­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 nj> @sddlmZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlmZddlmZddlmZddlmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ddlm,Z,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2m3Z3m4Z4d Z5d Z6dZ7dZ8dZ9dZ:dZ;dZZ?ej=dZ@ejAjBdre jAjCddejDdeEde$jFjGejHddZIddZJdd ZKd!d"ZLd#d$ZMdd%d&ZNd'd(ZOd)d*ZPd+d,ZQd-d.ZRd/d0ZSd1d2ZTGd3d4d4eUZVGd5d6d6e,ZWGd7d8d8e,ZXGd9d:d:e,ZYd;d<ZZed=d>Z[dd?d@Z\dAdBZ]dCdDZ^iZ_dEdFZ`e`e2ja_bece dGdsy8ddldZeddlfZgeejhjiegjjeejhjidHkrekdIWnekk rYn8XdJdKZle2jmZnGdLdMdMeoZpGdNdOdOe2jmZqeqe2_mdPdQZrejsfdRdSZtdTdUZudVdWZvGdXdYdYeoZwdZd[Zxd\d]Zydd_d`ZzdadbZ{dcddZ|ddedfZ}dgdhZ~didjZdkdlZdmdnZdodpZdqdrZdsdtZdudvZdwdxZdydzZd{d|Zd}d~ZddZddZddZddZdddZddZddZddZddZdddZddZddZddZddZddZe&jdddZddZddZGdddZddZddZddZddZejejsfddZddZe&je*jdejfddZddZddZddZdddZddZddZdS))print_functionN)ArgumentParser)contextmanager)datetime)anomalyauth capabilitiesconfigconfig_handlers constantsdoctorerrorsfetch http_utils ipv6_supportkcarelibcare log_utilsplatform_utils process_utilsselinux server_infoserverid update_utilsutils) KcareErrorNotFoundSafeExceptionWrapper) HTTPErrorURLErrorhttplibjson_loads_nstr urlencodecZv312h24h48htestz./etc/sysconfig/kcare/freezer.modules.blacklistz/usr/libexec/kcare/kcdoctor.sh latest.v3 latest.v2z /etc/sysconfig/kcare/sysctl.conf z$==BLACKLIST== (.*)==END BLACKLIST== z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/pythonignore)categorycCsDt}tjjtr@ttd}x|D]}|j|jq"W|j|S)Nr) setospathisfileFREEZER_BLACKLISTopenaddrstripclose)resultfliner;./usr/libexec/kcare/python/kcarectl/__init__.pyget_freezer_blacklistSs   r=cCsB|jd}|r(dj|d||dg}ndj|d|dg}|S)N.rrr?)splitjoin)ptypefilenameZ name_partsr;r;r< _apply_ptype]s  rDcCsJt|tjt_t|tjt_t|tjt_t|tjt_t|tjt_dS)N)rDr PATCH_BIN PATCH_INFOBLACKLIST_FILE FIXUPS_FILE PATCH_DONE)rBr;r;r< apply_ptypefs rJcCstj\}}}d}t|trbt|t rbyd|jtj|j|jf}Wqt t fk r^YqXnPt|t t t frt|t rd|}n*t|t r|jpt|j}|jpd|j}tj}tjtj|d|dt|dt||djtj|dt|ddd S) Nz[Errno %i] %s: '%s'z%srr__name__dattempts)Z agent_versionZpython_versiondistroZdistro_versionerrordetails tracebackrN)sysexc_info isinstanceOSErrorr errnor0strerrorrCAttributeError TypeErrorKeyErrorIOErrorretypetypeinnerrQr get_distror VERSIONget_python_versiongetattrstrrArRZ format_tb)r]valuetbZdetails_sanitizedrOr;r;r< format_exception_without_detailsns*  rgc Csvtjr dStjt}tjtjtj |}tj dd|}t j |t j}yt j|Wntk rpYnXdS)Nz/api/kcarectl-tracez?trace=)r UPDATE_FROM_LOCALjsondumpsrgrnstrbase64Zurlsafe_b64encodeZbstrget_patch_server_urlrZ http_requestrZget_http_auth_stringZ urlopen_base Exception)ZtraceZ encoded_traceurlZrequestr;r;r<send_excs rpcCstj}|dkr tj|ddStjtj}|dkrBtjdtjdttjd&}tj |j dtj |j dWdQRX|rt j |y |Wn*t k rtjjdtjdYnXtjddS)z Run func in a fork in an own process group (will stay alive after kcarectl process death). :param func: function to execute :return: rNarzWait exception)r0forkwaitpidsetsid_exitr7r4r ZLOG_FILEdup2filenotimesleeprnrkcarelog exception)funcrzpidfdr;r;r< nohup_forks(      rcCstjjtjd}tjj|rtt|dH}y,t|j}|t j t j krRt ||Wnt k rhYnXWdQRXtj|tjdS)aCheck the fact that there was a failed patching attempt. If anchor file not exists we should create an anchor with timestamp and schedule its deletion at $timeout. If anchor exists and its timestamp more than $timeout from now we should raise an error. z.kcareprev.lockr.N)r0r1rAr PATCH_CACHEr2r4intreadr SUCCESS_TIMEOUTryPreviousPatchFailedException ValueErrorr atomic_write timestamp_str)Zanchor_filepathZafile timestampr;r;r< touch_anchors   rcCsxytjtjjtjdWntk r.YnXtd|tj j yt ddWn t k rrt jjdYnXdS)z See touch_anchor() for detailed explanation of anchor mechanics. See KPT-730 for details about action registration. :param state_data: dict with current level, kernel_id etc. z.kcareprev.lockdone)reasonzCannot send update info!N)r0remover1rAr rrVregister_actionrget_loaded_modulesclearget_latest_patch_levelrnrr{r|) state_datar;r;r< commit_updates  rcCs(tjtjjtjdtj||dddS)NpatchesrK)Z exclude_path) rclean_directoryr0r1rAr rrget_cache_path)khashZplevelr;r;r< clear_cachesrcCs>tjpd}dj||g}tjd|f}|r2||f7}tjj|S)Nnone-modules)r PREFIXrAr rr0r1)rfnameprefixZ module_dirr8r;r;r<get_current_level_paths    rcCstjt|dt|dddS)NlatestT)Z ensure_dir)rrrrd)r patch_levelr;r;r<save_cache_latestsrc CsVt|d}tjj|rRy"tt|djj}tj ||St t fk rPYnXdS)Nrr.) rr0r1r2rr4rstriprLegacyKernelPatchLevelrrZ)rZpath_with_latestplr;r;r<get_cache_latests   rc@s eZdZdS)CertificateErrorN)rL __module__ __qualname__r;r;r;r<r srcs eZdZdZfddZZS)UnknownKernelExceptionzunknown kernelc s6djtjdtjtj}tt|j |f|dS)NzLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.r) formatrr`platformreleaserget_kernel_hashsuperr__init__)selfkwargsmsg) __class__r;r<rszUnknownKernelException.__init__)rLrrstatusr __classcell__r;r;)rr<rsrcs(eZdZdZfddZddZZS)ApplyPatchErrorzpatch apply errorcsFtt|j||||_||_||_||_tjd|_ t j |_ dS)Nr) rrrcode freezer_stylelevel patch_filerr`rOrr)rrrrrargsr)rr;r<rszApplyPatchError.__init__c Cs0dj|j|j|j|j|jdjdd|jDS)Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})z, cSsg|] }t|qSr;)rd).0ir;r;r< -sz+ApplyPatchError.__str__..)rrrrrOrrAr)rr;r;r<__str__&szApplyPatchError.__str__)rLrrrrrrr;r;)rr<rs rcs(eZdZdZfddZddZZS)rzprevious patch failedcs"tt|j||||_||_dS)N)rrrranchor)rrrrr)rr;r<r5sz%PreviousPatchFailedException.__init__cCsd}|j|j|jS)NzIt seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)rrr)rmessager;r;r<r:sz$PreviousPatchFailedException.__str__)rLrrrrrrr;r;)rr<r2s rcCstjdj|}yztj|}tjtj|j}t |d}|dkrRtj dn8|dkrftj dn$|dkrztj dntj d j||St k r}zt j ||WYdd}~XnXd S) Nz"/nagios/register_key.plain?key={0}rrzKey successfully registeredrzWrong key format or sizerrz!No KernelCare license for that IPzUnknown error {0}r?)rget_registration_urlrrurlopenr data_as_dictrkrr print_wrapperrrprint_cln_http_error)keyroresponseresrer;r;r<!set_monitoring_key_for_ip_licenseCs      rc cs>tjrtjtjddz dVWdtjr8tjtjddXdS)NT)shell)r ZBEFORE_UPDATE_COMMANDr run_commandZAFTER_UPDATE_COMMANDr;r;r;r< execute_hooksWs  rcCst}|j}|j}tj}|dkrht|tjtj t j |t t j|d}tjdtjtj|njtjdtjt|tjdt|tjtjtjtj tjt j tj|tjt jdS)a1 The output will consist of: Ignore output up to the line with "--START--" Line 1: show if update is needed: 0 - updated to latest, 1 - update available, 2 - unknown kernel 3 - kernel doesn't need patches 4 - no license, cannot determine Line 2: licensing message (can be skipped, can be more then one line) Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license Line 4: Update mode (True - auto-update, False, no auto update) Line 5: Effective kernel version Line 6: Real kernel version Line 7: Patchset Installed # --> If None, no patchset installed Line 8: Uptime (in seconds) If *format* is 'json' return the results in JSON format. Any other output means error retrieving info :return: ri)Z updateCodeZ autoUpdateZeffectiveKernelZ realKernelZloadedPatchLevelZuptimelicensez --START--z LICENSE: N)_patch_level_infor applied_lvlr license_infordr AUTO_UPDATEr kcare_unamerrrrZ get_uptimerrrirj)fmtpliZ update_codeZ loaded_plZlicense_info_resultZresultsr;r;r< plugin_infocs,     rc Cs^tj}ytdd}Wntk r4tjr0dSdSX|dkrBdS||krNdStjrZdSdS)Ninfo)rrrrr)rloaded_patch_levelrrr IGNORE_UNKNOWN_KERNELrZstatus_gap_passed) current_levelZlatest_patch_levelr;r;r<get_update_statussrcCs2tjdd\}}|dkr*|jdr*dSdSdS)NrrZ CloudLinuxz7.extrarK)rr` startswith)rOversionr;r;r<edf_fallback_ptypesrcCsl|j|jf}tj||}tj||j|_|jjtj tj d|tkrZ|jj ddt|<|j rh|j dS)zFunction remembers IP address of host connected to and uses it for later connections. Replaces stdlib version of httplib.HTTPConnection.connect rNrr)hostZportCONNECTION_STICKY_MAPgetsocketZcreate_connectionZtimeoutsockZ setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername _tunnel_hostZ_tunnel)rZaddrZ resolved_addrr;r;r<sticky_connects  rZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.cGsdS)NTr;)rr;r;r<dummy_verify_callbacksrc@s,eZdZddZddZddZddZd S) SSLSockcCs||_d|_dS)Nr) _ssl_conn_makefile_refs)rrr;r;r<rszSSLSock.__init__cGs&|jd7_tj|jf|ddiS)Nrr7T)rrZ _fileobjectr)rrr;r;r<makefileszSSLSock.makefilecCs"|j r|jr|jjd|_dS)N)rrr7)rr;r;r<r7s z SSLSock.closecGs |jj|S)N)rsendall)rrr;r;r<rszSSLSock.sendallN)rLrrrrr7rr;r;r;r<rsrc@seZdZddZdS)PyOpenSSLHTTPSConnectioncCstjj|tjjtjj}|jtjjtjj Bt j rJ|j tjj tn|j tjjt|jtjj||j}|j|jp|j}|j|j|jt j rt|j|t||_dS)N)r!HTTPConnectionconnectOpenSSLZSSLZContextZ SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r CHECK_SSL_CERTSZ set_verifyZ VERIFY_PEERrZ VERIFY_NONEZset_default_verify_pathsZ ConnectionrZset_connect_staterrZset_tlsext_host_nameencodeZ do_handshakematch_hostnameZget_peer_certificater)rZctxZconnZ server_hostr;r;r<rs  z PyOpenSSLHTTPSConnection.connectN)rLrrrr;r;r;r<rsrcCstjr&tj||}tjtj|ddS|dk}tjo6|}xrd|fd|fdgD]Z\}}t j |||d} t j | |d} |rdj | } tj|t ||d | }d } |s|rt || kr|rd nd } tjd j | qNyxtjtj|dd} tjrJtj| rJtj| }tj|}|r.tjdj |ddntjddd|rJ|j| Stk r}z>|sl|r|jdks|jdkrtjdj |wNWYdd}~XqNXqNWdS)NF) check_license latest.v1 latest.v2T)secure_boot_info perf_metrics) b64_encodingzinfo={0}?iXzsecure boot infoz perf metricsz/Check-in URL param is too large, discarding {0}z:Automatic kernel anomaly report uploaded successfully: {0}) print_msgz$Failed to send kernel anomaly reportizCCheck-in request failed with error: {0}, retrying with reduced info)rr)FF)rr)r rhrZget_kernel_prefixed_urlrZwrap_with_cache_keyr urlopen_authZSEND_PERF_METRICSrZencode_checkin_payloadrstickyfylenrlogwarnZKERNEL_ANOMALY_REPORT_ENABLErZdetect_anomalyprepare_kernel_anomaly_reportsend_data_packageloginforemove_archiverr)rrrmoderorZ perf_enabledrrZsinfoZ request_paramZmax_url_lengthZ discard_infor8 data_package upload_nameexr;r;r<_fetch_patch_level_requestsB       $r c Cs8tj}tjdk r$tj|ttjSxtD]}yt||||}tj |j t t j |jj}tjdj||dd|r|jdrt|}|jdg}tj|stjdtj||d|d|d Stj|t|Stk rYq,tk r(}z|jd krtd WYdd}~Xq,Xq,WtdS)Nz;fetch patch level, reason: {0}, kernel latest response: {1}F)r{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgraderbaseurlrzKC licence is required)rr) rrr PATCH_LEVELrr PATCH_LATESTr r Zset_feature_flags_from_headersheadersupdate_all_kmod_paramsrrkrrrrrrr"rr Zhas_kc_capabilitiesrCapabilitiesMismatchZKernelPatchLevelrrrrr) rr rrrrZ latest_infoZrequired_capabilitiesr r;r;r<fetch_patch_level;s2     rcCs<|jt|tj}tjjdj|ytj |ddddSt k r^tjjdj|dSt k r}ztjj dj|t |WYdd}~XnX|jt|tjtj}tjjdj|ytj |ddWnbt k rtjjdj|dStk r6}ztjjd j|t |WYdd}~XnXdS) NzProbing patch URL: {0}FHEAD)rmethodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1})rz{0} is not available: {1})file_urlrDr rErr{rrrrrrndebugrdr ZSIGr )rrBZbin_urlr ror;r;r< probe_patch\s(**rcCsF|tjkr|jtj}n |j|}|j|}tj||tjtj |dS)N)Z hash_checker) r KMOD_BINZkmod_urlr cache_pathrZ fetch_urlr USE_SIGNATUREZget_hash_checker)rnameroZdstr;r;r<fetch_and_verify_kernel_fileus    r!c@s>eZdZdddZddZddZdd Zd d Zd d ZdS) PatchFetcherNcCs ||_dS)N)r)rrr;r;r<rszPatchFetcher.__init__cCs t|j|S)N)r!r)rr r;r;r<_fetchszPatchFetcher._fetchcCsr|jjtj}|jjtj}|jjtj}|jjtj}tdd||||fDopt j j |dkopt j j |dkS)Ncss|]}tjj|VqdS)N)r0r1r2)rr1r;r;r< sz0PatchFetcher.is_patch_fetched..r) rrr rIrErFr rallr0r1getsize)rZpatch_done_pathZpatch_bin_pathZpatch_info_pathZ kmod_bin_pathr;r;r<is_patch_fetchedszPatchFetcher.is_patch_fetchedcCs4|jdkrtd|js|jS|jr6tjd|jStjdt|jtjrytj |jj t j dd}Wnt k r~Yn(X|jjdd}|r|jjtj||_y|jt j Wn0t k rtdj|jt jpdd d YnX|jt j|jtj|jtj|jjt jd d d tjtj |jS)Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr)rz KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch leveldefaultzpatch level not found)rwb)r )!rrr'rrrUrrrrrr rErrrupgraderrkr#rr PATCH_TYPErFr rextract_blacklistrrrIrrestore_selinux_contextr)rresprr;r;r< fetch_patchs:      zPatchFetcher.fetch_patchcCsFtj|jjtj}|rBtj|}|rBtj|jjtj |j ddS)Nr) rread_text_filerrr rF BLACKLIST_REsearchrrGgroup)rZbufZmor;r;r<r-s  zPatchFetcher.extract_blacklistcCs|dkr dSyt|tj}Wntk r0dSX|jjdd}|rT|jtj|}|j tj}t |d}t dd|j D}WdQRXx|D]}t||qWt jtjdS)z Download fixup files for defined patch level :param level: download fixups for this patch level (usually it's a level of loaded patch) :return: None Nz KC-Base-Urlr.cSsg|] }|jqSr;)r)rfixupr;r;r<rsz-PatchFetcher.fetch_fixups..)r!r rHrrrr+rrkrr4r/ readlinesrr.r r)rrr/rZ fixups_fnamer9fixupsr5r;r;r< fetch_fixupss    zPatchFetcher.fetch_fixups)N) rLrrrr#r'r0r-r8r;r;r;r<r"~s   )r"cCs8t}tj|j|jtjkr*tjdn tjddS)Nrr) rrrrrPLIPATCH_NEED_UPDATErSexit)rr;r;r< kcare_checks    r<c Cs\t}t|}y tj}Wntk r2i}YnXtj}d}|dk r\tj|dj d}tj }|j dg}t t j|dd}t |}dd|D} t t j| d d} td d |D} || } tj} | st jd n t jd t jdj|t jdj||dkr t jdj|| dkr:t jdj| | dkrNt jdt jddS)NZUnknowntsz%Y-%m-%drz kpatch-cve)Z cve_fieldcSs"g|]}|jdgD]}|qqS)r)r)rrecpatchr;r;r<rsz%show_generic_info..Zcvecss|]}t|jdgVqdS)rN)rr)rr>r;r;r<r$sz$show_generic_info..z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}rz* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r_kcare_patch_info_jsonrZlibcare_patch_info_basicrrZ get_staterZ fromtimestampZstrftimerrrrZextract_unique_cvessumrrr)r kcare_info libcare_infostateZ latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countrr;r;r<show_generic_infos>         rEFc Csytdtjd}|st|jtj}tjt j |j }|rgi}}x>|j dD]0}tj |}|rxd|krx|j|qR|j|qRW||d<tj|}tj|WnJtk r}ztj||jdSd}~Xntk rtjdYnXd S) z Retrieve and output to STDOUT latest patch info, so it is easy to get list of CVEs in use. More info at https://cloudlinux.atlassian.net/browse/KCARE-952 :return: None r)rpolicyz z kpatch-namerrNzNo patches availabler)rr POLICY_REMOTErrr rFrrkrrrr@rappendupdaterirjrrrrro) is_jsonrro patch_inforr8chunkdatarr;r;r<kcare_latest_patch_infos,      rNcCsd|ji}|jdk rt|}g}x>|jdD]0}tj|}|rRd|krR|j|q,|j|q,W||d<tj }|r||dnd|d<|S)Nrz z kpatch-namerrunknown) rr_kcare_patch_infor@rrrHrIrZread_dumped_kernel_patch_level)rr8rKrrLrMZsaved_patch_levelr;r;r<r@4s     r@cCsPtj}tj||jtj}tjj|s2t dddt j |}|rLt j d|}|S)NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not found)rrK)rrrrr rFr0r1r2rrr1r2sub)rrrrr;r;r<rPHs   rPcCsZt}|s>|jdkr tj|j|jdkr.dStjt|ntjtjt |dddS)NrT)Z sort_keys) rrrrrrrPrirjr@)rJrr;r;r<rKWs   rKcCs:tjd|g}tj|}tj}d}tj||tj||kS)Nz file-infozkpatch-build-time)r KPATCH_CTLr check_outputr _patch_infoZget_patch_value)new_patch_filerZnew_patch_infoZcurrent_patch_infoZbuild_time_labelr;r;r< is_same_patchcs   rVcCsL|dkr dS|r||krdS||kr(dStjtj|tj}t|sHdSdS)NrFT)rrrr rErV) applied_level new_levelrUr;r;r<kcare_need_updateks rYcCsptjrltjjtotjttjs6tj j dj tdSt j dddtgdd\}}}|dkrltj j dj |dS) Nz-File {0} does not exist or has no read accessz /sbin/sysctlz-qz-pT) catch_stdoutrz%Unable to load kcare sysctl.conf: {0})r ZUPDATE_SYSCTL_CONFIGr0r1r2 SYSCTL_CONFIGaccessR_OKrr{warningrrr)r_r;r;r< update_sysctl}sr`c stjjtsttdjtjttjs>tj j dj tdSttdj}|j }|j dx,|D]$tfdd|Dsb|jqbWx|D]}|j|dqW|jWdQRXdS) z*Update SYSCTL_CONFIG accordingly the editsrqzFile {0} has no read accessNzr+rc3s|]}j|VqdS)N)r)rr.)r:r;r<r$sz#edit_sysctl_conf.. )r0r1r2r[r4r7r\r]rr{r^rr6seekanywritetruncate)rrHZsysctllinesrqr;)r:r<edit_sysctl_confs     rgcCs.x(|D] }tj|rtdj|ddqWdS)NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel module)r)CONFLICTING_MODULES_REmatchrr)rmoduler;r;r<detect_conflicting_moduless   rkcCsdjtjS)Nz/lib/modules/{0}/extra/kcare.ko)rrZget_system_unamer;r;r;r<get_kcare_kmod_linksrlc CsXtdd}tjtj|tj}tjj|s.dSt |d}|j dddkSQRXdS)Nr)rrbs~Module signature appended~ i) rrrrr rr0r1r2r4r)rZ kmod_fileZvfdr;r;r<kmod_is_signeds    rocs4tjddkrdSddg}tfdd|DS)Nz /proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c3s|]}|kVqdS)Nr;)rr) system_keysr;r<r$sz'kcare_certs_enrolled..)rZ try_to_readrc)Z kcare_keysr;)rpr<kcare_certs_enrolleds  rqcKsdd|g}x&|jD]\}}|jdj||qWtj|dd\}}}|dkr`tdj||dddS) Nz /sbin/insmodz{0}={1}T)rZrzLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load error)r)itemsrHrrrr)Zkmodrcmdrrerr_r;r;r< load_kmods rtcCsTtjr,tdkrtdtdkr,tdtjsDtjsDtjrPtddddS)NFz4Secure boot is enabled. Not supported by KernelCare.z|}YnXtj rbt j j tj  rbt j tj t}t|tfdd|jD}t|f|tdS)Nc3s"|]\}}|kr||fVqdS)Nr;)rkv)available_kmod_paramsr;r<r$!sz"load_kcare_kmod..)rlrrr rshutilcopyrnr rr0r1rrrr~dictrrrt update_depmod)rrr|Z kcare_fileZ kmod_paramsr;)rr<load_kcare_kmods   rcCsXdg}|dk r|jd|gtj|ddd\}}}|rTtjdjdj|||dddS) Nz /sbin/depmodz-aT)rZrvz%Running of `{0}` failed with {1}: {2} F)r)extendrrrrxrrA)unamersrr_stderrr;r;r<r's rcCs8tjd|gdd\}}}|dkr4tdj||dddS)Nz /sbin/rmmodT)rZrzUnable to unload {0} kmod {1}zkmod unload error)r)rrrr)modnamerr_r;r;r< unload_kmod3srcCsTg}xJdg|D]<}tj||dj|}tjj|rt||jdj|qW|S)NZvmlinuxz fixup_{0}.koz fixup_{0})rrrr0r1rrtrH)rrrZloadedmodZmodpathr;r;r< apply_fixups9s rc CsDx>|D]6}y t|Wqtk r:tjjd|YqXqWdS)Nz$Exception while unloading module %s.)rrnrr{r|)r7rr;r;r< remove_fixupsCs   rcCs|r |}n6tjrtj}n(tj|r2d|tjdfSd|tjdfSdddddd}|j}||krj||}ntdj||tjdd d ||tjdfS) NZfreeze_conflictTr(FZ freeze_noneZ freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})zfreezer style detection error)r)r Z PATCH_METHODr= intersectionupperrr)freezerrrZpatch_method_mapr;r;r<get_freezer_styleKs&  rrKcs|||dtdtj}tj}t|t||}tj||tj}t ||dj |tj t j tj|} d|k} | otj||} |dk } | ot|otj| } j|| d| rtddS| rtdt|||}tdt|td t|| r"td tdd } | sszkcare_load..)rz)"rrrrrkrrr rErrr,rrZ parse_unameZis_kmod_version_changedrVZkcare_update_effective_versionrIrkpatch_ctl_unpatchrrrrkpatch_ctl_patchr`rrrrZtouch_status_gap_filerr)rrr r use_anchorrrrr descriptionZ kmod_loadedrZ patch_loadedZ same_patchr7r;)rr< kcare_loadmsR              rcCsDg}tjdk r"|jdttjgtjdk r@|jdttjg|S)Nz-rz-t)r ZKPATCH_RETRIESrrdZKPATCH_TIMEOUT_SEC)rr;r;r<kpatch_ctl_tuning_argss   rc Cstjg}tj||tj}tjj|r2|j d|g|j dd|g|j d|dg|j t |j |t j |dd\}}}|dkrt||||dS)Nz-br?z-dz-mrT)rZ)r rRrrr rGr0r1rrrrHrrr) rrrrrrZblacklist_filerr_r;r;r<rs   rcCsdtjtjdd|dgtddd\}}}|dkr`tjdj||ddtd j|t |d d dS) Nrz-mrT)rZrvz4Error unpatching, kpatch_ctl stdout: {0} stderr: {1}F)rzError unpatching [{0}] {1}z unpatch error)r) rrr rRrrrxrrrd)rrr}rr;r;r<rsrcCs8||d<ttj|d<tjtjjtjdt |dS)Nactionr=z kcare.state) rryrrr0r1rAr rrd)rrr;r;r<rsrcCspd}tjj|sdSxVtj|D]H}tjj||dd}tjj|sDq tj|}||kr tj|t|q WdS)Nz/usr/lib/modules/z weak-updateszkcare.ko) r0r1isdirlistdirrAislinkreadlinkunlinkr) kmod_linkZ modules_pathentryZ sym_link_pathZ target_pathr;r;r<update_weak_moduless    rc "Cstj}t}y|j|Wn8tk rT}z|sDtdj|ddWYdd}~XnXtj}t||}t d|kr|dk }|rt tj ||}z t |Wdt |Xtjtjtdtdtdt} tjj| rtj| t| WdQRXdS)NzUnable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval error)rrr)countdelay)rrr"r8rnrrrrrrrrrrZretryrZ check_excUNLOAD_RETRY_DELAYrrlr0r1r2rr) rforcerpferrrrZ need_unpatchr7rr;r;r< kcare_unloads2     rcCs8t}|rt|S|jdkr"|jS|jdk r4tjSdS)Nr)r_kcare_info_jsonrrrrrT)rJrr;r;r<rBs  rBcCsRd|ji}|jdk r>|jtjtj|jtj|jd|j |d<t j |S)Nrzkpatch-descriptionz kpatch-state) rrrIrrrrTZparse_patch_descriptionrrDrirj)rr8r;r;r<rs    rc@s$eZdZdZdZdZdZddZdS)r9rrrrrcCs"||_||_||_||_||_dS)N)rr remote_lvlrrD)rrrrrrDr;r;r<r,s z PLI.__init__N)rLrrrr:PATCH_UNAVALIABLEPATCH_NOT_NEEDEDrr;r;r;r<r9&s r9c Cstj}ytdd}|rJt||r6tjdd}}}qxtjdd}}}n.|dkrftjdd}}}ntjd d}}}t|||||}Wnltk rtj }t j rd j t j t jdtj}nd j t jdtjtj}t||ddd }YnX|S) Nr)rz*Update available, run 'kcarectl --update'.ZappliedzThe latest patch is applied.rz(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingszLNew kernel detected ({0} {1} {2}). There are no updates for this kernel yet.Z unavailable)rrrrYr9r:rrrrr STICKY_PATCHrrr`rrr)Zcurrent_patch_levelZnew_patch_levelrrrDrr;r;r<r4s8   rc Csd}yXtj}td|fd|fg}tjdj|}tj|}tj tj |j }t |dSt k r}ztj||d Sd}~XnZtk r}ztj||d Sd}~Xn0tk r}ztjdj|d Sd}~XnXdS) z Request to tag server from ePortal. See KCARE-947 for more info :param tag: String used to tag the server :return: 0 on success, -1 on wrong server id, other values otherwise N server_idtagz/tag_server.plain?{0}rrzInternal Error {0})r get_serveridr#rrrrrrrrkrrrrrr rnrx) rrorZqueryrrrZueZeer;r;r< tag_serverfs"    rcCstjd}tjdj|t}tj}y:tj ||j }tj t j ||j tj|j ||j }Wn2tk r}ztjdj|WYdd}~XnXtjd|tjgdd\}}}|rtdj||dd WdQRXdS) Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)rvzScript failed with '{0}' {1}zdoctor script failed)r)rrmrZlogdebugrKCDOCTORtempfileZNamedTemporaryFilerZfetch_signaturer Z save_to_filerrZcheck_gpg_signaturernrxrrrZget_patch_serverr)Z doctor_urlZdoctor_filenameZ doctor_dstZ signaturerrr_rr;r;r<kcdoctors   "rc CsBtjdjt}ytj|Wntk r2dSXtjddS)Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) rrmrEFFECTIVE_LATESTrrr rr)ror;r;r<check_new_kc_versionsrc Cstj}t|}|tjkp*|tjko*|dk}yt||}Wntjk r}z.|dkrXt j t |t j dtj }WYdd}~Xn<t k r}z |rnt jjdj|WYdd}~XnX|tjkr|} n@|} |dkr|tj krtj|d} n|tjkr |} ntd| S)a Get patch level to apply. :param reason: what was the source of request (update, info etc.) :param policy: REMOTE -- get latest patch_level from patchserver, LOCAL -- use cached latest, LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :return: patch_level string Nz#Using previously downloaded patcheszUnable to send data: {0}rz9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)rrrr rGZPOLICY_LOCAL_FIRSTrrrrrrdZ POLICY_LOCALrnr{r^rrr) rrFr rZ cached_levelZconsider_remote_exZ remote_levelrr rr;r;r<rs2  $    rcCs|dkr dS|dkrdn|t_ttddtjrtjtjdtjdkrntjrntjpXt }t dd d j |ft j d j |ntdj |dddS)Nedfr(rKZprobe)r)r,rwrfs.enforce_symlinksifownerfs.symlinkown_gidzfs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailable)r)rwr)rr)r r,rrr update_configrZ is_cpanelZ FORCE_GID CPANEL_GIDrgrrrr)rBZgidr;r;r<update_patch_types rZkernelc $Cshttj|tjkrtytd||d}WnRtk r~}z6|tjtj fkrltj rlt |}t j j|dSWYdd}~XnXtj}|tjkrtj rdSt|}|jt||dst jd|Sy(tjtjdddtjtjdd dWn"tk rt j jd YnXtj}t(|j|t|||||tj kd WdQRXtj|t |||S) aU :param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART :param policy: REMOTE -- download latest and patches from patchserver, LOCAL -- use cached files, LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases :param freezer: freezer mode :return: patch level in effect for the running kernel or None if the update was not performed at all. Zero level means the patchserver has no patches for this kernel, so nothing was applied. rI)rrFr N)rWrXz%No updates are needed for this kernelrz kcore*.dump)Zkeep_nZpatternz kmsg*.logz#Error during crash reporter cleanup)r)!ryr r,r rGrrrUPDATE_MODE_AUTOUPDATE_MODE_SMARTrrdrr{r^rrrr"r0rYrrrrrnr|rrr8rZdump_kernel_patch_levelr) rr rFrrrrrrr;r;r< do_updates>      "  rcCstttjttjptjttjp$tjf}|dkr@tdddtjrLtjS|t j krptjp`tj}tjpltj}n tj}tj}|r|S|rd|SdS)NrzInvalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settings)rzrelease-) rAboolr rZ UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETrr UPDATE_MODE_MANUAL)r rrZpatchsetr;r;r< get_sticky(s&  rcCs |d|S)Nr>r;)rrr;r;r< _stickyfyHsrcCs t|}|s|S|dkr"t||Stj}|sDtjjdtjdyt j t j dj |}Wn:tk r}ztj||jtjdWYdd}~XnXtjtj|j}t|d}|dkrt|d |S|d kr|S|d krtjjd tjdtjjd |dtjddS)z Used to add sticky prefix to satisfy KCARE-953 :param file: name of the file to stickify :return: stickified file. KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyrz!/sticky_patch.plain?server_id={0}rNrrrrrrzEServer ID is not recognized. Please check if the server is registeredzError: rrrrr?r)rrrrrr{rrSr;rrrrrrrrorrrkrr)filer srrrrrr;r;r<rLs2       rc Csg}|s dS|jd}|d}|dd}|jd}||krLtdt||s`|j|jkS|dkrt|jdn>|jd s|jd r|jtj|n|jtj|j d d x|D]}|jtj|qWtj d d j |dtj } | j |S)zhMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 Fr>rrN*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r@rrreprlowerrHrreescapereplacecompilerAZ IGNORECASEri) ZdnhostnameZ max_wildcardsZpatspiecesZleftmostZ remainderZ wildcardsZfragZpatr;r;r<_dnsname_matchxs(     rc Cs g}xBt|jD]2}|j|}|jdkrddt|jdD}qW|sTtdg}x0|D](\}}|dkr^t||r|dS|j|q^W|s|j j }t||rdS|j|t |dkrt dj |d jtt|n,t |dkrt d j ||d nt d dS) NZsubjectAltNamecSsg|]}|jjddqS)rzr)rr@)ritr;r;r<rsz"match_hostname..,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSrz(hostname {0} doesn't match either of {1}z, zhostname {0} doesn't match {1}rz=no appropriate commonName or subjectAltName fields were found)rangeZget_extension_countZ get_extensionZget_short_namerdr@rrrHZ get_subjectZ commonNamerrrrAmapr) ZcertrZsanrrZdnsnamesrreZcnr;r;r<rs0       rc Cs@ tddd}|jdddd|jdd d dd|jd d dd|jd dddd|jdddd|jdddd|jdddd|jdddd|jdddd|jdddd|jdd dd|jd!d"dd|jd#d$dd|jd%d&dd|jd'd(d)d|jd*d+dd|jd,d-dd|jd.d/dd|jd0d1dd|jd2d3dd|jd4d5d6d|jd7d8d9d|jd:d;dd|jdd?dd|jd@dAdd|jdBdCdd|jdDdEddFdG|jdHdIdd|jdJdKdd|jdLdMdd|jdNdOdd|jdPdQdd|jdRdSdd|jdTdUdd|jdVdWdd|jdXdYdd|jdZd[d\tdd]d^|jd_d`dd|jdadbdd|j}|jdcddd\d|jdedfdd|jdgdhdd|jdidjd\dd]dk|jdldmdndd]do|jdpdqdr|jdsdtdd|jdudvdwdxdytjs|jdzd{d|d}d]d~|jddd|d}dd~|jdddd|jddddd|jddddd|jdddd|jddddd|jddddd|jddddd|jdddddd|jdddd|jdddd|jddd6dd\dd]d|j}tjtjsFtj dg7_ |j dk rzt t d|j j djtj rvdSdS|js|jrtjrtjt_ntjt_n|jrtjt_|jstjdkrtdtjddStj}|jrtj }n|jrtj!}t"j#|tj$stj%tj&r|j'p0|j rx2t(tj&j)D] \}}t"j*dj+|tj,|qFWt"j*d|j-rt-j.t/|j0ddS|j1rt2j3|j4r|j4dkrt5|j4t_6tj7tj6dndt_6tj7dd|j8dk rtj7|j8d|j8t_9|j:rd]t_;|j<r d]t_=|j>r.dt_?|j@r) into an isolated cache, leaving the default storage untouched. Use together with --lib-update or --userspace-update.)rrrr(rzlibcare-enabledrrrzPlease run as root)rz{0}: unusable value in {1}: {2}zVSet a valid value with `kcarectl --set-config OPTION=VALUE`, or `OPTION=` to unset it.)Zforce_fallback)r)rzTFlag --edf-enabled has been deprecated and will be not available in future releases.rr(zMFlag --test has been deprecated and will be not available in future releases.r(/z(Prefix `{0}` is not in expected one {1}.rzfile:z+edf patches are deprecated. Fallback to {0})rJr)rrrz)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}z$Failed to send kernel anomaly report)rri)rZYES)rZNOrwr)r,rzUserspace patches are applied.r zUserspace patches are unloaded.zLibcare plugin reloaded.cSsg|]}|jjqSr;)rr)rZptchr;r;r<rLszmain..limit)r rzQFlag --nofreeze has been deprecated and will be not available in future releases.r)r rF)r zKernel is safe)rz=KernelCare protection disabled. Your kernel might not be safe<)rZ add_argumentrZadd_mutually_exclusive_groupr ZLIBCARE_DISABLEDZ parse_argsr Zset_settings_from_config_fileZFLAGSZ has_flagsr/filterr@issubsetquietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORrZ PRINT_DEBUGrr0getuidprintrSrloggingZINFOZWARNINGDEBUGrZinitialize_loggingZIGNORE_FEATURE_FLAGSZset_feature_flags_from_cacheZINVALID_CONFIG_OPTIONSZ set_configsortedrrrxrZCONFIGr Zsend_doctor_reportrZfallbackrrZclear_all_cacheZset_patch_levelrdrrZset_sticky_patchrZ nosignaturerZ no_check_certrrrruZ edf_enabledwarningswarnDeprecationWarningZ edf_disabledr,ZPREV_PATCH_TYPEZset_patch_typerIrrr(rEXPECTED_PREFIXr{r^rAZlocalrhZ PATCH_SERVERrrZapp_inforrrirrjrJZkernel_anomaly_reportrrZ archive_pathrrrrZ keep_localrrZenable_auto_updateZdisable_auto_updateZupdate_config_from_argsZset_monitoring_keyrZ unregisterrregisterZregister_autoretryrrrrrarcrZset_libcare_statusrZlib_tagZuserspace_statusZget_userspace_update_statusZ lib_updateZdo_userspace_updateZlib_auto_updaterZ lib_unloadZlibcare_unloadZ lib_repluginZlibcare_repluginZlib_inforCZlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updaterlistZget_userspace_mapkeysZuserspace_auto_updaterrBZnofreezerZ smart_updaterrZ UPDATE_POLICYrrrrrrZCHECK_CLN_LICENSE_STATUSryrzrandomZuniformrKrrZlatest_patch_inforNZcheckr<rargvrE) ZparserZexclusive_grouprrr rerr Zlocal_path_messager Z lib_tag_kwrrr;r;r<mains                                                r)r%r&r'r()r)r*)N)N)F)F)N)rKF)rKF)r)Z __future__rrlrirr0rrrrrZsslrSrryrRrZargparser contextlibrrrKrrr r r r r rrrrrrrrrrrrrrrrrZpy23rr r!r"r#rrrr3rrr[rrZDOTALLr2rhr1rinsertfilterwarningsrr{ZsetLevelrr=rDrJrgrprrrrrrrrrrrrrrrrrrrrrrcZdistutils.versionZ distutilsZ OpenSSL.SSLrrZ StrictVersionZ __version__ ImportErrorrZHTTPSConnectionZPureHTTPSConnectionobjectrrr rrrr!r"r<rErNr@rPrKrVrYr`rgrkrlrorqrtruryr~rrrrrrrrrrrrrrrZlog_all_parent_processesrrBrr9rrrrrGrrZtrack_update_statusrrrrrrrr;r;r;r<s    \    &    4  -! b +             " ?   (  2 .B , 3)