FM / bin

/opt/cloudlinux/venv/bin

Name	Size	Mode	Actions
activate	1691	0644	edit dl rm
activate.csh	915	0644	edit dl rm
activate.fish	2191	0644	edit dl rm
Activate.ps1	9033	0644	edit dl rm
alembic	229	0755	edit dl rm
cagefsctl_user.py	15925	0755	edit dl rm
cagefs_enter_site.py	1877	0755	edit dl rm
chardetect	237	0755	edit dl rm
clcpapi	5409	0755	edit dl rm
cl_sysctl	4620	0755	edit dl rm
coverage	231	0755	edit dl rm
coverage-3.11	231	0755	edit dl rm
coverage3	231	0755	edit dl rm
cpanel-dbmapping	3929	0755	edit dl rm
crontab-user-wrapper.py	4401	0755	edit dl rm
da_suid_caller.py	686	0644	edit dl rm
detect-requirements	238	0755	edit dl rm
dodgy	224	0755	edit dl rm
epylint	235	0755	edit dl rm
f2py	232	0755	edit dl rm
f2py3	232	0755	edit dl rm
f2py3.11	232	0755	edit dl rm
flake8	230	0755	edit dl rm
futurize	231	0755	edit dl rm
get_gprof	1885	0755	edit dl rm
get_objgraph	1667	0755	edit dl rm
isort	225	0755	edit dl rm
isort-identify-imports	259	0755	edit dl rm
jsonschema	229	0755	edit dl rm
lvestats_config_reader.py	1145	0644	edit dl rm
mako-render	229	0755	edit dl rm
normalizer	260	0755	edit dl rm
pasteurize	233	0755	edit dl rm
pip	237	0755	edit dl rm
pip3	237	0755	edit dl rm
pip3.11	237	0755	edit dl rm
plesk_suid_caller.py	905	0644	edit dl rm
prospector	229	0755	edit dl rm
py.test	237	0755	edit dl rm
pycodestyle	228	0755	edit dl rm
pydocstyle	229	0755	edit dl rm
pyflakes	227	0755	edit dl rm
pylint	233	0755	edit dl rm
pylint-config	249	0755	edit dl rm
pyreverse	239	0755	edit dl rm
pysemver	225	0755	edit dl rm
pytest	237	0755	edit dl rm
python	15368	0755	edit dl rm
python3	15368	0755	edit dl rm
python3.11	15368	0755	edit dl rm
raven	235	0755	edit dl rm
symilar	235	0755	edit dl rm
tap	223	0755	edit dl rm
tappy	223	0755	edit dl rm
undill	603	0755	edit dl rm
virtualenv	254	0755	edit dl rm

Edit: /opt/cloudlinux/venv/bin/crontab-user-wrapper.py (4401B)

#!/opt/cloudlinux/venv/bin/python3 -sbb
# -*- coding: utf-8 -*-
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENCE.TXT
#
"""
Crontab wrapper for website isolation support.

This wrapper mimics crontab command-line interface:
- crontab -l: Lists current crontab entries, filtering isolation tool prefixes
- crontab [file]: Installs crontab from file (or '-' for stdin)

When website isolation is active (PROXYEXEC_DOCUMENT_ROOT is set):
1. List operations filter out isolation wrapper prefixes from output
2. Save operations automatically prepend isolation tool to commands

The isolation tool is prepended to commands to ensure they run within the
isolated website context.
"""

import argparse
import os
import sys

from clcagefslib.webisolation import crontab

def create_parser():
    """
    Create argument parser for the crontab wrapper.

Returns:
        argparse.ArgumentParser: Configured argument parser
    """
    parser = argparse.ArgumentParser(
        prog="crontab-user-wrapper",
        description="Crontab wrapper for website isolation support. "
                    "Filters and modifies crontab entries to support website isolation.",
    )

parser.add_argument(
        "-l",
        "--list",
        action="store_true",
        help="List current crontab entries (filters isolation prefixes)",
        dest="list_crontab",
    )

parser.add_argument(
        "file",
        nargs="?",
        default="-",
        help="File containing crontab entries to install, or '-' to read from stdin (default: '-')",
    )

return parser

def main(argv=None):
    """
    Main entry point.

Args:
        argv: Command line arguments (defaults to sys.argv[1:])

Returns:
        int: Exit code
    """
    parser = create_parser()
    args = parser.parse_args(argv)

try:
        if args.list_crontab:
            return crontab.process_list()

# Handle file argument: '-' means stdin, otherwise open the file
        if args.file == "-":
            stdin = sys.stdin.buffer
        else:
            # scanner-triage (F-03, CLOS-5941): the scanner reads this
            # `open(args.file, "rb")` as a root-context read of a caller-
            # controlled path. It is not. Every CRONTAB_* proxyexec alias
            # in proxyexec/proxy.commands is `:secure:noproceed=` (never
            # `root:`), so proxyexec/cagefs.server.c setuid(pw.pw_uid)-
            # drops to the authenticated caller before execv'ing
            # /usr/sbin/cloudlinux-user-cron, which securelve.spec ships
            # as a plain non-setuid symlink to this wrapper. By the time
            # main() runs, the process is already the caller — this open
            # is a caller-context read of the caller's own file, not a
            # cross-tenant read. See SECURITY-EXCEPTIONS.md for the
            # sibling get_document_root triage that pins the same
            # invariant. DiD: use os.open with O_NOFOLLOW/O_CLOEXEC so a
            # symlink swap between argparse and this line still fails
            # closed at the caller boundary, and refuse if the wrapper is
            # ever invoked with euid 0 (a future `root:` alias regression
            # or a setuid-root wrapper on top of cloudlinux-user-cron).
            if os.geteuid() == 0:
                sys.stderr.write("crontab: operation not permitted\n")
                return 1
            try:
                fd = os.open(
                    args.file,
                    os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW,
                )
                stdin = os.fdopen(fd, "rb")
            except OSError:
                sys.stderr.write("crontab: unable to read the requested file\n")
                return 1

try:
            return crontab.process_save(stdin=stdin)
        finally:
            if args.file != "-" and stdin != sys.stdin.buffer:
                stdin.close()
    except Exception as e:
        # Surface any failure (e.g. forged PROXYEXEC_DOCUMENT_ROOT rejected
        # by get_document_root) as a clean stderr message instead of a
        # Python traceback leaking into the user's terminal.
        sys.stderr.write(f"crontab: {type(e).__name__}: {e}\n")
        return 1

if __name__ == "__main__":
    sys.exit(main())

cmd: