j
d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl
mZmZmZmZmZ d dlmZ d dlmZ d dlZd d
lmZ d d lmZ d d l m Z d d
l m Z m Z d dl!m"Z" d dl m#Z# d dl m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z* d dl+m,Z,m-Z-m.Z. d dl/m0Z0 d dl1m2Z2 d dl3m4Z4m5Z5m6Z6 d dl7m8Z8 n# e9$ r d Z4Y nw xY w d dl3m:Z: n# e9$ r d Z:Y nw xY w d dl;mZ> n# e9$ r d ZY nw xY w G d d e Z?dS ) )print_function)absolute_import)divisionN) configparser)S_IRUSRS_IWUSRS_IRGRPS_IROTHS_ISREG) iteritems)Path )ClSelect)ClSelectExcept)multiphp_sync_client)ClPwd clcaptain)clprint)utils)clcagefs)ExternalProgramFailed)docroot domain_owner userdomains)NoDomain NoPanelUser NotSupported)BASEDIR)get_user_prefix)is_ea4_enabledread_cpanel_ea4_php_confconfigure_alt_php)da_change_user_php_inic dS NF argskwargss L/opt/cloudlinux/venv/lib64/python3.11/site-packages/clselect/cluserselect.pyr r , s u )native_website_targetsc i S Nr& r' s r* r, r, 8 s r+ )get_website_id)load_user_configc d S r. r& )_s r* r3 ? s t r+ c e Zd ZdZdZ ej rendZdZdZ d5dZ
d6d Z d
Z d7d Z
d8dZd9dZd9dZd Zd Zd Zd Zd Zd Z d:dZd:dZdedefdZd9d Zd Z d Z d Z d Z d! Z d" Z!d;d#Z"d ClUserSelectz /var/cagefsz
/usr/selectorz'/usr/share/cagefs-skeleton/usr/selectorz/etc/cagefs/excludez.cl.selector/selector.pathNc \ t j s!t j d sdS |D ]}| j | }t j |j d }t j | s| | } t j | n.# t t f$ r}t j || d}~ww xY w t | # t | w xY wdS )z
Creates flags mod_lsapi_reset_me in users' home directories in order
to recreate CRIU images when php version/extensions/options have changed
For details see LVEMAN-1210
:param users: list of usernames (strings)
z /var/run/mod_lsapi/criu.enabledNmod_lsapi_reset_me)r in_cagefsospathisfile_clpwdget_pw_by_namejoinpw_dir _change_uidr writeOSErrorr r UnableToSaveDatar5 _restore_uid)selfusersuserpwr: previous_user_dataes r* clean_crui_imagesz ClUserSelect.clean_crui_imagesJ s: !## BGNN;\,],] F
B
BD++D11B7<< +?@@D7>>$''
B%)%5%5d%;%;"B OD)))) !67 C C C(9$BBBC * !--.@AAAAL--.@AAAA
B
B
Bs* -CD C-C((C--D D(Tc t j t s;t j s(t
d |rt j d ndS |rut rgt }|rW |d }| d s(t
d |rt j d ndS n# t $ r Y nw xY wt |||dt j dk | }|r|rt j d |st t! t |j j } t' |j }
n# t( t* f$ r g }
Y nw xY w|
D ]O\ } } | | vr
t || |j | p|| dt j dk | P|S )
z
Switch symlink for alt php.
Create .cagefs directory if not created
Rerurn True if error has occured
ERROR: CageFS not installed.r Tdefaultzea-phpzlERROR: system default PHP version is alt-php. PHP Selector is disabled. Use cPanel MultiPHP manager instead.Fr ) write_log drop_permconfigure_multiphp)r9 r: isdirr r r8 printsysexitr r!
startswithKeyErrorr" geteuidr0 setpw_nameenabled_websitesr r r _website_selected_version)
rE versionrH
document_root
exit_on_errorrQ conf default_phperrorisolated_domainstarget_domainsdomaindomain_docroots
r* switch_symlink_for_alt_phpz'ClUserSelect.switch_symlink_for_alt_phpb s1 w}}W%% h.@.B.B 0 1 1 1
t ."2"2 +--D
"&y/K&11(;; ( ] ) ( HQKKKK#'4 D " z||q( 1
] HQKKK & !1!= "#3BJ#?#?#P Q Q
$!,RZ!8!8 .
$
$
$!#
$ +9
&!111 $ "222:~NNYRY" # !z||q 0'9
s% AC
CC E E43E4c | j r#t d t j d t j dk r#t d t j d | }t | D ]H\ }}t d| | j | }|
||dd Id S )NzPERROR: this option does not work in "single user" mode (when CageFS is disabled)r r z ERROR: root privileges requiredzProcessing userF)r_ rQ ) without_cagefsrS rT rU r9 rX get_user_version_mapr r< r= rg )rE users_vers_dictrG r] rH s r* apply_symlinks_rulesz!ClUserSelect.apply_symlinks_rules s d e e e HQKKK
:<<1 3 4 4 4 HQKKK 3355 & 7 7 h hMD' #T * * *++D11B + +GRuaf + g g g g h hr+ phpc t j | | t | _ t | _ |r || _ d S g | _ d S r. )r __init__r r< rY _user_excludesexclude_pid_list)rE itemrq s r* ro zClUserSelect.__init__ sP $%%%gg !ee '$4D ! ! !$&D ! ! !r+ Fc F | | | | }|r`| || rJ| |t | d }t j | r|}| || S )zl
Returns alternative version for a user
@param user: string
@return: string
r )_check_user_in_cagefs_compose_user_alt_pathwebsite_isolation_enabledr r9 r: rR _version_at_alt_path)rE rG re show_native_versionalt_path website_paths r* get_versionzClUserSelect.get_version s
""4(((..t44 (d44T6BB ( 66tWV__Q=OPPLw}}\**
('((3FGGGr+ c l t j | s| | S t j || j }t j | s| | S | t j | | S )ax Resolves the alternative a selector directory currently points at.
Split out of ``get_version`` so the per-website scope can be read from
a document root the caller already has, without re-resolving a domain
through the panel API. ``alt_path`` is an account-level
``etc/cl.selector`` or a per-website ``etc/cl.selector/``.
) r9 r: rR _compose_native_infor> _itemislink_version_for_link_targetreadlink)rE ry rx full_paths r* rw z!ClUserSelect._version_at_alt_path s w}}X&& B,,-@AA AGLL4:66 w~~i(( B,,-@AA A,,R[-C-CEXYYYr+ c @ | } j r9 j s j j j k r|S t
j j k r|S t t fdt d }|| d | d j fS # t t f$ r |cY S w xY w)a, Resolves the alternative a primary ``- `` link target names.
Split off from ``_version_at_alt_path`` so a caller holding a target it
has already read can resolve *that* target instead of re-reading the
link. The re-read is not equivalent: CageFS rewrites these links
unlink-then-symlink, so a second look can find the link gone and answer
``native`` -- the reading for a selector directory that holds no
selection -- where the target in hand still names the alternative the
website ran.
c > | d j k S )Ndata)r~ )i alternativeslink_dstrE s r* r3 z7ClUserSelect._version_for_link_target.. s ,q/&"9$*"E"Q r+ r r] r )r} ri _native_contents_load_native_contentsr~ r9 r: dirname
SELECTOR_PATHget_all_alternatives_datalistfilterkeys
IndexErrorrW )rE r rx nativer] r s `` @r* r z%ClUserSelect._version_for_link_target s8 **+>?? (
7**4:66640<<<
7??8 $ $(: : :M5577 QQQQQQTXYeYjYjYlYlTmTmnn G \' 29 =|G?TU[?\]a]g?hi iH% MMM s A.D D D c | || }t j || j }t j | sdS t j | }n# t $ r Y dS w xY wt j | | j k rdS |
| d S )a PHP version a website has selected for itself, or None to follow the
account-level one.
Reads the website's own selector directory -- the very tree
``configure_alt_php`` is about to write ``link/conf`` into -- so the
answer is what the website *runs*, which is what those symlinks have to
agree with. The primary ``
- `` link is the evidence of a per-domain
selection: ``_set_version`` creates it for a per-domain set, and CageFS
re-creates it on its own sweep. Its absence (no directory at all, or a
directory holding only the cPanel-MultiPHP ``ea-*`` aliases that an
account-level save writes there) means the website has made no
selection, so the account-level version is the right input. So does a
primary link routed through ``/usr/selector`` -- see below: that
encoding resolves to the account's own selection rather than pinning
anything, so such a website follows the account too.
CLOS-3932 made per-domain PHP Selector default-on for every isolated
website, so isolation alone no longer implies a selection -- which is
why this has to be asked per website rather than inferred.
Nr ) ru r9 r: r> r~ r r rB r r r )rE rG r^ ry linkr s r* r\ z&ClUserSelect._website_selected_version s * ..t]CCw||Hdj11w~~d## 4 {4((HH 44 7??8 $ $(: : :* 4 ,,X66q99s A3 3
B Bc n t j | s| | } t j | n.# t t f$ r}t j || d }~ww xY w t | d S # t | w xY wd S r. ) r9 r: rR r@ r mkdirrB r r rC r5 rD )rE r: rG rI rJ s r*
create_dirzClUserSelect.create_dir[ s w}}T"" >!%!1!1$!7!7
>%%%% 23
?
?
?$5dA>>>
? & ))*<===== ))*<==== > >s) A
B A6 A11A66B B2c p | j | }t j || j }| | }| || | d|dz d | d|dz d | | dS )z\
Creates additional directory and symlinks for use in "without CageFS" mode
z
../php-cliz/phpT)check_existencez../phpz/php-cgiN)
r< get_homedirr9 r: r>
SELECTOR2_DIRr@ r _create_symlinkrD )rE rG homedir path_in_homecur_users r* create_selector_symlinksz%ClUserSelect.create_selector_symlinkse s +))$//w||GT-?@@ ##D)) d+++ \<&+@RV WWW X|j'@RV WWW (#####r+ c t j t j rD | j d| j S # t j t t f$ r Y dS w xY wdS )Nversionsr ) r9 r: r; r
DEFAULTS_PATH_dhgetr~ ConfigParserErrorIOErrorrW )rE s r* get_default_versionz ClUserSelect.get_default_versionq si
7>>(0 1 1
x||J
;;; &:
xx
xs A A+*A+c t j | j | dd } t j | }n# t $ r d }Y nw xY w|t |j s*| ||
d S | | }| || d| j
d S # t j t t" f$ r<}t% dt' | t) j d Y d }~d S d }~ww xY w)N .cl.selector defaults.cfgr z*Error while restoring settings from backupr )r9 r: r> r< r lstatrB r st_mode set_versionr _get_default_config_handlerr r~ r r r rW rS strrT rU )rE rG user_backup_pathstdhrJ s r* set_version_from_backupz$ClUserSelect.set_version_from_backupy s? 7<< (?(?(E(E~Weff *++BB BBB
:WRZ 0 0: T4#;#;#=#= > > > > >
556FGG rvvj$*'E'EFFFFF &:
BCFFKKK
s* A A A #AC) ) E1D<<Ec R | j | j |d sdS dS )aL "
Checks if version is enabled,
a version is considered "enabled" if there is no "state" option in the config.
The presence of the "state" option always means it is disabled, regardless of its value.
@param version: string
@return: bool - True if version is enabled, False otherwise
stateTF)r
has_optionr~ )rE r] s r* _version_enabledz ClUserSelect._version_enabled s3 x""TZZ#A7KK 45r+ c
" t j dk r+| | x}rt j | | | st j d|z |rY t
| }n# t $ r d}Y nw xY w||k rt j d|d| | || |dk r*||
vrt j | | o$|dk o | | d |k } n# t $ r d} Y nw xY w | rdnt j | }
n.# t j $ r } t j d| z d} ~ ww xY w t# j | j | j | j | t j ||||| } t j ||
n# t j ||
w xY w|r| S dS )
zz
Sets alternative version for a users with the same uid
@param user: string
@return: None
r z'Version %s is disabled by administratorNzDomain z does not belong to user r Fz PHP version was not changed: %s) after_change)r9 rX "get_version_selection_disabled_msgr VersionModificationBlockedr r r SelectorException_require_website_isolationr NoSuchAlternativeVersionr{ Exceptionr release_for_changeHandBackFailedr apply_for_at_least_one_user _set_versionr< get_namesget_uidNoUserSelector
notify_change)
rE rG r] re return_summaryrx r_ messageownerstayingchangerJ r s
r* r zClUserSelect.set_version s :<<1 T-T-TUY-Z-Z"Z' ;GDD D $$W-- q ;*QRV*W*WFF#2 7 7 7 ;1A57 7
7 7 J4! %%dk&9&9$&?&?@@ - # D
! .t& I I I I I .t& I I I I I K sI 2B BB;(D$ $ D32D37E E; E66E;?AG0 0Hc | j r| | }| | d}|rt | d }| || } t
j | s4| j s|r| | | nt j
| | }
||
vr|dk rt j | |
| | j | } |dk r| j r[| j s| | j t' | j D ]#\ } }
| |
| dz | z || $n|rt+ ni }d}d}t
j | j d| }t
j | ro||v r || }n(t
j d| j z | }t
j | | }| |||| d }t j | j D ]}| j |vr | d
r|r$t
j | | }||v r || }n%t
j | j | }| |||| nWt' |
| d D ];\ } }| |t
j | | || <| j rt8 | n/| || || | || | | | ! ||pd
| |r| " || S d
S )zg
Sets alternative version for a user
@param user: string
@return: None
r r /zphp.iniFz.etcz%s.etcT.inir )r^ r_ N)r^ re )#ri r@ rt r ru r9 r: rR r r r r r _remove_alternatives_linksr< r= r r r~ r r r, r> NATIVE_PATHexistsr listdirendswithr5 rD rg _switch_php_da_isp_reload_processes_backup_settings get_summary)rE rG r] re r rx r_ rI r^ ry r rH rr native_pathnative_targetsininew_ini_created new_ini_pathsrcdstfilenamer: s r* r zClUserSelect._set_version s/ 8!%!1!1$!7!7 ""4(((
/ #FOOA .M..t]CCw}}X&& :"
:f
:$////$3D9995577 , & &7h+>+> 9'BB B ''111
[
'
'
-
- h " (
B, ;..tz:::)243H)I)I \ \%D+((hnt6KTSZ[[[[\ >D!K!7!9!9!9 "' !w||8H8H8H,JC P P 7>>,// +n,, ,S 1 gll8d6H+H# N N ',,x55C((c4AAA&*O "
4+; < <
B
BHz11 ((00 !_ ! ',,x::C >11 ,X 6 gll4+=x H H((c4AAAA
B ( W(=f(E F F
X
X
d$$T27<<$+G+GwWWWW 3 % %&8 9 9 9 9 + +GR:G:G
,
I
I
I
# #D' 2 2 2 t$$$ d-2G4PV WWW ?##D*=>> > ? ?r+ usernamereturnc n | j | }t d| d }| sdS | d 5 }t j | }| dd cddd S # 1 swxY w Y dS # t t f$ r Y dS w xY w)a
Returns a message indicating that the selection of the PHP version
is disabled for the user, based on the configuration file.
Args:
username (str): The username for which to check the configuration.
Returns:
str: The message indicating that version selection is disabled,
or an empty string if the configuration file does not exist
or does not contain the message.
z!/var/cloudlinux/cl.selector/uids/z /version_selection_conf.jsonr zutf-8)encoding version_selection_disabled_msgN)
r< r r
r openjsonloadr rB
ValueError)rE r uid config_filef config_datas r* r z/ClUserSelect.get_version_selection_disabled_msg: s# k!!(++`s```aa !!## 2 !!7!33
Mq "ill "'GLL
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M $ 22 s6 B *B B BB BB B43B4c | | | }| | }dddddi}t | }| d | | d }|D ]?}||vri ||< | | || d< d|| d< d|| d< @ | j d | j
} n## t j t j
f$ r d} Y nw xY w d|| d< d|| d< n"# t $ r t j | w xY w| d ||d < | d | |d g }
t' | D ]z\ } } t) || d || d || d f s<|
| || d || d || d ff {t+ |
S )
a'
Returns a summary of available alternative versions for the given user.
Only versions that are enabled, default, or selected are included.
The label for the "native" version is replaced if show_native_version is True.
@param user: str - Username inside CageFS.
@param show_native_version: bool - Whether to replace the 'native' version label.
@return: tuple of (str, (bool, bool, bool)) - Each entry contains the version name and a tuple with flags:
(enabled, default, selected).
r TF)enabledrN selectedr r rN r r )rt r r} sortedr appendr{ r r r r~ r NoSectionError
NoOptionErrorrW r r popremove enumerateanytuple)
rE rG rx r native_infosummary alt_versionsselected_versionr] default_versionresultidxvs
r* r zClUserSelect.get_summaryS s
""4(((5577 //0CDD %U S ST l / / 1 122 H%%% ++D11!4# 1 1Gg%%#% *.*?*?*H*HGG Y '*/GG Y '+0GG Z ( ( ' "hll:tz B BOO +\-GH ' ' ' &OOO ' K26GO $Y /48G$ %j 1 1 K K K 9/JJ J K")++h"7"7 A H%%%KN+++ -- g gFC
9-wqz)/DgajQ[F\]^^
MM1wqz) 4gaj6KWUVZXbMc de f f f fV}} s C< < D D D7 7 Ec V | | }||k r|dk p|dk o|| v} t j }t dt | | D ]}||||z }|rdt
fnt j | \ }} | ||| t j || f# t j || w xY w|
| t j dS # t j w xY w)z
Changes users of a supplied version to specified_version
@param version: string
@param current_version: string
r r N)
list_usersr r
BULK_CHUNKrangelenrY release_bulk_set_versions_suppressedend_bulkrK notify_bulk_change)
rE new_versioncurrent_versionrF stays
chunk_sizestartchunkr refuseds
r* change_to_versionz ClUserSelect.change_to_version sQ 00 /KK84K ] 8 # [ 4;Y;Y;[;[([ 6-8J q#e**j99
A
A eEJ$6 6738 #B4---:5AA A11%gNNN(1%@@@@(1%@@@@ " "5 ) ) )
! 3 5 5 5 5 5 3 5 5 5 5s$ A"D "C9D C&&D D(c t j t j }dt j t j < |D ]}||v r)t j ddd|dt j d / | ||d I# t $ r/}t j ddt | d Y d }~}d }~ww xY w |,t j t j d d S |t j t j < d S # |+t j t j d n|t j t j < w xY w)
zset_version for each of a bulk move's accounts, without its
per-account MultiPHP sync steps (see change_to_version). An account
the sync could not step aside for keeps its version.1textERRORzPHP version of zj was not changed: the MultiPHP Manager versions the MultiPHP sync set could not be handed back first; see )statusr F)r_ N) r9 environr r SUPPRESS_ENVr
print_diagLOG_PATHr r r r )rE rF r r previousrG rJ s r* r z%ClUserSelect._set_versions_suppressed s :>>"6"CDD8;
'45 I
W
W7??&v")' 04tt5I5R5R$T0U 0U V V V W$$T;e$LLLL W W W&v'cRSff/U/UVVVVVVVVW
W
3 @$GGGGG@H
/<===
3 @$GGGG@H
/<=HHHHs7 1D 6BD
C%C>D CD AE c F | }||v r|| S g S )z8
Returns users of a certain alternative
)get_version_user_map)rE r] r s r* r zClUserSelect.list_users s- ((** d??= r+ c | j rddlm} | gS t | | S )zF
Returns all valid system users
@return: list
r )get_cpanel_user)ri clselectctlphpr# r _get_system_users
difference_get_user_excludes)rE r# s r* list_all_userszClUserSelect.list_all_users sf
' 7 7 7 7 7 7#O%%& &D**,,778O8O8Q8QRRSSSr+ c t }d|d< d|d< d|d< d}t j | dd l}n3# t
$ r& t
d t j d Y nw xY wt j t t | |d }t j |d z r"t j |d
z s|
|| d S d S ) Nr initreinitverbose/usr/share/cagefsrM r etcz /cl.selectorz /cl.php.d)dictrT r: r cagefsctl ImportErrorrS rU r9 r> r r r cpetc_for_user)rE rG configLIBDIRr0 cagefs_etc_paths r* cagefs_copy_etcz ClUserSelect.cagefs_copy_etc s v x y$ 0 1 1 1 HQKKKKK ',,w0E0EtUSSw~~o >?? 3rw~~VehsVsGtGt 3 $ $T6 2 2 2 2 2 3 3s A -A54A5c | }i }|D ]7} | |d d ||< ## t j $ r Y 4w xY w|S )zH
Returns user version map as dict
@return: dict
Fr )r( r{ r
NotCageFSUser)rE actual_usersr rG s r* rj z!ClUserSelect.get_user_version_map sv
**,, D
! - -dE : :1 =T
!/
s <A
Ac |p| }i }|D ]Y} | ||d d }||vrg ||< || | E# t j $ r Y Vw xY w|S )zH
Returns users grouped by version
@return: dict
Fr )r( r{ r r r8 )rE
user_namesre r9 r rG r] s r* r! z!ClUserSelect.get_version_user_map s
":T%8%8%:%: D
**4??B $$&DMW
$$T****!/
s AA A21A2c
|rbt j | r/t j | | k rt j | ndS t j | t j | | dS # t $ r=}||t j ||| t j d| d|d|d d}~ww xY w)z
Creates symlink from src to dst
@param src: string
@param dst: string
@param user: string
@param version: string
@param check_existence: bool
@return: None
NzCannot create symlink from z to z ())
r9 r: r r unlinkr remove_file_or_dirr symlinkr r UnableToSetAlternativer )r r rG r] r rJ s r* r z ClUserSelect._create_symlink s
o
27>>#&& 2{3''3.. # ,S111 c3 ' ' ' ' ' o o o G$7$;D'1MMM 22adadadfififiklklkl3mnn n os AA= )A= =
C8B??Cc | j r| j S t j | j st S t j | j D ]}t j | j | }| j t t d t j | | j S )zE
Returns list of user excludes
@return: list
c * | S r. )strip)xs r* r3 z1ClUserSelect._get_user_excludes..2 s 17799 r+ )
rp r9 r: rR CAGEFS_EXCLUDErY r r> updatemapr read_file_as_string
splitlines)rE rr full_item_paths r* r' z ClUserSelect._get_user_excludes& s
'& &w}}T 011 55LJt 233 D W\\$*=t D DN & &C,,u/H /X/X/c/c/e/effgg
""r+ c | j rdS t j rdS d}t j | ddl}n3# t $ r& t d t j d Y nw xY w |
| st j | dS # t $ r' t d t j d Y dS w xY w)z4
Check that cagefs enabled for user
Nr- r rM r z;ERROR: CageFS version is unsupported. Please update CageFS.)ri r r8 rT r: r r0 r1 rS rU is_user_enabledr r8 AttributeError)rE rG r4 r0 s r* rt z"ClUserSelect._check_user_in_cagefs6 s F F$ 0 1 1 1 HQKKKKK ,,T22
9$24888
9
9 O P P P HQKKKKKK s$ A -A65A6:)B% %-CCc N | j st dS |t | j v S )a Is CloudLinux Isolates enabled for ``domain`` of ``user``?
The per-website scope only exists for an isolated website: CageFS
binds that website's ``cl.selector/`` and
``cl.php.d/`` over the account-level ones inside its
namespace, and no other domain ever reads them. So this is the
precondition for both reading and writing a per-domain setting.
Reads ``enabled_websites`` from
``/var/clwebisolate/users//.json`` -- the same source the
admin UI reports ``isolated`` from (`cloudlinux_cli._site_isolation_user`)
and the same one the account-level sync loop in
``switch_symlink_for_alt_php`` already uses. ``cagefs.mp`` mounts that
directory split-by-uid and the file is root: 0640, so the
answer is the same for root and for the user inside the jail.
Fails closed: in single-user mode (CageFS off) and without the cagefs
package there is no isolated website at all.
NF)ri r0 r[ rE rG re s r* rv z&ClUserSelect.website_isolation_enabledN s1 ( "2":5)$//@@@r+ c b |r*| || st j | dS dS )a Guard every per-domain WRITE. Raises before anything is touched.
CLOS-7489: without this, a per-domain write on a non-isolated domain
got half-way -- the per-website selector directory was created and
reported back as the domain's version -- and then died on the
``~/.cagefs/websites/`` overlay that only isolate-enable
creates. Refusing up front is what keeps "failed" and "recorded"
from disagreeing.
N)rv r WebsiteIsolationDisabledrP s r* r z'ClUserSelect._require_website_isolationf sN B$88vFF B 9&AA A B B B Br+ c D | ||r|j nd dS )z``Website``-object flavour of :meth:`_require_website_isolation`,
for the extension and option writers, which carry the scope as a
``Website`` rather than a domain name. ``None`` is account scope.
N)r re )rE rG websites r* _require_isolated_websitez&ClUserSelect._require_isolated_websites s+
''.QgnnTRRRRRr+ c t j | D ]`}| j |vr t j || }t j | sLt j | adS )zg
Removes all symlinks from directory
@param path: string
@return: None
N)r9 r r~ r: r> r r> )rE r: r r s r* r z'ClUserSelect._remove_alternatives_linksz sx
4(( ! !Hz)) T844I7>>),,
Ii
! !r+ c | j r | j | }|dz S t | j | }d}|r|rt | nd}t
j s0t j
| j |dd |dd nd}|r t j
|| n|S )zz
Composes and returns user alternative directory path
@param user: string
@return: string
z
/.cl.selectorr Nr. z cl.selectorz/etc/cl.selector) ri r< r r r r/ r r8 r9 r: r> CAGEFS_PATH)rE rG r^ r r document_root_idbases r* ru z#ClUserSelect._compose_user_alt_path s -k--d33G_, ,$+%%d++,, V@M U~m < < rB r rC ) file_paths r* _delete_if_symlinkz ClUserSelect._delete_if_symlink sv 7>>) $ $ l
l )$$$$$
l
l
l$5iAjkkk
l l ls 7 Ac | j | }|j }|j }t j }t j }||k r||fS t j | t j | t j
||fS # t $ r}t j
|| d}~ww xY w)z
Changes to another uid and returns tuple of previous euid and egid
@param user: string
@return: tuple
N)r< r= pw_uidpw_gidr9 rX getegidsetegidseteuidsecureioset_capabilityrB r UnableToChangeToAnotherUser)rE rG entrynew_uidnew_gidcur_euidcur_egidrJ s r* r@ zClUserSelect._change_uid s **400,,:<<:<< w X% % F Jw Jw # % % %X% % F F F B
B=#B88B=c L | d t j k rt j d t j | d t j | d dS # t $ r-}t j t | d | d}~ww xY wdS )zw
Restores changed uid and gid to original ones
@param uid_and_gid: tuple
@return: None
r T)clearr N)
r9 rX rh ri rf rg rB r rj r ) uid_and_gidrJ s r* rD zClUserSelect._restore_uid s q>RZ\\ ) ) #$ / / / /
Y
;q>***
;q>*****
Y
Y
Y$@[QR^ATATVWXXX
Y * )s 4A* *
B!4(B B!c | | } |s rA r r r r
renamechmodr r> ) rE rG
file_contentsr` createrI file_directoryrJ r temp_pathmasks r* _write_to_filezClUserSelect._write_to_file sW " - -d 3 3& :
"'..";";
H
% %&8 9 9 9 9 9G
# #I . . . W__Y 7 7N 7== 00
MM ON$OOOOO !67 M M M(9.!LLLM
'#djll*;*;; GLL A A ]]]+DEEE"W,w6@DIi333HY---- D W&;<
D
D
Dw~~i00 - ),,,D$5iCCC
D
% %&8 9 9 9 9 9L % %&8 9 9 9 9s !H2 AH2 )C H2 C,C''C,,H2 0AF& A F H2
F# H2 "F##H2 &H>3G21H2G64HHH2 2 Ic 6 t j }t d D ]8}| }| | j |j 8 n# t j $ r Y nw xY w t | }n# t j
f$ r Y dS w xY w t j D ]} || j
| j fvs0| | j dk rh|j }n# t j $ r Y w xY w || j vr t% j |t( j # t, f$ r Y w xY wdS # t, t. f$ r Y dS w xY w)z&
Reloads user process
N)psutilProcessr parentrq r pid
NoSuchProcessr r NoSuchUserException process_iteruidsreal effectivenamefindr~ r9 killsignalSIGHUPrB r )rE rG next_parentr r procr s r* r z ClUserSelect._reload_processes s .**K1XX
) 0 0 2 2 *)00 AAAA# D ''//$''CC)+ FF +--
499;;#3TYY[[5J"KKKtyy{{O_O_`d`jOkOkoqOqOq (CC + H $"777V]333 z H
! DD s AA A0/A04!B B*)B*.F A$D1(F )D10F 1E F EF (E0/F 0 E>;F =E>>F FFc g } t | }|D ]I}| d r2|d| d }| | J| n# t
t f$ r Y nw xY w|S )zH
Get extension names from user extensions file comments
z;--- z---)r rV rfindr closerB r )r:
extensionsr lineexts r* _skim_over_extensionsz"ClUserSelect._skim_over_extensions+ s
t**C
+
+??6** + q4::e#4#4 45C %%c*** IIKKKK! D s A/A4 4BBc | | t | o| j }|rt | nd}g }| || }t
j t
j | | d }|r t
j || }| } t
j | j
| d }
|r t
j |
| }
t
j |
s|
| } t j |
nH# t t" f$ r4} t$ | t) j |
| d} ~ ww xY wt$ | t
j |
d }
t
j | r*d| j d| || d d
}n d| j d }| | t3 | D ]}| j r |d z | d
d z dz }n8t
j |d| d
d d }| | }| d| j |dd t3 | d
| |d
| |
dS )a
Scans all user settings and backups'em in homedir as INI file
When ``document_root`` is given (an isolated per-domain config), the
backup is written to the per-website ``~/.cl.selector//``
directory and reflects the per-website ``cl.php.d/`` inis,
so ``cagefsctl`` regenerates the isolated config from it. Otherwise the
account-level backup is written as before. Without this, per-domain
extension changes were lost on ``cagefsctl --force-update`` (CLOS-4702).
@param user: string
@param document_root: str or None - domain docroot for the per-website backup
@param domain: str or None - domain name, used to record its PHP version
r zcl.php.dr Nr z [versions]
z = )re r rv z
= native
z/alt_php.r zalt-phpz alt_php.ini[z ]
modules = ,) rt boolri r/ ru r9 r: r> r r r< r rR r@ r r rB r r5 rD r rC r~ r{ r r r replacer r )rE rG r^ re per_website
website_idbackup_contents
user_alt_path
user_ext_pathr r rI rJ user_backup_filer] alt
curr_ext_pathr s r* r z ClUserSelect._backup_settings= sU
""4(((=))E$2E.E 6AI^M222r
33D-HH
RW__T5P5PQU5V5V%W%WYcdd
D GLL
C CM5577 7<< (?(?(E(E~VV J !w||,NOOOOOs -F G/GGc 8 | j rd S t || d S r. )ri r# )rE rG r] s r* r z ClUserSelect._switch_php_da_ispp s( F tW-----r+ r. )NTT)rm Nr% )F)NFFT)NN)NNF)T)5__name__
__module__ __qualname__rY r r r8 r rF r rK rg rl ro r{ rw r r\ r r r r r r r r r r r r r r( r6 rj r! r staticmethodr' rt rv r rU r ru r% ra r@ rD r r r r r r& r+ r* r5 r5 C s K#M#58#5#7#7f--=fK*N0MB B B B0T T T Tl h h h' ' ' 'H H H H*
Z
Z
Z
Z 8K: K: K:Z> > >
$
$
$ 4 aeE E E ENP? P? P? P?d3 3 2/ / / / b&6 &6 &6PI I I4 T T T3 3 3$ "o o o o2 #l?33O# # # 0A A A0 B B BS S S ! ! ! R R R R*& & &l l l & &899F F F* Y Y Y < --L/: /: /: /:b" " "H )L)> ? ?1P 1P 1P 1Pf. . . . .r+ r5 )@
__future__r r r r r9 rT rw r rh future.movesr r statr r r r
r future.utilsr pathlibr
r clselectr clselectexceptr r r clcommonr r
clselectprintr r r clcommon.utilsr clcommon.cpapir r r clcommon.cpapi.cpapiexceptionsr r r clcagefslib.constr clcagefslib.fsr clcagefslib.selector.configurer r! r" clcagefslib.selector.panel.dar# r1 r, #clcagefslib.webisolation.jail_utilsr/ clcagefslib.webisolation.configr0 r5 r& r+ r* r s' & % % % % % & & & & & &
5 5 5 5 5 5 < < < < < < < < < < < < < < " " " " " "
* * * * * * " " " " " " % % % % % % % % " " " " " " 0 0 0 0 0 0 = = = = = = = = = = N N N N N N N N N N ))))))......jjjjjjjjjjDDDDDDD
FEEEEEE BBBBBB@@@@@@@ #^N
p. p. p. p. p.8 p. p. p. p. p.s6 B3 3B>=B>C CC C% %
C21C2