�
v�{gc @ s
d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d l m Z d d l m! Z! d d l m" Z" d d l m# Z# d d l m$ Z$ d d l m% Z% d d l m& Z& d d l' m( Z( m) Z) m* Z* m+ Z+ m, Z, d d l$ m- Z- m. Z. m/ Z/ d Z0 d Z1 d� Z2 d Z3 d Z4 d� Z5 d" Z6 d# Z7 e j8 d$ e j9 � Z: e j8 d% � Z; e j< j= d& � r�e j< j> d' d& � n e j? d( d) e@ �eA r�d d* lB mC ZC mD ZD mE ZE mF ZF mG ZG mH ZH n e jI jJ e jK � d+ � ZL d, � ZM d- � ZN d. � ZO d/ � ZP d d0 � ZR d1 � ZS d2 � ZT d3 � ZU d4 � ZV d5 � ZW d6 � ZX d7 eY f d8 � � YZZ d9 e. f d: � � YZ[ d; e. f d< � � YZ\ d= e. f d> � � YZ] d? � Z^ e d@ � � Z_ d dA � Z` dB � Za dC � Zb i Zc dD � Zd ed e* je _f eg e dE d � s�yR d d lh Zi d d lj Zk ei jl jm ek jn � ei jl jm dF � k r�eo dG � � n Wn eo k
r�q�XdH � Zp e* jq Zr dI es f dJ � � YZt dK e* jq f dL � � YZu eu e* _q n e jv dM � Zw dN � Zx dO � Zy dP es f dQ � � YZz dR � Z{ dS � Z| eA dT � Z} dU � Z~ dV � Z eA dW � Z� dX � Z� dY � Z� dZ � Z� d[ � Z� d\ � Z� d] � Z� d^ � Z� d_ � Z� d` � Z� da � Z� db � Z� dc � Z� dd � Z� de � Z� df � Z� d dg � Z� dh � Z� di � Z� dj � Z� dk � Z� dl eA dm � Z� dn � Z� do � Z� dp � Z� dq � Z� dl eA dr � Z� ds � Z� dt � Z� du d� dv � � YZ� dw � Z� dx � Z� dy � Z� dz � Z� e j� e jv d{ � Z� d| � Z� e j� d} � Z� d~ � Z� d � Z� d� � Z� d d� � Z� d� � Z� d� � Z� d S(� i����( t print_functionN( t ArgumentParser( t datetime( t contextmanageri ( t config( t constants( t log_utils( t utils( t
process_utils( t platform_utils( t
http_utils( t auth( t config_handlers( t libcare( t selinux( t fetch( t update_utils( t errors( t kcare( t server_info( t URLErrort HTTPErrort httplibt urlencodet json_loads_nstr( t SafeExceptionWrappert
KcareErrort NotFoundic t v2t 12ht 24ht 48ht tests. /etc/sysconfig/kcare/freezer.modules.blacklists /usr/libexec/kcare/kcdoctor.shs latest.v2s /etc/sysconfig/kcare/sysctl.confi
s$ ==BLACKLIST==
(.*)==END BLACKLIST==
s' (kpatch.*|ksplice.*|kpatch_livepatch.*)s /usr/libexec/kcare/pythoni t ignoret category( t Optionalt Dictt Tuplet Anyt Uniont Setc C s_ t � } t j j t � r[ t t d � } x! | D] } | j | j � � q1 W| j � n | S( Nt r( t sett ost patht isfilet FREEZER_BLACKLISTt opent addt rstript close( t resultt ft line( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_blacklistJ s
c C sY | j d � } | r8 d j | d | | d g � } n d j | d | d g � } | S( Nt .i i����( t splitt join( t ptypet filenamet
name_parts( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _apply_ptypeT s
# c C sm t | t j � t _ t | t j � t _ t | t j � t _ t | t j � t _ t | t j � t _ d S( N( R= R t PATCH_BINt
PATCH_INFOt BLACKLIST_FILEt FIXUPS_FILEt
PATCH_DONE( R: ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_ptype] s
c
C s� t j � \ } } } d } t | t � r� t | t � r� y) d | j t j | j � | j f } Wq� t t
f k
r| q� Xnu t | t t
t f � r� t | t � r� d | } n@ t | t
� r� | j p� t | j � } | j p� d | j } n t j � } i t j d 6t j � d 6| d d 6| d d 6t | d
t | � � d 6| d 6d j t j | d
� � d 6t | d d � d 6S( Nt s [Errno %i] %s: '%s's %st
agent_versiont python_versioni t distroi t distro_versiont __name__t errort detailsid t tracebackt attempts( t syst exc_infot
isinstancet OSErrorR t errnoR+ t strerrorR; t AttributeErrort TypeErrort KeyErrort IOErrorR t etypet typet innerRK R t
get_distroR t VERSIONt get_python_versiont getattrt strR9 RL t format_tb( RX t valuet tbt details_sanitizedRG ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt format_exception_without_detailse s, )(
c C s� t j r
d St j t � � } t j t j t j | � � � } t j
d � d | } t j | t
j � � } y t j | � Wn t k
r� n Xd S( Ns /api/kcarectl-traces ?trace=( R t UPDATE_FROM_LOCALt jsont dumpsRd R t nstrt base64t urlsafe_b64encodet bstrt get_patch_server_urlR
t http_requestR t get_http_auth_stringt urlopen_baset Exception( t tracet
encoded_tracet urlt request( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt send_exc� s !
c C s t j � } | d k r, t j | d � d St j � t j � } | d k r^ t j d � n t j d � t t j d � �3 } t j | j
� d � t j | j
� d � Wd QX| r� t j | � n y | � Wn. t
k
rt j j d � t j d � n Xt j d � d S( s�
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
i Nt ai i s Wait exception( R+ t forkt waitpidt setsidt _exitR2 R/ R t LOG_FILEt dup2t filenot timet sleepRp R t kcarelogt exception( t funcR t pidt fd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
nohup_fork� s(
c C s� t j j t j d � } t j j | � r� t | d � �\ } yA t | j � � } | t j
t j � k r| t | | � � n Wn t
k
r� n XWd QXn t j | t j � � d S( s Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
s .kcareprev.lockR) N( R+ R, R9 R t PATCH_CACHER- R/ t intt readR t SUCCESS_TIMEOUTR~ t PreviousPatchFailedExceptiont
ValueErrorR t atomic_writet
timestamp_str( t anchor_filepatht afilet timestamp( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt touch_anchor� s
c C s� y# t j t j j t j d � � Wn t k
r6 n Xt d | � t j j
� y t d d � Wn! t k
r� t
j j d � n Xd S( s�
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
s .kcareprev.lockt donet reasons Cannot send update info!N( R+ t removeR, R9 R R� RQ t register_actionR t get_loaded_modulest cleart get_latest_patch_levelRp R R� R� ( t
state_data( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
commit_update� s #
c C s8 t j t j j t j d � d t j | | d � �d S( Nt patchest exclude_pathRD ( R t clean_directoryR+ R, R9 R R� R t get_cache_path( t khasht plevel( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt clear_cache� s c C s\ t j p d } d j | | g � } t j d | f } | rL | | f 7} n t j j | � S( Nt nonet -t modules( R t PREFIXR9 R R� R+ R, ( R� t fnamet prefixt
module_dirR3 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_current_level_path� s c C s) t j t | d � t | � d t �d S( Nt latestt
ensure_dir( R R� R� R_ t True( R� t patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt save_cache_latest� s c C sw t | d � } t j j | � rs y5 t t | d � j � j � � } t j | | � SWqs t
t f k
ro qs Xn d S( NR� R) ( R� R+ R, R- R� R/ R� t stripR t LegacyKernelPatchLevelR� RU ( R� t path_with_latestt pl( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_cache_latest� s !t CertificateErrorc B s e Z RS( ( RI t
__module__( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s t UnknownKernelExceptionc B s e Z d � Z RS( c C s9 t j | d j t j � d t j � t j � � � d S( NsL New kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.i ( Rp t __init__t formatR R[ t platformt releaseR t get_kernel_hash( t self( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s ( RI R� R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s t ApplyPatchErrorc B s e Z d � Z d � Z RS( c O sc t t | � j | | � | | _ | | _ | | _ | | _ t j � d | _ t
j � | _ d S( Ni ( t superR� R� t codet
freezer_stylet levelt
patch_fileR R[ RG R� R� ( R� R� R� R� R� t argst kwargs( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s c C sP d j | j | j | j | j | j d j g | j D] } t | � ^ q4 � � S( Ns0 Unable to apply patch ({0} {1} {2} {3} {4}, {5})s , ( R� R� R� R� RG R� R9 R� R_ ( R� t i( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt __str__ s ( RI R� R� R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR�
s R� c B s e Z d � Z d � Z RS( c O s/ t t | � j | | � | | _ | | _ d S( N( R� R� R� R� t anchor( R� R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� $ s c C s d } | j | j | j � S( Ns� It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file( R� R� R� ( R� t message( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� ) s ( RI R� R� R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� # s c C s� t j d j | � } y� t j | � } t j t j | j � � � } t | d � } | d k ro t
d � nE | d k r� t
d � n, | d k r� t
d � n t
d j | � � | SWn# t k
r� } t j
| | � n Xd
S( Ns" /nagios/register_key.plain?key={0}R� i s Key successfully registeredi s Wrong key format or sizei s! No KernelCare license for that IPs Unknown error {0}i����( R t REGISTRATION_URLR� R
t urlopenR t data_as_dictRh R� R� t printR R t print_cln_http_error( t keyRs t responset resR� t e( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt! set_monitoring_key_for_ip_license2 s
c c sU t j r" t j t j d t �n z d VWd t j rP t j t j d t �n Xd S( Nt shell( R t BEFORE_UPDATE_COMMANDR t run_commandR� t AFTER_UPDATE_COMMAND( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
execute_hooksF s c C s$ t � } | j } | j } t j � } | d k r� i t | � d 6t j d 6t j � d 6t
j � d 6| d 6t t
j � � d 6| d 6} t d � t t j | � � nu t d � t t | � � t d
t | � � t t j � t t j � � t t
j � � t | � t t
j � � d S( s1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
Rf t
updateCodet
autoUpdatet effectiveKernelt
realKernelt loadedPatchLevelt uptimet licenses --START--s LICENSE: N( t _patch_level_infoR� t applied_lvlR t license_infoR_ R t AUTO_UPDATER t kcare_unameR� R� R� R t
get_uptimeR� Rf Rg ( t fmtt plit update_codet loaded_plt license_info_resultt results( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt plugin_infoR s.
c C su t j � } y t d d � } Wn t k
r@ t j r< d Sd SX| d k rQ d S| | k ra d St j � rq d Sd S( NR� t infoi i i i ( R t loaded_patch_levelR� R� R t IGNORE_UNKNOWN_KERNELt NoneR t status_gap_passed( t
current_levelt latest_patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_update_status� s
c C s= t j � d \ } } | d k r5 | j d � r5 d Sd Sd S( Ni t
CloudLinuxs 7.t extraRD ( R R[ t
startswith( RG t version( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edf_fallback_ptype� s c C s� | j | j f } t j | | � } t j | | j � | _ | j j t j t j
d � | t k r~ | j j � d t | <n | j r� | j
� n d S( s� Function remembers IP address of host connected to
and uses it for later connections.
Replaces stdlib version of httplib.HTTPConnection.connect
i i N( t hostt portt CONNECTION_STICKY_MAPt gett sockett create_connectiont timeoutt sockt
setsockoptt IPPROTO_TCPt TCP_NODELAYt getpeernamet _tunnel_hostt _tunnel( R� t addrt
resolved_addr( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt sticky_connect� s t HAS_SNIs 0.13s% No pyOpenSSL module with SNI ability.c G s t S( N( R� ( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt dummy_verify_callback� s t SSLSockc B s, e Z d � Z d � Z d � Z d � Z RS( c C s | | _ d | _ d S( Ni ( t _ssl_connt _makefile_refs( R� R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s c G s( | j d 7_ t j | j d t | �S( Ni R2 ( R R� t _fileobjectR
R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt makefile� s c C s0 | j r, | j r, | j j � d | _ n d S( N( R R
R2 R� ( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR2 � s
c G s | j j | � S( N( R
t sendall( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s ( RI R� R� R R2 R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s t PyOpenSSLHTTPSConnectionc B s e Z d � Z RS( c C s
t j j | � t j j t j j � } | j t j j t j j B� t
j rg | j t j j
t � n | j t j j t � | j � t j j | | j � } | j � | j p� | j } | j | j � � | j � t
j r� t | j � | � n t | � | _ d S( N( R t HTTPConnectiont connectt OpenSSLt SSLt Contextt
SSLv23_METHODt set_optionst OP_NO_SSLv2t OP_NO_SSLv3R t CHECK_SSL_CERTSt
set_verifyt VERIFY_PEERR t VERIFY_NONEt set_default_verify_pathst
ConnectionR t set_connect_stateR R� t set_tlsext_host_namet encodet do_handshaket match_hostnamet get_peer_certificateR ( R� t ctxt connt server_host( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s
( RI R� R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR � s c C s� t j � } t j d k r4 t j | t t j � � SxLt D]D} t j r_ t j | | � } n, t j | t
| | � � d t j | � } y� t
j t j � | d t �} t j | j � t � t j | j � � j � } | r!| j d � r!t | � } t j | | d | d | d � St j | t | � � SWq; t k
rKq; t k
r~} | j d
k rxt d � � n � q; Xq; Wt! � � d S( Nt ?t
check_licenset {R� t baseurlR� i� i� s KC licence is required( i� i� (" R R� R t PATCH_LEVELR� R� R� t PATCH_LATESTRe t get_kernel_prefixed_urlt stickyfyR t based_server_infoR t wrap_with_cache_keyR t urlopen_autht FalseR t set_config_from_patchservert headerst update_all_kmod_paramsR Rh R� R� R� R t KernelPatchLevelR R R� R R� ( R� t modeR� R� Rs R� R� t latest_infot ex( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_patch_level� s.
, "
c C so | j t | t j � � } t j j d j | � � y! t j | d t
d d �t SWn_ t k
r� t j j d j | � � t
St
k
r� } t j j d j | t | � � � n X| j t | t j � t j � } t j j d j | � � y t j | d t
�Wn_ t k
r6t j j d j | � � t
St k
rj} t j j d j | t | � � � n Xt S( Ns Probing patch URL: {0}R, t methodt HEADs {0} is not available: 404sF HEAD request for {0} raised an error, fallback to the GET request: {1}s {0} is not available: {1}( t file_urlR= R R> R R� R� R� R R5 R6 R� R Rp t debugR_ R t SIGR ( R� R: t bin_urlR= Rs ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt probe_patch s(
&"
&c C sg | t j k r$ | j t j � } n | j | � } | j | � } t j | | t j d t j | � �S( Nt hash_checker(
R t KMOD_BINt kmod_urlRA t
cache_pathR t fetch_urlR t
USE_SIGNATUREt get_hash_checker( R� t nameRs t dst( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_and_verify_kernel_file3 s
t PatchFetcherc B sA e Z d d � Z d � Z d � Z d � Z d � Z d � Z RS( c C s
| | _ d S( N( R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� = s c C s t | j | � S( N( RO R� ( R� RM ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _fetch@ s c C s� | j j t j � } | j j t j � } | j j t j � } | j j t j � } t d � | | | | f D� � o� t j
j | � d k o� t j
j | � d k S( Nc s s! | ] } t j j | � Vq d S( N( R+ R, R- ( t .0R, ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>J s i ( R� RI R RB R> R? R RG t allR+ R, t getsize( R� t patch_done_patht patch_bin_patht patch_info_patht
kmod_bin_path( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt is_patch_fetchedC s "c C s� | j d k r t d � � n | j s. | j S| j � rN t j d � | j St j d � t | j t j � r� y( t j
| j j t j
� d d �} Wn t k
r� q� X| j j d d � } | r� | j j t j | � � | _ q� n y | j t j
� Wn5 t k
r6t d j | j t j p*d � � � n X| j t j � | j t j � | j � t j | j j t j � d d
d �t j t j! � | j S( Ns+ Cannot fetch patch as no patch level is sets Updates already downloadeds Downloading updatesR? R@ s KC-Base-Urlsf The `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch levelt defaultRD R; t wb(" R� R� R� RY R t loginfoRP R R� R R5 RA R R> R R8 R� t upgradeR Rh RQ R R� t
PATCH_TYPER? R RG t extract_blacklistR� RI RB R t restore_selinux_contextR� ( R� t respR. ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_patchO s8
(
$
%c C sq t | j j t j � d � j � } | rm t j | � } | rm t j | j j t j
� | j d � � qm n d S( NR) i ( R/ R� RI R R? R� t BLACKLIST_REt searchR R� R@ t group( R� t buft mo( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR_ w s
$c C s� | d k r d Sy t | t j � } Wn t k
r: d SX| j j d d � } | rq | j t j | � � } n | j
t j � } t | d � �2 } t g | j
� D] } | j � ^ q� � } Wd QXx | D] } t | | � q� Wt j t j � d S( s�
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Ns KC-Base-UrlR) ( R� RO R RA R R8 R� R] R Rh RI R/ R* t readlinesR� R R` R R� ( R� R� Ra R. t fixups_fnameR4 t fixupt fixups( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_fixups~ s
1
N( RI R� R� R� RQ RY Rb R_ Rl ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRP < s ( c C sI t � } t | j � | j t j k r8 t j d � n
t j d � d S( Ni i ( R� R� t msgR� t PLIt PATCH_NEED_UPDATERN t exit( R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_check� s
c C st t � } t | � } y t j � } Wn t k
r> i } n Xt j � } d } | d k r| t j | d � j
d � } n t j � } t | j
d g � � } t d � | D� � } t j � } | s� t d � n
t d � t d j | � � t d j | � � | d
k r't d j | � � n | d
k rIt d j | � � n | | d
k rft d
� n t d � d S( Nt Unknownt tss %Y-%m-%dR� c s s' | ] } t | j d g � � Vq d S( R� N( t lenR� ( RR t rec( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s s$ KernelCare live patching is disableds" KernelCare live patching is actives - Last updated on {0}s - Effective kernel version {0}i s* - {0} kernel vulnerabilities live patcheds- - {0} userspace vulnerabilities live patcheds% - This system has no applied patchess( Type kcarectl --patch-info to learn more( R� t _kcare_patch_info_jsonR
t libcare_patch_info_basicR R t get_stateR� R t
fromtimestampt strftimeR� Rt R� t sumR� R� R� ( R� t
kcare_infot libcare_infot statet
latest_updatet effective_versiont kernel_vulnerabilitiest userspace_vulnerabilitiesR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt show_generic_info� s4
c C s4 y� t d d d t j � } | s* t � n | j t j � } t j t j
| � j � � } | r� g i } } xU | j d � D]D } t j
| � } | r� d | k r� | j | � q} | j | � q} W| | d <t j | � } n t | � WnA t k
r} t j | | j � d St k
r/t d � n Xd S(
s�
Retrieve and output to STDOUT latest patch info, so it is easy to get
list of CVEs in use. More info at
https://cloudlinux.atlassian.net/browse/KCARE-952
:return: None
R� R� t policys
s kpatch-nameR� i s No patches availablei ( R� R t
POLICY_REMOTER� RA R R? R Rh R R5 R� R8 R� t appendt updateRf Rg R� R R R� Rs ( t is_jsonR� Rs t
patch_infoR� R3 t chunkt dataR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_latest_patch_info� s,
c C s� i | j d 6} | j d k r� t | � } g } xU | j d � D]D } t j | � } | rx d | k rx | j | � qA | j | � qA W| | d <n | S( NR� s
s kpatch-nameR� ( Rm R� R� t _kcare_patch_infoR8 R R� R� R� ( R� R3 R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRv � s
c C s| t j � } t j | | j t j � } t j j | � sH t d � � n t
| d � j � } | rx t j
d | � } n | S( Nsv Can't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.R) RD ( R R� R� R� R R? R+ R, R- R R/ R� Rc t sub( R� R� RI R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s c C sw t � } | sT | j d k r. t | j � n | j d k rA d St t | � � n t t j t | � d t
�� d S( Ni t sort_keys( R� R� R� Rm R� R� R� Rf Rg Rv R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� s c C sU t j d | g } t j | � } t j � } d } t j | | � t j | | � k S( Ns file-infos kpatch-build-time( R t
KPATCH_CTLR t check_outputR t _patch_infot get_patch_value( t new_patch_fileR� t new_patch_infot current_patch_infot build_time_label( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
is_same_patch s
c C sh | d k r t S| r& | | k r& t S| | k r6 t St j t j � | t j � } t | � sd t St S( Ni ( R6 R� R R� R� R R> R� ( t
applied_levelt new_levelR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_need_update s c C s� t j r� t j j t � o- t j t t j � sM t j j
d j t � � d St j
d d d t g d t �\ } } } | d k r� t j j
d j | � � q� n d S( Ns- File {0} does not exist or has no read accesss /sbin/sysctls -qs -pt catch_stdouti s% Unable to load kcare sysctl.conf: {0}( R t UPDATE_SYSCTL_CONFIGR+ R, R- t
SYSCTL_CONFIGt accesst R_OKR R� t warningR� R R� R� ( R� t _( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
update_sysctl, s '* c s� t j j t � s( t t d � j � n t j t t j � sZ t j j
d j t � � d St t d � �� } | j � } | j
d � x: | D]2 � t � f d � | D� � s� | j � � q� q� Wx | D] } | j | d � q� W| j � Wd QXd S( s* Update SYSCTL_CONFIG accordingly the editsRv s File {0} has no read accessNs r+i c 3 s | ] } � j | � Vq d S( N( R� ( RR R) ( R5 ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>F s s
( R+ R, R- R� R/ R2 R� R� R R� R� R� Rh t seekt anyt writet truncate( R� R� t sysctlt linesRv ( ( R5 s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edit_sysctl_conf6 s
c C s< x5 | D]- } t j | � r t d j | � � � q q Wd S( NsD Detected '{0}' kernel module loaded. Please unload that module first( t CONFLICTING_MODULES_REt matchR R� ( R� t module( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt detect_conflicting_modulesN s
c C s d j t j � � S( Ns /lib/modules/{0}/extra/kcare.ko( R� R t get_system_uname( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kcare_kmod_linkT s c C ss t d d � } t j t j � | t j � } t j j | � sC d St | d � � } | j
� d d k SWd QXd S( NR� R� t rbi��s ~Module signature appended~
( R� R R� R� R RG R+ R, R- R/ R� ( R� t kmod_filet vfd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kmod_is_signedX s c K s� d | g } x3 | j � D]% \ } } | j d j | | � � q Wt j | d t �\ } } } | d k r� t d j | | � � � n d S( Ns /sbin/insmods {0}={1}R� i sL Unable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.( t itemsR� R� R R� R� R ( t kmodR� t cmdR� Ra R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kmoda s c C s\ t j � r% t � r% t d � � n t j � sI t j � sI t j � rX t d � � n d S( Ns4 Secure boot is enabled. Not supported by KernelCare.sW You are running inside a container. Kernelcare should be executed on host side instead.( R t is_secure_bootR� R t inside_vz_containert inside_lxc_containert inside_docker_container( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_compatibilityj s $c C sv t j d � } t j | d g d t d t �d d k } | rr | d
k rr t j d j | � � t j d � n d S( Nt modinfot kmodlveR� t catch_stderri t freeR� s3 {0} patch type conflicts with kmodlve kernel modulei ( R� s extra( R t find_cmdR� R� R t logerrorR� RN Rp ( R: R� t has_kmodlve( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_patch_type_compatibilityq s
+c C ss t j d d d | g � } g } xK | j d � D]: } | j � r1 | j d � \ } } } | j | � q1 q1 W| S( Ns
/sbin/modinfos -Ft parms
t :( R R� R8 R� t partitionR� ( t
kcare_linkt stdoutt available_paramsR5 t
param_nameR� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kmod_available_params| s c C s� i t j r d n d d 6t j r( d n d d 6t j rA t j n d d 6t t j t � rc t j n d d 6t j ry d n d d 6S( Ni i t kpatch_debugt kmsg_outputt kcore_outputRD t
kdumps_dirt enable_crashreporter( R t KPATCH_DEBUGt KMSG_OUTPUTt KCORE_OUTPUTt KCORE_OUTPUT_SIZERP t
KDUMPS_DIRR_ t ENABLE_CRASHREPORTER( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt make_kmod_new_params� s "c C sc t j r2 t j j t j � r2 t j t j � n x* t � j � D] \ } } t | | � qB Wd S( N( R R� R+ R, t existst makedirsR� R� t update_kmod_param( t paramt val( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR9 � s c C s� d } t j j | | � } t j j | � s1 d Sy/ t | d � � } | j t | � � Wd QXWn' t k
r� t j j
d | | � n Xd S( Ns /sys/module/kcare/parameterst ws! failed to set %s kmod param to %s( R+ R, R9 R� R/ R� R_ Rp R R� RJ ( t kmod_param_namet param_valuet params_roott
param_pathR4 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s
c s� t � } t j | | t j � } y t j | | � Wn t k
rN | } n Xt j r� t
j j t j � r� t
j
t j � n t � } t | � � t � f d � | j � D� � } t | | � t � d S( Nc 3 s- | ]# \ } } | � k r | | f Vq d S( N( ( RR t kt v( t available_kmod_params( s. /usr/libexec/kcare/python/kcarectl/__init__.pys <genexpr>� s ( R� R R� R RG t shutilt copyRp R R� R+ R, R� R� R� R� t dictR� R� t
update_depmod( R� R� R� t
kcare_filet kmod_params( ( R� s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kcare_kmod� s
"
c C s� d g } | d k r+ | j d | g � n t j | d t d t �\ } } } | r� t j d j d j | � | | � d t �n d S( Ns /sbin/depmods -aR� R� s% Running of `{0}` failed with {1}: {2}t t print_msg(
R� t extendR R� R� R R� R� R9 R6 ( t unameR� R� R� t stderr( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s $c C sO t j d | g d t �\ } } } | d k rK t d j | | � � � n d S( Ns /sbin/rmmodR� i s Unable to unload {0} kmod {1}( R R� R� R R� ( t modnameR� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt unload_kmod� s $ c C su g } xh d g | D]Y } t j | | d j | � � } t j j | � r t | � | j d j | � � q q W| S( Nt vmlinuxs fixup_{0}.kos fixup_{0}( R R� R� R+ R, R� R� R� ( R� R� R� t loadedt modt modpath( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_fixups� s
c C sK xD | D]< } y t | � Wq t k
rB t j j d | � q Xq Wd S( Ns$ Exception while unloading module %s.( R� Rp R R� R� ( Rk R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
remove_fixups� s
c C s� | r | } nM t j r$ t j } n8 t � j | � rI d | t j t f Sd | t j t f Si d d 6d d 6d d 6d d 6d d 6} | j � } | | k r� | | } n! t d
j | | t j t � � � | | t j t f S( Nt freeze_conflictRZ t freeze_nonet NONEt NOFREEZEt
freeze_allt FULLt FREEZEt SMARTs3 Unable to detect freezer style ({0}, {1}, {2}, {3})( R t PATCH_METHODR6 t intersectionR� R6 t upperR R� ( t freezerR� R? t patch_method_map( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_style� s$
!RD c sZ i | d 6| d 6| d 6� t d � � t j � } t j � } t | � t | | � } t j | | t j � } t | | � d j
| t j t j
� t j | � � } d | k }
|
o� t j | | � } | d k } | o� t | � o� t j | � }
� j i | d 6| d 6� |
r+t d � � d S| r�t d
� � t | | | � } t d � � t | � t d � � t | � n | r�t d
� � t d � t }
n |
s�t d � � t | | � n | r�t � n t d � � t | | | | | � t � t j d j
| t j � � � t j! � t d � � t" � f d � d t j# �d S( NR� t futureR; t starts {0}-{1}:{2};{3}R t currentt kmod_changedR� t fxpt unpatcht unfxpt unloadt loadt patchs5 Patch level {0} applied. Effective kernel version {1}t waitc s
t � � S( N( R� ( ( R� ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt <lambda>; s R ($ R� R R� R� R� R R� R R> R� R� R^ R R� t parse_unamet is_kmod_version_changedR� R� t kcare_update_effective_versionR� R� t kpatch_ctl_unpatchR� R� R6 R� R� t kpatch_ctl_patchR� R R\ R� R t touch_status_gap_fileR� R� ( R� R� R; R t
use_anchorR� R� R� R� t descriptiont kmod_loadedR t patch_loadedt
same_patchRk ( ( R� s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
kcare_load� sR
$ !
c C s� t j g } t j | | t j � } t j j | � rL | j d | g � n | j d d | g � | j d | d g � | j
| � t j | d t
�\ } } } | d k r� t | | | | � � n d S( Ns -bR s -ds -mi R� ( R R� R R� R R@ R+ R, R� R� R� R R� R� R� ( R� R� R� R R� R� t blacklist_fileR� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR > s
c C s� t j t j d d | d g d t d t �\ } } } | d k r� t j d j | | � d t �t d j | t
| � � � � n d S( NR s -mi R� R� s4 Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}R� s Error unpatching [{0}] {1}( R R� R R� R� R R� R� R6 R R_ ( R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR K s
1 c C sL | | d <t t j � � | d <t j t j j t j d � t | � � d S( Nt actionRs s kcare.state(
R� R~ R R� R+ R, R9 R R� R_ ( R" R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� U s
c C s� d } t j j | � s d Sx t j | � D]n } t j j | | d d � } t j j | � se q, n t j | � } | | k r, t j | � t | � q, q, Wd S( Ns /usr/lib/modules/s weak-updatess kcare.ko( R+ R, t isdirt listdirR9 t islinkt readlinkt unlinkR� ( t kmod_linkt modules_patht entryt
sym_link_patht target_path( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt update_weak_modules[ s
c
C s� t j � } t � } y | j | � Wn1 t k
rY } | sZ t d j | � � � qZ n Xt j � } t | | � } t � �1d | k rv| d k } | rEt t j � | | � } t
j t j d d | d g d t d t �\ } }
} t | � | d k rEt j d j |
| � d t �t d
j | t | � � � � qEn t j t j t � d d d
t �t � d � n t � } t j j | � r�t j! | � n t" | � Wd QXd S( Ns� Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.R R s -mi R� R� s4 Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}R� s Error unpatching [{0}] {1}t counti t delay(# R R� RP Rl Rp R R� R� R R� R� R� R� R R� R R� R� R� R R� R6 R_ R t retryR t check_exct UNLOAD_RETRY_DELAYR� R� R+ R, R- R' R- (
R t forceR� t pft errR� R� t need_unpatchRk R� R� R� R( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_unloadk s8
1
$1 c C sL t � } | r t | � S| j d k r/ | j S| j d k rH t j � Sd S( Ni ( R� t _kcare_info_jsonR� Rm R� R� R R� ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR| � s
c C sw i | j d 6} | j d k r] | j t j t j � � � | j t j | j d � � � n | j
| d <t j | � S( NR� s kpatch-descriptions kpatch-state(
Rm R� R� R� R R� R R� t parse_patch_descriptionR� R~ Rf Rg ( R� R3 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR8 � s "
Rn c B s) e Z d Z d Z d Z d Z d � Z RS( i i i i c C s1 | | _ | | _ | | _ | | _ | | _ d S( N( R� Rm t
remote_lvlR� R~ ( R� R� Rm R: R� R~ ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s
( RI R� R0 Ro t PATCH_UNAVALIABLEt PATCH_NOT_NEEDEDR� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRn � s
c C sU t j � } y� t d d � } | rg t | | � rM t j d d } } } q� t j d d } } } n= | d k r� t j d d } } } n t j d d } } } t | | | | | � } Wn� t k
rPt j } t
j r
d
j t
j t
j � d t j � � } n+ d j t
j � d t j � t j � � } t | | d d d � } n X| S(
NR� R� s* Update available, run 'kcarectl --update'.t applieds The latest patch is applied.i s( This kernel doesn't require any patches.t unsetsD No patches applied, but some are available, run 'kcarectl --update'.su Invalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingssL New kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.t unavailable( R R� R� R� Rn Ro R0 R< R� R; R t STICKY_PATCHR� R R[ R� R� R� R� ( t current_patch_levelt new_patch_levelR� Rm R~ R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� � s8
%% c C s� d } y t j � } t d | f d | f g � } t j d j | � } t j | � } t j
t j | j � � � } t
| d � SWnp t k
r� } t j | | � d St k
r� } t j | | � d St k
r� } t j d j | � � d SXd S(
s�
Request to tag server from ePortal. See KCARE-947 for more info
:param tag: String used to tag the server
:return: 0 on success, -1 on wrong server id, other values otherwise
t server_idt tags /tag_server.plain?{0}R� i����i����s Internal Error {0}i����N( R� R t get_serveridR R R� R� R
R� R R� Rh R� R� R R R� R Rp R� ( RD Rs RC t queryR� R� R� t uet ee( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
tag_server� s" c C s t j d � } t j d j | � � t } t j � �� } yQ t j | | j
� } t j t j
| � | j
� t j | j
| � | j
} Wn) t k
r� } t j d j | � � n Xt j d | t j g d t �\ } } } | rt d j | | � � � n Wd QXd S( Ns doctor.shs# Requesting doctor script from `{0}`s3 Kcare doctor error: {0}. Fallback to the local one.t bashR� s Script failed with '{0}' {1}( R Rl R t logdebugR� t KCDOCTORt tempfilet NamedTemporaryFileR t fetch_signatureRM t save_to_fileR
R� t check_gpg_signatureRp R� R R� R t PATCH_SERVERR� R ( t
doctor_urlt doctor_filenamet
doctor_dstt signatureR5 R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcdoctor
s
*c C sO t j d j t � � } y t j | � Wn t k
r= t SXt j d � t
S( Ns {0}-new-versionsw A new version of the KernelCare package is available. To continue to get kernel updates, please install the new version( R Rl R� t EFFECTIVE_LATESTR
R� R R6 R R\ R� ( Rs ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_new_kc_version s
c C s t j � } t | � } | t j k p? | t j k o? | d k } y t | | � } Wn8 t k
r� } | rs � q� t j
j d j | � � n X| t j k r� | } n] | } | d k r| t j
k r� t j | d � } q| t j k r� | } qt d � � n | S( s�
Get patch level to apply.
:param reason: what was the source of request (update, info etc.)
:param policy: REMOTE -- get latest patch_level from patchserver,
LOCAL -- use cached latest,
LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:return: patch_level string
s Unable to send data: {0}i s9 Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRSTN( R R� R� R R� t POLICY_LOCAL_FIRSTR� R> Rp R R� R� R� t POLICY_LOCALR� R ( R� R� R; R� t cached_levelt consider_remote_ext remote_levelR= R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR� ( s& * c C s� | d k r d S| d k r" d n | t _ t t d d � t j � r� t j d t j � t j d k r� t j � r� t j p� t } t
d d d j | � f � n t j
d
j | � � n t d j | � � � d S( Nt edfRZ RD R� t probeR^ R� R� s fs.enforce_symlinksifowners fs.symlinkown_gids fs.enforce_symlinksifowner=1s fs.symlinkown_gid={0}s '{0}' patch type selecteds/ '{0}' patch type is unavailable for your kernel( s frees extra( s fs.enforce_symlinksifowners fs.symlinkown_gid( R R^ RE R> R t
update_configR t is_cpanelt FORCE_GIDt
CPANEL_GIDR� R� R R\ R ( R: t gid( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt update_patch_typeM s c C s� t j � t t j � | t j k r0 t � n y t d d d | d | � } WnW t k
r� } | t j
t j f k r� t j r� t
| � } t j j | � d S� n Xt j � } t | � } | j � t d | d | � s� t j d � d Sy< t j t j d d
d d �t j t j d d
d d
�Wn! t k
rPt j j d � n Xt j � } | t j
k sut j r�t � �4 | j | � t | | | | d | t j k �Wd QXn t! | | � d S( sx
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:param policy: REMOTE -- download latest and patches from patchserver,
LOCAL -- use cached files,
LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases
:param freezer: freezer mode
R� R� R� R; NR� R� s% No updates are needed for this kernelt keep_ni t patterns kcore*.dumps kmsg*.logs# Error during crash reporter cleanupR (" R t log_all_parent_processesR� R R^ R R� RY R� R� t UPDATE_MODE_AUTOt UPDATE_MODE_SMARTR� R_ R R� R� R R� RP Rb R� R\ R R� R� Rp R� R� R� R� Rl R R� ( R R; R� R� R� Rm R� R4 R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt do_updatec s:
!
+c C s� t t t j � t t j p! t j � t t j p6 t j � f � } | d k r] t d � � n t j rm t j S| t j
k r� t j p� t j } t j p� t j } n t j } t j } | r� | S| r� d | Sd S( Ni s� Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of thems release-( R{ t boolR R@ t UPDATE_DELAYt AUTO_UPDATE_DELAYt STICKY_PATCHSETt AUTO_STICKY_PATCHSETR R t UPDATE_MODE_MANUAL( R; R. R/ t patchset( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
get_sticky� s$ c C s | d | S( NR7 ( ( R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _stickyfy� s c C sj t | � } | s | S| d k r/ t | | � St j � } | sa t j j d � t j d � n y# t j
t j d j
| � � } Wn3 t k
r� } t j | | j � t j d � n Xt j t j | j � � � } t | d � } | d k rt | d | � S| d k r| S| d
k rAt j j d � t j d � n t j j d
| d � t j d � d S( s�
Used to add sticky prefix to satisfy KCARE-953
:param file: name of the file to stickify
:return: stickified file.
t KEYsH Patch set to STICKY_PATCH=KEY, but server is not registered with the keyi����s! /sticky_patch.plain?server_id={0}i����R� i R� i i sE Server ID is not recognized. Please check if the server is registeredi����s Error: R� i����N( Rt Ru R RE R R� R� RN Rp R
R� R R� R� R R� Rs R R� Rh R� R� ( t fileR; t sRC R� R� R� R� ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR2 � s2
# c
C sR g } | s t S| j d � } | d } | d } | j d � } | | k rg t d t | � � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t j | � � n" | j t j | � j
d d � � x$ | D] } | j t j | � � q� Wt j d
d j | � d t j
� } | j | � S(
sh Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
R7 i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( R6 R8 R. R� t reprt lowerR� R� t ret escapet replacet compileR9 t
IGNORECASER� (
t dnt hostnamet
max_wildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _dnsname_match� s(
"
&c
C s� g } xx t | j � � D]d } | j | � } | j � d k r g t | � j d � D] } | j � j d d � ^ qV } q q W| s� t d � � n g } xC | D]; \ } } | d k r� t | | � r� d S| j | � q� q� W| s| j
� j } t | | � r
d S| j | � n t | � d k rYt
d j | d j t t | � � � � � n= t | � d k r�t
d j | | d
� � � n t
d � � d S( Nt subjectAltNamet ,R� i st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt DNSs( hostname {0} doesn't match either of {1}s , s hostname {0} doesn't match {1}i s= no appropriate commonName or subjectAltName fields were found( t ranget get_extension_countt
get_extensiont get_short_nameR_ R8 R� R� R� R� t get_subjectt
commonNameRt R� R� R9 t mapRz (
t certR� t sanR� R� t itt dnsnamesR� Ra t cn( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR& s0 A - c C s� t d d d d � } | j d d d d d �| j d
d d d d d �| j d
d d d d �| j d d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d d d d d �| j d! d d" d d �| j d# d d$ d d �| j d% d d& d d �| j d' d d( d d �| j d) d d* d d+ �| j d, d d- d d �| j d. d d/ d d �| j d0 d d1 d d �| j d2 d d3 d d �| j d4 d d5 d d �| j d6 d d7 d d8 �| j d9 d d: d d; �| j d< d d= d d �| j d> d d? d d+ �| j d@ d dA d d �| j dB d dC d d �| j dD d dE d d �| j dF d dG d d �| j dH d dI d d �| j dJ d dK d d �| j dL d dM d d �| j dN d dO d d �| j dP d dQ d dR dS t dT d dU t �| j dV d dW d d �| j dX d dY d d �| j � } | j dZ d d[ d dR �| j d\ d d] d d �| j d^ d d_ d d �| j d` d da d dR dT d dU t �| j db dc d dd d d dU t �| j de d df �| j dg d dh d d �| j di d dj d dk d dl �t j s�| j dm d dn do dp d dq dr t �| j ds d dt do dp d dq dr t �| j du d dv d d �| j dw dx d dy d d �| j dz d d d d �| j d{ d| d d} d d �| j d~ d d d� d d �| j d� d� d d� d d� �| j d� d d� d� d� dr d d d� �| j d� d d� d d �| j d� d d� d d �n | j � } t j
j t j
� � t j st j d� g 7_ n | j d k rWt t d | j j d� � � � j t j � rPd� Sd� Sn | j si| j r�t j r�t j t _ q�t j t _ n | j r�t j t _ n | j s�t j � d� k r�t d� d� t! j" �d� Sn t# j$ } | j r�t# j% } n | j rt# j& } n t' j( | � | j) r3t* j+ � n | j, r�| j, d� k rst- | j, � t _. t j/ d� t j. � q�d t _. t j/ d� d � n | j0 d k r�t j/ d� | j0 � | j0 t _1 n | j2 r�t t _3 n | j4 r�t t _5 n | j6 r�t t _7 n | j8 rt8 � n | j9 r.t: j; d� t< � nN | j= r|t j> d� k r|t j? d� k r[d n t j? pgdT | _@ t | _ q|n | jA r�| jA t _B n | jC r�t: j; d� t< � d� t _B n t jB jD d� � t _B t jB r t jB tE k r t' jF jG d� jH t jB d� jI tE � � � n | jJ r6 t t _K d� | jJ t _L n | j@ rO tM | j@ � n t j> d� k r� tN � t _> t: j; d� jH t j> p� dT � t< � n | jO r� t tP jO d� | jQ � � d StR t j> � | jS r� tT � d S| jU r
| jQ r� tU d� d� � n tU � d S| jV r
t j/ d� d� � d S| jW r=
t j/ d� d� � d S| jX rZ
t jY | jX � d S| jZ rp
t[ | jZ � S| j\ r�
t] j\ � n | j^ r�
t j> d� k r�
t j/ d� d� � n t] j^ | j^ | j_ � S| j` r�
t] j` � d� k r�
d� Sd� Sn | ja d k r tb | ja � S| jc r" t t jd � n te | dp d � d k rN tf jg | jh � d� St j s
| ji rj tf jj � S| jk r� tf jl � d k r� t' jm d� � q� n | jn r� tf jl d� t jo � n# | jp r� tf jq � t' jm d� � n | jr r� t tf js � � n | jt r t tf ju � � n | jv r@ tf jw � r@ t tf jx | jv � � n | jy d k r� | jy d k r t jz py t{ tf j| j} � � } n1 g | jy j d� � D] } | jD � j~ � ^ q� } tf jl d� t | � � d k r� t' jm d� � q� n | j� r
tf jl d� t jo d� d � q
n | j� r+
t t� d� | jQ � � n d } | j� rS
t: j; d� t< � d� } n | j� rh
| j� } n | j� r�
t� | d� t j� d� t j� �n | j r�
t� | d� t j� �t' jm d� � n | j r�
t t� j� � � n | j� rt� | d� | j� �t' jm d� � n | j rEt t _� t� j� t� j� d� d� � � t� | d� t jo �n | j� rat� d� | jQ � n | j� rqt� � S| j� r�t� d� | jQ � n | j� r�t� � n t� t! j� � d� k r�t� � n d S(� Nt progt kcarectlR s) Manage KernelCare patches for your kernels --debugt helpRD R" t
store_trues -is --infos] Display information about KernelCare. Use with --json parameter to get result in JSON format.s
--app-infosc Display information about KernelCare agent. Use with --json parameter to get result in JSON format.s -us --updates< Download latest patches and apply them to the current kernels --unloads Unload patchess --smart-updates, Patch kernel based on UPDATE POLICY settingss
--auto-updates- Check if update is available, if so -- updates --localsN Update from a server local directory; accepts a path where patches are locatedt metavart PATHs --patch-infos" Return the list of applied patchess --freezers) Freezer type: full (default), smart, noneR s
--nofreezes/ [deprecated] Don't freeze tasks before patchings --unames Return safe kernel versions --license-infos Return current license infos --statuss Return status of updatess
--registers Register using KernelCare KeyRv s --register-autoretrys= Retry registering indefinitely if failed on the first attempts --unregisters7 Unregister from KernelCare (for key-based servers only)s --checks Check if new update availables --latest-patch-infosi Return patch info for the latest available patch. Use with --json parameter to get result in JSON format.s --tests& [deprecated] Use --prefix=test insteads --tags7 Tag server with custom metadata, for ePortal users onlyt TAGs --prefixsp Patch source prefix used to test different builds by downloading builds from different locations based on prefixR� s
--nosignatures Do not check signatures --set-monitoring-keysP Set monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlys --doctors@ Submits a vitals report to CloudLinux for analysis and bug-fixess --enable-auto-updates Enable auto updatess --disable-auto-updates Disable auto updatess
--plugin-infos Provides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.s --jsonso Return '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formats --versions( Return the current version of KernelCares --kpatch-debugs Enable the debug modes --no-check-certs2 Disable the patch server SSL certificates checkings --set-patch-levelsB Set patch level to be applied. To select latest patch level set -1t storeRY RZ t requireds --check-compatibilitys Check compatibility.s
--clear-caches Clear all cached filess --set-patch-types@ Set patch type feed. To select default feed use 'default' options
--edf-enableds" Enable exploit detection frameworks --edf-disableds# Disable exploit detection frameworks --set-sticky-patchsj Set patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unsticks -qs --quiets= Suppress messages, provide only errors and warnings to stderrs --has-flagss Check agent featuress --forces- Force action and ignore several restristions.s --set-configs Change configuration optionR� s KEY=VALUEs --disable-libcares Disable libcare servicest destt enable_libcaret store_constt consts --enable-libcares Enable libcare servicess --lib-updatesI Download latest patches and apply them to the current userspace librariess --lib-unloads --userspace-unloads Unload userspace patchess --lib-auto-updates
--lib-infos --userspace-infos& Display information about KernelCare+.s --lib-patch-infos --userspace-patch-infos, Return the list of applied userspace patchess
--lib-versions --userspace-versions Return safe package versiont PACKAGENAMEs --userspace-updatet USERSPACE_PATCHESt nargsR+ sO Download latest patches and apply them to the corresponding userspace processess --userspace-auto-updates --userspace-statuss" Return status of userspace updatess libcare-enabledR� i i s Please run as rootRw R/ R@ sT Flag --edf-enabled has been deprecated and will be not available in future releases.R_ sM Flag --test has been deprecated and will be not available in future releases.R t /s( Prefix `{0}` is not in expected one {1}.R� s file:s+ edf patches are deprecated. Fallback to {0}R� R� Rf R� t YESt NOR� R^ R� s Userspace patches are applied.R; s Userspace patches are unloaded.t limitsQ Flag --nofreeze has been deprecated and will be not available in future releases.R� R� s Kernel is safeR3 s= KernelCare protection disabled. Your kernel might not be safei< (� R t add_argumentR� R� R6 t add_mutually_exclusive_groupR t LIBCARE_DISABLEDR� t
parse_argst __dict__R� R t get_config_settingst FLAGSt has_flagsR* t filterR8 t issubsett quiett auto_updatet SILENCE_ERRORSR t PRINT_CRITICALt PRINT_LEVELt PRINT_ERRORRB t PRINT_DEBUGR� R+ t getuidR� RN R� t loggingt INFOt WARNINGt DEBUGR t initialize_loggingR� R t clear_all_cachet set_patch_levelR_ R/ Ra t set_sticky_patchR@ t nosignatureRK t
no_check_certR R� R� R� t edf_enabledt warningst warnt DeprecationWarningt edf_disabledR^ t PREV_PATCH_TYPEt set_patch_typeR� R� R R� t EXPECTED_PREFIXR� R� R� R9 t localRe RR Rf R� t app_infoR Rf RC t doctorRW R� t enable_auto_updatet disable_auto_updatet
set_configt update_config_from_argst set_monitoring_keyR� t
unregisterR t registert register_autoretryR� RD RI R� R\ R^ R
t set_libcare_statusR� t userspace_statust get_userspace_update_statust
lib_updatet do_userspace_updateR\ t lib_auto_updateRj t
lib_unloadt libcare_unloadt lib_infoR} t lib_patch_infot libcare_patch_infot lib_versiont libcare_server_startedt libcare_versiont userspace_updateR� t listt
USERSPACE_MAPt keysR{ t sortedt userspace_auto_updateR� R| t nofreezeR t smart_updateRl Rk t
UPDATE_POLICYRr R R� R R7 R3 t CHECK_CLN_LICENSE_STATUSR~ R t randomt uniformR� t statusR� t latest_patch_infoR� t checkRq Rt t argvR� ( t parsert exclusive_groupR� R� R� t ptchR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt mainD s -
' + %
!1
( R R R s test( s latest.v2( (� t
__future__R Ri Rf R� R+ R� R� R| R� R� t sslRN RM R~ RL R� t argparseR R t
contextlibR RD R R R R R R R
R R R
R R R R R R t py23R R R R R R R R Rd RX R� R. RL R0 R� R2 R t DOTALLRc R� R, R# t insertt filterwarningsR� R6 t typingR# R$ R% R& R' R( R� t setLevelR� R6 R= RC Rd Ru R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R R R R^ t distutils.versiont distutilst OpenSSL.SSLR R� t
StrictVersiont __version__t ImportErrorR t HTTPSConnectiont PureHTTPSConnectiont objectR R Rr R> RE RO RP Rq R� R� Rv R� R� R� R� R� R� R� R� R� R� R� R� R� R� R9 R� R� R� R� R� R� R R R R R� R- R7 R| R8 Rn R� RI RW RY R� R� Rf Rl Rt Ru R2 R� R& R� ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt <module> s ( 1
%
4
'
` #
?
, 2
% 6 , 3 )