/opt/cloudlinux/venv/lib/python3.11/site-packages/xray/internal/__pycache__/
/opt/cloudlinux/venv/lib/python3.11/site-packages/xray/internal/__pycache__
NameSizeModeActions
advanced_metrics.cpython-311.pyc31440644editdlrm
clwpos_safe_imports.cpython-311.pyc18200644editdlrm
constants.cpython-311.pyc51110644editdlrm
exceptions.cpython-311.pyc76430644editdlrm
fpm_utils.cpython-311.pyc74650644editdlrm
local_counters.cpython-311.pyc75010644editdlrm
nginx_utils.cpython-311.pyc116870644editdlrm
phpinfo_utils.cpython-311.pyc404510644editdlrm
probe_targets.cpython-311.pyc185910644editdlrm
types.cpython-311.pyc544110644editdlrm
user_limits.cpython-311.pyc66890644editdlrm
user_manager.cpython-311.pyc82330644editdlrm
user_plugin_utils.cpython-311.pyc171770644editdlrm
utils.cpython-311.pyc551080644editdlrm
__init__.cpython-311.pyc8910644editdlrm
Edit: /opt/cloudlinux/venv/lib/python3.11/site-packages/xray/internal/__pycache__/utils.cpython-311.pyc (55108B)
j܏dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlmcmZddlmZddlmZddlmZmZddlmZddlmZdd l m!Z!m"Z"m#Z#m Z ddl$Z$dd l%m&Z&dd l'm(Z(dd l)m*Z*m+Z+m,Z,m-Z-dd l.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5ddl6m7Z7ddl8m9Z:ddl;mZ>m?Z?m@Z@mAZAmBZBmCZCddlDmEZEmFZFejGdZHeIeJejKfZLdndZMdod!ZNdpdqd$ZOdrd'ZPdrd(ZQdrd)ZRdsd*ZSdtd,ZTdud.ZUdvd/ZVdwd2ZWdwd3ZXdvd4ZYe>fdxd7ZZdvd8Z[dyd:Z\eRdvd;Z]dzd>Z^d{d?Z_d|d@Z`eAfd}dBZae jbdCZcd~dEZdddHZeddKZfddNZgddPZhddRZiddSZjdpddTZkddVZlddWZmddXZnddZZodd[Zpdd\Zqdd]Zrdd^Zsd_Zted|d`ZueddddZvedddfZwe dddkZxedlZydmZzdS)zB This module contains helpful utility functions for X-Ray Manager ) annotationsN)Callable)contextmanager)date timedeltawraps)glob)AF_UNIX SOCK_STREAMfromfdsocket)drop_privileges)Feature)get_cp_description getCPNameis_panel_feature_supportedis_wp2_environment)get_cl_edition_readable)UIConfig)get_rhn_systemid_value)AtexitIntegration)LoggingIntegration)gettext)php_get_vhost_versions_user) agent_filejwt_token_locationlocal_tasks_storage logging_level sentry_dsnuser_agent_sock) XRayErrorXRayManagerExitutilspathstrmodeintreturnNonec&t||dS)a7Set ``mode`` on a directory we just created, without following symlinks. ``mkdir``'s mode argument is masked by the ambient umask, so a directory that must have an exact mode has to be chmod'ed after the fact. Doing that with a path-based ``os.chmod`` is unsafe here: these call sites run as root with no privilege drop, and ``os.chmod`` re-resolves the name at syscall time. A tenant who controls the parent can win the mkdir -> chmod window, replace the new directory with a symlink, and redirect the root chmod onto a root-owned target. Pin the inode instead. ``O_NOFOLLOW`` refuses a symlink swapped in for the final component outright, and reading the fd back through ``/proc/self/fd`` catches an ancestor component that was swapped, because that changes the canonical path. ``fchmod`` then acts on the pinned inode and never on a re-resolved name -- the same idiom ``unified_write``/``unified_erase`` use in ``xray.internal.types``. Anything unexpected (the directory vanished, was replaced by a symlink, moved) is logged and skipped rather than raised: the mode is a hardening detail, not a precondition of the operation that created the directory. Caller contract: ``path`` must be the CANONICAL path of the directory that was just created -- i.e. already ``os.path.realpath``'d, and resolved before the mkdir, not after. Passing a path that merely happens to reach the right inode through a symlink is not an error, but the identity check below will not match and the mode will be skipped. N)_chmod_pinned_dir)r&r(s J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/utils.pychmod_created_dirr/=s8dD!!!!! damaged_mode target_modec tjtj|j|krdSn#t$rYdSwxYwt |||dS)aUpgrade a directory that an earlier release left at ``damaged_mode``. The mode-pinning above only runs when a directory is CREATED, so it does nothing for hosts whose directories were already created wrong -- and the 0.6-51/0.6-52 crons ran under umask 077 for weeks, so that is most affected hosts rather than an edge case (ZD 290458). Unlike xray.so, xray.ini and the skeleton ini -- which are rewritten wholesale on the next run and therefore self-heal -- a directory is only ever created once. The repair is deliberately narrow: it fires only when the current mode is EXACTLY ``damaged_mode``, the signature the umask-077 runs produced. An administrator's or tenant's deliberate 0750 (or anything else) is left alone, so this cannot quietly loosen a directory nobody asked us to touch. Same caller contract and same symlink handling as ``chmod_created_dir``. N) only_if_mode)statS_IMODEosst_modeOSErrorr-)r&r1r2s r.repair_dir_moder:\sn. < - . ., > > F ? dKlCCCCCCs/4 AAr4 int | Nonec tj|tjtjztjztjz}nD#t $r7}td|t|dYd}~dSd}~wwxYw tj d|}||kr6td||d tj |dS|tj tj|j}||kr tj |dStd|t#|t#|d tj||nC#t $r6}td |t|dYd}~nd}~wwxYwtj |dS#tj |wxYw) a Shared worker for the two functions above: chmod through a pinned fd. ``only_if_mode`` makes the chmod conditional on the pinned inode's CURRENT mode, read via ``fstat`` on the same fd that ``fchmod`` acts on -- so the check and the change cannot be separated by a race. zNot setting mode on directory)r&errextraNz/proc/self/fd/z,Directory changed under us; not setting mode)r&pinnedz4Repairing directory mode left by the umask-077 crons)r& from_modeto_modezFailed to set mode on directory)r7openO_RDONLY O_DIRECTORY O_NOFOLLOW O_CLOEXECr9loggerwarningr'readlinkcloser5r6fstatr8infooctfchmod)r&r(r4dir_fder@currents r.r-r-{sr{R^;bmKblZ[[ 6tTWXYTZTZ>[>[\\\6f6677 T>> NN>#v66        #l28F#3#3#;<z'Failed to unlink ini in cagefs-skeleton)rVr=z0Refusing to copy over symlink in cagefs-skeletonrbiz'Failed to copy ini into cagefs-skeleton)r7r&join ini_location startswithr realpathdirnameexistsmkdirr/r:lexistsislinkrHrIunlinkr9r'rCreadO_WRONLYO_CREATO_TRUNCrFwriterOrK)args original_ini skeleton_ini skeleton_dirrQsrc src_bytesfds r.updatezskeleton_update..updates w||DG$8*EE  " "= 1 1 d;N6O6O 7<<(Ll[\[][]N^__LL  $ $\ 2 2 t>,// <&&&",6666 eU;;;; Fw~~l++! w|,, 7>>,//NN#R[egsZtNuuuFIl+++++NNAVbknopkqkqIrIr#   7>>,//NN#U^hjv]wNxxxF,--+ # I+++++++++++++++W\2;+Cbj+PSUS`+`bghh!HR+++ Ib%(((HRLLLLLBHRLLLL   =R^gjklgmgmEnEn ssG-- H.7,H))H.4=M3MJ$ M$J((M+J(,A M7*L7!M7M  M N,N  Nc"|i|}||S Wraps func )rgkwargsresultrSrns r.wrapperz skeleton_update..wrappers) t&v&&  r0r)rSrurns` @r.skeleton_updatervsN BBBH 4[[[ Nr0cPddtfd}|S)zs Decorator aimed to update DBM storage with fake_id:real_id mapping Applies to task.add nd task.remove c|d}tt5}|j||j<ddddS#1swxYwYdS)z- Update DBM storage contents rN) dbm_storagertask_idfake_id)rg task_instance task_storages r.rnz"dbm_storage_update..updatesQ , - - H2?2GL. / H H H H H H H H H H H H H H H H H Hs :>>ctt5} ||dj=n#t$rYnwxYwddddS#1swxYwYdS)z. Remove task from DBM storage rN)ryrr{encodeKeyError)rgr}s r.removez"dbm_storage_update..removes, - -   a!7!7!9!9::                      s1A 8A AAAAAAcZ jdkr|n.#t$r!}tt|d}~wwxYw |i|}n#t$rjdkr|wxYw jdkr|n.#t$r!}tt|d}~wwxYw|S)rqaddNr)__name__ RuntimeErrorr#r' Exception)rgrsrQrtrSrrns r.ruz#dbm_storage_update..wrappers  $}%%  $ $ $CFF## # $ T4*6**FF   }%%    $}((  $ $ $CFF## # $ s4 ?:?A A(,A== B(B##B(r)rSrurrns` @@r.dbm_storage_updatersb HHH    4[[[: Nr0cFdtfd}|S)z5 Decorator aimed to validate given JWT token c"tdS)z7 Check if retrieved JWT token is valid N)is_xray_supportedrrr0r.checkzcheck_jwt..check6s r0c,|i|}|Srprr)rgrstokenrrSs r.ruzcheck_jwt..wrapper<s) d%f%%  r0r)rSrurs` @r. check_jwtr1sJ   4[[[ Nr0cBttjS)zJ Get current epoch timestamp as int :return: timestamp as int )r)timerrr0r. timestamprKs ty{{  r0rcJtjtdz S)zC Pick a yesterday date :return: a datetime.date object r)days)rtodayrrrr0r. prev_daterSs :<<)+++ ++r0tsc*tj|S)zy Get the datetime.date object for given int timestamp :param ts: timestamp :return: datetime.date object )r fromtimestamp)rs r.date_of_timestampr[s  b ! !!r0cDtdS)zj Get a formatted representation of yesterday date :return: str date in the form of dd/mm/YYYY z%d/%m/%Y)rstrftimerrr0r.get_formatted_daterds ;;   + ++r0links list[dict]cfddfdt|dDS)u HTML formatted links. Both the domain (interpolated into the visible body) and the link (interpolated into the href attribute) are passed through html.escape(..., quote=True) so HTML-special characters in either slot cannot break attribute parsing or inject tags. The href is also explicitly double-quoted — without quotes, whitespace in the link value would let any subsequent token be parsed as a new attribute (e.g. ``onmouseover=...``). Defense-in-depth: today the sole caller (continuous.tracing.generate_mail) passes url_split(task.url)[0] and task.shared_link, both of which are derived from controlled sources, but the template must remain safe for any future caller. z+

{num}) {domain}

 c g|]_\}}|D]E\}}|tj|dtj|dF`S)T)quote)numlinkdomain)itemsformathtmlescape).0ilink_mapkv html_items r. z,get_html_formatted_links..~s   8 ((  1   Qd)C)C)CDKXYaeLfLfLf  g g    r0rrX enumerate)rrs @r.get_html_formatted_linksrlsP >I 99    (22     r0cfddfdt|dDS)z Formatted links z{num}) {dom}: {link}rczg|]7\}}|D]\}}|||8S))rdomr)rr)rrrrr text_items r.rz,get_text_formatted_links..sStttKAxckcqcqcscstt[_[\^_  aQQ  / /ttttr0rr)rrs @r.get_text_formatted_linksrsB'I 99tttt9UTUCVCVttt  r0c tjd}|}|dj}t j5}|d|dddn #1swxYwY|dS#ttj f$r"}ttd|d}~wwxYw)ze Obtain system ID from /etc/sysconfig/rhn/systemid :return: system ID without ID- prefix z/etc/sysconfig/rhn/systemidz(.//member[name='system_id']/value/string system_idNzID-zFailed to retrieve system_id) ETparsegetrootfindtext sentry_sdkconfigure_scopeset_taglstripr9 ParseErrorr#_)treerootwhole_idscoperQs r. read_sys_idrs Bx566||~~99GHHM  ' ) ) 1U MM+x 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1u%%% R] #BBB899::ABs<ABA:. B:A>>BA>BC0C  Csys_idagent_system_id_pathc>tj|tjtjztjztjzd} tj||tj|dS#tj|wxYw)zH Write system_id into file /usr/share/alt-php-xray/agent_sys_id N) r7rCrdrcrerFrfrrK)rrrms r. write_sys_idrsr %rzBK'?"*'Lr}'\^c d dB V]]__%%%   s 'BBcL tt5}|cdddS#1swxYwYdS#t$rC}t ddt|itcYd}~Sd}~wwxYw)zA Read system_id saved by agent during its initialization Nz8Failed to retrieve agent's system_id, returning real oner=r>) rCrrbstripr9rHrMr'r)agent_sysid_filerQs r.read_agent_sys_idrs *   3!1#((**0022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3  NW\^abc^d^dVe fff}}s?A&A  A A  AA A B# 8BB#B# bool | Nonec@ttj}|st}t }t dt|t|ttd ||dS)z9Raise XRayError in case of detected non-supported editionzMCurrent CloudLinux edition: %s or Control Panel: %s is not supported by X-RayzMCurrent CloudLinux edition: {} or Control Panel: {} is not supported by X-RayT) rrXRAYrrrHrMr'r$rr) is_supportedcurrent_edition current_panels r.rrs-gl;;L   133!  [        ] ^ ^ e e     4r0c* tt5}|cdddS#1swxYwYdS#t$r2t t dttzwxYw)zT Obtain jwt token from /etc/sysconfig/rhn/jwt.token :return: token read NzJWT file %s read error)rCrrbrr9r#rr') token_files r.read_jwt_tokenrs O $ % % -??$$**,, - - - - - - - - - - - - - - - - - - OOO233c:L6M6MMNNNOs-A&A  A A  AA A.add_infost g~|<=== 6kBBmYYw++  nn]D99  1$/=E-  r0c dt}|r|dnd}|r|dnd}trdnd}d|fd|fd|fdtjfdt d fd t fd t d ff}|D] }|j| dS) NrnameWP2zControl Panel NamezControl Panel VersionzControl Panel ProductkernelzCloudLinux version os_releasezCloudlinux edition Architecture architecture)rrrplatformreleaserrr) sentry_scopecp_description cp_versioncp_name cp_producttagstags r.set_tagszsentry_init..set_tags s+--6DN^'' 222$ 0>H.$$V,,,D022.nopes r0)level event_levelzalt-php-xray@0.6-54.el9)callbacki'r)dsn before_sendrmax_value_lengthr integrationsidzFailed to set Sentry tags: %sN)rrrrr*rr*r+)rloggingINFOWARNINGrrrinitr!rruserrrHdebugr')rrrsentry_loggingxray_ver silent_atexitrrQs r. sentry_initrs,'''(    (glXXXN~~:!:H%t444MO +;77$m4      # % % B (55   B HUOOOO B B B LL8#a&& A A A A A A A A B B B B B B B B B B B B B B B B B B Bs<D* B65D6 C2(C-(D-C22DD DlognamecHtjtjtjtjtjd}t  tj|g}|dkr&|tj tj | |tjdd|n8#t$r+tj tj gYdSwxYw tj|d n#t $rYnwxYw|S) z[ Configure logging and Sentry :param logname: path to log :return: logpath )rrMrIerrorcritical)filenamerz1%(asctime)s [%(threadName)s:%(name)s] %(message)sz%m/%d/%Y %I:%M:%S %p)rrdatefmthandlers)r!Nr)rDEBUGrrERRORCRITICALr FileHandlerappend StreamHandler basicConfigrr9 NullHandlerr7chmodPermissionError)rrlevelsr!s r.configure_loggingr-:s4 ?$ FMMM '999: G   OOG133 4 4 4**UGL11F*      g&9&;&;%<====   %         Ns% A8C1C87C8<D DDz"^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,31}$usernamec|stdt|std| tj|dS#t $rtd|dwxYw)zValidate that username is a real system user. Raises ValueError with a clear message if username is empty, has an invalid format, or does not exist in the system user database. zusername must not be emptyzInvalid username: zsystem user does not exist: N) ValueError_safe_username_patternmatchpwdgetpwnamr)r.s r.validate_system_userr5bs 75666 ! ' ' 1 1<:h::;;;P X PPPDDDEE4OPs AA3 clwpos_argslistct|ttjs-d|D}dd|z}dd|ddd|gSd |d g|zS) zBuild subprocess argv for /usr/bin/clwpos-user invocation. Non-CageFS: wraps in sudo -u bash -c with shell-quoted args. CageFS: passes args directly via cagefs_enter_user argv. cPg|]#}tjt|$Srr)shlexrr')ras r.rz)build_clwpos_user_cmd..zs(???aek#a&&))???r0z/usr/bin/clwpos-user  sudo-uz-sz /bin/bashz-cz/sbin/cagefs_enter_userz/usr/bin/clwpos-user)r5rrCAGEFSrX)r.r6 safe_parts inner_cmds r.build_clwpos_user_cmdrBrsv """ %gn 5 5[??;??? +chhz.B.BB hk4KK)85KL{ZZr0rkdstc  tj||dS#t$rD}tt d||t ||d}~wwxYw)zZ Move file with error catching :param src: source :param dst: destination z Failed to move file {} to {}: {}N)shutilmover9r#rrr')rkrCrQs r. safe_moverGsv _ C ___<==DDS#sSTvvVVWW]^^_s A'?A""A' sock_locationrcttjdd}|dkrt 5 tj|n#t $rYnwxYwtt}| || dddn #1swxYwYn/tdtt}| |S)z Create world-writable socket in given sock_location or reuse existing one :param sock_location: socket address :return: socket object LISTEN_FDS0rN) r)r7environrumask_0raFileNotFoundErrorrr bindlistenr r )rH listen_fdssockobjs r. create_socketrTsRZ^^L#6677JQ YY    -(((($    WooG LL ' ' ' NN                  G[11 Ns7B2AB2 A&#B2%A&&AB22B69B6lve_idc>ttjsdSd}d|d} t|5}|D]}||rut d|t| |dccdddS dddn #1swxYwYn@#t$r3}t d|t|Yd}~nd}~wwxYwdS) zX Retrieve current value of CPU throttled time. Return 0 in case of failures rthrottled_timez/sys/fs/cgroup/cpu,cpuacct/lvez /cpu.statz%sNzFailed to open %s: %s) rrLVErCrZrHrr)rrr9rr')rUmarker stat_file stat_valuesvaluerQs r.get_current_cpu_throttling_timer^s &gk 2 2q FBBBBIA )__ H $ H H##F++HLLu---u{{}}226::2>DDFFGGGG  H H H H H H H HH H H H H H H H H H H H H H H H H AAA ,iQ@@@@@@@@A 1sGCBC6 CC CCCCC D')DD tuple | Nonecd}tj|sdS tj|d|dgddd}|j|jfS#tj$r6}t ddt|i Yd}~dSd}~wt$r3}t d t|Yd}~dSd}~wwxYw) z 'selectorctl -u username --user-current' command :param username: name of user :return: tuple(stdout, stderr) or None if command fails z/usr/bin/selectorctlNr>z--user-currentTcapture_outputrrz&Failed to get selectorctl user-currentr=r>z%selectorctl --user-current failed: %s)r7r&isfile subprocessrunstdoutrstderrCalledProcessErrorrHrIr'subprocess_errorsr)r. _selectorctlrtrQs r._selectorctl_get_versionrks *L 7>>, ' 'tF 4+; z cagefsctl --getprefix failed: %s) r7r&rcrdrerfrrhrHrIr'rirr. _cagefsctlrtrQs r.cagefsctl_get_prefixrps'J 7>>* % %tA]H EVZaemqrrr}""$$$  (PPP7s1vvOOOOOOOOO AAA 7Q@@@@@@@@@As#3AC(+B C&(CCcd}tj|sdS||ddg}n|d|g} tj|ddt d|dS#tj$r6}t d d t|i Yd}~dSd}~wt$r3}t d t|Yd}~dSd}~wwxYw) z 'cagefsctl --remount username' or 'cagefsctl --remount-all' command :param username: name of user or None (for remount-all) rmNz --wait-lockz --remount-allz --remountT)rrbz Remounted %szFailed to remount cagefsr=r>zcagefsctl --remount failed: %s) r7r&rcrdrerHrMrhrIr'rir)r.rorgrQs r._cagefsctl_remountrrs 'J 7>>* % %M?;K2?t4==== NH-----  (JJJ1%QIIIIIIIII ??? 5s1vv>>>>>>>>>?s#2A&&C&5+B&& C&3(C!!C&boolc6d}tj|sdS tj|d|gddd}d|jvS#t$r3}t dt|Yd}~dSd}~wwxYw) z 'cagefsctl --user-status username' command :param username: name of user :return: True if user has Enabled status, False otherwise rmFz --user-statusTraEnabledz"cagefsctl --user-status failed: %sN) r7r&rcrdrerfrrirHrr'rns r._is_cagefs_enabledrvs 'J 7>>* % %uC_h GX\cgotuuuFM//1111 CCC 93q66BBBBBBBBBCs5A B%(BBc td5}|}dddn #1swxYwYn#t$rYdSwxYwd|vS)z` Check if there is php.d.location = selector set in /etc/cl.selector/symlinks.rules z/etc/cl.selector/symlinks.rulesNFselector)rCrbr9) rules_filecontentss r._is_selector_phpd_location_setr{s  3 4 4 ) !((H ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) uu  !!s'>2 >6>6> A  A ctt5}t|dkcdddS#1swxYwYdS)z:Check if there are no active tasks (== empty task storage)rN)ryrlenkeys)r}s r.no_active_tasksrs ( ) )-\<$$&&''1,------------------s%AA A enabledcHttjsdS tddd5}||rdndddddS#1swxYwYdS#t $r4}t d|t|Yd}~dSd}~wwxYw) zb Switch on/off throttle statistics gathering by kmodlve :param enabled: True or False Nz!/proc/sys/kernel/sched_schedstatswbr)r( buffering10z(Failed to set sched_schedstats to %s: %s) rrrYrCrfr9rHrMr')rfrQs r.switch_schedstatsrs &gk 2 2Q 5DA N N N /RS GGG-DD . . . / / / / / / / / / / / / / / / / / / QQQ >QPPPPPPPPPQs:A#A A#AA#AA## B!-)BB!cJtddduS)zG Check if end-users have access to X-Ray UI of End-User plugin hideXrayApp uiSettingsF)r get_paramrrr0r.is_xray_app_availabler(s# ::   | < < EEr0cttt5} |tn##t t f$rYddddSwxYw dddn #1swxYwYdS)z Check if User Agent is listeningNFT)rr r connectr"ConnectionErrorr9)ss r.is_xray_user_agent_activer/s  % %  IIo & & & &)      ' 4s1A(8A(A A(AA((A,/A,cBtjd S)z2Check if SSA is disabled by its internal flag-filez/usr/share/clos_ssa/ssa_enabled)r7r&rcrrr0r. ssa_disabledr9sw~~?@@ @@r0c~ ttj|jz dkS#t$rYdSwxYw)z.Check is file was modified during the last dayiQF)rr7r5st_mtimer9)rs r.is_file_recently_modifiedr>sJ{{RWX..77%?? uus +. <<cpt|5t}dddn #1swxYwY|Sr)rr)rrts r.get_user_php_versionrGsu   //,../////////////// Ms +//c#KtdD]} tj|tjtjzt d|n#t$rf}t dt||j tj tj fvrtj dYd}~d}~wwxYwttdd dVtj|tjt d |dS#tj|tjt d |wxYw) uq Context manager for locking given file object :param fd: а file object providing a fileno() method xzFile %s lockedzFailed to lock: %sg?Nz%Failed to lock at all. Exiting threadrI)flagzFile %s unlocked)rangefcntlflockLOCK_EXLOCK_NBrHrMr9r'errnoEAGAINEACCESrsleepr#rLOCK_UN)rm_attemptrQs r.filelockrPsR#JJ T T  KEMEM9 : : : KK(" - - - E    KK,c!ff 5 5 5wu|U\::: JsOOOOOOOO  ABBSSSS,   B &&& &+++++  B &&& &++++s%AA C(AC  C0D00>D EEEHTNNNNNr0rT target_uid target_gidc#Ktj}tj}td} tj|}n#t $rd}YnwxYw| ||}n|j}| ||}n|j}|tj|} ||krWtj |t d||r&tj |krt|||krqtj|t d||r@tj|kr)||krtj |t| dV||kr/tj|t d|||kr/tj |t d||tj| dSdS#||kr/tj|t d|||kr/tj |t d||tj| wwxYw)aH Context manager to drop privileges during some operation and then restore them back. If target_uid or target_gid are given, use input values. Otherwise, stat target_uid and target_gid from given target_path. If no target_path given, use current directory. Use mask if given. :param target_uid: uid to set :param target_gid: gid to set :param target_path: directory or file to stat for privileges, default -- current directory :param mask: umask to use :param with_check: check the result of switching privileges z6Unable to execute required operation: permission issueNzDropped GID privs to %szDropped UID privs to %szRestored UID privs to %szRestored GID privs to %s)r7getuidgetgidrr5r9st_uidst_gidrsetegidrHrgetegidr#seteuidgeteuid) rr target_pathr with_checkprev_uidprev_gidpermission_issue_message stat_infors r.set_privilegesrs,y{{Hy{{H !YZZGK((    !JJ")J  !JJ")J x~~: : . ;;;  6"*,,*44455 5: : . ;;;  6"*,,*44:%% 8$$$455 5   z ! ! Jx LL3X > > > z ! ! Jx LL3X > > >   HTNNNNN   z ! ! Jx LL3X > > > z ! ! Jx LL3X > > >   HTNNNN sA AA'G//BI2c#K tj|tj|dVtjdtjddS#tjdtjdwxYw)z Dive into user context by dropping permissions to avoid most of the security issues. Does not cover cagefs case because it also requires nsenter, which is only available with execve() call in our system Nr)r7rr)uidgids r. user_contextrsn 3 3  1  1  1  1 s ,A*Bcfd}|S)z: Decorator to retry method on specific exceptions cfd}|S)NcRd}ttdtz}|krq |i|S#t$rM}|dz }tdt||}t jdYd}~nd}~wwxYw|kq|)Nrz0Request to website failed even after %s retries.rz'Retry to request website, exception: %s)r0rr'tuplerHrIrr)rgrsretries exceptionrQexceptions_to_retryrS max_retriess r.ruz7retry_on_exceptions..decorator..wrappersG"1%W#X#X[^_j[k[k#kllIK''"40000011"""qLGNN#LcRSffUUU !IJqMMMMMMMM "K''Os?BABBrr)rSrurrs` r. decoratorz&retry_on_exceptions..decorators.       r0rr)rrrs`` r.retry_on_exceptionsrs*  r0)r&r'r(r)r*r+)r&r'r1r)r2r)r*r+r)r&r'r(r)r4r;r*r+)rSrr*r)r*r))r*r)rr)r*r)r*r')rrr*r')rr'rr'r*r+)r*r)rr'r*r)r*rr)rr'r*r)r.r'r*r+)r.r'r6r7r*r7)rkr'rCr'r*r+)rHr'r*r)rUr)r*r))r.r'r*r_)r.r'r*r)r.rr*r+)r.r'r*rs)r*rs)rrsr*r+)rr'r*rs)F)rr'rrs)r)rr)r*r+)NNrNT)rr;rr;rr;r*r+){__doc__ __future__rrrrrrr7rr3rerr:rEr5rdrxml.etree.ElementTreeetree ElementTreercollections.abcr contextlibrdatetimerr functoolsr r rr r r rclcommon.clpwdrclcommon.constrclcommon.cpapirrrrclcommon.lib.cleditionrclcommon.ui_configrclcommon.utilsrsentry_sdk.integrations.atexitrsentry_sdk.integrations.loggingrxrayrr!xray.internal.clwpos_safe_importsr constantsrrrr r!r" exceptionsr#r$ getLoggerrHr9r0SubprocessErrorrir/r:r-rvrrrrrrrrrrrrrrrrr-compiler1r5rBrGrTr^rkrprrrvr{rrrrrrrrryrNrrrrrr0r.rs #"""""    """""""""$$$$$$%%%%%%$$$$$$$$777777777777******""""""hhhhhhhhhhhh::::::''''''111111<<<<<<>>>>>>IIIIIIvvvvvvvvvvvvvvvv22222222  7 # #j**DE"""">DDDD>     LSSSSl7777t4,,,,"""",,,,4 B B B B ;E    &  O O O  O7777:::: OBOBOBOBd+8"""""J$$IJJ P P P P [ [ [ [ _ _ _ _0    (FFFF(AAAA&?????* C C C C " " " "---- Q Q Q Q FFFFAAAA ,,,,:11111>!! MMMMM`$r0