/
usr
/
libexec
/
kcare
/
python
/
kcarectl
/
Upload File
HOME
� �;jc @ s� d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z m Z m! Z! m" Z" m# Z# m$ Z$ m% Z% m& Z& m' Z' m( Z( m) Z) m* Z* m+ Z+ d d l m, Z, m- Z- m. Z. d d l/ m0 Z0 m1 Z1 m2 Z2 m3 Z3 m4 Z4 d Z5 d Z6 dy Z7 d Z8 d Z9 dz Z: d Z; d Z< e j= d e j> � Z? e j= d � Z@ e jA jB d � r<e jA jC d d � n e jD d d eE �eF r�d d lG mH ZH mI ZI mJ ZJ mK ZK mL ZL mM ZM n e$ jN jO e jP � d � ZQ d � ZR d � ZS d � ZT d! � ZU d d" � ZW d# � ZX d$ � ZY d% � ZZ d& � Z[ d' � Z\ d( � Z] d) e^ f d* � � YZ_ d+ e, f d, � � YZ` d- e, f d. � � YZa d/ e, f d0 � � YZb d1 � Zc e d2 � � Zd d d3 � Ze d4 � Zf d5 � Zg i Zh d6 � Zi ei e2 jj _k el e d7 d � svyR d d lm Zn d d lo Zp en jq jr ep js � en jq jr d8 � k ret d9 � � n Wn et k r(qvXd: � Zu e2 jv Zw d; ex f d< � � YZy d= e2 jv f d> � � YZz ez e2 _v n d? � Z{ e j| d@ � Z} dA � Z~ dB � Z dC ex f dD � � YZ� dE � Z� dF � Z� eF dG � Z� dH � Z� dI � Z� eF dJ � Z� dK � Z� dL � Z� dM � Z� dN � Z� dO � Z� dP � Z� dQ � Z� dR � Z� dS � Z� dT � Z� dU � Z� dV � Z� dW � Z� dX � Z� dY � Z� dZ � Z� d d[ � Z� d\ � Z� d] � Z� d^ � Z� d_ � Z� d` eF da � Z� db � Z� dc � Z� dd � Z� de � Z� e& j� d` eF df � � Z� dg � Z� dh � Z� di d{ dj � � YZ� dk � Z� dl � Z� dm � Z� dn � Z� e j� e j| do � Z� dp � Z� e& j� e* j� dq � e j� dr � � � Z� ds � Z� dt � Z� du � Z� d dv � Z� dw � Z� dx � Z� d S(| i����( t print_functionN( t ArgumentParser( t contextmanager( t datetimei ( t anomalyt autht capabilitiest configt config_handlerst constantst doctort errorst fetcht http_utilst ipv6_supportt kcaret libcaret log_utilst platform_utilst process_utilst selinuxt server_infot serveridt update_utilst utils( t KcareErrort NotFoundt SafeExceptionWrapper( t HTTPErrort URLErrort httplibt json_loads_nstrt urlencodeic t v3t 12ht 24ht 48ht tests. /etc/sysconfig/kcare/freezer.modules.blacklists /usr/libexec/kcare/kcdoctor.shs latest.v3s latest.v2s /etc/sysconfig/kcare/sysctl.confi s$ ==BLACKLIST== (.*)==END BLACKLIST== s' (kpatch.*|ksplice.*|kpatch_livepatch.*)s /usr/libexec/kcare/pythoni t ignoret category( t Anyt Dictt Optionalt Sett Tuplet Unionc C s_ t � } t j j t � r[ t t d � } x! | D] } | j | j � � q1 W| j � n | S( Nt r( t sett ost patht isfilet FREEZER_BLACKLISTt opent addt rstript close( t resultt ft line( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_blacklistS s c C sY | j d � } | r8 d j | d | | d g � } n d j | d | d g � } | S( Nt .i i����( t splitt join( t ptypet filenamet name_parts( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _apply_ptype] s # c C sm t | t j � t _ t | t j � t _ t | t j � t _ t | t j � t _ t | t j � t _ d S( N( RB R t PATCH_BINt PATCH_INFOt BLACKLIST_FILEt FIXUPS_FILEt PATCH_DONE( R? ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_ptypef s c C s� t j � \ } } } d } t | t � r� t | t � r� y) d | j t j | j � | j f } Wq� t t f k r| q� Xnu t | t t t f � r� t | t � r� d | } n@ t | t � r� | j p� t | j � } | j p� d | j } n t j � } i t j d 6t j � d 6| d d 6| d d 6t | d t | � � d 6| d 6d j t j | d � � d 6t | d d � d 6S( Nt s [Errno %i] %s: '%s's %st agent_versiont python_versioni t distroi t distro_versiont __name__t errort detailsid t tracebackt attempts( t syst exc_infot isinstancet OSErrorR t errnoR0 t strerrorR@ t AttributeErrort TypeErrort KeyErrort IOErrorR t etypet typet innerRP R t get_distroR t VERSIONt get_python_versiont getattrt strR> RQ t format_tb( R] t valuet tbt details_sanitizedRL ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt format_exception_without_detailsn s, )( c C s� t j r d St j t � � } t j t j t j | � � � } t j d � d | } t j | t j � � } y t j | � Wn t k r� n Xd S( Ns /api/kcarectl-traces ?trace=( R t UPDATE_FROM_LOCALt jsont dumpsRi R t nstrt base64t urlsafe_b64encodet bstrt get_patch_server_urlR t http_requestR t get_http_auth_stringt urlopen_baset Exception( t tracet encoded_tracet urlt request( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt send_exc� s ! c C s t j � } | d k r, t j | d � d St j � t j � } | d k r^ t j d � n t j d � t t j d � �3 } t j | j � d � t j | j � d � Wd QX| r� t j | � n y | � Wn. t k rt j j d � t j d � n Xt j d � d S( s� Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: i Nt ai i s Wait exception( R0 t forkt waitpidt setsidt _exitR7 R4 R t LOG_FILEt dup2t filenot timet sleepRu R t kcarelogt exception( t funcR� t pidt fd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt nohup_fork� s( c C s� t j j t j d � } t j j | � r� t | d � �\ } yA t | j � � } | t j t j � k r| t | | � � n Wn t k r� n XWd QXn t j | t j � � d S( s Check the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. s .kcareprev.lockR. N( R0 R1 R> R t PATCH_CACHER2 R4 t intt readR t SUCCESS_TIMEOUTR� t PreviousPatchFailedExceptiont ValueErrorR t atomic_writet timestamp_str( t anchor_filepatht afilet timestamp( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt touch_anchor� s c C s� y# t j t j j t j d � � Wn t k r6 n Xt d | � t j j � y t d d � Wn! t k r� t j j d � n Xd S( s� See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. s .kcareprev.lockt donet reasons Cannot send update info!N( R0 t removeR1 R> R R� RV t register_actionR t get_loaded_modulest cleart get_latest_patch_levelRu R R� R� ( t state_data( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt commit_update� s # c C s8 t j t j j t j d � d t j | | d � �d S( Nt patchest exclude_pathRI ( R t clean_directoryR0 R1 R> R R� R t get_cache_path( t khasht plevel( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt clear_cache� s c C s\ t j p d } d j | | g � } t j d | f } | rL | | f 7} n t j j | � S( Nt nonet -t modules( R t PREFIXR> R R� R0 R1 ( R� t fnamet prefixt module_dirR8 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_current_level_path� s c C s) t j t | d � t | � d t �d S( Nt latestt ensure_dir( R R� R� Rd t True( R� t patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt save_cache_latest� s c C sw t | d � } t j j | � rs y5 t t | d � j � j � � } t j | | � SWqs t t f k ro qs Xn d S( NR� R. ( R� R0 R1 R2 R� R4 R� t stripR t LegacyKernelPatchLevelR� RZ t None( R� t path_with_latestt pl( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_cache_latest� s !t CertificateErrorc B s e Z RS( ( RN t __module__( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s t UnknownKernelExceptionc B s e Z d Z d � Z RS( s unknown kernelc K sH d j t j � d t j � t j � � } t t | � j | | � d S( NsL New kernel detected ({0} {1} {2}). There are no updates for this kernel yet.i ( t formatR R` t platformt releaseR t get_kernel_hasht superR� t __init__( t selft kwargst msg( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s %( RN R� t statusR� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s t ApplyPatchErrorc B s e Z d Z d � Z d � Z RS( s patch apply errorc O sc t t | � j | | � | | _ | | _ | | _ | | _ t j � d | _ t j � | _ d S( Ni ( R� R� R� t codet freezer_stylet levelt patch_fileR R` RL R� R� ( R� R� R� R� R� t argsR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s c C sP d j | j | j | j | j | j d j g | j D] } t | � ^ q4 � � S( Ns0 Unable to apply patch ({0} {1} {2} {3} {4}, {5})s , ( R� R� R� R� RL R� R> R� Rd ( R� t i( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt __str__& s ( RN R� R� R� R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s R� c B s e Z d Z d � Z d � Z RS( s previous patch failedc O s/ t t | � j | | � | | _ | | _ d S( N( R� R� R� R� t anchor( R� R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� 5 s c C s d } | j | j | j � S( Ns� It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file( R� R� R� ( R� t message( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� : s ( RN R� R� R� R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� 2 s c C s� t j � d j | � } y� t j | � } t j t j | j � � � } t | d � } | d k ru t j d � nN | d k r� t j d � n2 | d k r� t j d � n t j d j | � � | SWn# t k r� } t j | | � n Xd S( Ns" /nagios/register_key.plain?key={0}R� i s Key successfully registeredi s Wrong key format or sizei s! No KernelCare license for that IPs Unknown error {0}i����( R t get_registration_urlR� R t urlopenR t data_as_dictRm R� R� t print_wrapperR R t print_cln_http_error( t keyRx t responset resR� t e( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt! set_monitoring_key_for_ip_licenseC s c c sU t j r" t j t j d t �n z d VWd t j rP t j t j d t �n Xd S( Nt shell( R t BEFORE_UPDATE_COMMANDR t run_commandR� t AFTER_UPDATE_COMMAND( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt execute_hooksW s c C sB t � } | j } | j } t j � } | d k r� i t | � d 6t j d 6t j � d 6t j � d 6| d 6t t j � � d 6| d 6} t j d � t j t j | � � n� t j d � t j t | � � t j d t | � � t j t j � t j t j � � t j t j � � t j | � t j t j � � d S( s1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: Rk t updateCodet autoUpdatet effectiveKernelt realKernelt loadedPatchLevelt uptimet licenses --START--s LICENSE: N( t _patch_level_infoR� t applied_lvlR t license_infoRd R t AUTO_UPDATER t kcare_unameR� R� R� R t get_uptimeR R� Rk Rl ( t fmtt plit update_codet loaded_plt license_info_resultt results( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt plugin_infoc s. c C su t j � } y t d d � } Wn t k r@ t j r< d Sd SX| d k rQ d S| | k ra d St j � rq d Sd S( NR� t infoi i i i ( R t loaded_patch_levelR� R� R t IGNORE_UNKNOWN_KERNELR� R t status_gap_passed( t current_levelt latest_patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_update_status� s c C s= t j � d \ } } | d k r5 | j d � r5 d Sd Sd S( Ni t CloudLinuxs 7.t extraRI ( R R` t startswith( RL t version( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edf_fallback_ptype� s c C s� | j | j f } t j | | � } t j | | j � | _ | j j t j t j d � | t k r~ | j j � d t | <n | j r� | j � n d S( s� Function remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect i i N( t hostt portt CONNECTION_STICKY_MAPt gett sockett create_connectiont timeoutt sockt setsockoptt IPPROTO_TCPt TCP_NODELAYt getpeernamet _tunnel_hostt _tunnel( R� t addrt resolved_addr( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt sticky_connect� s t HAS_SNIs 0.13s% No pyOpenSSL module with SNI ability.c G s t S( N( R� ( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt dummy_verify_callback� s t SSLSockc B s, e Z d � Z d � Z d � Z d � Z RS( c C s | | _ d | _ d S( Ni ( t _ssl_connt _makefile_refs( R� R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s c G s( | j d 7_ t j | j d t | �S( Ni R7 ( R R t _fileobjectR R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt makefile� s c C s0 | j r, | j r, | j j � d | _ n d S( N( R R R7 R� ( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR7 � s c G s | j j | � S( N( R t sendall( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s ( RN R� R� R R7 R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s t PyOpenSSLHTTPSConnectionc B s e Z d � Z RS( c C s t j j | � t j j t j j � } | j t j j t j j B� t j rg | j t j j t � n | j t j j t � | j � t j j | | j � } | j � | j p� | j } | j | j � � | j � t j r� t | j � | � n t | � | _ d S( N( R t HTTPConnectiont connectt OpenSSLt SSLt Contextt SSLv23_METHODt set_optionst OP_NO_SSLv2t OP_NO_SSLv3R t CHECK_SSL_CERTSt set_verifyt VERIFY_PEERR t VERIFY_NONEt set_default_verify_pathst ConnectionR t set_connect_stateR R t set_tlsext_host_namet encodet do_handshaket match_hostnamet get_peer_certificateR ( R� t ctxt connt server_host( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s ( RN R� R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s c C sN t j r7 t j | | � } t j t j � | d t �S| d k } t j oO | } x�t | f t | f t t f g D]�\ } } t j | d | d | �} t j | d | �} | r� d j | � } n t j | t | | � � d | } d } | s� | r=t | � | k r=| rd n d } t j d j | � � qt n y� t j t j � | d t �} t j r�t j | � r�t j | � } t j | � } | r�t j d j | � d t �n t j d d t �| r�| j � q�n | SWqt t k rE} | s| r?| j d k s#| j d k r?t j d j | � � qt n � qt Xqt Wd S( Nt check_licenses latest.v1s latest.v2t secure_boot_infot perf_metricst b64_encodings info={0}t ?iX s secure boot infos perf metricss/ Check-in URL param is too large, discarding {0}s: Automatic kernel anomaly report uploaded successfully: {0}t print_msgs$ Failed to send kernel anomaly reporti� i� i� sC Check-in request failed with error: {0}, retrying with reduced info( s latest.v1s latest.v2( i� i� ( R Rj R t get_kernel_prefixed_urlR t wrap_with_cache_keyR t urlopen_autht Falset SEND_PERF_METRICSR� R t encode_checkin_payloadR� t stickyfyt lenR t logwarnt KERNEL_ANOMALY_REPORT_ENABLER t detect_anomalyt prepare_kernel_anomaly_reportt send_data_packaget loginfot remove_archiveR R� ( R� R� R� t modeRx R5 t perf_enabledR3 R4 t sinfot request_paramt max_url_lengtht discard_infoR8 t data_packaget upload_namet ex( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _fetch_patch_level_request sB .# *c C s� t j � } t j d k r4 t j | t t j � � SxKt D]C} y� t | | | | � } t j | j � t � t j | j � � j � } t j d j | | � d t �| r | j d � r t | � } | j d g � } t j | � s� t j d � � n t j | | d | d | d � St j | t | � � SWq; t k rJq; t k r}} | j d k rwt d � � n � q; Xq; Wt! � � d S( Ns; fetch patch level, reason: {0}, kernel latest response: {1}R7 t {R se Latest KernelCare patchset is incompatible with the current kernecare package version, please upgradeR� t baseurlR� i� i� s KC licence is required( i� i� (" R R� R t PATCH_LEVELR� R� R� t PATCH_LATESTRP R t set_feature_flags_from_headerst headerst update_all_kmod_paramsR Rm R� R� R RE R� R; R� R R R t has_kc_capabilitiesR t CapabilitiesMismatcht KernelPatchLevelR R R� R R� ( R� RG R� R� R� R� t latest_infot required_capabilitiesRO ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_patch_level; s2 " c C so | j t | t j � � } t j j d j | � � y! t j | d t d d �t SWn_ t k r� t j j d j | � � t St k r� } t j j d j | t | � � � n X| j t | t j � t j � } t j j d j | � � y t j | d t �Wn_ t k r6t j j d j | � � t St k rj} t j j d j | t | � � � n Xt S( Ns Probing patch URL: {0}R2 t methodt HEADs {0} is not available: 404sF HEAD request for {0} raised an error, fallback to the GET request: {1}s {0} is not available: {1}( t file_urlRB R RC R R� R� R� R R: R; R� R Ru t debugRd R t SIGR ( R� R? t bin_urlRO Rx ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt probe_patch\ s( &" &c C sg | t j k r$ | j t j � } n | j | � } | j | � } t j | | t j d t j | � �S( Nt hash_checker( R t KMOD_BINt kmod_urlR` t cache_pathR t fetch_urlR t USE_SIGNATUREt get_hash_checker( R� t nameRx t dst( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_and_verify_kernel_fileu s t PatchFetcherc B sA e Z d d � Z d � Z d � Z d � Z d � Z d � Z RS( c C s | | _ d S( N( R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s c C s t | j | � S( N( Rn R� ( R� Rl ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _fetch� s c C s� | j j t j � } | j j t j � } | j j t j � } | j j t j � } t d � | | | | f D� � o� t j j | � d k o� t j j | � d k S( Nc s s! | ] } t j j | � Vq d S( N( R0 R1 R2 ( t .0R1 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s i ( R� Rh R RG RC RD R Rf t allR0 R1 t getsize( R� t patch_done_patht patch_bin_patht patch_info_patht kmod_bin_path( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt is_patch_fetched� s "c C s� | j d k r t d � � n | j s. | j S| j � rN t j d � | j St j d � t | j t j � r� y( t j | j j t j � d d �} Wn t k r� q� X| j j d d � } | r� | j j t j | � � | _ q� n y | j t j � Wn; t k r<t d j | j t j p*d � d d �� n X| j t j � | j t j � | j � t j | j j t j � d d d �t j t j! � | j S( Ns+ Cannot fetch patch as no patch level is sets Updates already downloadeds Downloading updatesR^ R_ s KC-Base-Urlsf The `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch levelt defaultR� s patch level not foundRI RG t wb(" R� R� R� Rx R RE RU R R� R R: R` R RC R RV R t upgradeR Rm Rp R R� t PATCH_TYPERD R Rf t extract_blacklistR� Rh RG R t restore_selinux_contextR� ( R� t respRR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_patch� s: ( $ %c C sq t | j j t j � d � j � } | rm t j | � } | rm t j | j j t j � | j d � � qm n d S( NR. i ( R4 R� Rh R RD R� t BLACKLIST_REt searchR R� RE t group( R� t buft mo( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR} � s $c C s� | d k r d Sy t | t j � } Wn t k r: d SX| j j d d � } | rq | j t j | � � } n | j t j � } t | d � �2 } t g | j � D] } | j � ^ q� � } Wd QXx | D] } t | | � q� Wt j t j � d S( s� Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Ns KC-Base-UrlR. ( R� Rn R RF R RV R R{ R Rm Rh R4 R/ t readlinesR� R R~ R R� ( R� R� R RR t fixups_fnameR9 t fixupt fixups( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_fixups� s 1 N( RN R� R� R� Rp Rx R� R} R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRo ~ s ) c C sL t � } t j | j � | j t j k r; t j d � n t j d � d S( Ni i ( R� R R� R� R� t PLIt PATCH_NEED_UPDATERS t exit( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_check� s c C s t � } t | � } y t j � } Wn t k r> i } n Xt j � } d } | d k r| t j | d � j d � } n t j � } | j d g � } t t j | d d �� } t | � } g | D]% } | j d g � D] } | ^ q� q� } t t j | d d �� } t d � | D� � } | | } t j � } | sPt j d � n t j d � t j d j | � � t j d j | � � | d k r�t j d j | � � n | d k r�t j d j | � � n | d k r�t j d � n t j d � d S( Nt Unknownt tss %Y-%m-%dR� t cve_fields kpatch-cvet cvec s s' | ] } t | j d g � � Vq d S( R� N( R? R ( Rq t rec( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s s$ KernelCare live patching is disableds" KernelCare live patching is actives - Last updated on {0}s - Effective kernel version {0}i s* - {0} kernel vulnerabilities live patcheds- - {0} userspace vulnerabilities live patcheds% - This system has no applied patchess( Type kcarectl --patch-info to learn more( R� t _kcare_patch_info_jsonR t libcare_patch_info_basicR R t get_stateR� R t fromtimestampt strftimeR� R R? R t extract_unique_cvest sumR� R� R� ( R� t kcare_infot libcare_infot statet latest_updatet effective_versiont kernel_patchest kernel_vulnerabilitiest kernel_patches_countR� t patcht userspace_patchest userspace_vulnerabilitiest userspace_patches_countt total_patches_countR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt show_generic_info� s> 2 c C s: y� t d d d t j � } | s* t � n | j t j � } t j t j | � j � � } | r� g i } } xU | j d � D]D } t j | � } | r� d | k r� | j | � q} | j | � q} W| | d <t j | � } n t j | � WnD t k r} t j | | j � d St k r5t j d � n Xd S( s� Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None R� R� t policys s kpatch-nameR� i s No patches availablei ( R� R t POLICY_REMOTER� R` R RD R Rm R R: R� R= R� t appendt updateRk Rl R� R R R� Rx ( t is_jsonR� Rx t patch_infoR� R8 t chunkt dataR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_latest_patch_info s, c C s� i | j d 6} | j d k r� t | � } g } xU | j d � D]D } t j | � } | rx d | k rx | j | � qA | j | � qA W| | d <t j � } | r� | d n d | d <n | S( NR� s s kpatch-nameR� R� t unknown( R� R� R� t _kcare_patch_infoR= R R� R� R� R t read_dumped_kernel_patch_level( R� R8 R� R� R� R� t saved_patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� 4 s c C s� t j � } t j | | j t j � } t j j | � sN t d d d �� n t | d � j � } | r~ t j d | � } n | S( Nsv Can't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.R� s patch info not foundR. RI ( R R� R� R� R RD R0 R1 R2 R R4 R� R� t sub( R� R� Rh R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� H s c C s� t � } | sZ | j d k r1 t j | j � n | j d k rD d St j t | � � n" t j t j t | � d t �� d S( Ni t sort_keys( R� R� R R� R� R� R� R� Rk Rl R� R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� W s c C sU t j d | g } t j | � } t j � } d } t j | | � t j | | � k S( Ns file-infos kpatch-build-time( R t KPATCH_CTLR t check_outputR t _patch_infot get_patch_value( t new_patch_fileR� t new_patch_infot current_patch_infot build_time_label( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt is_same_patchc s c C sh | d k r t S| r& | | k r& t S| | k r6 t St j t j � | t j � } t | � sd t St S( Ni ( R; R� R R� R� R RC R� ( t applied_levelt new_levelR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_need_updatek s c C s� t j r� t j j t � o- t j t t j � sM t j j d j t � � d St j d d d t g d t �\ } } } | d k r� t j j d j | � � q� n d S( Ns- File {0} does not exist or has no read accesss /sbin/sysctls -qs -pt catch_stdouti s% Unable to load kcare sysctl.conf: {0}( R t UPDATE_SYSCTL_CONFIGR0 R1 R2 t SYSCTL_CONFIGt accesst R_OKR R� t warningR� R R� R� ( R� t _( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt update_sysctl} s '* c s� t j j t � s( t t d � j � n t j t t j � sZ t j j d j t � � d St t d � �� } | j � } | j d � x: | D]2 � t � f d � | D� � s� | j � � q� q� Wx | D] } | j | d � q� W| j � Wd QXd S( s* Update SYSCTL_CONFIG accordingly the editsR{ s File {0} has no read accessNs r+i c 3 s | ] } � j | � Vq d S( N( R� ( Rq R. ( R: ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s s ( R0 R1 R2 R� R4 R7 R� R� R R� R� R� R� t seekt anyt writet truncate( R� R� t sysctlt linesR{ ( ( R: s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edit_sysctl_conf� s c C sB x; | D]3 } t j | � r t d j | � d d �� q q Wd S( NsD Detected '{0}' kernel module loaded. Please unload that module firstR� s conflicting kernel module( t CONFLICTING_MODULES_REt matchR R� ( R� t module( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt detect_conflicting_modules� s c C s d j t j � � S( Ns /lib/modules/{0}/extra/kcare.ko( R� R t get_system_uname( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kcare_kmod_link� s c C ss t d d � } t j t j � | t j � } t j j | � sC d St | d � � } | j � d d k SWd QXd S( NR� R� t rbi��s ~Module signature appended~ ( R� R R� R� R Rf R0 R1 R2 R� R4 R� ( R� t kmod_filet vfd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kmod_is_signed� s c sE t j d � � � d k r d Sd d g } t � f d � | D� � S( Ns /proc/keyst( 12ff0613c0f80cfba3b2f8eba71ebc27c5a76170t( 69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ] } | � k Vq d S( N( ( Rq R� ( t system_keys( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s ( R t try_to_readR� R� ( t kcare_keys( ( R� s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_certs_enrolled� s c K s� d | g } x3 | j � D]% \ } } | j d j | | � � q Wt j | d t �\ } } } | d k r� t d j | | � d d �� n d S( Ns /sbin/insmods {0}={1}R� i sL Unable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.R� s kmod load error( t itemsR� R� R R� R� R ( t kmodR� t cmdR� Rf R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kmod� s c C s� t j � rK t � t k r* t d � � n t � t k rK t d � � qK n t j � so t j � so t j � r� t d d d �� n d S( Ns4 Secure boot is enabled. Not supported by KernelCare.s< Secure boot is enabled. No KernelCare certificates enrolled.sW You are running inside a container. Kernelcare should be executed on host side instead.R� s running in container( R t is_secure_bootR� R; R R� t inside_vz_containert inside_lxc_containert inside_docker_container( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_compatibility� s $c C sv t j d � } t j | d g d t d t �d d k } | rr | d k rr t j d j | � � t j d � n d S( Nt modinfot kmodlveR� t catch_stderri t freeR� s3 {0} patch type conflicts with kmodlve kernel modulei ( R� s extra( R t find_cmdR� R� R t logerrorR� RS R� ( R? R� t has_kmodlve( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_patch_type_compatibility� s +c C ss t j d d d | g � } g } xK | j d � D]: } | j � r1 | j d � \ } } } | j | � q1 q1 W| S( Ns /sbin/modinfos -Ft parms t :( R R� R= R� t partitionR� ( t kcare_linkt stdoutt available_paramsR: t param_nameR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kmod_available_params� s c C s� i t j r d n d d 6t j r( d n d d 6t j rA t j n d d 6t t j t � rc t j n d d 6t j ry d n d d 6S( Ni i t kpatch_debugt kmsg_outputt kcore_outputRI t kdumps_dirt enable_crashreporter( R t KPATCH_DEBUGt KMSG_OUTPUTt KCORE_OUTPUTt KCORE_OUTPUT_SIZERU t KDUMPS_DIRRd t ENABLE_CRASHREPORTER( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt make_kmod_new_params� s "c C sc t j r2 t j j t j � r2 t j t j � n x* t � j � D] \ } } t | | � qB Wd S( N( R R R0 R1 t existst makedirsR R� t update_kmod_param( t paramt val( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRW � s c C s� d } t j j | | � } t j j | � s1 d Sy/ t | d � � } | j t | � � Wd QXWn' t k r� t j j d | | � n Xd S( Ns /sys/module/kcare/parameterst ws! failed to set %s kmod param to %s( R0 R1 R> R R4 R� Rd Ru R R� RO ( t kmod_param_namet param_valuet params_roott param_pathR9 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s c s� t � } t j | | t j � } y t j | | � Wn t k rN | } n Xt j r� t j j t j � r� t j t j � n t � } t | � � t � f d � | j � D� � } t | | � t � d S( Nc 3 s- | ]# \ } } | � k r | | f Vq d S( N( ( Rq t kt v( t available_kmod_params( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>! s ( R� R R� R Rf t shutilt copyRu R R R0 R1 R R R R� t dictR� R� t update_depmod( R� R� R� t kcare_filet kmod_params( ( R s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kcare_kmod s " c C s� d g } | d k r+ | j d | g � n t j | d t d t �\ } } } | r� t j d j d j | � | | � d t �n d S( Ns /sbin/depmods -aR� R� s% Running of `{0}` failed with {1}: {2}t R7 ( R� t extendR R� R� R R� R� R> R; ( t unameR� R� R� t stderr( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR ' s $c C sU t j d | g d t �\ } } } | d k rQ t d j | | � d d �� n d S( Ns /sbin/rmmodR� i s Unable to unload {0} kmod {1}R� s kmod unload error( R R� R� R R� ( t modnameR� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt unload_kmod3 s $ c C su g } xh d g | D]Y } t j | | d j | � � } t j j | � r t | � | j d j | � � q q W| S( Nt vmlinuxs fixup_{0}.kos fixup_{0}( R R� R� R0 R1 R R� R� ( R� R� R� t loadedt modt modpath( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_fixups9 s c C sK xD | D]< } y t | � Wq t k rB t j j d | � q Xq Wd S( Ns$ Exception while unloading module %s.( R! Ru R R� R� ( R� R$ ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt remove_fixupsC s c C s� | r | } nM t j r$ t j } n8 t � j | � rI d | t j t f Sd | t j t f Si d d 6d d 6d d 6d d 6d d 6} | j � } | | k r� | | } n' t d j | | t j t � d d �� | | t j t f S( Nt freeze_conflictRy t freeze_nonet NONEt NOFREEZEt freeze_allt FULLt FREEZEt SMARTs3 Unable to detect freezer style ({0}, {1}, {2}, {3})R� s freezer style detection error( R t PATCH_METHODR; t intersectionR� R; t upperR R� ( t freezerR� R^ t patch_method_map( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_styleK s( RI c sZ i | d 6| d 6| d 6� t d � � t j � } t j � } t | � t | | � } t j | | t j � } t | | � d j | t j t j � t j | � � } d | k } | o� t j | | � } | d k } | o� t | � o� t j | � } � j i | d 6| d 6� | r+t d � � d S| r�t d � � t | | | � } t d � � t | � t d � � t | � n | r�t d � � t d � t } n | s�t d � � t | | � n | r�t � n t d � � t | | | | | � t � t j d j | t j � � � t j! � t d � � t" � f d � d t j# �d S( NR� t futureRG t starts {0}-{1}:{2};{3}R t currentt kmod_changedR� t fxpt unpatcht unfxpt unloadt loadR� s5 Patch level {0} applied. Effective kernel version {1}t waitc s t � � S( N( R� ( ( R� ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt <lambda>� s R� ($ R� R R� R� R� R5 R� R RC R� R� R| R R� t parse_unamet is_kmod_version_changedR� R� t kcare_update_effective_versionR� R& t kpatch_ctl_unpatchR' R! R; R R� t kpatch_ctl_patchR� R RE R� R t touch_status_gap_fileR� R� ( R� R� RG R3 t use_anchorR� R� R� R� t descriptiont kmod_loadedR9 t patch_loadedt same_patchR� ( ( R� s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_loadm sR $ ! c C s� t j g } t j | | t j � } t j j | � rL | j d | g � n | j d d | g � | j d | d g � | j | � t j | d t �\ } } } | d k r� t | | | | � � n d S( Ns -bR� s -ds -mi R� ( R R� R R� R RE R0 R1 R R R� R R� R� R� ( R� R� R� RH R� R� t blacklist_fileR� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRE � s c C s� t j t j d d | d g d t d t �\ } } } | d k r� t j d j | | � d t �t d j | t | � � d d �� n d S( NR; s -mi R� R� s4 Error unpatching, kpatch_ctl stdout: {0} stderr: {1}R7 s Error unpatching [{0}] {1}R� s unpatch error( R R� R R� R� R R� R� R; R Rd ( R� R� R� R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRD � s 1 c C sL | | d <t t j � � | d <t j t j j t j d � t | � � d S( Nt actionR� s kcare.state( R� R� R R� R0 R1 R> R R� Rd ( RN R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s c C s� d } t j j | � s d Sx t j | � D]n } t j j | | d d � } t j j | � se q, n t j | � } | | k r, t j | � t | � q, q, Wd S( Ns /usr/lib/modules/s weak-updatess kcare.ko( R0 R1 t isdirt listdirR> t islinkt readlinkt unlinkR ( t kmod_linkt modules_patht entryt sym_link_patht target_path( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt update_weak_modules� s c C s� t j � } t � } y | j | � Wn7 t k r_ } | s` t d j | � d d �� q` n Xt j � } t | | � } t � �7d | k r�| d k } | rQt t j � | | � } t j t j d d | d g d t d t �\ } } } t | � | d k rQt j d j | | � d t �t d j | t | � � d d �� qQn t j t j t � d d d t �t � d � n t � } t j j | � r�t j! | � n t" | � Wd QXd S( Ns� Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.R� s fixups retrieval errorR R; s -mi R� R� s4 Error unpatching, kpatch_ctl stdout: {0} stderr: {1}R7 s Error unpatching [{0}] {1}s unpatch errort counti t delay(# R R� Ro R� Ru R R� R� R5 R� R� R& R� R R� R R� R� R' R R� R; Rd R t retryR t check_exct UNLOAD_RETRY_DELAYR! R� R0 R1 R2 RS RY ( R3 t forceR� t pft errR� R� t need_unpatchR� R� R� R RT ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_unload� s: 1 *1 c C sL t � } | r t | � S| j d k r/ | j S| j d k rH t j � Sd S( Ni ( R� t _kcare_info_jsonR� R� R� R� R R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s c C sw i | j d 6} | j d k r] | j t j t j � � � | j t j | j d � � � n | j | d <t j | � S( NR� s kpatch-descriptions kpatch-state( R� R� R� R� R R� R R� t parse_patch_descriptionR R� Rk Rl ( R� R8 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRd s " R� c B s) e Z d Z d Z d Z d Z d � Z RS( i i i i c C s1 | | _ | | _ | | _ | | _ | | _ d S( N( R� R� t remote_lvlR� R� ( R� R� R� Rf R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� % s ( RN R� RT R� t PATCH_UNAVALIABLEt PATCH_NOT_NEEDEDR� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s c C sU t j � } y� t d d � } | rg t | | � rM t j d d } } } q� t j d d } } } n= | d k r� t j d d } } } n t j d d } } } t | | | | | � } Wn� t k rPt j } t j r d j t j t j � d t j � � } n+ d j t j � d t j � t j � � } t | | d d d � } n X| S( NR� R� s* Update available, run 'kcarectl --update'.t applieds The latest patch is applied.i s( This kernel doesn't require any patches.t unsetsD No patches applied, but some are available, run 'kcarectl --update'.su Invalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingssL New kernel detected ({0} {1} {2}). There are no updates for this kernel yet.t unavailable( R R� R� R� R� R� RT Rh R� Rg R t STICKY_PATCHR� R R` R� R� R� R� ( t current_patch_levelt new_patch_levelR� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� - s8 %% c C s� d } y� t j � } t d | f d | f g � } t j � d j | � } t j | � } t j t j | j � � � } t | d � SWnp t k r� } t j | | � d St k r� } t j | | � d St k r� } t j d j | � � d SXd S( s� Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise t server_idt tags /tag_server.plain?{0}R� i����i����s Internal Error {0}i����N( R� R t get_serveridR R R� R� R R� R R� Rm R� R� R R R� R Ru R� ( Rp Rx Ro t queryR� R� R� t uet ee( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt tag_server_ s" c C s t j d � } t j d j | � � t } t j � �� } yQ t j | | j � } t j t j | � | j � t j | j | � | j } Wn) t k r� } t j d j | � � n Xt j d | t j � g d t �\ } } } | r t d j | | � d d �� n Wd QXd S( Ns doctor.shs# Requesting doctor script from `{0}`s3 Kcare doctor error: {0}. Fallback to the local one.t bashR� s Script failed with '{0}' {1}R� s doctor script failed( R Rq R t logdebugR� t KCDOCTORt tempfilet NamedTemporaryFileR t fetch_signatureRl t save_to_fileR R� t check_gpg_signatureRu R� R R� R t get_patch_serverR� R ( t doctor_urlt doctor_filenamet doctor_dstt signatureRa R� R� R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcdoctorz s -c C sO t j d j t � � } y t j | � Wn t k r= t SXt j d � t S( Ns {0}-new-versionsw A new version of the KernelCare package is available. To continue to get kernel updates, please install the new version( R Rq R� t EFFECTIVE_LATESTR R� R R; R RE R� ( Rx ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_new_kc_version� s c C sY t j � } t | � } | t j k p? | t j k o? | d k } y t | | � } Wn� t j k r� } | d k r| � n t j t | � � t j d � t j } n8 t k r� } | r� � q� t j j d j | � � n X| t j k r� | } n] | } | d k rU| t j k r.t j | d � } qU| t j k rF| } qUt d � � n | S( s� Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string s# Using previously downloaded patchess Unable to send data: {0}i s9 Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRSTN( R R� R� R R� t POLICY_LOCAL_FIRSTR� R] R RY R R@ Rd t POLICY_LOCALRu R� R� R� R� R ( R� R� RG R� t cached_levelt consider_remote_ext remote_levelR� RO R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s2 * c C s� | d k r d S| d k r" d n | t _ t t d d � t j � r� t j d t j � t j d k r� t j � r� t j p� t } t d d d j | � f � n t j d j | � � n t d j | � d d �� d S( Nt edfRy RI R� t probeR| R� R� s fs.enforce_symlinksifowners fs.symlinkown_gids fs.enforce_symlinksifowner=1s fs.symlinkown_gid={0}s '{0}' patch type selecteds/ '{0}' patch type is unavailable for your kernelR� s patch type unavailable( s frees extra( s fs.enforce_symlinksifowners fs.symlinkown_gid( R R| Rd R] R t update_configR t is_cpanelt FORCE_GIDt CPANEL_GIDR� R� R RE R ( R? t gid( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt update_patch_type� s t kernelc C s� t t j � | t j k r& t � n y t d d d | d | � } WnW t k r� } | t j t j f k r� t j r� t | � } t j j | � d S� n Xt j � } | t j k r� t j r� d St | � } | j � t d | d | � st j d � d Sy< t j t j d d d d �t j t j d d d d �Wn! t k rct j j d � n Xt j � } t � �4 | j | � t | | | | d | t j k �Wd QXt j | � t | | � d S( sx :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode R� R� R� RG NR� R� s% No updates are needed for this kernelt keep_ni t patterns kcore*.dumps kmsg*.logs# Error during crash reporter cleanupRG (! R� R R| R R� R� R� R� t UPDATE_MODE_AUTOt UPDATE_MODE_SMARTR� Rd R R� R� R R� R� Ro R� R� RE R R� R Ru R� R� R� R� RL t dump_kernel_patch_levelR� ( R3 RG R� R� R� R� R� R` R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt do_update� s< ! ( c C s� t t t j � t t j p! t j � t t j p6 t j � f � } | d k rc t d d d �� n t j rs t j S| t j k r� t j p� t j } t j p� t j } n t j } t j } | r� | S| r� d | Sd S( Ni s� Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themR� s conflicting sticky settingss release-( R� t boolR Rl t UPDATE_DELAYt AUTO_UPDATE_DELAYt STICKY_PATCHSETt AUTO_STICKY_PATCHSETR R t UPDATE_MODE_MANUAL( RG RZ R[ t patchset( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_sticky s& c C s | d | S( NR< ( ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _stickyfy< s c C sm t | � } | s | S| d k r/ t | | � St j � } | sa t j j d � t j d � n y& t j t j � d j | � � } Wn3 t k r� } t j | | j � t j d � n Xt j t j | j � � � } t | d � } | d k rt | d | � S| d k r| S| d k rDt j j d � t j d � n t j j d | d � t j d � d S( s� Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. t KEYsH Patch set to STICKY_PATCH=KEY, but server is not registered with the keyi����s! /sticky_patch.plain?server_id={0}i����R� i R� i i sE Server ID is not recognized. Please check if the server is registeredi����s Error: R� i����N( R� R� R Rq R R� R� RS R� R R� R R� R� R R� Rx R R� Rm R� R� ( t fileRG t sRo R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR> @ s2 & c C sR g } | s t S| j d � } | d } | d } | j d � } | | k rg t d t | � � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t j | � � n" | j t j | � j d d � � x$ | D] } | j t j | � � q� Wt j d d j | � d t j � } | j | � S( sh Matching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 R< i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( R; R= RZ R� t reprt lowerR� R� t ret escapet replacet compileR> t IGNORECASER� ( t dnt hostnamet max_wildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _dnsname_matchl s( " &c C s� g } xx t | j � � D]d } | j | � } | j � d k r g t | � j d � D] } | j � j d d � ^ qV } q q W| s� t d � � n g } xC | D]; \ } } | d k r� t | | � r� d S| j | � q� q� W| s| j � j } t | | � r d S| j | � n t | � d k rYt d j | d j t t | � � � � � n= t | � d k r�t d j | | d � � � n t d � � d S( Nt subjectAltNamet ,R� i st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt DNSs( hostname {0} doesn't match either of {1}s , s hostname {0} doesn't match {1}i s= no appropriate commonName or subjectAltName fields were found( t ranget get_extension_countt get_extensiont get_short_nameRd R= R� R� R� R� t get_subjectt commonNameR? R� R� R> t mapR� ( t certR� t sanR� R� t itt dnsnamesR� Rf t cn( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR- � s0 A - c C s t d d d d � } | j d d d d d �| j d d d d d d �| j d d d d d �| j d d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d! d d" d d �| j d# d d$ d d �| j d% d d& d d �| j d' d d( d d �| j d) d d* d d+ �| j d, d d- d d �| j d. d d/ d d �| j d0 d d1 d d �| j d2 d d3 d d �| j d4 d d5 d d �| j d6 d d7 d d8 �| j d9 d d: d d; �| j d< d d= d d �| j d> d d? d d+ �| j d@ d dA d d �| j dB d dC d d �| j dD d dE d d �| j dF d dG d d dH dI �| j dJ d dK d d �| j dL d dM d d �| j dN d dO d d �| j dP d dQ d d �| j dR d dS d d �| j dT d dU d d �| j dV d dW d d �| j dX d dY d d �| j dZ d d[ d d �| j d\ d d] d d^ d_ t d` d da t �| j db d dc d d �| j dd d de d d �| j � } | j df d dg d d^ �| j dh d di d d �| j dj d dk d d �| j dl d dm d d^ d` d da t �| j dn do d dp d d da t �| j dq d dr �| j ds d dt d d �| j du d dv d dw d dx �t j s�| j dy d dz dH d{ d d| d} t �| j d~ d d dH d{ d d| d} t �| j d� d d� d d �| j d� d� d d� d d �| j d� d� d d� d d �| j d� d d d d �| j d� d� d d� d d �| j d� d� d d� d d �| j d� d� d d� d d� �| j d� d d� d� d� d} d d d� �| j d� d d� d d �| j d� d d� d d �| j d� d� d d8 d d� d d^ d` d da t �n | j � } t j � t j s�t j d� g 7_ n | j d k rt t d | j j d� � � � j t j � rd� Sd� Sn | j s*| j rQt j rBt j t _ qit j t _ n | j rit j t _ n | j s�t j � d� k r�t d� d� t j �d� Sn t! j" } | j r�t! j# } n | j r�t! j$ } n t% j& | � t j' s�t j( � n | j) r t* j+ � n | j, rf| j, d� k rJt- | j, � t _. t j/ d� t j. � qfd t _. t j/ d� d � n | j0 d k r�t j/ d� | j0 � | j0 t _1 n | j2 r�t t _3 n | j4 r�t t _5 n | j6 r�t t _7 n | j8 r�t8 � n | j9 r t: j; d� t< � nN | j= rS t j> d� k rS t j? d� k r2 d n t j? p> d` | _@ t | _A qS n | jB rk | jB t _C n | jD r� t: j; d� t< � d� t _C n t jC jE d� � t _C t jC r� t jC tF k r� t% jG jH d� jI t jC d� jJ tF � � � n | jK r t t _L d� | jK t _M n | j@ r& tN | j@ � n t j> d� k rf tO � t _> t: j; d� jI t j> pY d` � t< � n | jP r� t* jQ tR jP d� | jS � � d S| jT r� tT jT d� d� d� t d� t � } t* jQ tS jU | � � d StV t j> � | jW r tW jX tY d� | jZ �d S| j[ r� t\ j] tT jT d� d� d� t d� t � � } d� jI | j^ � } | j_ r[ t* jQ | � q� t\ j` | � } | r� t% ja d� jI | � � n t% jb d� d� t �| jc r� t* jQ | � q� | r� | jd � q� n | je r� | jS r� te d� d� � n te � d S| jf r t j/ d� d� � d S| jg r2 t j/ d� d� � d S| jh rO t ji | jh � d S| jj re tk | jj � S| jl r{ tm jl � n | jn r� t j> d� k r� t j/ d� d� � n tm jn | jn | jo � S| jp r� tm jp � d� k r� d� Sd� Sn | jq d k r� tr | jq � S| js r t* jQ t jt � n tu | d{ d � d k rF tv jw | jx � d� St j s[| jy rh i | jy d� 6n i } | jz r� tv j{ � S| j| r� tv j} | � d k r� t% ja d� � q� n | j~ r� tv j} d� t j | � n# | j� r� tv j� � t% ja d� � n | j� rtv j� � t% ja d� � n | j� r9t* jQ tv j� � � n | j� rXt* jQ tv j� � � n | j� r�tv j� � r�t* jQ tv j� | j� � � n | j� d k r0| j� d k r�t j� p�t� tv j� � j� � � } n1 g | j� j d� � D] } | jE � j� � ^ q�} tv j} d� t� | � | � d k r0t% ja d� � q0n | j� r[tv j} d� t j d� d | � q[n | j� r�t* jQ t� d� | jS � � n d } | j� r�t: j; d� t< � d� } n | j� r�| j� } n | j� r�t� | d� t j� d� t j� �n | jA rt� | d� t j� �t% ja d� � n | j r0t* jQ t� j� � � n | j� r\t� | d� | j� �t% ja d� � n | j r�t t _� t� j� t� j� d� d� � � t� | d� t j �n | j� r�t� d� | jS � n | j� r�t� � S| j� r�t� d� | jS � n | j� r�t� � n t� t j� � d� k rt� � n d S(� Nt progt kcarectlRH s) Manage KernelCare patches for your kernels --debugt helpRI RN t store_trues -is --infos] Display information about KernelCare. Use with --json parameter to get result in JSON format.s --app-infosc Display information about KernelCare agent. Use with --json parameter to get result in JSON format.s -us --updates< Download latest patches and apply them to the current kernels --unloads Unload patchess --smart-updates, Patch kernel based on UPDATE POLICY settingss --auto-updates- Check if update is available, if so -- updates --localsN Update from a server local directory; accepts a path where patches are locatedt metavart PATHs --patch-infos" Return the list of applied patchess --freezers) Freezer type: full (default), smart, noneR3 s --nofreezes/ [deprecated] Don't freeze tasks before patchings --unames Return safe kernel versions --license-infos Return current license infos --statuss Return status of updatess --registers Register using KernelCare KeyR� s --register-autoretrys= Retry registering indefinitely if failed on the first attempts --unregisters7 Unregister from KernelCare (for key-based servers only)s --checks Check if new update availables --latest-patch-infosi Return patch info for the latest available patch. Use with --json parameter to get result in JSON format.s --tests& [deprecated] Use --prefix=test insteads --tags7 Tag server with custom metadata, for ePortal users onlyt TAGs --prefixsp Patch source prefix used to test different builds by downloading builds from different locations based on prefixR� s --nosignatures Do not check signatures --set-monitoring-keysP Set monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlys --doctors@ Submits a vitals report to CloudLinux for analysis and bug-fixess --fallbacksN With --doctor, force the legacy kcdoctor.sh flow instead of the v2 upload paths --kernel-anomaly-reportsH Submits a kernel anomaly report to CloudLinux for analysis and bug-fixess --no-sends Skip sending artifactst destt save_onlys --keep-locals: Don't delete generated kernel anomaly report after sendings --enable-auto-updates Enable auto updatess --disable-auto-updates Disable auto updatess --plugin-infos Provides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.s --server-infos3 Provides information about the host in JSON format.s --jsonso Return '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formats --versions( Return the current version of KernelCares --kpatch-debugs Enable the debug modes --no-check-certs2 Disable the patch server SSL certificates checkings --set-patch-levelsB Set patch level to be applied. To select latest patch level set -1t storeR^ Ry t requireds --check-compatibilitys Check compatibility.s --clear-caches Clear all cached filess --set-patch-types@ Set patch type feed. To select default feed use 'default' options --edf-enableds" Enable exploit detection frameworks --edf-disableds# Disable exploit detection frameworks --set-sticky-patchsj Set patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unsticks -qs --quiets= Suppress messages, provide only errors and warnings to stderrs --has-flagss Check agent featuress --forces- Force action and ignore several restristions.s --set-configs Change configuration optionR� s KEY=VALUEs --disable-libcares Disable libcare servicest enable_libcaret store_constt consts --enable-libcares Enable libcare servicess --lib-updatesI Download latest patches and apply them to the current userspace librariess --lib-unloads --userspace-unloads Unload userspace patchess --lib-replugins --userspace-replugins Reload libcare-server plugins --lib-auto-updates --lib-infos --userspace-infos& Display information about KernelCare+.s --lib-patch-infos --userspace-patch-infos, Return the list of applied userspace patchess --lib-versions --userspace-versions Return safe package versiont PACKAGENAMEs --userspace-updatet USERSPACE_PATCHESt nargsR6 sO Download latest patches and apply them to the corresponding userspace processess --userspace-auto-updates --userspace-statuss" Return status of userspace updatess --lib-tags --userspace-tags� Apply userspace patches for a specific tag (DDMMYY, YYYY-MM-DD, Nd, Nh, release-<NAME>) into an isolated cache, leaving the default storage untouched. Use together with --lib-update or --userspace-update.s libcare-enabledR� i i s Please run as rootR� RS Rl sT Flag --edf-enabled has been deprecated and will be not available in future releases.R� sM Flag --test has been deprecated and will be not available in future releases.R% t /s( Prefix `{0}` is not in expected one {1}.R s file:s+ edf patches are deprecated. Fallback to {0}R� R� Ra R3 R4 t force_fallbacks) Kernel anomaly report file generated: {0}s0 Kernel anomaly report uploaded successfully: {0}s$ Failed to send kernel anomaly reportR7 R� Rk R� t YESt NOR� R| R� Rp s Userspace patches are applied.RG s Userspace patches are unloaded.s Libcare plugin reloaded.t limitsQ Flag --nofreeze has been deprecated and will be not available in future releases.R� R� s Kernel is safeR_ s= KernelCare protection disabled. Your kernel might not be safei< (� R t add_argumentR� R� R; t add_mutually_exclusive_groupR t LIBCARE_DISABLEDR� t parse_argsR t set_settings_from_config_filet FLAGSt has_flagsR/ t filterR= t issubsett quiett auto_updatet SILENCE_ERRORSR t PRINT_CRITICALt PRINT_LEVELt PRINT_ERRORRa t PRINT_DEBUGR R0 t getuidt printRS R t loggingt INFOt WARNINGt DEBUGR t initialize_loggingt IGNORE_FEATURE_FLAGSt set_feature_flags_from_cacheR� R t clear_all_cachet set_patch_levelRd RS R� t set_sticky_patchRl t nosignatureRj t no_check_certR# R� R R� t edf_enabledt warningst warnt DeprecationWarningt edf_disabledR| t PREV_PATCH_TYPEt set_patch_typeR� R� R� R% R� t EXPECTED_PREFIXR� R� R� R> t localRj t PATCH_SERVERR� R� t app_infoR� R Rk R Rl RH R t send_doctor_reportR� t fallbackt kernel_anomaly_reportR RC t archive_pathR� RD RE R@ t keep_localRF R� t enable_auto_updatet disable_auto_updatet set_configt update_config_from_argst set_monitoring_keyR� t unregisterR t registert register_autoretryR� Rp Ru R� Ra Rc R t set_libcare_statusR� t lib_tagt userspace_statust get_userspace_update_statust lib_updatet do_userspace_updatet lib_auto_updateR� t lib_unloadt libcare_unloadt lib_replugint libcare_replugint lib_infoR� t lib_patch_infot libcare_patch_infot lib_versiont libcare_server_startedt libcare_versiont userspace_updateR� t listt get_userspace_mapt keysR� t sortedt userspace_auto_updateR� R� t nofreezeR3 t smart_updateR� R� t UPDATE_POLICYR� R R� R= Rc R_ t CHECK_CLN_LICENSE_STATUSR� R� t randomt uniformR� R� R� t latest_patch_infoR� t checkR� R? t argvR� ( t parsert exclusive_groupR� R� R� RM t local_path_messageRN t lib_tag_kwR� t ptchR3 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt main� sr - ' + % ! $1! " ( R" R# R$ s test( s latest.v3s latest.v2( (� t __future__R Rn Rk R� R0 R� R/ R� R R t sslRS Ry R� RQ R� t argparseR t contextlibR R RI R R R R R R R R R R R R R R R R R R R R R R R R t py23R R R R R R� R� R R3 Rx RT R� R^ R� t DOTALLR� R� R1 RO t insertt filterwarningsR� R; t typingR( R) R* R+ R, R- R� t setLevelR� R; RB RH Ri Rz R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R R R R Rc t distutils.versiont distutilst OpenSSL.SSLR R� t StrictVersiont __version__t ImportErrorR t HTTPSConnectiont PureHTTPSConnectiont objectR R RP R� R] Rd Rn Ro R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R RW R R R R! R& R' R5 RL RE RD R� RY t log_all_parent_processesRc R� Rd R� R� Ru R� R� R� R� R� t track_update_statusR� R� R� R> R� R- R9 ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt <module> s � ( 1 & 4 ' -! b + "? - 2 . = , 3 )