⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.177
Server IP:
50.6.168.112
Server:
Linux server-617809.webnetzimbabwe.com 5.14.0-570.25.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jul 9 04:57:09 EDT 2025 x86_64
Server Software:
Apache
PHP Version:
8.4.10
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
__pycache__
/
View File Name :
__init__.cpython-39.pyc
a ‰Îwh ã @ sr d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZ ddlmZ dd lmZ dd lmZ dd lmZ dd lm Z dd lm Z ddlm Z ddlm Z ddlm Z ddlm!Z! ddlm"Z" ddlm#Z# ddlm$Z$ ddlm%Z% ddlm&Z& ddlm'Z' ddlm(Z( ddl)m*Z*m+Z+m,Z,m-Z-m.Z. ddl&m/Z/m0Z0m1Z1 dZ2d Z3d Z4d Z5d Z6d Z7d!Z8d"Z9e :d#ej;¡Z<e :d$¡Z=ej> ?d%¡re j> @d d%¡ ejAd&eBd' ejI JejK¡ d(d)„ ZLd*d+„ ZMd,d-„ ZNd.d/„ ZOd0d1„ ZPdÉd2d3„ZQd4d5„ ZRd6d7„ ZSd8d9„ ZTd:d;„ ZUd<d=„ ZVd>d?„ ZWG d@dA„ dAeXƒZYG dBdC„ dCe0ƒZZG dDdE„ dEe0ƒZ[G dFdG„ dGe0ƒZ\dHdI„ Z]edJdK„ ƒZ^dÊdLdM„Z_dNdO„ Z`dPdQ„ Zai ZbdRdS„ Zcece,jd_eefe dTdƒs–z8d dlgZhd dliZjehjk lejjm¡ehjk ldU¡k rHendVƒ‚W n eny^ Y n80 dWdX„ Zoe,jpZqG dYdZ„ dZerƒZsG d[d\„ d\e,jpƒZtete,_pd]d^„ Zuejvfd_d`„Zwdadb„ Zxdcdd„ ZyG dedf„ dferƒZzdgdh„ Z{didj„ Z|dËdldm„Z}dndo„ Z~dpdq„ ZdÌdrds„Z€dtdu„ Zdvdw„ Z‚dxdy„ Zƒdzd{„ Z„d|d}„ Z…d~d„ Z†d€d„ Z‡d‚dƒ„ Zˆd„d…„ Z‰d†d‡„ ZŠdˆd‰„ Z‹dŠd‹„ ZŒdŒd„ ZdŽd„ ZŽdd‘„ ZdÍd’d“„Zd”d•„ Z‘d–d—„ Z’d˜d™„ Z“dšd›„ Z”dÎddž„Z•dŸd „ Z–d¡d¢„ Z—d£d¤„ Z˜d¥d¦„ Z™dÏd§d¨„Zšd©dª„ Z›d«d¬„ ZœG dd®„ d®ƒZd¯d°„ Zžd±d²„ ZŸd³d´„ Z dµd¶„ Z¡ej¢ejvfd·d¸„Z£d¹dº„ Z¤ej¢fd»d¼„Z¥d½d¾„ Z¦d¿dÀ„ Z§dÁd„ Z¨dÐdÃdÄ„Z©dÅdÆ„ ZªdÇdÈ„ Z«dS )Ñé )Úprint_functionN)ÚArgumentParser)Údatetime)Úcontextmanageré )Úconfig)Ú constants)Ú log_utils)Úutils)Ú process_utils)Úplatform_utils)Ú http_utils)Ú ipv6_support)Úauth)Úserverid)Úconfig_handlers)Úlibcare)Úselinux)Úfetch)Ú update_utils)Úerrors)Úkcare)Ú server_info)ÚURLErrorÚ HTTPErrorÚhttplibÚ urlencodeÚjson_loads_nstr)ÚSafeExceptionWrapperÚ KcareErrorÚNotFoundéc Zv2)Z12hZ24hZ48hÚtestz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh)z latest.v2z /etc/sysconfig/kcare/sysctl.confé z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/pythonÚignore)Úcategoryc C s@ t ƒ } tj t¡r<ttdƒ}|D ]}| | ¡ ¡ q | ¡ | S )NÚr) ÚsetÚosÚpathÚisfileÚFREEZER_BLACKLISTÚopenÚaddÚrstripÚclose)ÚresultÚfÚline© r3 ú./usr/libexec/kcare/python/kcarectl/__init__.pyÚget_freezer_blacklistL s r5 c C sB | d¡}| r(d |d | |d g¡}nd |d |d g¡}|S )NÚ.r éÿÿÿÿ)ÚsplitÚjoin)ÚptypeÚfilenameZ name_partsr3 r3 r4 Ú _apply_ptypeV s r< c C sJ t | tjƒt_t | tjƒt_t | tjƒt_t | tjƒt_t | tjƒt_d S ©N)r< r Ú PATCH_BINÚ PATCH_INFOÚBLACKLIST_FILEÚ FIXUPS_FILEÚ PATCH_DONE)r: r3 r3 r4 Ú apply_ptype_ s rC c C sú t ¡ \} }}d}t|tƒr^t|tƒs^z d|jt |j¡|jf }W q¬ t t fyZ Y q¬0 nNt|t t t fƒr‚t|tƒs‚d| }n*t|t ƒr¬|jpšt|jƒ} |jpªd|j }t ¡ }tjt ¡ |d |d t| dt| ƒƒ|d t |d¡¡t|ddƒd œS ) NÚ z[Errno %i] %s: '%s'z%sr r Ú__name__éd Úattempts)Z agent_versionZpython_versionÚdistroZdistro_versionÚerrorÚdetailsÚ tracebackrG ) ÚsysÚexc_infoÚ isinstanceÚOSErrorr Úerrnor( Ústrerrorr; ÚAttributeErrorÚ TypeErrorÚKeyErrorÚIOErrorr ÚetypeÚtypeÚinnerrJ r Ú get_distror ÚVERSIONZget_python_versionÚgetattrÚstrr9 rK Z format_tb)rV ÚvalueÚtbZdetails_sanitizedrH r3 r3 r4 Ú format_exception_without_detailsg s, ør_ c C st t jr d S t tƒ ¡} t t t | ¡¡¡}t d¡d | }t |t ¡ ¡}zt |¡ W n tyn Y n0 d S )Nz/api/kcarectl-tracez?trace=)r ÚUPDATE_FROM_LOCALÚjsonÚdumpsr_ r ÚnstrÚbase64Zurlsafe_b64encodeZbstrÚget_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_baseÚ Exception)ZtraceZ encoded_traceÚurlZrequestr3 r3 r4 Úsend_excƒ s rh c C sè t ¡ }|dkr t |d¡ dS t ¡ t ¡ }|dkrBt d¡ t d¡ ttjdƒ0}t | ¡ d¡ t | ¡ d¡ W d ƒ n1 sŽ0 Y |r¦t |¡ z | ƒ W n( t yØ tj d¡ t d¡ Y n0 t d¡ dS )zš Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: r NÚar é zWait exception)r( ÚforkÚwaitpidÚsetsidÚ_exitr/ r, r ZLOG_FILEÚdup2ÚfilenoÚtimeÚsleeprf r ÚkcarelogÚ exception)Úfuncrr ÚpidÚfdr3 r3 r4 Ú nohup_fork• s( . rx c C sš t j tjd¡} t j | ¡r†t| dƒP}z,t| ¡ ƒ}|t j t ¡ krRt || ƒ‚W n t yf Y n0 W d ƒ n1 s|0 Y t | t ¡ ¡ dS )a Check the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. ú.kcareprev.lockr& N)r( r) r9 r Ú PATCH_CACHEr* r, ÚintÚreadr ÚSUCCESS_TIMEOUTrq Ú PreviousPatchFailedExceptionÚ ValueErrorr Ú atomic_writeÚ timestamp_str)Zanchor_filepathZafileÚ timestampr3 r3 r4 Ú touch_anchor» s $rƒ c C st zt t j tjd¡¡ W n ty, Y n0 td| ƒ tj ¡ zt dd W n t yn t j d¡ Y n0 dS )zÀ See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. ry Údone©ÚreasonzCannot send update info!N)r( Úremover) r9 r rz rO Úregister_actionr Úget_loaded_modulesÚclearÚget_latest_patch_levelrf r rs rt ©Ú state_datar3 r3 r4 Ú commit_updateÒ s rŽ c C s( t jtj tjd¡t | |d¡d d S )NÚpatchesrD )Z exclude_path) r Úclean_directoryr( r) r9 r rz r Úget_cache_path)ÚkhashZplevelr3 r3 r4 Ú clear_cacheç s r“ c C s> t jpd}d || g¡}tjd|f}|r2||f7 }tjj|Ž S )NÚnoneú-Úmodules)r ÚPREFIXr9 r rz r( r) )r’ ÚfnameÚprefixZ module_dirr0 r3 r3 r4 Úget_current_level_pathë s rš c C s t jt| dƒt|ƒdd d S )NÚlatestT)Z ensure_dir)r r€ rš r\ )r’ Ú patch_levelr3 r3 r4 Úsave_cache_latestô s r c C sV t | dƒ}tj |¡rRz$tt|dƒ ¡ ¡ ƒ}t | |¡W S t t fyP Y n0 d S )Nr› r& ) rš r( r) r* r{ r, r| Ústripr ÚLegacyKernelPatchLevelr rS )r’ Zpath_with_latestÚplr3 r3 r4 Úget_cache_latestø s r¡ c @ s e Zd ZdS )ÚCertificateErrorN)rE Ú __module__Ú __qualname__r3 r3 r3 r4 r¢ s r¢ c @ s e Zd Zdd„ ZdS )ÚUnknownKernelExceptionc C s* t | d t ¡ d t ¡ t ¡ ¡¡ d S )NúLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r ) rf Ú__init__Úformatr rY ÚplatformÚreleaser Úget_kernel_hash©Úselfr3 r3 r4 r§ s ÿþz UnknownKernelException.__init__N)rE r£ r¤ r§ r3 r3 r3 r4 r¥ s r¥ c s$ e Zd Z‡ fdd„Zdd„ Z‡ ZS )ÚApplyPatchErrorc sJ t t| ƒj|i |¤Ž || _|| _|| _|| _t ¡ d | _ t ¡ | _ d S ©Nr ) Úsuperr® r§ ÚcodeÚ freezer_styleÚlevelÚ patch_filer rY rH r© rª )r r± r² r³ r´ ÚargsÚkwargs©Ú __class__r3 r4 r§ s zApplyPatchError.__init__c C s0 d | j| j| j| j| jd dd„ | jD ƒ¡¡S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})ú, c S s g | ] }t |ƒ‘qS r3 )r\ )Ú.0Úir3 r3 r4 Ú <listcomp>! ó z+ApplyPatchError.__str__.<locals>.<listcomp>)r¨ r´ r³ r± rH rª r9 r² r¬ r3 r3 r4 Ú__str__ s úzApplyPatchError.__str__©rE r£ r¤ r§ r¾ Ú __classcell__r3 r3 r· r4 r® s r® c s$ e Zd Z‡ fdd„Zdd„ Z‡ ZS )r~ c s& t t| ƒj|i |¤Ž || _|| _d S r= )r° r~ r§ r‚ Úanchor)r r‚ rÁ rµ r¶ r· r3 r4 r§ ' s z%PreviousPatchFailedException.__init__c C s d}| | j| j¡S )NzˆIt seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r¨ r‚ rÁ )r Úmessager3 r3 r4 r¾ , s ÿz$PreviousPatchFailedException.__str__r¿ r3 r3 r· r4 r~ & s r~ c C s¼ t ¡ d | ¡ }ztt |¡}t t | ¡ ¡¡}t |d ƒ}|dkrPt dƒ n2|dkrbt dƒ n |dkrtt dƒ nt d |¡ƒ |W S t y¶ } zt ||¡ W Y d }~n d }~0 0 d S ) Nz"/nagios/register_key.plain?key={0}r± r zKey successfully registeredr zWrong key format or sizerj z!No KernelCare license for that IPzUnknown error {0}r7 )r Úget_registration_urlr¨ r Úurlopenr Ú data_as_dictrc r| r{ Úprintr r Úprint_cln_http_error)Úkeyrg ÚresponseÚresr± Úer3 r3 r4 Ú!set_monitoring_key_for_ip_license5 s "rÌ c c sT t jrtjt jdd z d V W t jrPtjt jdd nt jrNtjt jdd 0 d S )NT)Úshell)r ZBEFORE_UPDATE_COMMANDr Ú run_commandZAFTER_UPDATE_COMMANDr3 r3 r3 r4 Ú execute_hooksI s ÿrÏ c C s t ƒ }|j}|j}t ¡ }| dkrdt|ƒtjt ¡ t ¡ |t t ¡ ƒ|dœ}tdƒ tt |¡ƒ nZtdƒ tt|ƒƒ tdt|ƒ ƒ ttjƒ tt ¡ ƒ tt ¡ ƒ t|ƒ tt ¡ ƒ dS )a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: ra )Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptimeÚlicensez --START--z LICENSE: N)Ú_patch_level_infor± Ú applied_lvlr Ú license_infor\ r Ú AUTO_UPDATEr Ú kcare_unamer© rª r{ r Z get_uptimerÆ ra rb )ÚfmtÚpliZ update_codeZ loaded_plZlicense_info_resultZresultsr3 r3 r4 Ú plugin_infoU s. ù rØ c C s` t ¡ } ztdd}W n ty6 tjr.dnd Y S 0 | d u rDdS | |krPdS t ¡ r\dS dS )NÚinfor… r é r rj )r Úloaded_patch_levelr‹ r¥ r ÚIGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)Ú current_levelZlatest_patch_levelr3 r3 r4 Úget_update_status‰ s rÞ c C s2 t ¡ d d… \} }| dkr*| d¡r*dS dS d S )Nrj Z CloudLinuxz7.ÚextrarD )r rY Ú startswith)rH Úversionr3 r3 r4 Úedf_fallback_ptype™ s râ c C sl | j | jf}t ||¡}t || j¡| _| j tj tj d¡ |tvrZ| j ¡ dd… t|< | j rh| ¡ dS )zFunction remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect r Nrj )ÚhostZportÚCONNECTION_STICKY_MAPÚgetÚsocketZcreate_connectionZtimeoutÚsockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeernameÚ _tunnel_hostZ_tunnel)r ZaddrZ resolved_addrr3 r3 r4 Ústicky_connect¦ s ré ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr3 )rµ r3 r3 r4 Údummy_verify_callbackÉ s rê c @ s, e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd S ) ÚSSLSockc C s || _ d| _d S r¯ )Ú _ssl_connÚ_makefile_refs)r rç r3 r3 r4 r§ Ó s zSSLSock.__init__c G s( | j d7 _ tj| jg|¢R ddiŽS )Nr r/ T)rí ræ Z _fileobjectrì ©r rµ r3 r3 r4 Úmakefile× s zSSLSock.makefilec C s | j s | jr | j ¡ d | _d S r= )rí rì r/ r¬ r3 r3 r4 r/ Û s z SSLSock.closec G s | j j|Ž S r= )rì Úsendallrî r3 r3 r4 rð à s zSSLSock.sendallN)rE r£ r¤ r§ rï r/ rð r3 r3 r3 r4 rë Ò s rë c @ s e Zd Zdd„ ZdS )ÚPyOpenSSLHTTPSConnectionc C s¾ t j | ¡ tj tjj¡}| tjjtjj B ¡ t j rJ| tjj t¡ n| tjjt¡ | ¡ tj || j¡}| ¡ | jp„| j}| | ¡ ¡ | ¡ t j r°t| ¡ |ƒ t|ƒ| _d S r= ) r ÚHTTPConnectionÚconnectÚOpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r ÚCHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERrê Z VERIFY_NONEZset_default_verify_pathsZ Connectionrç Zset_connect_staterè rã Zset_tlsext_host_nameÚencodeZ do_handshakeÚmatch_hostnameZget_peer_certificaterë )r ÚctxZconnZ server_hostr3 r3 r4 ró ä s z PyOpenSSLHTTPSConnection.connectN)rE r£ r¤ ró r3 r3 r3 r4 rñ ã s rñ c C sò t jr&t | |¡}t tj¡|ddS dD ]Â}tj ||d}t | t ||ƒ¡d | }d}|rvt |ƒ|krvt d¡ q*zt tj¡|ddW S tyê } zB|rÔ|jdv s¸|jd krÔt d |¡¡ W Y d }~q*‚ W Y d }~q*d }~0 0 q*d S ) NF©Ú check_license)TF)Úsecure_boot_infoú?iX z<Check-in URL param is too large, discarding secure boot info)i iž iô zJCheck-in request failed with error: {0}, retrying without secure boot info)r r` r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr Ú urlopen_authr Zbased_server_infoÚstickyfyÚlenr Zlogwarnr r± r¨ ) r’ r› r† Úmoderg rû Z request_paramZmax_url_lengthÚexr3 r3 r4 Ú_fetch_patch_level_requestÿ s" r c C s t ¡ }tjd ur$t |ttjƒ¡S tD ]æ}z–t||| |ƒ}t |j ¡ t ƒ t | ¡ ¡ ¡ }tjd | |¡dd |r®| d¡r®t|ƒ}t ||d |d |d ¡W S t |t|ƒ¡W S tyÔ Y q( ty } z |jdv rötd ƒ‚‚ W Y d }~q(d }~0 0 q(tƒ ‚d S ) Nz;fetch patch level, reason: {0}, kernel latest response: {1}F©Z print_msgÚ{r³ Úbaseurlrª )i“ i‘ zKC licence is required)r r« r Ú PATCH_LEVELrŸ r{ Ú PATCH_LATESTr r Zset_config_from_patchserverÚheadersÚupdate_all_kmod_paramsr rc r| rž r Úloginfor¨ rà r ZKernelPatchLevelr r r± r r¥ )r† r r’ r› rÉ r Z latest_infor r3 r3 r4 Úfetch_patch_level s* " r c C sB | t|tjƒ¡}tj d |¡¡ ztj |ddd W dS t y` tj d |¡¡ Y dS t yš } z$tj d |t |ƒ¡¡ W Y d }~n d }~0 0 | t|tjƒtj ¡}tj d |¡¡ ztj |dd W nd t y tj d |¡¡ Y dS ty< } z$tj d |t |ƒ¡¡ W Y d }~n d }~0 0 dS ) NzProbing patch URL: {0}FÚHEAD)rú ÚmethodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1}rù z{0} is not available: {1})Úfile_urlr< r r> r rs rÙ r¨ r rý r rf Údebugr\ r ZSIGr )r³ r: Zbin_urlr rg r3 r3 r4 Ú probe_patch. s( ..r c C sF |t jkr| t j¡}n | |¡}| |¡}tj||tjt | ¡dS )N)Z hash_checker) r ÚKMOD_BINZkmod_urlr Ú cache_pathr Z fetch_urlr Ú USE_SIGNATUREZget_hash_checker)r³ Únamerg Zdstr3 r3 r4 Ú fetch_and_verify_kernel_fileG s r c @ s> e Zd Zddd„Zdd„ Zdd„ Zdd „ Zd d „ Zd d „ ZdS )Ú PatchFetcherNc C s || _ d S r= )rœ )r rœ r3 r3 r4 r§ R s zPatchFetcher.__init__c C s t | j|ƒS r= )r rœ )r r r3 r3 r4 Ú_fetchU s zPatchFetcher._fetchc C sr | j tj¡}| j tj¡}| j tj¡}| j tj¡}tdd„ ||||fD ƒƒopt j |¡dkopt j |¡dkS )Nc s s | ]}t j |¡V qd S r= )r( r) r* )rº r) r3 r3 r4 Ú <genexpr>_ r½ z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) rœ r r rB r> r? r r Úallr( r) Úgetsize)r Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr3 r3 r4 Úis_patch_fetchedX s ÿýz PatchFetcher.is_patch_fetchedc C s, | j d u rtdƒ‚| j s | j S | ¡ r6t d¡ | j S t d¡ t| j tjƒr¤z tj | j t j ¡dd}W n t y| Y n(0 |j dd ¡}|r¤| j t |¡¡| _ z| t j ¡ W n* t yÞ td | j t jpÔd¡ƒ‚Y n0 | t j¡ | tj¡ | ¡ tj| j t j ¡d d d t tj ¡ | j S ) Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r ú KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch levelÚdefaultr½ Úwb©r )!rœ r r r r rN r rŸ r rý r r r> r r rå Úupgrader rc r r r¨ Ú PATCH_TYPEr? r r Úextract_blacklistr€ r rB r Úrestore_selinux_contextrz )r Úrespr r3 r3 r4 Ú fetch_patchd s< ÿÿ zPatchFetcher.fetch_patchc C sJ t | j tj¡dƒ ¡ }|rFt |¡}|rFt | j tj ¡| d¡¡ d S )Nr& r ) r, rœ r r r? r| Ú BLACKLIST_REÚsearchr r€ r@ Úgroup)r ZbufZmor3 r3 r4 r" Œ s z PatchFetcher.extract_blacklistc C sÄ |du r dS zt |tjƒ}W n ty0 Y dS 0 |j dd¡}|rT| t |¡¡}| tj¡}t |dƒ&}t dd„ | ¡ D ƒƒ}W d ƒ n1 s–0 Y |D ]}t ||ƒ q¤t tj¡ dS )z¶ Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nr r& c S s g | ] }| ¡ ‘qS r3 )rž )rº Úfixupr3 r3 r4 r¼ © r½ z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r r rA r r rå r r rc r r, r' Ú readlinesr r# r rz )r r³ r$ r Z fixups_fnamer1 Úfixupsr) r3 r3 r4 Ú fetch_fixups“ s 4 zPatchFetcher.fetch_fixups)N) rE r£ r¤ r§ r r r% r" r, r3 r3 r3 r4 r P s (r c C s6 t ƒ } t| jƒ | jtjkr(t d¡ n t d¡ d S )Nr r )rÑ rÆ Úmsgr± ÚPLIÚPATCH_NEED_UPDATErL Úexit)r× r3 r3 r4 Ú kcare_check± s r1 c C s t ƒ } t| ƒ}z t ¡ }W n ty0 i }Y n0 t ¡ }d}|d urZt |d ¡ d¡}t ¡ }t | dg ¡ƒ}t dd„ |D ƒƒ}t ¡ }|sštdƒ ntdƒ td |¡ƒ td |¡ƒ |d krÔtd |¡ƒ |d krêtd |¡ƒ || d krþtdƒ tdƒ d S )NZUnknownÚtsz%Y-%m-%dr c s s | ]}t | d g ¡ƒV qdS )r N)rÿ rå )rº Zrecr3 r3 r4 r Ê r½ z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)rÑ Ú_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z fromtimestampÚstrftimerÕ rÿ rå ÚsumrÛ rÆ r¨ ) r× Ú kcare_infoÚ libcare_infoÚstateZ latest_updateZeffective_versionZkernel_vulnerabilitiesZuserspace_vulnerabilitiesrœ r3 r3 r4 Úshow_generic_infoº s4 r9 Fc C sð zžt dtjd}|st‚| tj¡}t t |¡ ¡ ¡}| r”g i }}| d¡D ]0}t |¡}|rvd|v rv| |¡ qP| |¡ qP||d< t |¡}t|ƒ W nL tyÒ } z t ||j¡ W Y d}~dS d}~0 tyê tdƒ Y n0 d S ) z½ Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None rÙ )r† Úpolicyú ú kpatch-namer Nr zNo patches availabler )r‹ r Ú POLICY_REMOTEr¥ r r r? r rc r rý r| r8 rÅ ÚappendÚupdatera rb rÆ r r rÇ rg ) Úis_jsonr› rg Ú patch_infor r0 ÚchunkÚdatarË r3 r3 r4 Úkcare_latest_patch_infoÝ s, rD c C s„ d| j i}| jd ur€t| ƒ}g }| d¡D ]0}t |¡}|rPd|v rP| |¡ q*| |¡ q*||d< t ¡ }|rx|d nd|d< |S )Nr r; r< r rª Úunknown) r- rÒ Ú_kcare_patch_infor8 r rÅ r> r? r Z read_dumped_kernel_patch_level)r× r0 rA r rB rC Zsaved_patch_levelr3 r3 r4 r3 ý s r3 c C sP t ¡ }t || jtj¡}tj |¡s.t dƒ‚t |dƒ ¡ }|rLt d|¡}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.r& rD )r r« r‘ rÒ r r? r( r) r* r r, r| r& Úsub)r× r’ r rÙ r3 r3 r4 rF s ÿ rF c C sT t ƒ }| s:|jdkr t|jƒ |jd u r,d S tt|ƒƒ nttjt|ƒddƒ d S )Nr T)Z sort_keys) rÑ r± rÆ r- rÒ rF ra rb r3 ©r@ r× r3 r3 r4 rA s rA c C s: t jd| g}t |¡}t ¡ }d}t ||¡t ||¡kS )Nz file-infozkpatch-build-time)r Ú KPATCH_CTLr Ú check_outputr Ú _patch_infoZget_patch_value)Únew_patch_filerµ Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr3 r3 r4 Ú is_same_patch+ s rM c C sL |dkr dS | r || k r dS | |kr(dS t t ¡ |tj¡}t|ƒsHdS dS )Nr FT)r r‘ r« r r> rM )Ú applied_levelÚ new_levelrL r3 r3 r4 Úkcare_need_update3 s rP c C sp t jrltj t¡r t ttj¡s6tj d t¡¡ d S t j dddtgdd\} }}| dkrltj d | ¡¡ d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctlú-qz-pT©Ú catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr( r) r* Ú SYSCTL_CONFIGÚaccessÚR_OKr rs Úwarningr¨ r rÎ )r± Ú_r3 r3 r4 Ú update_sysctlE s rY c sÈ t j t¡sttdƒ ¡ t tt j¡s>tj d t¡¡ dS ttdƒl}| ¡ }| d¡ |D ]$‰ t‡ fdd„| D ƒƒs`| ˆ ¡ q`|D ]}| |d ¡ qŠ| ¡ W d ƒ n1 sº0 Y dS ) z*Update SYSCTL_CONFIG accordingly the editsri zFile {0} has no read accessNzr+r c 3 s | ]}ˆ |¡V qd S r= )rà )rº r& ©r2 r3 r4 r a r½ z#edit_sysctl_conf.<locals>.<genexpr>Ú )r( r) r* rT r, r/ rU rV r rs rW r¨ r* ÚseekÚanyÚwriteÚtruncate)r‡ r> ZsysctlÚlinesri r3 rZ r4 Úedit_sysctl_confP s ra c C s& | D ] }t |¡rtd |¡ƒ‚qd S )NzDDetected '{0}' kernel module loaded. Please unload that module first)ÚCONFLICTING_MODULES_REÚmatchr r¨ )r– Úmoduler3 r3 r4 Údetect_conflicting_modulesi s re c C s d t ¡ ¡S )Nz /lib/modules/{0}/extra/kcare.ko)r¨ r Zget_system_unamer3 r3 r3 r4 Úget_kcare_kmod_linko s rf c C sp t dd} t t ¡ | tj¡}tj |¡s.d S t |dƒ$}| ¡ dd … dkW d ƒ S 1 sb0 Y d S )NrÙ r… Úrbiäÿÿÿs ~Module signature appended~ ) r‹ r r‘ r« r r r( r) r* r, r| )r³ Z kmod_fileZvfdr3 r3 r4 Úkmod_is_signeds s rh c K s\ d| g}| ¡ D ]\}}| d ||¡¡ qtj|dd\}}}|dkrXtd | |¡ƒ‚d S )Nz /sbin/insmodz{0}={1}TrR r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.)Úitemsr> r¨ r rÎ r )Zkmodr¶ ÚcmdrÈ r] r± rX r3 r3 r4 Ú load_kmod| s rk c C s: t ¡ rtƒ stdƒ‚t ¡ s.t ¡ s.t ¡ r6tdƒ‚d S )Nz4Secure boot is enabled. Not supported by KernelCare.zWYou are running inside a container. Kernelcare should be executed on host side instead.)r Zis_secure_bootrh r Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr3 r3 r3 r4 Úcheck_compatibility… s rl c C sP t d¡}t j|dgdddd dk}|rL| dv rLt d | ¡¡ t d¡ d S ) NZmodinfoZkmodlveT©rS Ú catch_stderrr ©Úfreerß z3{0} patch type conflicts with kmodlve kernel moduler )r Zfind_cmdrÎ r Úlogerrorr¨ rL r0 )r: rj Z has_kmodlver3 r3 r4 Ú check_patch_type_compatibilityŒ s rr c C sL t ddd| g¡}g }| d¡D ]&}| ¡ r | d¡\}}}| |¡ q |S )Nz /sbin/modinfoz-FZparmr[ ú:)r rJ r8 rž Ú partitionr> )Ú kcare_linkÚstdoutZavailable_paramsr2 Z param_namerX r3 r3 r4 Úget_kmod_available_params— s rw c C sL t jr dndt jrdndt jr$t jndtt jtƒr8t jndt jrDdnddœS )Nr r rD )Ú kpatch_debugZ kmsg_outputZ kcore_outputZ kdumps_dirZenable_crashreporter) r Ú KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErN Ú KDUMPS_DIRr\ ZENABLE_CRASHREPORTERr3 r3 r3 r4 Úmake_kmod_new_params¡ s ûr{ c C sB t jr tj t j¡s t t j¡ tƒ ¡ D ]\} }t| |ƒ q*d S r= ) r rz r( r) ÚexistsÚmakedirsr{ ri Úupdate_kmod_param)ZparamÚvalr3 r3 r4 r « s r c C s† d}t j || ¡}t j |¡s"d S z<t|dƒ }| t|ƒ¡ W d ƒ n1 sR0 Y W n" ty€ tj d| |¡ Y n0 d S )Nz /sys/module/kcare/parametersÚwz!failed to set %s kmod param to %s) r( r) r9 r| r, r^ r\ rf r rs rI )Zkmod_param_nameZ param_valueZ params_rootZ param_pathr1 r3 r3 r4 r~ ³ s 0 r~ c s t ƒ }t | |tj¡}zt ||¡ W n ty< |}Y n0 tj r^t j tj ¡s^t tj ¡ tƒ }t|ƒ‰ t‡ fdd„| ¡ D ƒƒ}t|fi |¤Ž tƒ d S )Nc 3 s" | ]\}}|ˆ v r||fV qd S r= r3 )rº ÚkÚv©Zavailable_kmod_paramsr3 r4 r Ñ r½ z"load_kcare_kmod.<locals>.<genexpr>)rf r r‘ r r ÚshutilÚcopyrf r rz r( r) r| r} r{ rw Údictri rk Ú update_depmod)r’ r³ ru Z kcare_fileZ kmod_paramsr3 rƒ r4 Úload_kcare_kmodÁ s rˆ c C sX dg}| d ur | d| g¡ tj|ddd\}}}|rTtjd d |¡||¡dd d S ) Nz /sbin/depmodz-aTrm z%Running of `{0}` failed with {1}: {2}ú Fr )Úextendr rÎ r rq r¨ r9 )Úunamerj r± rX Ústderrr3 r3 r4 r‡ × s ÿr‡ c C s4 t jd| gdd\}}}|dkr0td | |¡ƒ‚d S )Nz /sbin/rmmodTrR r z Unable to unload {0} kmod {1})r rÎ r r¨ )Úmodnamer± rX r3 r3 r4 Ú unload_kmodã s rŽ c C sP g }dg| D ]<}t | |d |¡¡}tj |¡rt|ƒ | d |¡¡ q|S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r‘ r¨ r( r) r| rk r> )r’ rÝ r– ZloadedÚmodÚmodpathr3 r3 r4 Ú apply_fixupsé s r‘ c C s> | D ]4}z t |ƒ W q ty6 tj d| ¡ Y q0 qd S )Nz$Exception while unloading module %s.)rŽ rf r rs rt )r+ r r3 r3 r4 Ú remove_fixupsó s r’ c C sŽ | r | }n6t jrt j}n(tƒ |¡r2d| t jdfS d| t jdfS ddddddœ}| ¡ }||v rj|| }ntd || t jd¡ƒ‚|| t jdfS ) NZfreeze_conflictTr FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3}))r Z PATCH_METHODr5 Ú intersectionÚupperr r¨ )Úfreezerr– r Zpatch_method_mapr3 r3 r4 Úget_freezer_styleû s$ û r– rD c sª | ||dœ‰ t dˆ ƒ t ¡ }t ¡ }t|ƒ t||ƒ}t | |tj¡}t | |ƒ d |tj t ¡ t |¡¡} d|v } | o„t | |¡} |d u} | o¢t|ƒo¢t | ¡} ˆ || dœ¡ | rÆt dˆ ƒ d S | rt dˆ ƒ t| ||ƒ}t dˆ ƒ t|ƒ t d ˆ ƒ t|ƒ | r"t d ˆ ƒ tdƒ d } | s<t d ˆ ƒ t| |ƒ |rHtƒ t d ˆ ƒ t|| || |ƒ tƒ t d |t ¡ ¡¡ t ¡ t dˆ ƒ t ‡ fdd„tj!d d S )N)r’ Zfuturer Ústartz{0}-{1}:{2};{3}r )ZcurrentÚ kmod_changedr„ ZfxpÚunpatchZunfxpÚunloadFÚloadÚpatchz5Patch level {0} applied. Effective kernel version {1}Úwaitc s t ˆ ƒS r= )rŽ r3 rŒ r3 r4 Ú<lambda>V r½ z kcare_load.<locals>.<lambda>)rr )"rˆ r rÛ r‰ re r– r‘ r r> r r¨ r! r r Z parse_unameZis_kmod_version_changedrM Z kcare_update_effective_versionr? r‘ Úkpatch_ctl_unpatchr’ rŽ rˆ rƒ Úkpatch_ctl_patchrY r r rÕ r Ztouch_status_gap_filerx r} )r’ r³ r r• Ú use_anchorrÝ r– r² r´ Ú descriptionZ kmod_loadedr˜ Z patch_loadedZ same_patchr+ r3 rŒ r4 Ú kcare_load sT ÿ r£ c C sŒ t jg}t ||tj¡}tj |¡r2| d|g¡ | dd|g¡ | d|d g¡ | | ¡ t j |dd\}}}|dkrˆt |||| ƒ‚d S )Nz-brœ z-dú-mr TrR )r rI r r‘ r r@ r( r) r| rŠ r> r rÎ r® ) r´ r’ r³ r¢ r² rµ Zblacklist_filer± rX r3 r3 r4 r Y s r c C sZ t jtjdd| d gddd\}}}|dkrVtjd ||¡dd td |t| ƒ¡ƒ‚d S ) Nr™ r¤ r Trm ú4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}Fr úError unpatching [{0}] {1}) r rÎ r rI r rq r¨ r r\ )r² r± rv rŒ r3 r3 r4 rŸ f s ÿ rŸ c C s8 | |d< t t ¡ ƒ|d< t tj tjd¡t |ƒ¡ d S )NÚactionr2 z kcare.state) r{ rq r r€ r( r) r9 r rz r\ )r§ r r3 r3 r4 rˆ p s rˆ c C sl d}t j |¡sd S t |¡D ]H}t j ||dd¡}t j |¡sBq t |¡}|| kr t |¡ t|ƒ q d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r( r) ÚisdirÚlistdirr9 ÚislinkÚreadlinkÚunlinkr‡ )Ú kmod_linkZ modules_pathÚentryZ sym_link_pathZ target_pathr3 r3 r4 Úupdate_weak_modulesv s r¯ c C sZ t ¡ }tƒ }z| |¡ W n6 tyR } z |s>td |¡ƒ‚W Y d }~n d }~0 0 t ¡ }t| |ƒ}t ƒ Ø d|v r|d u}|ròt t ¡ ||ƒ}t j tjdd|d gddd\} } } t|ƒ | dkròtjd | | ¡d d td | t|ƒ¡ƒ‚tjt t¡d td tƒdƒ tƒ } tj | ¡r.t | ¡ t | ƒ W d ƒ n1 sL0 Y d S )NzUnable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.r r™ r¤ r Trm r¥ Fr r¦ r )ÚcountÚdelay) r rÛ r r, rf r r¨ r‰ r– rÏ r‘ r« r rÎ r rI r’ r rq r\ r Zretryr Z check_excÚUNLOAD_RETRY_DELAYrŽ rf r( r) r* r¬ r¯ ) r• ÚforcerÝ ÚpfÚerrr– r² Z need_unpatchr+ r± rv rŒ r r3 r3 r4 Ú kcare_unload† s@ ÿÿ ÿ ÿ r¶ c C s8 t ƒ }| rt|ƒS |jdkr"|jS |jd ur4t ¡ S d S r¯ )rÑ Ú_kcare_info_jsonr± r- rÒ r rK rH r3 r3 r4 r6 ² s r6 c C sR d| j i}| jd ur>| t t ¡ ¡¡ | t | d¡¡¡ | j |d< t |¡S )Nr zkpatch-descriptionz kpatch-state) r- rÒ r? r rÅ r rK Zparse_patch_descriptionrå r8 ra rb )r× r0 r3 r3 r4 r· ¾ s r· c @ s$ e Zd ZdZdZdZdZdd„ ZdS )r. r r rj rÚ c C s" || _ || _|| _|| _|| _d S r= )r± r- Ú remote_lvlrÒ r8 )r r± r- r¸ rÒ r8 r3 r3 r4 r§ Ð s z PLI.__init__N)rE r£ r¤ r r/ ÚPATCH_UNAVALIABLEÚPATCH_NOT_NEEDEDr§ r3 r3 r3 r4 r. Ê s r. c C sú t ¡ } z‚tdd}| rJt| |ƒr6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |ƒ}W nj tyô tj }t j rÂd t j t ¡ d t ¡ ¡}n d t ¡ d t ¡ t ¡ ¡}t||d d d ƒ}Y n0 |S ) NrÙ r… z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingsr¦ Z unavailable)r rÛ r‹ rP r. r/ r rº r¥ r¹ r Ú STICKY_PATCHr¨ r rY r© rª r« )Zcurrent_patch_levelZnew_patch_levelr± r- r8 rÙ r3 r3 r4 rÑ Ø sF ý ý ý ý þÿÿrÑ c C sü d}zZt ¡ }td|fd| fgƒ}t ¡ d |¡ }t |¡}t t | ¡ ¡¡}t |d ƒW S t y } zt ||¡ W Y d}~dS d}~0 tyÀ } zt ||¡ W Y d}~dS d}~0 t yö } z t d |¡¡ W Y d}~d S d}~0 0 dS ) zÁ Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise NÚ server_idÚtagz/tag_server.plain?{0}r± éýÿÿÿéüÿÿÿzInternal Error {0}éûÿÿÿ)r Ú get_serveridr r rà r¨ r rÄ r rÅ rc r| r{ r r rÇ r rf rq ) r½ rg r¼ ZqueryrÉ rÊ rË ZueZeer3 r3 r4 Ú tag_server s" r c C sì t d¡} t d | ¡¡ t}t ¡ ²}z:t | |j ¡}t t | ¡|j ¡ t |j |¡ |j }W n4 ty– } z t d |¡¡ W Y d }~n d }~0 0 tjd|t ¡ gdd\}}}|rÊtd ||¡ƒ‚W d ƒ n1 sÞ0 Y d S )Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)rn z Script failed with '{0}' {1})r re r Zlogdebugr¨ ÚKCDOCTORÚtempfileZNamedTemporaryFiler Zfetch_signaturer Z save_to_filer rÄ Zcheck_gpg_signaturerf rq r rÎ r Zget_patch_serverr )Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturerµ r± rX rŒ r3 r3 r4 Úkcdoctor% s & rÅ c C sB t d t¡¡} zt | ¡ W n ty2 Y dS 0 t d¡ dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r re r¨ ÚEFFECTIVE_LATESTr rÄ r r r )rg r3 r3 r4 Úcheck_new_kc_version6 s ÿrÇ c C sÊ t ¡ }t|ƒ}|tjkp*|tjko*|du }zt| |ƒ}W n> tyx } z&|rR‚ ntj d |¡¡ W Y d}~n d}~0 0 |tjkrŠ|}n<|}|du rÆ|tj kr®t |d¡}n|tjkr¾|}ntdƒ‚|S )aÒ Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string NzUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r« r¡ r r= ZPOLICY_LOCAL_FIRSTr rf r rs rW r¨ Z POLICY_LOCALrŸ r ) r† r: r r’ Z cached_levelZconsider_remote_exZ remote_levelr r³ r3 r3 r4 r‹ C s& ( r‹ c C s’ | dkr d S | dkrdn| t _ttddt jƒr€tjt jd t jdv rnt ¡ rnt jpXt }t dd d |¡fƒ t d | ¡¡ ntd | ¡ƒ‚d S ) NÚedfr rD Zprober… ©r! ro )zfs.enforce_symlinksifownerzfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernel)r r! r r r Ú update_configr Z is_cpanelZ FORCE_GIDÚ CPANEL_GIDra r¨ r r r )r: Úgidr3 r3 r4 Úupdate_patch_typeh s þrÍ c C sŽ t ¡ ttjƒ |tjkr"tƒ ztd||d}W n^ t y’ } zF|tj tj fv r|tj r|t |ƒ}tj |¡ W Y d}~dS ‚ W Y d}~n d}~0 0 t ¡ }t|ƒ}| ¡ t||dsÆt d¡ dS z(tjtjddd tjtjdd d W n ty tj d ¡ Y n0 t ¡ }|tj ks,tj rvt ƒ 2 | |¡ t |||| |tj kd W d ƒ n1 sl0 Y t !|¡ t"||ƒ dS ) ax :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode r? )r† r: r N)rN rO z%No updates are needed for this kernelrÚ z kcore*.dump)Zkeep_nÚpatternz kmsg*.logz#Error during crash reporter cleanup)r¡ )#r Zlog_all_parent_processesrr r r! r r= rÇ r‹ r¥ ÚUPDATE_MODE_AUTOÚUPDATE_MODE_SMARTrÜ r\ r rs rW r rÛ r r% rP r r r rz rf rt r« rÔ rÏ r, r£ Zdump_kernel_patch_levelr“ ) r• r r: r³ rË r- rÝ r´ r’ r3 r3 r4 Ú do_update~ s< 8 rÑ c C s t ttjƒttjptjƒttjp$tjƒfƒ}|dkr<tdƒ‚tjrHtjS | t j krltjp\tj}tjphtj}n tj}tj}|r€|S |rŒd| S d S )Nr z‰Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzrelease-) r5 Úboolr r» Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r ÚUPDATE_MODE_MANUAL)r r° r± Zpatchsetr3 r3 r4 Ú get_stickyµ s* ýÿÿ rÔ c C s | d | S )Nr6 r3 )r™ r˜ r3 r3 r4 Ú _stickyfyÔ s rÕ c C s" t |ƒ}|s| S |dkr"t|| ƒS t ¡ }|sDtj d¡ t d¡ z t t ¡ d |¡ ¡}W n< tyœ } z$t ||j¡ t d¡ W Y d}~n d}~0 0 t t | ¡ ¡¡}t|d ƒ}|dkrÔt|d | ƒS |d krà| S |d kr tj d ¡ t d ¡ tj d|d ¡ t d¡ dS )z„ Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. ÚKEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr¿ z!/sticky_patch.plain?server_id={0}rÀ Nr± r r™ r rj zEServer ID is not recognized. Please check if the server is registeredr7 zError: r r¾ )rÔ rÕ r rÁ r rs rÙ rL r0 r rÄ r rà r¨ r rÇ rg r rÅ rc r| r{ )Úfiler Úsr¼ rÉ rË rÊ r± r3 r3 r4 rþ Ø s2 rþ c C sò g }| s dS | d¡}|d }|dd… }| d¡}||krLtdt| ƒ ƒ‚|s`| ¡ | ¡ kS |dkrt| d¡ n>| d ¡sˆ| d ¡rš| t |¡¡ n| t |¡ d d ¡¡ |D ]}| t |¡¡ q¶t d d |¡ d tj ¡} | |¡S )zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr6 r r NÚ*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r8 r° r¢ ÚreprÚlowerr> rà ÚreÚescapeÚreplaceÚcompiler9 Ú IGNORECASErc ) ZdnÚhostnameZ max_wildcardsZpatsÚpiecesZleftmostZ remainderZ wildcardsZfragZpatr3 r3 r4 Ú_dnsname_match s( rã c C s g }t | ¡ ƒD ]2}| |¡}| ¡ dkrdd„ t|ƒ d¡D ƒ}q| sPtdƒ‚g }|D ]*\}}|dkrXt||ƒrx d S | |¡ qX|sª| ¡ j }t||ƒr d S | |¡ t |ƒdkrÔt d |d tt|ƒ¡¡ƒ‚n*t |ƒdkröt d ||d ¡ƒ‚nt d ƒ‚d S ) NZsubjectAltNamec S s g | ]}| ¡ d d¡‘qS )rs r )rž r8 )rº Úitr3 r3 r4 r¼ < r½ z"match_hostname.<locals>.<listcomp>ú,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}r¹ z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)ÚrangeZget_extension_countZ get_extensionZget_short_namer\ r8 r rã r> Z get_subjectZ commonNamerÿ r¢ r¨ r9 ÚmaprÚ ) Zcertrá Zsanr» rË ZdnsnamesrÈ r] Zcnr3 r3 r4 r÷ 7 s2 ÿ r÷ c C s$ t ddd} | jdddd | jdd d dd | jd d dd | jd dddd | jdddd | jdddd | jdddd | jdddd | jdddd | jd d d d | jd d dd | jd!d"dd | jd#d$dd | jd%d&dd | jd'd(d)d | jd*d+dd | jd,d-dd | jd.d/dd | jd0d1dd | jd2d3dd | jd4d5d6d | jd7d8d9d | jd:d;dd | jd<d=d)d | jd>d?dd | jd@dAdd | jdBdCdd | jdDdEdd | jdFdGdd | jdHdIdd | jdJdKdd | jdLdMdd | jdNdOdPtd dQdR | jdSdTdd | jdUdVdd | ¡ }|jdWdXdPd |jdYdZdd |jd[d\dd | jd]d^dPd dQd_ | jd`dadbddQdc | jdddedf | jdgdhdd | jdidjdkdldm tjs¢| jdndodpdqdQdr | jdsdtdpdqdudr | jdvdwdd | jdxdydzdd | jd{ddd | jd|d}d~dd | jdd€ddd | jd‚dƒd„d…d | jd†d‡dˆdd‰dŠ | jd‹d‰dd | jdŒddd | ¡ }tj t ¡ ¡ tjsÒt j dŽg7 _ |j d urt td |j d¡ƒƒ tj ¡rdS d‘S |js|jr2tjr(tjt_ntjt_n|jrBtjt_|jsjt ¡ dkrjt d’t j d“ d‘S t j!}|jr€t j"}n|jrŽt j#}t$ %|¡ |j&r¨t' (¡ |j)rê|j)dkrØt*|j)ƒt_+t j,tj+d” nd t_+t j,dd” |j-d ur t j,|j-d• |j-t_.|j/rdQt_0|j1r(dQt_2|j3r6dut_4|j5rDt5ƒ |j6rZt7 8d–t9¡ n8|j:r’tj;d—kr’tj<d—kr~dntj<pˆd˜|_=du|_|j>r¢|j>t_?|j@r¼t7 8d™t9¡ dšt_?tj? Ad›¡t_?tj?rútj?tBvrút$jC Ddœ Etj?d FtB¡¡¡ |jGrdut_Hdž|jG t_I|j=r&tJ|j=ƒ tj;d—krTtKƒ t_;t7 8dŸ Etj;pLd˜¡t9¡ |jLrrt tMjL|jNd ƒ d S tOtj;ƒ |jPrŽtQƒ d S |jRr´|jNrªtRd¡d¢ ntRƒ d S |jSrÌt j,d£d¤ d S |jTrät j,d¥d¤ d S |jUrüt V|jU¡ d S |jWrtX|jWƒS |jYr tZ Y¡ |j[rNtj;d¦kr>t j,d§d¨ tZ [|j[|j\¡S |j]rltZ ]¡ dkrhdS d‘S |j^d ur‚t_|j^ƒS |j`r”t tjaƒ tb|dpd ƒd ur¶tc d|je¡ dS tjsè|jfrÎtc g¡ S |jhrîtc i¡ d urît$ jd©¡ |jkrtcjitjldª n|jmr tc n¡ t$ jd«¡ |jor4t tc p¡ ƒ |jqrHt tc r¡ ƒ |jsrjtc t¡ rjt tc u|js¡ƒ |jvd urÐ|jvdkrštjwp–txtcjy z¡ ƒ}nd¬d„ |jv d¡D ƒ}tcjit{|ƒd®d urÐt$ jd©¡ |j|rètcjitjld d¯ |j} r t t~|jNd ƒ d}|j r t7 8d°t9¡ d±}|j€ r*|j€}|j rDt‚|tjƒtj„d² |j rdt‚|tj…dª t$ jd³¡ |j rxt t† ‡¡ ƒ |jˆ r˜t‰||jŠd´ t$ jdµ¡ |j rÆdQt_‹tŒ tŽ dd¶¡¡ t‚|tjldª |j rÚt|jNd |j‘ rèt’ƒ S |j“ rüt”|jNd |j• r t–ƒ t—t j˜ƒd‘k r t™ƒ d S )·NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr¢ z--debugrD Z store_true)Úhelpr§ z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z --app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz --auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are locatedÚPATH)rè Úmetavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner• z --nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz --registerz Register using KernelCare KeyrÖ z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr— z --nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz --plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)rè r§ rW r Úrequiredz--check-compatibilityzCheck compatibility.z --clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz --edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)rè r§ r rë rQ z--quietz=Suppress messages, provide only errors and warnings to stderr)rè r§ rë z --has-flagszCheck agent features)rè z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionr> z KEY=VALUE)rè r§ rê z--disable-libcarezDisable libcare servicesÚenable_libcareZ store_const)rè Zdestr§ Úconstz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-auto-updatez --lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz --lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-updateÚUSERSPACE_PATCHESrü zODownload latest patches and apply them to the corresponding userspace processes)rê Znargsrí rè z--userspace-auto-updatez--userspace-statusz"Return status of userspace updateszlibcare-enabledrå r r zPlease run as root)r× )r )r» zTFlag --edf-enabled has been deprecated and will be not available in future releases.rÈ r zMFlag --test has been deprecated and will be not available in future releases.r" ú/z(Prefix `{0}` is not in expected one {1}.r‰ zfile:z+edf patches are deprecated. Fallback to {0})r@ ra )rÖ ZYES)rÔ ZNOrp rß rÉ z Userspace patches are applied.r z Userspace patches are unloaded.c S s g | ]}| ¡ ¡ ‘qS r3 )rž rÛ )rº Zptchr3 r3 r4 r¼ r½ zmain.<locals>.<listcomp>)Úlimit)r rð zQFlag --nofreeze has been deprecated and will be not available in future releases.r” )r r: zKernel is safe)r³ z=KernelCare protection disabled. Your kernel might not be safeé< )šr Z add_argumentr{ Z add_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_argsÚ__dict__r? r Zget_config_settingsÚFLAGSZ has_flagsr' Úfilterr8 ÚissubsetÚquietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr‹ r( ÚgetuidrÆ rL rŒ ÚloggingÚINFOZWARNINGÚDEBUGr Zinitialize_loggingr“ r Zclear_all_cacheZset_patch_levelr\ r rÊ Zset_sticky_patchr» Z nosignaturer Z no_check_certrõ rx ry rl Z edf_enabledÚwarningsÚwarnÚDeprecationWarningZ edf_disabledr! ZPREV_PATCH_TYPEZset_patch_typer™ r— r" rž ÚEXPECTED_PREFIXrs rW r¨ r9 Zlocalr` Z PATCH_SERVERrÍ râ Zapp_infor ra rC ZdoctorrÅ rØ Zenable_auto_updateZdisable_auto_updateZ set_configZupdate_config_from_argsZset_monitoring_keyrÌ Z unregisterr ÚregisterZregister_autoretryrÓ r½ r rá rZ r[ r Zset_libcare_statusrì Zuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updater Zlib_auto_updaterÏ Z lib_unloadZlibcare_unloadZlib_infor7 Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updaterî ÚlistZ USERSPACE_MAPÚkeysÚsortedZuserspace_auto_updaterÙ r6 Znofreezer• Z smart_updaterÑ rÐ Z UPDATE_POLICYrÓ r rÕ rš r¶ r³ ZCHECK_CLN_LICENSE_STATUSrq rr ÚrandomZuniformrA ZstatusrÞ Zlatest_patch_inforD Zcheckr1 rÿ Úargvr9 )ZparserZexclusive_grouprµ r³ rð r• r3 r3 r4 Úmain` s: üýÿÿýýÿüýúÿû ÿ ÿ ÿÿÿûý r )N)N)F)F)N)rD F)rD F)r )¬Z __future__r rd ra rø r( r© r rÜ r„ ræ ZsslrL rÄ rq rK rû Zargparser r Ú contextlibr rD r r r r r r r r r r r r r r r r r r Zpy23r r r r r r r r rË rÆ rþ r+ rà r rT r² rß ÚDOTALLr& rb r) r¨ ÚinsertÚfilterwarningsrý ÚOptionalÚDictÚTupleÚAnyÚUnionÚSetrs ZsetLevelrú r5 r< rC r_ rh rx rƒ rŽ r“ rš r r¡ r r¢ r¥ r® r~ rÌ rÏ rØ rÞ râ rä ré rò ró r[ Zdistutils.versionZ distutilsZ OpenSSL.SSLrô rá Z StrictVersionÚ __version__Ú ImportErrorrê ZHTTPSConnectionZPureHTTPSConnectionÚobjectrë rñ r rÓ r r r r r1 r9 rD r3 rF rA rM rP rY ra re rf rh rk rl rr rw r{ r r~ rˆ r‡ rŽ r‘ r’ r– r£ r rŸ rˆ r¯ r¶ r6 r· r. rÑ r rÅ rÇ r= r‹ rÍ rÑ rÔ rÕ rþ rã r÷ r r3 r3 r3 r4 Ú<module> s & 4 a # ? , 2 %7 , 3)