HEX
Server: LiteSpeed
System: Linux catuipe.dhs10.info 4.18.0-553.111.1.lve.el8.x86_64 #1 SMP Fri Mar 13 13:42:17 UTC 2026 x86_64
User: paradatacom (1125)
PHP: 8.1.34
Disabled: NONE
Upload Files
File: //usr/share/cagefs/__pycache__/feature_manager.cpython-311.pyc
�

��lj8�	�P�ddlZddlZddlZddlZddlZddlmZddlmZddl	m
Z
ddlZddlm
Z
dZejdd��ZGd	�d
ej��ZeGd�d����ZeGd
�d����ZGd�d��Zed��Zd�ZGd�d��ZGd�de��ZGd�de��Zdefd�Zdefd�Zd�Zeddeed ej�!���"��gZ d#e!efd$�Z"d%�Z#d&�Z$e%d'krej&e$����dSdS)(�N)�	dataclass)�Path)�Callable)�DEFAULT_FLAGS_STORAGE_PATHz/etc/cagefs/enabled_features�feature_managerz/var/log/cloudlinux/cagefs.logc�N�eZdZdZej��Zej��ZdS)�FlagBehaviorz�
    Defines the behavior of a CloudLinux Server Flag
    based on the presence of a file. The existence of this flag
    not only indicates that the 'feature' is enabled
    but could also mean it is explicitly disabled by creating the file.
    N)�__name__�
__module__�__qualname__�__doc__�enum�auto�ENABLE_ON_PRESENT�DISABLE_ON_PRESENT���c/builddir/build/BUILDROOT/cagefs-7.6.44-1.el8.cloudlinux.x86_64/usr/share/cagefs/feature_manager.pyr	r	s8��������"��	����"�������rr	c�D�eZdZUdZeed<eed<edefd���Z	dS)�Flagz�
    Represents a CloudLinux Server Flag
    typically located at /opt/cloudlinux/flags/enabled-flags.d/
    with a specific behavior based on a file existence.
    �	flag_name�
flag_behavior�returnc���tt|j�d���}|���}|jt
jkr|S|jt
jkr|Std���)Nz.flagz/Invalid value for the "flag_behavior" attribute)	rrr�existsrr	rr�RuntimeError)�self�	flag_path�flag_existss   r�enabledzFlag.enabled/sm���3���5M�5M�5M�N�N�	��&�&�(�(�����!?�?�?���
�
�<�#B�
B�
B�"�?�"��P�Q�Q�QrN)
r
rrr
�str�__annotations__r	�property�boolr rrrrr%sc���������
�N�N�N�����
�	R��	R�	R�	R��X�	R�	R�	Rrrc�t�eZdZUdZeed<eed<eed<eed<ede	fd���Z
edefd���Zd	S)
�
CageFsFeaturez=
    Represents a feature within the CageFS file system.
    �name�description�handler�flagrc�6�tt|j��S)zE
        Returns the path to the CageFS feature marker file.
        )r�ENABLED_FEATURES_DIRr'�rs r�feature_marker_pathz!CageFsFeature.feature_marker_pathFs��
�(�$�)�4�4�4rc�L�|j���o|jjS)z�
        Determines if the CageFS feature is enabled based on the existence
        of its feature marker file and CloudLinux Server Flag status.
        )r.rr*r r-s rr zCageFsFeature.enabledMs#���'�.�.�0�0�F�T�Y�5F�FrN)
r
rrr
r!r"rrr#rr.r$r rrrr&r&<s�����������I�I�I�����
����
�J�J�J�
�5�T�5�5�5��X�5��G��G�G�G��X�G�G�Grr&c�N�eZdZdZdeefd�Zd�Zd�Zdefd�Z	defd�Z
d	S)
�CageFsFeatureManagerz2
    Manages a collection of CageFS features.
    �featuresc��||_dS�N)r2)rr2s  r�__init__zCageFsFeatureManager.__init__[s
��-5��
�
�
rc�D�|jD]}|�|���dSr4)r2�_enable_feature�r�features  r�enablezCageFsFeatureManager.enable^s4���}�	*�	*�G�� � ��)�)�)�)�	*�	*rc�D�|jD]}|�|���dSr4)r2�
_sync_featurer8s  r�synczCageFsFeatureManager.syncbs4���}�	(�	(�G����w�'�'�'�'�	(�	(rr9c�8�|j���dSr4)r.�touchr8s  rr7z$CageFsFeatureManager._enable_featurefs���#�)�)�+�+�+�+�+rc�:�|�|j��dSr4)r)r r8s  rr<z"CageFsFeatureManager._sync_featureis�������(�(�(�(�(rN)r
rrr
�listr&r5r:r=r7r<rrrr1r1Vs���������6��m�!4�6�6�6�6�*�*�*�(�(�(�,�}�,�,�,�,�)�]�)�)�)�)�)�)rr1z9/usr/share/cagefs/configs/dbus/cagefs-dbus-hardening.confc���	tjgd�dtjtj���dS#ttjf$r&}t�d|��Yd}~dSd}~wwxYw)aAsk the running message bus to re-read its policy files.

    The classic dbus-daemon (cl7/cl7h/cl8, Ubuntu) reads its config only at
    startup or on an explicit reload; dbus-broker (cl9/cl10) reloads drop-ins on
    its own when a policy file changes, but not when an *account* referenced by a
    user= rule is created later. Both implement org.freedesktop.DBus.ReloadConfig,
    which re-reads every policy file and re-resolves user=/group= names from NSS.

    Invoke it over the bus (busctl) rather than `systemctl reload <unit>`: the
    bus unit name is not portable (messagebus.service on cl7/cl7h/cl8,
    dbus-broker.service on cl9/cl10, dbus.service on Ubuntu), but the
    ReloadConfig method is. Best-effort: a failure here must not abort the caller.
    )z/usr/bin/busctl�call�org.freedesktop.DBusz/org/freedesktop/DBusrD�ReloadConfigT)�check�stdout�stderrz�Could not reload the D-Bus message bus after updating the dbus-hardening policy; it will take effect on the next dbus restart. Error: %sN)�
subprocess�run�DEVNULL�PIPE�OSError�CalledProcessError�logger�warning)�excs r�_reload_dbusrRqs���
'���(�(�(�"�*�*<�(�o�		/�	/�	/�	/�	/�	/��

�Z�2�3�'�'�'����
!�"%�	'�	'�	'�	'�	'�	'�	'�	'�	'�����'���s�.2�A.�A)�)A.c��eZdZdZefdefd�Zdeddfd�Zdedefd	�Z	e
dedefd
���Zdefd�Zdefd�Z
defd
�ZdS)�_DbusHardeninga�Deploy or remove the cagefs dbus-hardening policy so its blanket
    default-deny is the LAST rule dbus parses for systemd1/login1 (dbus applies
    the last matching rule within a precedence class). Subclasses differ only in
    WHERE the policy must land to achieve that on a given OS layout.

    Root keeps access via systemd's own user="root" allow (a higher precedence
    class than context="default"), wherever our deny lands.
    �sourcec��||_dSr4)�_source)rrUs  rr5z_DbusHardening.__init__�s
������r�
is_enabledrNc�~�|r|���n|���}|rt��dSdS)aZBring the policy to the desired state, reloading the bus only when a
        file actually changed (an unconditional reload on every `sync` would
        needlessly churn the bus). The classic dbus-daemon re-reads its config
        only on reload; dbus-broker would pick drop-ins up on its own, but the
        explicit reload is harmless there.N)�_enable�_disablerR)rrX�changeds   r�applyz_DbusHardening.apply�sA��%/�C�$�,�,�.�.�.�D�M�M�O�O���	��N�N�N�N�N�	�	r�targetc���|���r/|���|j���krtj|j|��dSdS)z�Copy the packaged policy to `target` if it is missing or stale (e.g.
        after a package upgrade, where guarding only on `not exists` would leave
        the old policy in place). Returns True if it changed.TF)r�
read_bytesrW�shutil�copy2)rr^s  r�_writez_DbusHardening._write�sW���
�
���	��$�$�&�&�$�,�*A�*A�*C�*C�C�C��L���v�.�.�.��4��urc�Z�|���r|���dSdS)NTF)r�unlink)r^s r�_unlinkz_DbusHardening._unlink�s)���=�=�?�?�	��M�M�O�O�O��4��urc��t�r4��NotImplementedErrorr-s rrZz_DbusHardening._enable����!�!rc��t�r4rhr-s rr[z_DbusHardening._disable�rjrc��t�)z�True if our policy is currently in place, so re-reading the bus would
        actually re-resolve our exemptions (used to gate the postgres trigger).rhr-s r�is_deployedz_DbusHardening.is_deployed�s
��"�!r)r
rrr
�DBUS_POLICY_SRCrr5r$r]rc�staticmethodrfrZr[rmrrrrTrT�s��������'6���t��������������T��d��������������\��"��"�"�"�"�"�$�"�"�"�"�"�T�"�"�"�"�"�"rrTc�L�eZdZdZed��Zdefd�Zdefd�Zdefd�Z	dS)�DropinDbusHardeninga_Long-term path (cl8+/Ubuntu). systemd ships its own bus policy under
    /usr/share/dbus-1/system.d, which dbus parses BEFORE /etc/dbus-1/system.d,
    so a cagefs-owned drop-in in /etc/dbus-1/system.d is parsed later and wins.
    The file has a cagefs-specific name, so it is always ours and is %ghost'd by
    the package (RPM removes it on erase).z//etc/dbus-1/system.d/cagefs-dbus-hardening.confrc�v�|jj���sdS|�|j��S)NF)�TARGET�parentrrcr-s rrZzDropinDbusHardening._enable�s4���{�!�(�(�*�*�	��5��{�{�4�;�'�'�'rc�6�|�|j��Sr4)rfrsr-s rr[zDropinDbusHardening._disable�s���|�|�D�K�(�(�(rc�4�|j���Sr4)rsrr-s rrmzDropinDbusHardening.is_deployed�s���{�!�!�#�#�#rN)
r
rrr
rrsr$rZr[rmrrrrqrq�s�������.�.��T�C�
D�
D�F�(��(�(�(�(�
)�$�)�)�)�)�$�T�$�$�$�$�$�$rrqc��eZdZed��ZdZed��Zedefd���Z	defd�Z
defd�Zdefd�Zdefd	�Z
d
S)�SystemLocalDbusHardeningz/etc/dbus-1/system-local.confsCAGEFS-DBUS-HARDENING-MANAGEDz2/etc/dbus-1/system.d/org.freedesktop.systemd1.confrc�4�|j���S)z=True on cl7/cl7h, where systemd's bus policy shares system.d.)�SYSTEMD_POLICYr)�clss r�appliesz SystemLocalDbusHardening.applies�s���!�(�(�*�*�*rc�f�	|j|j���vS#t$rYdSwxYw)z�True if system-local.conf carries our marker (cagefs wrote it). A
        file without it is admin-authored and must never be touched.F)�MARKERrsr`rMr-s r�_owns_targetz%SystemLocalDbusHardening._owns_target�sD��	��;�$�+�"8�"8�":�":�:�:���	�	�	��5�5�	���s�"�
0�0c��|�tj��}|j���r6|���s"t
�d|j��|S|�|j��rd}|S)Nz�%s already exists and is not managed by cagefs; leaving it untouched. CageFS dbus-hardening is INACTIVE on this host until that file is removed or the deny policy is merged into it by hand.T)rfrqrsrrrOrPrc�rr\s  rrZz SystemLocalDbusHardening._enable�s����,�,�2�9�:�:���;�����	��(9�(9�(;�(;�	��N�N����	
&�
&�
&�
�N��;�;�t�{�#�#�	��G��rc���|�tj��}|j���r0|���r|�|j��rd}|S)NT)rfrqrsrrr�s  rr[z!SystemLocalDbusHardening._disable	s`���,�,�2�9�:�:���K��� � �	�T�%6�%6�%8�%8�	��L�L���-�-�	��G��rc�\�|j���o|���Sr4)rsrrr-s rrmz$SystemLocalDbusHardening.is_deployeds'���{�!�!�#�#�;��(9�(9�(;�(;�;rN)r
rrrrsr~rz�classmethodr$r|rrZr[rmrrrrxrx�s�������
�T�1�
2�
2�F�
-�F��T�N�O�O�N��+��+�+�+��[�+��d������������$�����<�T�<�<�<�<�<�<rrxrc�l�t���rt��St��S)z7Pick the deployment strategy for the running OS layout.)rxr|rqrrr�select_dbus_hardeningr�s.���'�'�)�)�*�'�)�)�)�� � � rrXc�H�t���|��dS)z9Entry point for the dbus-hardening CageFsFeature handler.N)r�r])rXs r�handle_dbus_hardeningr�s"�����!�!�*�-�-�-�-�-rc�j�t��}|���rt��dSdS)apRe-read the bus policy if our dbus-hardening policy is currently deployed.

    D-Bus resolves a policy's user= name to a uid only when it reads its config,
    then drops any rule it cannot resolve. The policy exempts the 'postgres'
    system account, but cagefs deploys and reloads it at its own install time --
    normally before postgresql-server creates that account -- so the rule is
    dropped and the exemption never activates. The postgresql-server package
    trigger calls this once the account exists to make the exemption take effect
    (CLOS-4632). No-op when the feature is disabled (policy not deployed).N)r�rmrR)�strategys r�reload_dbus_hardening_policyr�#s:��%�&�&�H��������������rzdbus-hardeningzVRestrict user's capability to communicate with systemd via D-Bus using certain methodszdisable-dbus-hardening)rr)r'r(r)r*r2c�L�t|��}|���dS)z+
    Enable specified CageFS features.
    N)r1r:)r2�managers  rr:r:Bs'��#�8�,�,�G��N�N�����rc�V�tt��}|���dS)zX
    Synchronize the state of CageFS featues based on their current enabled status.
    N)r1�FEATURESr=)r�s rr=r=Js"��#�8�,�,�G��L�L�N�N�N�N�Nrc����tjd���}|�dd���}|�dd���}tD]'}|�d	|j��d
|j����(|�dd
���|�dd���|����	�j	xdkr<�fd�tD��}|s|�
d��t|��dSxdkrt��dSdkrt��dS	|���dS#t$r'}t �
d|���Yd}~dSd}~wwxYw)Nz,Available manipulations with CageFS features)r(�commandzAvailable commands)�dest�helpr:zEnable CageFS features)r�z--�
store_true)�actionr�r=z<Sync CageFS features based on the state of the feature flagszreload-dbus-hardeningz~Re-read the D-Bus policy so an exempted account (e.g. postgres) created after the policy was deployed gets its user= exemptionc	�f��g|]-}t�|j�dd�����+|��.S)�-�_)�getattrr'�replace)�.0r9�argss  �r�
<listcomp>zmain.<locals>.<listcomp>osP���N�N�N��&�t�W�\�-A�-A�#�s�-K�-K�L�L�N�G�N�N�Nrz9At least one feature is required for the "enable" command�z<An error occurred during manipulations with CageFS features:)�exc_info)�argparse�ArgumentParser�add_subparsers�
add_parserr��add_argumentr'r(�
parse_argsr��errorr:r=r��
print_help�	ExceptionrO)�parser�
subparsers�
parser_enabler9r2�er�s      @r�mainr�Rs���
�
$�B�D�D�D�F��&�&�I�<P�&�Q�Q�J��)�)�(�9Q�)�R�R�M��
�
���"�"��������$�	#�	
�	
�	
�	
�����S��U�U�U�����N��O�O�O�
�����D���l������N�N�N�N�8�N�N�N���^��L�L�!\�]�]�]��x� � � � � ������������(�(�(�,�.�.�.�.�.���!�!�#�#�#��q���������S��	�	!�	!�	!��q�q�q�q�q��������s+�7AE�?E�E�+E�
E3�E.�.E3�__main__)'r�rrarI�sys�dataclassesr�pathlibr�typingr�logs�clflags.configrr,�setup_loggerrO�Enumr	rr&r1rnrRrTrqrxr�r$r�r�rr�rAr:r=r�r
�exitrrr�<module>r�s����������
�
�
�
�����
�
�
�
�!�!�!�!�!�!�����������������5�5�5�5�5�5�5��	��	�,�;�
=�
=��%�%�%�%�%�4�9�%�%�%��R�R�R�R�R�R�R���R�,�G�G�G�G�G�G�G���G�2)�)�)�)�)�)�)�)�0�$�R�S�S��'�'�'�63"�3"�3"�3"�3"�3"�3"�3"�l$�$�$�$�$�.�$�$�$�L*<�*<�*<�*<�*<�~�*<�*<�*<�^!�~�!�!�!�!�.�d�.�.�.�.�
���"�M�
�C�%�
�T�.�&�9�
�
�
�	�	�	����T�-�(��������-�-�-�`�z����C�H�T�T�V�V�������r