??????????????
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 173
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 174
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 175
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 176
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 177
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 178
)gc @ s d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d l m Z d d l m! Z! d d l m" Z" d d l m# Z# d d l m$ Z$ d d l m% Z% d d l m& Z& d d l' m( Z( m) Z) m* Z* m+ Z+ m, Z, d d l$ m- Z- m. Z. m/ Z/ d Z0 d Z1 d Z2 d Z3 d Z4 d Z5 d" Z6 d# Z7 e j8 d$ e j9 Z: e j8 d% Z; e j< j= d& re j< j> d' d& n e j? d( d) e@ eA rd d* lB mC ZC mD ZD mE ZE mF ZF mG ZG mH ZH n e jI jJ e jK d+ ZL d, ZM d- ZN d. ZO d/ ZP d d0 ZR d1 ZS d2 ZT d3 ZU d4 ZV d5 ZW d6 ZX d7 eY f d8 YZZ d9 e. f d: YZ[ d; e. f d< YZ\ d= e. f d> YZ] d? Z^ e d@ Z_ d dA Z` dB Za dC Zb i Zc dD Zd ed e* je _f eg e dE d syR d d lh Zi d d lj Zk ei jl jm ek jn ei jl jm dF k reo dG n Wn eo k
rqXdH Zp e* jq Zr dI es f dJ YZt dK e* jq f dL YZu eu e* _q n e jv dM Zw dN Zx dO Zy dP es f dQ YZz dR Z{ dS Z| eA dT Z} dU Z~ dV Z eA dW Z dX Z dY Z dZ Z d[ Z d\ Z d] Z d^ Z d_ Z d` Z da Z db Z dc Z dd Z de Z d df Z dg Z dh Z di Z dj Z dk eA dl Z dm Z dn Z do Z dp Z dk eA dq Z dr Z ds Z dt d du YZ dv Z dw Z dx Z dy Z e j e jv dz Z d{ Z e j d| Z d} Z d~ Z d Z d d Z d Z d Z d S( i( t print_functionN( t ArgumentParser( t datetime( t contextmanageri ( t config( t constants( t log_utils( t utils( t
process_utils( t platform_utils( t
http_utils( t auth( t config_handlers( t libcare( t selinux( t fetch( t update_utils( t errors( t kcare( t server_info( t URLErrort HTTPErrort httplibt urlencodet json_loads_nstr( t SafeExceptionWrappert
KcareErrort NotFoundic t v2t 12ht 24ht 48ht tests. /etc/sysconfig/kcare/freezer.modules.blacklists /usr/libexec/kcare/kcdoctor.shs latest.v2s /etc/sysconfig/kcare/sysctl.confi
s$ ==BLACKLIST==
(.*)==END BLACKLIST==
s' (kpatch.*|ksplice.*|kpatch_livepatch.*)s /usr/libexec/kcare/pythoni t ignoret category( t Optionalt Dictt Tuplet Anyt Uniont Setc C s_ t } t j j t r[ t t d } x! | D] } | j | j q1 W| j n | S( Nt r( t sett ost patht isfilet FREEZER_BLACKLISTt opent addt rstript close( t resultt ft line( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_blacklistJ s
c C sY | j d } | r8 d j | d | | d g } n d j | d | d g } | S( Nt .i i( t splitt join( t ptypet filenamet
name_parts( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _apply_ptypeT s
# c C sm t | t j t _ t | t j t _ t | t j t _ t | t j t _ t | t j t _ d S( N( R= R t PATCH_BINt
PATCH_INFOt BLACKLIST_FILEt FIXUPS_FILEt
PATCH_DONE( R: ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_ptype] s
c
C sn t j \ } } } d } t | t r t | t r y) d | j t j | j | j f } Wq t t
f k
r| q Xnu t | t t
t f r t | t r d | } n@ t | t
r | j p t | j } | j p d | j } n t j } i t j d 6t j d 6| d d 6| d d 6t | d
t | d 6| d 6d j t j | d
d 6S( Nt s [Errno %i] %s: '%s's %st
agent_versiont python_versioni t distroi t distro_versiont __name__t errort detailsid t traceback( t syst exc_infot
isinstancet OSErrorR t errnoR+ t strerrorR; t AttributeErrort TypeErrort KeyErrort IOErrorR t etypet typet innerRK R t
get_distroR t VERSIONt get_python_versiont getattrt strR9 RL t format_tb( RW t valuet tbt details_sanitizedRG ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt format_exception_without_detailse s* )(
c C s t j r
d St j t } t j t j t j | } t j
d d | } t j | t
j } y t j | Wn t k
r n Xd S( Ns /api/kcarectl-traces ?trace=( R t UPDATE_FROM_LOCALt jsont dumpsRc R t nstrt base64t urlsafe_b64encodet bstrt get_patch_server_urlR
t http_requestR t get_http_auth_stringt urlopen_baset Exception( t tracet
encoded_tracet urlt request( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt send_exc s !
c C s t j } | d k r, t j | d d St j t j } | d k r^ t j d n t j d t t j d 3 } t j | j
d t j | j
d Wd QX| r t j | n y | Wn. t
k
rt j j d t j d n Xt j d d S( s
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
i Nt ai i s Wait exception( R+ t forkt waitpidt setsidt _exitR2 R/ R t LOG_FILEt dup2t filenot timet sleepRo R t kcarelogt exception( t funcR~ t pidt fd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
nohup_fork s(
c C s t j j t j d } t j j | r t | d \ } yA t | j } | t j
t j k r| t | | n Wn t
k
r n XWd QXn t j | t j d S( s Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
s .kcareprev.lockR) N( R+ R, R9 R t PATCH_CACHER- R/ t intt readR t SUCCESS_TIMEOUTR} t PreviousPatchFailedExceptiont
ValueErrorR t atomic_writet
timestamp_str( t anchor_filepatht afilet timestamp( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt touch_anchor s
c C s y# t j t j j t j d Wn t k
r6 n Xt d | t j j
y t d d Wn! t k
r t
j j d n Xd S( s
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
s .kcareprev.lockt donet reasons Cannot send update info!N( R+ t removeR, R9 R R RP t register_actionR t get_loaded_modulest cleart get_latest_patch_levelRo R R R ( t
state_data( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
commit_update s #
c C s8 t j t j j t j d d t j | | d d S( Nt patchest exclude_pathRD ( R t clean_directoryR+ R, R9 R R R t get_cache_path( t khasht plevel( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt clear_cache s c C s\ t j p d } d j | | g } t j d | f } | rL | | f 7} n t j j | S( Nt nonet -t modules( R t PREFIXR9 R R R+ R, ( R t fnamet prefixt
module_dirR3 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_current_level_path s c C s) t j t | d t | d t d S( Nt latestt
ensure_dir( R R R R^ t True( R t patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt save_cache_latest s c C sw t | d } t j j | rs y5 t t | d j j } t j | | SWqs t
t f k
ro qs Xn d S( NR R) ( R R+ R, R- R R/ R t stripR t LegacyKernelPatchLevelR RT ( R t path_with_latestt pl( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_cache_latest s !t CertificateErrorc B s e Z RS( ( RI t
__module__( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s t UnknownKernelExceptionc B s e Z d Z RS( c C s9 t j | d j t j d t j t j d S( NsL New kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.i ( Ro t __init__t formatR RZ t platformt releaseR t get_kernel_hash( t self( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s ( RI R R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s t ApplyPatchErrorc B s e Z d Z d Z RS( c O sc t t | j | | | | _ | | _ | | _ | | _ t j d | _ t
j | _ d S( Ni ( t superR R t codet
freezer_stylet levelt
patch_fileR RZ RG R R ( R R R R R t argst kwargs( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR
s c C sP d j | j | j | j | j | j d j g | j D] } t | ^ q4 S( Ns0 Unable to apply patch ({0} {1} {2} {3} {4}, {5})s , ( R R R R RG R R9 R R^ ( R t i( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt __str__ s ( RI R R R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s R c B s e Z d Z d Z RS( c O s/ t t | j | | | | _ | | _ d S( N( R R R R t anchor( R R R R R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR # s c C s d } | j | j | j S( Ns It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file( R R R ( R t message( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR ( s ( RI R R R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR " s c C s t j d j | } y t j | } t j t j | j } t | d } | d k ro t
d nE | d k r t
d n, | d k r t
d n t
d j | | SWn# t k
r } t j
| | n Xd
S( Ns" /nagios/register_key.plain?key={0}R i s Key successfully registeredi s Wrong key format or sizei s! No KernelCare license for that IPs Unknown error {0}i( R t REGISTRATION_URLR R
t urlopenR t data_as_dictRg R R t printR R t print_cln_http_error( t keyRr t responset resR t e( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt! set_monitoring_key_for_ip_license1 s
c c sU t j r" t j t j d t n z d VWd t j rP t j t j d t n Xd S( Nt shell( R t BEFORE_UPDATE_COMMANDR t run_commandR t AFTER_UPDATE_COMMAND( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
execute_hooksE s c C s$ t } | j } | j } t j } | d k r i t | d 6t j d 6t j d 6t
j d 6| d 6t t
j d 6| d 6} t d t t j | nu t d t t | t d
t | t t j t t j t t
j t | t t
j d S( s1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
Re t
updateCodet
autoUpdatet effectiveKernelt
realKernelt loadedPatchLevelt uptimet licenses --START--s LICENSE: N( t _patch_level_infoR t applied_lvlR t license_infoR^ R t AUTO_UPDATER t kcare_unameR R R R t
get_uptimeR Re Rf ( t fmtt plit update_codet loaded_plt license_info_resultt results( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt plugin_infoQ s.
c C su t j } y t d d } Wn t k
r@ t j r< d Sd SX| d k rQ d S| | k ra d St j rq d Sd S( NR t infoi i i i ( R t loaded_patch_levelR R R t IGNORE_UNKNOWN_KERNELt NoneR t status_gap_passed( t
current_levelt latest_patch_level( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_update_status s
c C s= t j d \ } } | d k r5 | j d r5 d Sd Sd S( Ni t
CloudLinuxs 7.t extraRD ( R RZ t
startswith( RG t version( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edf_fallback_ptype s c C s | j | j f } t j | | } t j | | j | _ | j j t j t j
d | t k r~ | j j d t | R R R R R R4 R5 R R Ro t debugR^ R t SIGR ( R R: t bin_urlR< Rr ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt probe_patch s(
&"
&c C sg | t j k r$ | j t j } n | j | } | j | } t j | | t j d t j | S( Nt hash_checker(
R t KMOD_BINt kmod_urlR@ t
cache_pathR t fetch_urlR t
USE_SIGNATUREt get_hash_checker( R t nameRr t dst( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_and_verify_kernel_file2 s
t PatchFetcherc B sA e Z d d Z d Z d Z d Z d Z d Z RS( c C s
| | _ d S( N( R ( R R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR < s c C s t | j | S( N( RN R ( R RL ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _fetch? s c C s | j j t j } | j j t j } | j j t j } | j j t j } t d | | | | f D o t j
j | d k o t j
j | d k S( Nc s s! | ] } t j j | Vq d S( N( R+ R, R- ( t .0R, ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys I s i ( R RH R RB R> R? R RF t allR+ R, t getsize( R t patch_done_patht patch_bin_patht patch_info_patht
kmod_bin_path( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt is_patch_fetchedB s "c C s | j d k r t d n | j s. | j S| j rN t j d | j St j d t | j t j r y( t j
| j j t j
d d } Wn t k
r q X| j j d d } | r | j j t j | | _ q n y | j t j
Wn5 t k
r6t d j | j t j p*d n X| j t j | j t j | j t j | j j t j d d
d t j t j! | j S( Ns+ Cannot fetch patch as no patch level is sets Updates already downloadeds Downloading updatesR> R? s KC-Base-Urlsf The `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch levelt defaultRD R: t wb(" R R R RX R t loginfoRO R R R R4 R@ R R> R R7 R t upgradeR Rg RP R R t
PATCH_TYPER? R RF t extract_blacklistR RH RB R t restore_selinux_contextR ( R t respR- ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_patchN s8
(
$
%c C sq t | j j t j d j } | rm t j | } | rm t j | j j t j
| j d qm n d S( NR) i ( R/ R RH R R? R t BLACKLIST_REt searchR R R@ t group( R t buft mo( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR^ v s
$c C s | d k r d Sy t | t j } Wn t k
r: d SX| j j d d } | rq | j t j | } n | j
t j } t | d 2 } t g | j
D] } | j ^ q } Wd QXx | D] } t | | q Wt j t j d S( s
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Ns KC-Base-UrlR) ( R RN R RA R R7 R R\ R Rg RH R/ R* t readlinesR R R_ R R ( R R R` R- t fixups_fnameR4 t fixupt fixups( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt fetch_fixups} s
1
N( RI R R R RP RX Ra R^ Rk ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyRO ; s ( c C sI t } t | j | j t j k r8 t j d n
t j d d S( Ni i ( R R t msgR t PLIt PATCH_NEED_UPDATERM t exit( R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_check s
c C st t } t | } y t j } Wn t k
r> i } n Xt j } d } | d k r| t j | d j
d } n t j } t | j
d g } t d | D } t j } | s t d n
t d t d j | t d j | | d
k r't d j | n | d
k rIt d j | n | | d
k rft d
n t d d S( Nt Unknownt tss %Y-%m-%dR c s s' | ] } t | j d g Vq d S( R N( t lenR ( RQ t rec( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys s s$ KernelCare live patching is disableds" KernelCare live patching is actives - Last updated on {0}s - Effective kernel version {0}i s* - {0} kernel vulnerabilities live patcheds- - {0} userspace vulnerabilities live patcheds% - This system has no applied patchess( Type kcarectl --patch-info to learn more( R t _kcare_patch_info_jsonR
t libcare_patch_info_basicR R t get_stateR R t
fromtimestampt strftimeR Rs R t sumR R R ( R t
kcare_infot libcare_infot statet
latest_updatet effective_versiont kernel_vulnerabilitiest userspace_vulnerabilitiesR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt show_generic_info s4
c C s4 y t d d d t j } | s* t n | j t j } t j t j
| j } | r g i } } xU | j d D]D } t j
| } | r d | k r | j | q} | j | q} W| | d R ( t
applied_levelt new_levelR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kcare_need_update s c C s t j r t j j t o- t j t t j sM t j j
d j t d St j
d d d t g d t \ } } } | d k r t j j
d j | q n d S( Ns- File {0} does not exist or has no read accesss /sbin/sysctls -qs -pt catch_stdouti s% Unable to load kcare sysctl.conf: {0}( R t UPDATE_SYSCTL_CONFIGR+ R, R- t
SYSCTL_CONFIGt accesst R_OKR R t warningR R R R ( R t _( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
update_sysctl+ s '* c s t j j t s( t t d j n t j t t j sZ t j j
d j t d St t d } | j } | j
d x: | D]2 t f d | D s | j q q Wx | D] } | j | d q W| j Wd QXd S( s* Update SYSCTL_CONFIG accordingly the editsRu s File {0} has no read accessNs r+i c 3 s | ] } j | Vq d S( N( R ( RQ R) ( R5 ( s. /usr/libexec/kcare/python/kcarectl/__init__.pys E s s
( R+ R, R- R R/ R2 R R R R R R Rg t seekt anyt writet truncate( R R t sysctlt linesRu ( ( R5 s. /usr/libexec/kcare/python/kcarectl/__init__.pyt edit_sysctl_conf5 s
c C s< x5 | D]- } t j | r t d j | q q Wd S( NsD Detected '{0}' kernel module loaded. Please unload that module first( t CONFLICTING_MODULES_REt matchR R ( R t module( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt detect_conflicting_modulesM s
c C s d j t j S( Ns /lib/modules/{0}/extra/kcare.ko( R R t get_system_uname( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kcare_kmod_linkS s c C ss t d d } t j t j | t j } t j j | sC d St | d } | j
d d k SWd QXd S( NR R t rbis ~Module signature appended~
( R R R R R RF R+ R, R- R/ R ( R t kmod_filet vfd( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt kmod_is_signedW s c K s d | g } x3 | j D]% \ } } | j d j | | q Wt j | d t \ } } } | d k r t d j | | n d S( Ns /sbin/insmods {0}={1}R i sL Unable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.( t itemsR R R R R R ( t kmodR t cmdR R` R R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kmod` s c C s\ t j r% t r% t d n t j sI t j sI t j rX t d n d S( Ns4 Secure boot is enabled. Not supported by KernelCare.sW You are running inside a container. Kernelcare should be executed on host side instead.( R t is_secure_bootR R t inside_vz_containert inside_lxc_containert inside_docker_container( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt check_compatibilityi s $c C ss t j d d d | g } g } xK | j d D]: } | j r1 | j d \ } } } | j | q1 q1 W| S( Ns
/sbin/modinfos -Ft parms
t :( R R R8 R t partitionR ( t
kcare_linkt stdoutt available_paramsR5 t
param_nameR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_kmod_available_paramsp s c C s i t j r d n d d 6t j r( d n d d 6t j rA t j n d d 6t t j t rc t j n d d 6t j ry d n d d 6S( Ni i t kpatch_debugt kmsg_outputt kcore_outputRD t
kdumps_dirt enable_crashreporter( R t KPATCH_DEBUGt KMSG_OUTPUTt KCORE_OUTPUTt KCORE_OUTPUT_SIZERO t
KDUMPS_DIRR^ t ENABLE_CRASHREPORTER( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt make_kmod_new_paramsz s "c C sc t j r2 t j j t j r2 t j t j n x* t j D] \ } } t | | qB Wd S( N( R R R+ R, t existst makedirsR R t update_kmod_param( t paramt val( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR8 s c C s d } t j j | | } t j j | s1 d Sy/ t | d } | j t | Wd QXWn' t k
r t j j
d | | n Xd S( Ns /sys/module/kcare/parameterst ws! failed to set %s kmod param to %s( R+ R, R9 R R/ R R^ Ro R R RJ ( t kmod_param_namet param_valuet params_roott
param_pathR4 ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s
c s t } t j | | t j } y t j | | Wn t k
rN | } n Xt j r t
j j t j r t
j
t j n t } t | t f d | j D } t | | t d S( Nc 3 s- | ]# \ } } | k r | | f Vq d S( N( ( RQ t kt v( t available_kmod_params( s. /usr/libexec/kcare/python/kcarectl/__init__.pys s ( R R R R RF t shutilt copyRo R R R+ R, R R R R t dictR R t
update_depmod( R R R t
kcare_filet kmod_params( ( R s. /usr/libexec/kcare/python/kcarectl/__init__.pyt load_kcare_kmod s
"
c C s d g } | d k r+ | j d | g n t j | d t d t \ } } } | r t j d j d j | | | d t n d S( Ns /sbin/depmods -aR t catch_stderrs% Running of `{0}` failed with {1}: {2}t t print_msg(
R t extendR R R R t logerrorR R9 R5 ( t unameR R R t stderr( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR s $c C sO t j d | g d t \ } } } | d k rK t d j | | n d S( Ns /sbin/rmmodR i s Unable to unload {0} kmod {1}( R R R R R ( t modnameR R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt unload_kmod s $ c C su g } xh d g | D]Y } t j | | d j | } t j j | r t | | j d j | q q W| S( Nt vmlinuxs fixup_{0}.kos fixup_{0}( R R R R+ R, R R R ( R R R t loadedt modt modpath( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt apply_fixups s
c C sK xD | D]< } y t | Wq t k
rB t j j d | q Xq Wd S( Ns$ Exception while unloading module %s.( R Ro R R R ( Rj R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
remove_fixups s
c C s | r | } nM t j r$ t j } n8 t j | rI d | t j t f Sd | t j t f Si d d 6d d 6d d 6d d 6d d 6} | j } | | k r | | } n! t d
j | | t j t | | t j t f S( Nt freeze_conflictRY t freeze_nonet NONEt NOFREEZEt
freeze_allt FULLt FREEZEt SMARTs3 Unable to detect freezer style ({0}, {1}, {2}, {3})( R t PATCH_METHODR6 t intersectionR R5 t upperR R ( t freezerR R> t patch_method_map( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt get_freezer_style s$
!RD c sZ i | d 6| d 6| d 6 t d t j } t j } t | t | | } t j | | t j } t | | d j
| t j t j
t j | } d | k }
|
o t j | | } | d k } | o t | o t j | }
j i | d 6| d 6 |
r+t d d S| rt d
t | | | } t d t | t d t | n | rt d
t d t }
n |
st d t | | n | rt n t d t | | | | | t t j d j
| t j t j! t d t" f d d t j# d S( NR t futureR: t starts {0}-{1}:{2};{3}R t currentt kmod_changedR t fxpt unpatcht unfxpt unloadt loadt patchs5 Patch level {0} applied. Effective kernel version {1}t waitc s
t S( N( R ( ( R ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt / s R~ ($ R R R R R R R R R> R R R] R R t parse_unamet is_kmod_version_changedR R t kcare_update_effective_versionR R t kpatch_ctl_unpatchR R R5 R R t kpatch_ctl_patchR R R[ R R t touch_status_gap_fileR R ( R R R: R t
use_anchorR R R R t descriptiont kmod_loadedR t patch_loadedt
same_patchRj ( ( R s. /usr/libexec/kcare/python/kcarectl/__init__.pyt
kcare_load sR
$ !
c C s t j g } t j | | t j } t j j | rL | j d | g n | j d d | g | j d | d g | j
| t j | d t
\ } } } | d k r t | | | | n d S( Ns -bR s -ds -mi R ( R R R R R R@ R+ R, R R R R R R R ( R R R R R R t blacklist_fileR R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR 2 s
c C s t j t j d d | d g d t d t \ } } } | d k r t j d j | | d t t d j | t
| n d S( NR s -mi R R s4 Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}R s Error unpatching [{0}] {1}( R R R R R R R R R5 R R^ ( R R R R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR ? s
1 c C sL | | d R R R RM Ro R
R R R R R R Rr R R Rg R R ( t fileR: t sR< R R R R ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR1 s2
# c
C sR g } | s t S| j d } | d } | d } | j d } | | k rg t d t | n | s | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j
d d x$ | D] } | j t j | q Wt j d
d j | d t j
} | j | S(
sh Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
R7 i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( R5 R8 R' R t reprt lowerR R t ret escapet replacet compileR9 t
IGNORECASER (
t dnt hostnamet
max_wildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt _dnsname_match s(
"
&c
C s g } xx t | j D]d } | j | } | j d k r g t | j d D] } | j j d d ^ qV } q q W| s t d n g } xC | D]; \ } } | d k r t | | r d S| j | q q W| s| j
j } t | | r
d S| j | n t | d k rYt
d j | d j t t | n= t | d k rt
d j | | d
n t
d d S( Nt subjectAltNamet ,R i st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt DNSs( hostname {0} doesn't match either of {1}s , s hostname {0} doesn't match {1}i s= no appropriate commonName or subjectAltName fields were found( t ranget get_extension_countt
get_extensiont get_short_nameR^ R8 R R R R t get_subjectt
commonNameRs R R R9 t mapRt (
t certR| t sanR R t itt dnsnamesR R` t cn( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyR% s0 A - c C s t d d d d } | j d d d d d | j d
d d d d d | j d
d d d d | j d d d d d d | j d d d d d | j d d d d d | j d d d d d | j d d d d d | j d d d d d | j d d d d d | j d! d d" d d | j d# d d$ d d | j d% d d& d d | j d' d d( d d | j d) d d* d d+ | j d, d d- d d | j d. d d/ d d | j d0 d d1 d d | j d2 d d3 d d | j d4 d d5 d d | j d6 d d7 d d8 | j d9 d d: d d; | j d< d d= d d | j d> d d? d d+ | j d@ d dA d d | j dB d dC d d | j dD d dE d d | j dF d dG d d | j dH d dI d d | j dJ d dK d d | j dL d dM d d | j dN d dO d d | j dP d dQ d dR dS t dT d dU t | j dV d dW d d | j dX d dY d d | j } | j dZ d d[ d dR | j d\ d d] d d | j d^ d d_ d d | j d` d da d dR dT d dU t | j db dc d dd d d dU t | j de d df | j dg d dh d d | j di d dj d dk d dl t j s| j dm d dn do dp d dq dr t | j ds d dt do dp d dq dr t | j du d dv d d | j dw dx d dy d d | j dz d d d d | j d{ d| d d} d d | j d~ d d d d d | j d d d d d d | j d d d d d dr d d d | j d d d d d | j d d d d d n | j } t j
j t j
t j st j d g 7_ n | j d k rWt t d | j j d j t j rPd Sd Sn | j si| j rt j rt j t _ qt j t _ n | j rt j t _ n | j st j d k rt d d t! j" d Sn t# j$ } | j rt# j% } n | j rt# j& } n t' j( | | j) r3t* j+ n | j, r| j, d k rst- | j, t _. t j/ d t j. qd t _. t j/ d d n | j0 d k rt j/ d | j0 | j0 t _1 n | j2 rt t _3 n | j4 rt t _5 n | j6 rt t _7 n | j8 rt8 n | j9 r.t: j; d t< nN | j= r|t j> d k r|t j? d k r[d n t j? pgdT | _@ t | _ q|n | jA r| jA t _B n | jC rt: j; d t< d t _B n t jB jD d t _B t jB r t jB tE k r t' jF jG d jH t jB d jI tE n | jJ r6 t t _K d | jJ t _L n | j@ rO tM | j@ n t j> d k r tN t _> t: j; d jH t j> p dT t< n | jO r t tP jO d | jQ d StR t j> | jS r tT d S| jU r
| jQ r tU d d n tU d S| jV r
t j/ d d d S| jW r=
t j/ d d d S| jX rZ
t jY | jX d S| jZ rp
t[ | jZ S| j\ r
t] j\ n | j^ r
t j> d k r
t j/ d d n t] j^ | j^ | j_ S| j` r
t] j` d k r
d Sd Sn | ja d k r tb | ja S| jc r" t t jd n te | dp d d k rN tf jg | jh d St j s
| ji rj tf jj S| jk r tf jl d k r t' jm d q n | jn r tf jl d t jo n# | jp r tf jq t' jm d n | jr r t tf js n | jt r t tf ju n | jv r@ tf jw r@ t tf jx | jv n | jy d k r | jy d k r t jz py t{ tf j| j} } n1 g | jy j d D] } | jD j~ ^ q } tf jl d t | d k r t' jm d q n | j r
tf jl d t jo d d q
n | j r+
t t d | jQ n d } | j rS
t: j; d t< d } n | j rh
| j } n | j r
t | d t j d t j n | j r
t | d t j t' jm d n | j r
t t j n | j rt | d | j t' jm d n | j rEt t _ t j t j d d t | d t jo n | j rat d | jQ n | j rqt S| j rt d | jQ n | j rt n t t! j d k rt n d S( Nt progt kcarectlR s) Manage KernelCare patches for your kernels --debugt helpRD R t
store_trues -is --infos] Display information about KernelCare. Use with --json parameter to get result in JSON format.s
--app-infosc Display information about KernelCare agent. Use with --json parameter to get result in JSON format.s -us --updates< Download latest patches and apply them to the current kernels --unloads Unload patchess --smart-updates, Patch kernel based on UPDATE POLICY settingss
--auto-updates- Check if update is available, if so -- updates --localsN Update from a server local directory; accepts a path where patches are locatedt metavart PATHs --patch-infos" Return the list of applied patchess --freezers) Freezer type: full (default), smart, noneR s
--nofreezes/ [deprecated] Don't freeze tasks before patchings --unames Return safe kernel versions --license-infos Return current license infos --statuss Return status of updatess
--registers Register using KernelCare KeyRp s --register-autoretrys= Retry registering indefinitely if failed on the first attempts --unregisters7 Unregister from KernelCare (for key-based servers only)s --checks Check if new update availables --latest-patch-infosi Return patch info for the latest available patch. Use with --json parameter to get result in JSON format.s --tests& [deprecated] Use --prefix=test insteads --tags7 Tag server with custom metadata, for ePortal users onlyt TAGs --prefixsp Patch source prefix used to test different builds by downloading builds from different locations based on prefixR s
--nosignatures Do not check signatures --set-monitoring-keysP Set monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlys --doctors@ Submits a vitals report to CloudLinux for analysis and bug-fixess --enable-auto-updates Enable auto updatess --disable-auto-updates Disable auto updatess
--plugin-infos Provides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.s --jsonso Return '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formats --versions( Return the current version of KernelCares --kpatch-debugs Enable the debug modes --no-check-certs2 Disable the patch server SSL certificates checkings --set-patch-levelsB Set patch level to be applied. To select latest patch level set -1t storeRX RY t requireds --check-compatibilitys Check compatibility.s
--clear-caches Clear all cached filess --set-patch-types@ Set patch type feed. To select default feed use 'default' options
--edf-enableds" Enable exploit detection frameworks --edf-disableds# Disable exploit detection frameworks --set-sticky-patchsj Set patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unsticks -qs --quiets= Suppress messages, provide only errors and warnings to stderrs --has-flagss Check agent featuress --forces- Force action and ignore several restristions.s --set-configs Change configuration optionR s KEY=VALUEs --disable-libcares Disable libcare servicest destt enable_libcaret store_constt consts --enable-libcares Enable libcare servicess --lib-updatesI Download latest patches and apply them to the current userspace librariess --lib-unloads --userspace-unloads Unload userspace patchess --lib-auto-updates
--lib-infos --userspace-infos& Display information about KernelCare+.s --lib-patch-infos --userspace-patch-infos, Return the list of applied userspace patchess
--lib-versions --userspace-versions Return safe package versiont PACKAGENAMEs --userspace-updatet USERSPACE_PATCHESt nargsR* sO Download latest patches and apply them to the corresponding userspace processess --userspace-auto-updates --userspace-statuss" Return status of userspace updatess libcare-enabledR i i s Please run as rootRq R. R9 sT Flag --edf-enabled has been deprecated and will be not available in future releases.RX sM Flag --test has been deprecated and will be not available in future releases.R t /s( Prefix `{0}` is not in expected one {1}.R s file:s+ edf patches are deprecated. Fallback to {0}R R Re R t YESt NORZ R] R s Userspace patches are applied.R: s Userspace patches are unloaded.t limitsQ Flag --nofreeze has been deprecated and will be not available in future releases.R R s Kernel is safeR, s= KernelCare protection disabled. Your kernel might not be safei< ( R t add_argumentR R R5 t add_mutually_exclusive_groupR t LIBCARE_DISABLEDR t
parse_argst __dict__R R t get_config_settingst FLAGSt has_flagsR* t filterR8 t issubsett quiett auto_updatet SILENCE_ERRORSR t PRINT_CRITICALt PRINT_LEVELt PRINT_ERRORRA t PRINT_DEBUGR R+ t getuidR RM R t loggingt INFOt WARNINGt DEBUGR t initialize_loggingR R t clear_all_cachet set_patch_levelR^ R. R[ t set_sticky_patchR9 t nosignatureRJ t
no_check_certR R R R t edf_enabledt warningst warnt DeprecationWarningt edf_disabledR] t PREV_PATCH_TYPEt set_patch_typeR R R R t EXPECTED_PREFIXR R R R9 t localRd RK R` R t app_infoR Re RC t doctorRP R t enable_auto_updatet disable_auto_updatet
set_configt update_config_from_argst set_monitoring_keyR t
unregisterR t registert register_autoretryR R= RB R R[ R] R
t set_libcare_statusR t userspace_statust get_userspace_update_statust
lib_updatet do_userspace_updateR[ t lib_auto_updateRd t
lib_unloadt libcare_unloadt lib_infoR| t lib_patch_infot libcare_patch_infot lib_versiont libcare_server_startedt libcare_versiont userspace_updateR t listt
USERSPACE_MAPt keysRu t sortedt userspace_auto_updateR R{ t nofreezeR t smart_updateRf Re t
UPDATE_POLICYRl R R R R0 R, t CHECK_CLN_LICENSE_STATUSR} R~ t randomt uniformR t statusR t latest_patch_infoR t checkRp Rs t argvR ( t parsert exclusive_groupR R R t ptchR ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt main: s -
' + %
!1
( R R R s test( s latest.v2( ( t
__future__R Rh Re R R+ R R Rv R R t sslRM RF R} RL R t argparseR R t
contextlibR RD R R R R R R R
R R R
R R R R R R t py23R R R R R R R R R^ RQ R R. RE R/ R R+ Ry t DOTALLRb R R, R t insertt filterwarningsR R5 t typingR# R$ R% R& R' R( R t setLevelR R6 R= RC Rc Rt R R R R R R R R R R R R R R R R R R R R R R R] t distutils.versiont distutilst OpenSSL.SSLR R t
StrictVersiont __version__t ImportErrorR
t HTTPSConnectiont PureHTTPSConnectiont objectR R Rl R= RD RN RO Rp R R Ru R R R R R R R R R R R R R R8 R R R R R R R R R R R R& R0 R{ R1 Rm R RB RP RR R R R` Rf Rn Ro R1 R R% R ( ( ( s. /usr/libexec/kcare/python/kcarectl/__init__.pyt s ( 1
%
4
'
` #
?
, 2
% 5 , 3 )