Edit: /opt/cloudlinux/venv/bin/crontab-user-wrapper.py (4401B)
#!/opt/cloudlinux/venv/bin/python3 -sbb
# -*- coding: utf-8 -*-
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENCE.TXT
#
"""
Crontab wrapper for website isolation support.
This wrapper mimics crontab command-line interface:
- crontab -l: Lists current crontab entries, filtering isolation tool prefixes
- crontab [file]: Installs crontab from file (or '-' for stdin)
When website isolation is active (PROXYEXEC_DOCUMENT_ROOT is set):
1. List operations filter out isolation wrapper prefixes from output
2. Save operations automatically prepend isolation tool to commands
The isolation tool is prepended to commands to ensure they run within the
isolated website context.
"""
import argparse
import os
import sys
from clcagefslib.webisolation import crontab
def create_parser():
"""
Create argument parser for the crontab wrapper.
Returns:
argparse.ArgumentParser: Configured argument parser
"""
parser = argparse.ArgumentParser(
prog="crontab-user-wrapper",
description="Crontab wrapper for website isolation support. "
"Filters and modifies crontab entries to support website isolation.",
)
parser.add_argument(
"-l",
"--list",
action="store_true",
help="List current crontab entries (filters isolation prefixes)",
dest="list_crontab",
)
parser.add_argument(
"file",
nargs="?",
default="-",
help="File containing crontab entries to install, or '-' to read from stdin (default: '-')",
)
return parser
def main(argv=None):
"""
Main entry point.
Args:
argv: Command line arguments (defaults to sys.argv[1:])
Returns:
int: Exit code
"""
parser = create_parser()
args = parser.parse_args(argv)
try:
if args.list_crontab:
return crontab.process_list()
# Handle file argument: '-' means stdin, otherwise open the file
if args.file == "-":
stdin = sys.stdin.buffer
else:
# scanner-triage (F-03, CLOS-5941): the scanner reads this
# `open(args.file, "rb")` as a root-context read of a caller-
# controlled path. It is not. Every CRONTAB_* proxyexec alias
# in proxyexec/proxy.commands is `:secure:noproceed=` (never
# `root:`), so proxyexec/cagefs.server.c setuid(pw.pw_uid)-
# drops to the authenticated caller before execv'ing
# /usr/sbin/cloudlinux-user-cron, which securelve.spec ships
# as a plain non-setuid symlink to this wrapper. By the time
# main() runs, the process is already the caller — this open
# is a caller-context read of the caller's own file, not a
# cross-tenant read. See SECURITY-EXCEPTIONS.md for the
# sibling get_document_root triage that pins the same
# invariant. DiD: use os.open with O_NOFOLLOW/O_CLOEXEC so a
# symlink swap between argparse and this line still fails
# closed at the caller boundary, and refuse if the wrapper is
# ever invoked with euid 0 (a future `root:` alias regression
# or a setuid-root wrapper on top of cloudlinux-user-cron).
if os.geteuid() == 0:
sys.stderr.write("crontab: operation not permitted\n")
return 1
try:
fd = os.open(
args.file,
os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW,
)
stdin = os.fdopen(fd, "rb")
except OSError:
sys.stderr.write("crontab: unable to read the requested file\n")
return 1
try:
return crontab.process_save(stdin=stdin)
finally:
if args.file != "-" and stdin != sys.stdin.buffer:
stdin.close()
except Exception as e:
# Surface any failure (e.g. forged PROXYEXEC_DOCUMENT_ROOT rejected
# by get_document_root) as a clean stderr message instead of a
# Python traceback leaking into the user's terminal.
sys.stderr.write(f"crontab: {type(e).__name__}: {e}\n")
return 1
if __name__ == "__main__":
sys.exit(main())