VULN_CHECK_I913V6 񳈳YddlZddlZddlZddlZddlZddlZddlZddlmZm Z ej e Z Gdde ZGdde ZGdde ZGd d e Zd Zgd Zd gZgdZejdZejdZejdZgdZdZdZdZGddZdS)N)S_IRUSRS_IRGRPceZdZdZdS) NoSuchUsercDt|d|ddS)NzNo such user () Exception__init__)selfusers /builddir/build/BUILDROOT/alt-python27-cllib-3.4.41-1.el10.cloudlinux.x86_64/opt/cloudlinux/venv/lib/python3.11/site-packages/clsudo.pyr zNoSuchUser.__init__s*4!9$!9!9!9:::::N__name__ __module__ __qualname__r rrrrs#;;;;;rrceZdZdZdS) NoSuchGroupcDt|d|ddS)NzNo such group (rr )r groups rr zNoSuchGroup.__init__s*4!;5!;!;!;<<<<>>>>rNrrrrrr#s#?????rrz /etc/sudoers) /bin/ps "" /bin/grep ""/sbin/service ""z%/usr/bin/getcontrolpaneluserspackagesz/usr/sbin/lvectl lve-versionz>/usr/local/directadmin/plugins/new_lvemanager/admin/GetDomainsz0/usr/share/l.v.e-manager/utils/cloudlinux-cli.pyz5/usr/share/l.v.e-manager/utils/cloudlinux-cli-user.py)z/usr/sbin/cagefsctl ""r!r"r#z ^\s*Cmnd_Alias\s+CAGEFS_CMDS\s*=z"^\s*Cmnd_Alias\s+SELECTOR_CMDS\s*=z ^\s*Cmnd_Alias\s+LVECTL_CMDS\s*=)z/usr/bin/cl-selector ""z/usr/bin/piniset ""z/usr/sbin/lveps ""z/usr/bin/selectorctl ""zDefaults:%s !requirettyz-%%%s ALL=NOPASSWD: LVECTL_CMDS, SELECTOR_CMDSzDefaults:%%%s !requirettyceZdZdZefZdZgZdZdZ dZ dZ dZ dZ dZdZdZdZeefdZeefdZeefdZeefdZeefdZeefd Zed Zed Zed Zed ZedZedZedZedZ dS)Clsudoz/ Adds CloudLinux users to sudoers file NFctd||tjtjt |t |t |t j s:t j dd tzt js:t j dd tzt js:t j dd t"zt js"t j |dt js"t j |dt js"t j |dt js(t j t,|fzt td ||d S) z@ Adds username to sudoers file (for lvemanager) z@add_user: adding user '%s' to sudoers file '%s' (uid=%d, pid=%d)Cmnd_Alias LVECTL_CMDS = , zCmnd_Alias LVECTL_USER_CMDS = Cmnd_Alias SELECTOR_CMDS =  ALL=NOPASSWD: LVECTL_CMDS% ALL=(ALL) NOPASSWD: LVECTL_USER_CMDS ALL=NOPASSWD: SELECTOR_CMDSz.add_user: successfully added user '%s' to '%s'N)loggerinfoosgetuidgetpidr%update_commands_list _check_user _get_contents has_alias sudoers_listappendjoinALIAS_LVECTL_CMDShas_user_aliasALIAS_LVECTL_USER_CMDShas_selector_aliasALIAS_SELECTOR_CMDS has_rightshas_user_rightshas_selector_rights has_actionDEFAULTS_REQUIRETTY_write_contentsr sudoers_files radd_userzClsudo.add_userfs  ()-|Y[[")++ / / / ##L1114   T""" c   & &'BTYYO`EaEa'a b b b$ m   & &'G$))TjJkJk'k l l l( g   & &'DtyyQdGeGe'e f f f  L   & &$'J'J'J K K K% W   & &$'U'U'U V V V) N   & &$'L'L'L M M M  F   & &':dW'D E E E    D< ) ) ) ) )rctd||tjtj|t _t |t |t j s:t j dd tzt js"t j |dt js(t j t |fzt td||dS)z< Adds username to sudoers file (for cagefs) zGadd_cagefs_user: adding user '%s' to sudoers file '%s' (uid=%d, pid=%d)zCmnd_Alias CAGEFS_CMDS = r( ALL=NOPASSWD: CAGEFS_CMDSz5add_cagefs_user: successfully added user '%s' to '%s'N)r-r.r/r0r1r%filepathr3r4has_cagefs_aliasr6r7r8ALIAS_CAGEFS_CMDShas_cagefs_rightsrArBrCrDs radd_cagefs_userzClsudo.add_cagefs_users-  ()-|Y[[")++ / / /'4   T"""& c   & &'BTYYO`EaEa'a b b b' L   & &$'J'J'J K K K  F   & &':dW'D E E E    K< ) ) ) ) )rcttd||tjtjt |t |t |t j s:t j dd tzt js:t j dd tzt js(t j t"|fzt js(t j t&|fzt td||dS)zJ Adds group to sudoers file, grants access to LVE Manager zMadd_lvemanager_group: adding group '%s' to sudoers file '%s' (uid=%d, pid=%d)r'r(r)z;add_lvemanager_group: successfully added group '%s' to '%s'N)r-r.r/r0r1r%r2 _check_group_get_contents_groupr5r6r7r8r9r<r=rAGROUP_LVECTL_SELECTORhas_group_actionGROUP_DEFAULTS_REQUIRETTYrC) group_namerEs radd_lvemanager_groupzClsudo.add_lvemanager_groupso  ()3\Y[[")++ / / / ##L111J'''"":... c   & &'BTYYO`EaEa'a b b b( g   & &'DtyyQdGeGe'e f f f  N   & &'< }'L M M M& R   & &'@J='P Q Q Q    Q / / / / /rc"td||tjtj|t _ tt jd5}| t _ dddn #1swxYwYd}d}|tt j krt j |}| |ds6| |ds| t|fzr>td ||t j |d }|d z }|tt j k|r7t td ||dStd ||dS#t t"f$r}t%|d}~wwxYw)z5 Removes username from sudoers file zGremove_user: removing user '%s' from sudoers file '%s' (uid=%d, pid=%d)utf-8encodingNrFz ALL=NOPASSWD:z ALL=(ALL) NOPASSWD:z4remove_user: removing sudoers rule for user '%s': %sTz5remove_user: successfully removed user '%s' from '%s'z1remove_user: no rules found for user '%s' in '%s')r-r.r/r0r1r%rIopenread splitlinesr6len startswithrBremoverCIOErrorOSErrorr)r rEfidxremovedlinees r remove_userzClsudo.remove_usersK  ()-|Y[[")++ / / /' ,fo888 $+HIIKK V $d,,,'..t444"Gq!F/0000" 1&&((( S!<11111 O!<11111! , , ,"$$! + ,sCG))1B& G)&B**G)-B*.DG) G))H:H  Hc"td||tjtjt |t |t |dS)z updates username in sudoers file :param user: username for caching :param sudoers_file: path to /etc/sudoers (only for tests) :return: None zEupdate_user: updating user '%s' in sudoers file '%s' (uid=%d, pid=%d)N) r-r.r/r0r1r%r2r3r4rDs r update_userzClsudo.update_users{  ()-|Y[[")++ / / / ##L111 4   T"""""rc|t_tjtjt_ttdtftdtff}d}ttj D]k\}}|D]c\}}}| |rHtj |}t|||tj ||krd}ndl|rZtd|tjtjtdSdS)z Update command lists for lvemanager plugin If any required command absent in file, add it :param sudoers_file: path to /etc/sudoers :return: None LVECTL_CMDS SELECTOR_CMDSFTzGupdate_commands_list: updating command aliases in '%s' (uid=%d, pid=%d)N)r%rIr/pathdirnametemp_dir _read_sudoersLVECTL_ALIAS_REr9SELECTOR_ALIAS_REr= enumerater6match_rewrite_aliasr-r.r0r1rC) rE alias_specsis_sudoer_changerdcommand_stringalias_re alias_name alias_listbefores rr2zClsudo.update_commands_listsI''//&/::(8IJ)?>.11#05F))#z:FFF*3/699+/(E   % KK,-9bikk 3 3 3  " " $ $ $ $ $  % %rct tj|dS#t$r}t||d}~wwxYw)zZ Checks passwd database for username presence @param user: string N)pwdgetpwnamKeyErrorr)r rgs rr3zClsudo._check_usersL  * L      * * *T"" ) * 727ct tj|dS#t$r}t||d}~wwxYw)z_ Checks grp database for group_name presence @param group_name: string N)grpgetgrnamrr)rTrgs rrOzClsudo._check_groupsL  1 L $ $ $ $ $ 1 1 1j))q 0 1rcttjd5}|t_ddddS#1swxYwYdS)NrWrX)r[r%rIr\r]r6)rcs rrqzClsudo._read_sudoers(s &/G 4 4 4 8"#&&(("5"5"7"7F  8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s1AA!Acbtj}|}||dr8|dzt|krdS|dz }||d8d|dd|z}||kr |||krdS|g|||dz<dS)aRewrite the existing `alias_name` Cmnd_Alias definition at sudoers_list[idx] to the single canonical argv-restricted line, in place. Shared by the CAGEFS_CMDS and SELECTOR_CMDS upgrade rewrites - both are lax bare-command aliases whose pre-fix on-disk form must be tightened to the argv-restricted `alias_cmds` join without duplicating or corrupting the definition. The definition may span several physical lines via visudo-legal backslash line-continuation (_read_sudoers splits on physical lines, so each continuation line is its own list element). Consume the whole span - the matched line plus every following line the preceding line continued onto - and replace it with one restricted line. Never-corrupt invariant: if the definition cannot be confidently and safely collapsed (a continuation whose trailing backslash runs off the end of the file - i.e. the file is already malformed), leave it exactly as-is. The worst case of the upgrade rewrite is a safe no-op (the file stays as valid as it was), never a corrupted sudoers file. The caller still sets the has_*_alias flag, so no duplicate definition is appended. \rZNz Cmnd_Alias z = r()r%r6endswithr^r8strip)rdr{ alias_cmdslinesend restricteds rrvzClsudo._rewrite_alias-s.# Cj!!$'' Qw#e**$$ 1HCCj!!$'' 3:222TYYz5J5JJ #::%***,, :: F)\c#'krcDdt_dt_dt_dt_dt_dt_dt_dt_dt_ dt_ tj d|d} t ttjD]2\}}d|vr dt_d|vr dt_(t |r.t|dt&dt_ p|d|vr dt_|d |vr dt_|d |vr dt_ d |vr$||}|r dt_t*|r/t|d t,dt_|d |vrdt_24dS#t.t0f$r}t3|d}~wwxYw)zM Reads file into list of strings @param user: string Fz Defaults:\s*z\s*!requirettyCmnd_Alias LVECTL_CMDSTzCmnd_Alias LVECTL_USER_CMDS CAGEFS_CMDSr*r+rH requirettyrmr,N)r%rArRr5r:r>r?r<r@rJrLrecompilerqrtr6CAGEFS_ALIAS_RErurvrKsearchrsr=rarbr)r require_tty_patternrdry pattern_matchrgs rr4zClsudo._get_contentsVs=""'  %!!&$)!%*""'#(  j)M)M)M)MNN- ,  " " "'01D'E'E( ( #^+~=='+F$0NBB,0F)"((88 ))#}>OPPP.2F+666.HH(,F%AAA^SS-1F*666.HH/3F,>11$7$>$>~$N$NM$1,0)$**>:: ))#@STTT04F-888NJJ15F.KM( ( R! , , ,"$$! + ,sE&G::H HHcdt_dt_dt_dt_dt_dt_dt_dt_d|}d|}tj |d} t ttj D]\}}t|r.t|dt"dt_Nd|vr dt__t$|r.t|dt&dt_||r#||}|r dt_||r dt_d S#t,t.f$r}t1|d }~wwxYw) zS Reads file into list of strings @param group_name: string F%z Defaults:%z/\s*ALL=NOPASSWD:\s*LVECTL_CMDS,\s*SELECTOR_CMDSrmTrrN)r%rArRr5r>r<r@rJrLrrrqrtr6rsrurvr=rrKr_rrarbr)rT group_prefix group_action group_patternrdryrrgs rrPzClsudo._get_contents_groups""' !$)!%*""'#( ':'' 0J00  z#b#b#bcc  ,  " " "'01D'E'E 3 3#^$**>::))#@STTT04F-+~=='+F$"((88))#}>OPPP.2F+!,,\::1$1$8$8$H$HM$1,0)!,,\::3.2F++ 3 3,! , , ,"$$! + ,sD4F99G GGcdtjD}tjtj|vrWt dtjtjtj t tj tj}d}tj ||\}}tj|d}|dtjdz|t&t(z}tj||t|st.n#t.t0f$r}t dtjtjtj  tj|rtj|n#t6$rYnwxYwt|d}~wwxYw tj|tjdS#t0$r]}t d tjtjtj t|d}~wwxYw) zX Writes data to temporary file then checks it and rewrites sudoers file cLh|]!}tj|"Sr)r/rnrealpath).0ps r z)Clsudo._write_contents..s(NNN127##A&&NNNrzZ_write_contents: refusing to write sudoers to disallowed destination '%s' (uid=%d, pid=%d) lve_sudoers_)prefixdirw zC_write_contents: failed to write sudoers file '%s' (uid=%d, pid=%d)NzD_write_contents: failed to rename temp file to '%s' (uid=%d, pid=%d))r%_ALLOWED_SUDOERS_PATHSr/rnrrIr-warningr0r1rrotempfilemkstempfdopenwriter8r6closerrchmod_is_file_validrarbexistsunlinkr rename)allowedrp temp_prefixfd temp_pathfomaskrgs rrCzClsudo._write_contentss`ON0MNNN 7  FO , ,G ; ; NNJ!?BIKK F F F$%% % -wv77H(K$,KXNNNMB 2s##B HHTYYv233d: ; ; ; HHJJJW$D HY % % %((33   ! - - - NN./59;;  5 5 5 7>>),,)Ii(((    #%%1 , - - Ii 1 1 1 1 1 - - - NN./59;;  5 5 5$%%1 ,  -sWC'FH5A H03HH0 HH0HH00H59I K$AJ<<Kc ddd|g}tj|tjtjtj5}||jdkr ddddS dddn #1swxYwYdS)Nz/usr/sbin/visudoz-cz-f)stdinstdoutstderrrFT) subprocessPopenDEVNULLPIPESTDOUT communicate returncode)filenamecmdprocs rrzClsudo._is_file_valids   (    $?$            !##        $               ts!A88A<?A<)!rrr__doc__ SUDOERS_FILErrIr6rArRr5r:r>r?r<r@rJrL staticmethodrFrMrUrhrjr2r3rOrqrvr4rPrCrrrrr%r%Os+_HLJINJO$0)))\)<+7)))\)(6B///\/0'3&,&,&,\&,P'3###\#"*6!%!%!%\!%F**\*11\188\8&*&*\&*P?,?,\?,B,,,,\,,\)-)-\)-V\rr%)loggingr/rrrrrstatrr getLoggerrr-r rrrrrr9r;rKrrrsrrr=rBrQrSr%rrrrs !!!!!!!!  8 $ $;;;;;;;; =====)=== =====y=== ????? ???  III RRa``"*@AABJDEE"*@AAHHH0G7ttttttttttr