�O_RDONLY�
O_NOFOLLOW)�pathr r r �open_not_symlink� s r c C s t �t| �d�S )N�r)r �fdopenr )r r r r �open_file_not_symlink� s r# c C sd t �| �}t|�}|s td��t|� g }x$t|�}|s:P |j}|�|j� q,W t|� t |� |S )z:Returns list of entries of directory pointed by descriptorzfdopendir error)
r �dup� fdopendir� Exception� rewinddir�readdir�contents�appendr �closedir)�fdZfd2ZdirpZdirlistZentryp�entryr r r �flistdir� s
r. c C s0 | d k r,yt �| � W n tk
r* Y nX d S )N)r �close�OSError)r, r r r �closefd� s
r1 c C sL |dkr d}t �| �� |||�� �}|dkr0|S |dk rH|d| dd� dS )z{Sets permissions to directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredN���r z.Error: failed to set permissions of directory FT)�liblve�set_perm_dir_secure�encode)r �perm� parent_pathr, �loggerr r r r4 � s r4 c C sN |dkr d}t �| �� ||||�� �}|dkr2|S |dk rJ|d| dd� dS )zSets owner and group of directory (in secure manner)
Returns descriptor if successful
Returns None if error has occuredNr2 r z(Error: failed to set owner of directory FT)r3 �set_owner_dir_securer5 )r �uid�gidr7 r, r8 r r r r9 � s r9 c C sP |dkr d}t �| �� |||||�� �}|dkr4|S |dk rL|d| dd� dS )z�Creates directory if it does not exist, sets permissions/owner otherwise
Returns descriptor if successful
Returns None if error has occuredNr2 r z#Error : failed to create directory FT)r3 �create_dir_securer5 )r r6 r: r; r7 r, r8 r r r r< � s r< c C s6 t �| �� ||||�� �}|r2|r2|d| dd� |S )zeRecursive directory creation function
Returns 0 if successful
Returns -1 if error has occuredz#Error : failed to create directory FT)r3 �makedirs_securer5 )r r6 r: r; r7 r8 Zresr r r r= � s r= c
C s� |dkr|dk s |dk r(|dkr(t d��|dk o6|dk }|rFt||� y&t| �}|�� }|�� |rjt� |S ttfk
r� } z<|r�t� td| d t |� t
d|� |s�� t � d� W dd}~X Y nX dS )z read file not following symlinksNzEread_file_secure: uid and gid should be both null or be both not nullzError: failed to read z : � )
r& �
set_user_permr# � readlinesr/ �
set_root_permr0 �IOError�logging�str� SILENT_FLAG�sys�exit) �filenamer: r; Z
exit_on_error� write_log� drop_perm� file_object�content�er r r �read_file_secure s&
rN � c
C s t j�|�}|rt||� yttjd|d�\}} t �|d�}
|
�d�| �� |sr|dk rr|dk rrt |||�rrt
d��t ||�r�t
d��|
� � W n� t
t
fk
�r: } z�y |
� � W n Y nX yt � |� W n Y nX yt �| � W n Y nX |�rt� td| d t| ��d
d � td |� d S d} ~ X Y nB tk
�rz } z"td
t| � td� t�d� W dd} ~ X Y nX d} yt �| |� W nl t
k
�r� } zLd } td| d t| � td|� yt �| � W n t
k
�r� Y nX W dd} ~ X Y nX |�r
t� | S )z!Returns True if error has occuredZcagefs_)�prefix�dir�w� Nz
fchown failedz
fchmod failedz Error : failed to write file z : ZErrnozErr codeTzError: r> Fz$Error: failed to rename tempfile to )r r �dirnamer? �tempfile�mkstempr" �write�join�fchownr0 �fchmodr/ rB �unlinkrA rC rD �replacerE r& rF rG �rename)
rL Zini_pathr: r; rJ r6 rI �dirpathr, � temp_pathrK rM �errorr r r �write_file_secure! s\
& ra rS c C s� |dk r t �� }t|ddd� t j�|�}d\}} y>tj|||d�\}} t j|ddd ��}
|
�| � W dQ R X W n| t t
fk
r� |dks�| dkr�� yt � |� W n t t
fk
r� Y nX yt � | � W n t t
fk
r� Y nX � Y nX y t �
| |� t �| |� W nH t
t tfk
�rR yt � | � W n t
t fk
�rJ Y nX � Y nX |dk �r�t �� } t �| � t �t �� � | d
k�r�t �|� dS ) aP
Safely write string content to a file
:param content: str
:param dest_path: str -> path to a file
:param perm: int -> permissions for the file
:param prefix: str -> add to temporary file name
:param suffix: str -> add to temporary file name
:param as_user: str -> name of the user to drop privileges to
NTF)Zeffective_or_realZset_env)NN)rP �suffixrQ rR �surrogateescape)�errorsr )r � getgroupsr r rT rU rV r" rW rB r0 r/ r[ �chmodr] � TypeError�getuid�seteuid�setegid�getgid� setgroups) rL Z dest_pathr6 rP rb Zas_userZ
old_groupsr^ r, r_ Zf_tempZruidr r r �write_file_via_tempfileX sJ
rm c
C sN yt �|� W nT tfk
rb } z4|rNtdt|� d t|� � t�d� ndS W d d }~X Y nX t| |�}yt �|� W nH tfk
r� } z(|r�td|t|�� t�d� ndS W d d }~X Y nX yt � | � W nX tfk
�r, } z6|�rtdt| � d t|� � t�d� ndS W d d }~X Y nX | dk�r>da
n t � � d a
d S )
Nzfailed to set egid to z: r> r2 z'failed to set supplementary groups to :zfailed to set euid to r TF)
r rj r0 � print_errorrD rF rG �
get_groupsrl ri � root_flagr3 �enable_quota_capability)r: r; rG rM �groupsr r r r? � s4
r? c
C s yt �d� W nF tfk
rT } z&| r@tdt|�� t�d� ndS W d d }~X Y nX yt �d� W nF tfk
r� } z&| r�tdt|�� t�d� ndS W d d }~X Y nX tdd�}yt � |� W nJ tfk
�r } z(| r�td|t|�� t�d� ndS W d d }~X Y nX da
d S )Nr zfailed to set euid to 0 :r> r2 z Error: failed to set egid to 0 :z.Error: failed to set supplementary groups to :T) r ri r0 rn rD rF rG rj ro rl rp )rG rM rr r r r rA � s.
rA c G s> t ddtjd� x | D ]}t |dtjd� qW t tjd� d S )NzError:� )�end�file)ru )�printrF �stderr)�args�ar r r rn � s
rn c
C s� t � }t� }t� }xb|D ]Z}|| j}xJ|D ]B}y|| j}W n tk
rT w,Y nX || kr,|�|| j� q,W qW |�|� t|�S )z$Returns supplementary groups for uid) � get_grp_dict� get_pwd_dict�setZgr_memZpw_uid�KeyError�addZgr_gid�list) r: r; �grZpwrr �group�members�userZ
member_uidr r r ro � s
ro c C s0 t d kr,i a t�� } x| D ]}|t |j< qW t S )N)�grp_dict�grpZgetgrallZgr_name)r� �liner r r rz � s
rz )Zmin_uidc C s t �� S )N)�clpwdZ
get_user_dictr r r r r{ � s r{ c
C s� |s|rt | � |r�t}ts,t� \}}t� y@td krVt�d�}ttdd�at�|� t� | � t� d� W n@ t
t fk
r� } z t dtt
|�� t�d� W d d }~X Y nX |s�t||� d S )N� rR r> �
z writing to )rv rp �get_permrA �log_filer �umaskr �LOGFILErW r0 rB rn rD rF rG r? ) �msgZsilent�verboserI Zroot_flag_savedr: r; Z umask_savedrM r r r rC s(
rC c
C sZ yt �� } t �� }W n< tfk
rP } z tdt|�� t�d� W d d }~X Y nX | |fS )Nzfailed to get (euid,egid)r> )r �geteuid�getegidr0 rn rD rF rG )r: r; rM r r r r� s r� c C s | r t �� S t �� S )z�
Set CAP_SYS_RESOURCE capability
:param bool clear: Set on if it's true, set off otherwise
:return: 0 for success, -1 otherwise
:rtype: int
)r3 �disable_quota_capabilityrq )�clearr r r �set_capability* s r� c C s t �| � t� S )a
Change effective uid of current process and set CAP_SYS_RESOURCE capbality
to prevent "Disk quota exceeded" error
:param int euid: User ID to set it as current effective UID
:return: 0 if capability was set successfuly, -1 otherwise
:rtype: int
)r ri r� )r: r r r �
change_uid6 s
r� c C s | st �� nt �� dS )zZ
Disable quota kernel check to allow us to write
more than user can by quota.
N)r3 rq r� )�enabledr r r �_set_quota_checks_statusC s
r� c c s& t dd� z
d V W d t dd� X d S )NF)r� T)r� r r r r �
disable_quotaN s
r� c c s& t �| �}z
d V W d t �|� X d S )N)r r� )Z umask_valueZ saved_umaskr r r � set_umaskW s
r� )NN)NN)NN)N)NNTT)TrO T)rS rS N)T)T)FTT)F)MZ
__future__r r r r� rF rU �
contextlibZclcommonr Zclcommon.clpwdr r Zctypesr r r r
r r r
r r r Z LoadLibraryZlibcr3 r0 r r r Z
DIRENTRY_PrY ZargtypesZrestyperZ r% r( r' r+ r Z_open_not_symlinkr1 Z check_dir�isdirr4 r9 r< r= Zget_path_from_descriptorZ is_subdirrp r� ZMIN_UIDrE r# r. rN ra rm r? rA rn ro r� rz r� r{ r� rC r� r� r� r� �contextmanagerr� r� r r r r �<module>
s� 0
8
5
'
"
Mini Shell