File: //usr/share/jailkit/jk_lib.pyc
�
�gfac @ s d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d Z
i Z d � Z d d � Z
d d � Z d � Z d � Z d
� Z d � Z d � Z d
� Z d d d � Z d d d � Z d d d d � Z d � Z d d d d d � Z d � Z d � Z d � Z d d d d d � Z d d � Z d d � Z d d d d d � Z d d d � Z! d d d d d d g d � Z" d d d d d d d g d � Z# d � Z$ d d! � Z% d" � Z& d# � Z' d$ � Z( d d% � Z) d& � Z* d' � Z+ d S(( i����( t print_functionNi� c C s< t j | d � } | d k r8 t j | � t | <} n | S( N( t statcachet gett Nonet ost lstat( t patht ret( ( s /usr/share/jailkit/jk_lib.pyt cachedlstat0 s i c C s� y t | � } Wn9 t k
rK | d k rG t j j d | d � n d SXt j d d k r� | t j d k s� | t j t j
d � j k r� t j j d | d � d SnB | t j d k s� | t j d k r� t j j d | d
� d S| t j t j
@s| t j t j @rMt j | t j � rMt j j d | d � d St j | t j � s�t j | t j � r�t j | � } t t | � t | � � | d
d k r�t j j d | d � d Sq�t j j d | d � d Sn d S( Ni s ERROR: cannot lstat() s
i����i����t bsdt wheels ERROR: s is not owned by root:wheel!
s is not owned by root:root!
s is writable by group or others!i����i s usr/s2 is a symlink, please point to the real directory
i����s is not a directory!
i ( R t OSErrort syst stderrt writet platformt statt ST_UIDt ST_GIDt grpt getgrnamt gr_gidt ST_MODEt S_IWOTHt S_IWGRPt S_ISLNKt S_ISDIRR t readlinkt printt str( R t failquiett statbuft target( ( s /usr/share/jailkit/jk_lib.pyt path_is_safeB s4
2&?c C s� t j j | � } t | | � } | d k r1 | Sx5 d
D]- } t | d
| d � } | d k r8 | Sq8 Wt j j | � } xA | d
k r� t | d � } | d k r� | St j j | � } q~ Wd S( s] tests if path is a safe jail, not writable, no writable /etc/ and /lib, return 1 if all is OKi����t etct usrt vart bint devt proct sbinR t /i i ( R" R# s vars binR& R' R( s sys( R R t abspathR! t dirname( R R t retvalt subdt npath( ( s /usr/share/jailkit/jk_lib.pyt chroot_is_safeb s
c C s/ t | � } | t j t j t j B@r+ d Sd S( sA returns 1 if the file is setuid or setgid, returns 0 if it is noti i ( R R R t S_ISUIDt S_ISGID( R R ( ( s /usr/share/jailkit/jk_lib.pyt test_suid_sgidv s c
C sM t j d d k rI t | d d d d d d d d �t j d | � n d S( Ni t linuxs /etci t copy_permissionst
allow_suidt copy_ownerships ldconfig -r ( R R t create_parent_pathR t system( t jail( ( s /usr/share/jailkit/jk_lib.pyt gen_library_cache} s "c C s� g } t j d | d t d t j d t j d t j d t �} | j j � } t j d k r� t | t � r� | j
d d
� } n x t | � d k r�| j � } t | � d k r8| d d k r� | d d
k r� | S| d d k r
| d d k r
| d d k r
| S| d d k s5| d d k r0qJt | � d k re| d d k re| d d k reqJt | � d k r�t
j j | d � r�| | d g 7} q5t d | d d | � qJt | � d k r#| d d d k r#t
j j | d � r| | d g 7} q5t d | d � qJt d | d � n t d | d � | j j � } t j d k r� t | t � r� | j
d d
� } q� q� W| S( s; returns a list of libraries that the executable depends on s ldd t shellt stdint stdoutR
t close_fdsi i s utf-8t replacet
staticallyi t linkedt noti t dynamict
executables linux-gate.so.1s linux-vdso.so.1i t founds! ldd returns non existing library s for R) s$ WARNING: failed to parse ldd output i����( i i ( i i ( t
subprocesst Popent Truet PIPER= t readlineR t version_infot
isinstancet bytest decodet lent splitR R t existsR ( RD R, t pt linet subl( ( s /usr/share/jailkit/jk_lib.pyt lddlist_libraries_linux� s< : 0 2 & c C s6 g } d } t j d | d t d t j d t j d t j d t �} | j j � } t j d k r� t | t � r� | j
d d
� } n x�t | � d k r1| j � } t | � d k r�| d | d k r� q�| d d k rt | � d
k r�| d d k r�d } q�q�t | � d k r�| d k rmt
j j | d � rX| | d g 7} q�t d | d � q�| d k r�t
j j | d � r�| | d g 7} q�t d | d � q�t d � q�t d | d � n t d | d � | j j � } t j d k r� t | t � r� | j
d d
� } q� q� W| S( s; returns a list of libraries that the executable depends on i s ldd R; R< R= R
R> i s utf-8R? t :t Starti i t Namei i s! ldd returns non existing library s1 unknown mode, please report this bug in jk_lib.pys$ WARNING: failed to parse ldd output i����( i i ( i i ( RF RG RH RI R= RJ R RK RL RM RN RO RP R R RQ R ( RD R, t modeRR RS RT ( ( s /usr/share/jailkit/jk_lib.pyt lddlist_libraries_openbsd� s> : "
c C s
g } t j d | d t d t j d t j d t j d t �} | j j � } t j d k r� t | t � r� | j
d d
� } n x�t | � d k r| j � } t | � d k r�t | � d k r� | d t | � d | d k r� q�t | � d
k r"| d d k r"| d d k r"| St | � d k rst
j j | d � r^| | d g 7} q�t d | d � q�t d | d d � n7 | t | � d | d k r�n t d | d d � | j j � } t j d k r� t | t � r� | j
d d
� } q� q� W| S( s; returns a list of libraries that the executable depends on s ldd R; R< R= R
R> i i s utf-8R? i RV i i RB i RC s! ldd returns non existing library s% WARNING: failed to parse ldd output "i����t "( i i ( i i ( RF RG RH RI R= RJ R RK RL RM RN RO RP R R RQ R ( RD R, RR RS RT ( ( s /usr/share/jailkit/jk_lib.pyt lddlist_libraries_freebsd� s0 : 42 c C s� t j d d k r t | � St j d d k r: t | � St j d d k rW t | � St j d d k r� t | � } | d g 7} | St | � } | d d d
g 7} | Sd S( Ni R3 i t openbsdt freebsdt sunoss /lib/ld.so.1s /usr/libexec/ld.sos /usr/libexec/ld-elf.so.1s /libexec/ld-elf.so.1( R R RU RZ R\ ( RD R, ( ( s /usr/share/jailkit/jk_lib.pyt lddlist_libraries� s
t c C si | d k r d St | � } d } | s? | d } | d } n d } d } x| D] } t j j | | � } t | � } t j | j � rR | d 7} t j | � } | d d k r� t j j | | � } qRt j j t j j t j j
| � | � � }
t | � d k rI|
t | � | k rIt j
j d |
d � t d � � n |
} qR qR Wt j j | | � S( NR) Ra i����i i s ERROR: symlink s points outside jail, ABORT
s Symlink points outside jail( t
split_pathR R t joinR R R t st_modeR t normpathR+ RO R R
R t Exception( R t chroott include_filet spatht basenameR t
doscountert entryt sbt realpatht tmp( ( s /usr/share/jailkit/jk_lib.pyt resolve_realpath s.
-(
c
C s� t | � } | r! d } | } n$ t j j | � } t j j | � } d } x8| d k r�| d k r�t | � } t j | j � rP| d 7} t j | � } | d d k r� | | } | d d k rM| d } qMq|t j j
t j j t j j | � | � � } | d k rG| | | k rGt j
j d | d � t d � � n | } n, t j j | � d | } t j j | � } d
} qN Wd | S( sN will return the same path that contains not a single symlink directory elementRa i R) id i i����s ERROR: symlink s points outside jail, ABORT
s Symlink points outside jailN( RO R R Rj R+ R R R Rd R Re Rc R R
R Rf R (
R Rg Rh t chrootlent donepatht todopathRk Rm Rn Ro ( ( s /usr/share/jailkit/jk_lib.pyt OLDresolve_realpath& s2
-
c C s� t j | � } t j | t j � } | si | t j t j B@ri t d | � | t j @t j @} qi n t j | | t j | t j f � | r� t j
| | t j | t j � n t j
| | � d S( Ns, removing setuid and setgid permissions from ( R R t S_IMODER R0 R1 R t utimet ST_ATIMEt ST_MTIMEt chownR R t chmod( t srct dstt
be_verboseR5 R6 t sbufRY ( ( s /usr/share/jailkit/jk_lib.pyt copy_time_and_permissionsF s $$c C sO | } xB t j j | � rJ | d k p1 | d k rJ t j j | � } q W| S( ss This function tests if a directory exists, if not tries the parent etc. etc. until it finds a directory that existsR) Ra ( R R RQ R+ ( R Ro ( ( s /usr/share/jailkit/jk_lib.pyt! OLDreturn_existing_base_directory[ s /i c C s� | } | d d k r# | d } n y- t | | | � } t j j | � rO d SWn t k
rc n Xt | | � } t | � t | � } | j d | d � }
|
d k r� t | � }
n x�|
d k r�| d |
k r� |
} n\y t | |
� } WnG t k
r@} | j \ }
} t
j j d | |
d | d � Pn Xt
j | j � rnt j | |
� } t | | |
| � } | r�t d | d | � n y t j | | � WnQ t k
r} | j \ } }
| d
k r�qt
j j d | | |
d � n X| d d k r0t | | | | | | � q9t j | |
d � } t | | | d | | | | | � n� t
j | j � r9t | | |
| � } | r�t d
| � n t j | t � | r9y t | |
| | | | � Wq6t k
r2} | j \ }
} t
j j d | |
d | d | d � q6Xq9n |
} |
t | � k rZd }
q� | j d | d � }
|
d k r� t | � }
q� q� Wd S( su creates the directory and all its parents id needed. copy_ownership can only be used if copy permissions is also usedi����R) Ni s ERROR: failed to lstat(s ):s
s Creating symlink s to i s ERROR: failed to create symlink i s Creating directory s2 ERROR: failed to copy time/permissions/owner from s : ( Rp R R RQ R t return_existing_base_directoryRO t findR t argsR R
R R R Rd R R t symlinkR7 t stringt rfindR t mkdirt dir_modeR ( Rg R R} R4 R5 R6 t directoryt chrootdirectoryRo t oldindxt indxRm t et _t strerrort realfilet
chrootnamet errnot indx2( ( s /usr/share/jailkit/jk_lib.pyt OLD_create_parent_pathb sp
$ $ ( 6 c C sa d } d } xN | D]F } | d k s1 | d k r> | | 7} n | d k rS d } q d } q W| S( NRa i R) i ( ( t instringt outstringt slasht i( ( s /usr/share/jailkit/jk_lib.pyt fix_double_slashes� s
c C sc g } t t j j | � � } x> | d k r^ | j d t j j | � � t j j | � } q! W| S( NR) i ( R� R R Re t insertRj R+ ( R R t next( ( s /usr/share/jailkit/jk_lib.pyRb � s c C s? t | � d k r d Sd } x | D] } | d | 7} q# W| S( Ni R) Ra ( RO ( Ri R Rl ( ( s /usr/share/jailkit/jk_lib.pyt join_path� s
c C s# t | � } | } d } x} | t | � k r� t j j | | | � } t j j | � s\ Pn t | | d � }
t j j |
� s� Pn |
} | d 7} q Wx�| t | � k r t | d | d !� } t j j | | | � } y t | � }
WnC t k
r2} | j
\ } } t j j
d | d | d � d SXt j |
j � r�| r\t d | � n t j | t � | r y t | | | | | � Wq�t k
r�} | j
\ } } t j j
d t t d t d | d � q�Xq n(t j |
j � r t j | � } | r#t d
| d | � n t j | | � | d d k rat | | | | | | � } q t j j t j j t j j | � | � � }
t | � d k r�|
t | � | k r�t j j
d |
d
� t d � � n |
t | � } t | | | | | | � } n | } | d 7} q� W| S( Ni i s ERROR: failed to lstat(s ):s
s Create directory s2 ERROR: failed to copy time/permissions/owner from s to s : s Creating symlink R) s ERROR: symlink s points outside jail, ABORT
s Symlink points outside jail( Rb RO R R Rc RQ Rp R� R R R� R R
R R R R Rd R R� R� R R� R� R� R R R� R7 Re R+ Rf ( Rg R R} R4 R5 R6 Ri t existpathR� t tmp1Ro t origpatht jailpathRm R� R� R� R� ( ( s /usr/share/jailkit/jk_lib.pyR7 � s^ 6 -( c
C s� yD | r t d | � n t j | � t | | | d d d d �WnQ t t f k
r� } | j \ } } t j j d | d | d | d � d SXxEt j
| � D]4\ } } } x� | D]� } | r� t d
| d | d | d | � n yP t j | d | | d | � t | d | | d | | d d d d �Wq� t t f k
r�} | j \ } } t j j d | d | d | d | d | d � d SXq� Wx. | D]& } t
| d | | d | | � q�Wq� Wd S(
Ns Creating directoryR5 i R6 i s) ERROR: copying directory and permissions s to s : s
s Copying R) s$ ERROR: copying file and permissions ( R R R� R t IOErrorR R� R R
R t walkt shutilt copyfilet# move_dir_with_permissions_and_owner(
t srcdirt dstdirR} R� R� R� t roott dirst filest name( ( s /usr/share/jailkit/jk_lib.pyt# copy_dir_with_permissions_and_owner s.
(
) 08
(c C s� t | | | � } | d k r� | d k r; t d | � n y t j | � Wq� t t f k
r� } | j \ } } t j j d | d | d � q� Xn t d | d | � d S( Ni s! Removing original home directory s ERROR: failed to remove s : s
s Not everything was copied to s , keeping the old directory (
R� R R� t rmtreeR R� R� R R
R ( R� R� R} R, R� R� R� ( ( s /usr/share/jailkit/jk_lib.pyR� s 'c
C s� d } | d k rS y t j | | � d } WqS t d | d | d � qS Xn | d k r� y0 t j | | � t | | | d | d | �Wq� t t f k
r� } | j \ } } t j
j d | d | d | d
� q� Xn d S( sX copies/links the file and the permissions (and possibly ownership and setuid/setgid bitsi i s Linking s to s failed, will revert to copyingR5 R6 s$ ERROR: copying file and permissions s : s
N( R t linkR R� R� R R� R R� R R
R (
R{ R| R} t try_hardlinkR5 t retain_ownert do_normal_copyR� R� R� ( ( s /usr/share/jailkit/jk_lib.pyt copy_with_permissions) s
c
C s( t | t j j | � | d d d d d d �t | | | � } t j j | � ri t d | d � d St j | � } ybt j d d k r� | j
d
} | j
d
} nr t j d k rt j d k r� | j
d
} | j
d
} q | j
d } | j
d } n | j
d
} | j
d
} t j | j
� r8d } n1 t j | j
� rSd } n t d | d � d S| d k r�t d | | � n t j t j d d | t | � t | � t | � � } t | | d d d | �WnG t d | d � t d | d � t d | d � t d � n Xd S( NR4 i R5 i R6 s Device s does exist alreadyi R3 i t sunos5i���i t ct bs WARNING, s# is not a character or block devices Creating device t mknods Failed to create device s( , this is a know problem with python 2.1s use "ls -l s6 " to find out the mode, major and minor for the devices use "mknod s' mode major minor" to create the devices< use chmod and chown to set the permissions as found by ls -l( R7 R R R+ Rp RQ R R R R t st_rdevt maxintt S_ISCHRRd t S_ISBLKt spawnlpt P_WAITR R (
Rg R R} R� t
chrootpathRm t majort minorRY R ( ( s /usr/share/jailkit/jk_lib.pyt copy_device; sB .
6 c C s d } x� t j | � D]� }
t j j | |
� } y� t | � } t j | j � r� t | | d | d d d | d | �t | | | | | | | | | � } n | t j j | |
� f 7} Wq t
k
r� }
t j j
d | d |
j d � q Xq Wt | | | | | | | | | � } | S(
sb copies a directory and the permissions recursively, possibly with ownership and setuid/setgid bitsR} R4 i R5 R6 s) ERROR: failed to investigate source file s : s
( ( R t listdirR Rc R R R Rd R7 t copy_dir_recursiveR R R
R R� t copy_binaries_and_libs( Rg t dirt force_overwriteR} t
check_libsR� R5 R� t handledfilest files2Rl Ro R~ R� ( ( s /usr/share/jailkit/jk_lib.pyR� c s %' +$c
C s. | d d k r | d } n x
| D]}
|
| k r< q$ n y t |
� } Wn� t k
r2} | j d k r | d k r� t j |
� }
t |
� d k r� t | |
| | | d | d | d d d | �} q| rt d
|
d � qq,| r,t d |
d
� q,q$ t j j d |
d | j
d � q$ n Xt | t j
j |
� | d d d | d | �t t j
j | d |
� | � } y t | � } d } WnR t k
r�} | j d k r�d } q�t j j d | |
d | j
d � n X| d k r2| r2t j | j � r2| r&t d | d � q&q$ | r | r�t j | j � r�| rkt d | d � n y t j | � Wq�t k
r�} t j j d | d | j
d | d � q�Xq t j | j � r t d | d � q q t j | j � r�q | r$ t d | d � q$ q$ n t | t j
j |
� | d d d | d | �t j | j � r�t j |
� } | r�| r�t d | d � n y t j | � Wq�t k
r�} t j j d | d | j
d | d � q�Xn y* t d | d | � t j | | � Wn t k
r"n X| j |
� | d d k rpt j
j t j
j t j
j |
� | � � } n t | | g | | | | | | | � } n� t j | j � r�t | |
| | | | | | | � } n� t j | j � rC| rt d |
d | � n t d! |
d | � t |
| | | | | � | j |
� nR t j | j � sgt j | j � r}t | |
| | � n t j j d" |
d# � t j | t j! � } | r$ |
j" d$ � d k s�|
j" d% � d k s�| t j# t j$ Bt j% B@r$ t& |
� } t | | | | d | d | �} q$ q$ W| S(& s> copies a list of executables and their libraries to the chrooti����R) i i i R� R� t try_glob_matchingR� s Source file(s) s
do not exists Source file s does not exists) ERROR: failed to investigate source file s : s
R4 R5 R6 s. ERROR: failed to investigate destination file Ra s" already exists, will not touch its Destination file s$ exists, will delete to force updates ERROR: failed to delete s
cannot force update s Destination dir s existss Destination symlink s Creating symlink s to s Trying to link s Copying s Failed to find how to copy s= into a chroot jail, please report to the Jailkit developers
t libs .so(' R R R� t globRO R� R R R
R R� R7 R R R+ Rp Re R R Rd t S_ISREGt unlinkR R R� t appendRc R� R� R� R� R� Ru R R� t S_IXUSRt S_IXGRPt S_IXOTHR` ( Rg t binarieslistR� R} R� R� R5 R� R� R� t fileRm R� R t chrootrfilet chrootsbt chrootfile_existsR� RY t libs( ( s /usr/share/jailkit/jk_lib.pyR� � s�
3#.#
+%2.2
0*'$K (c C s^ g } | j | | � rZ | j | | � } x- | j d � D] } | | j � g 7} q: Wn | S( s� retrieves a comma separated option from the configparser and splits it into a list, returning an empty list if it does not existt ,( t
has_optionR RP t strip( t cfgparsert sectionnamet
optionnameR, t inputstrRo ( ( s /usr/share/jailkit/jk_lib.pyt config_get_option_as_list� s t ERRORc C s4 t d � t | d | � | � t j | � d S( NRa s : ( R R t exit( t exitnot messaget usagefunct type( ( s /usr/share/jailkit/jk_lib.pyt
clean_exit� s
c C s� y t | d � } Wn d SX| j � } t j d k r] t | t � r] | j d d � } n x� t | � d k r� | j d � } t | � | k r� | | | k r� | j � d S| j � } t j d k r` t | t � r` | j d d � } q` q` Wd S(
Nt ri i s utf-8R? RV i ( i i ( i i (
t openRJ R RK RL RM RN RO RP t close( t itemt numt filenamet fdRS t pwstruct( ( s /usr/share/jailkit/jk_lib.pyt test_numitem_exist� s "
c C s t | d | � S( Ni ( R� ( t usert
passwdfile( ( s /usr/share/jailkit/jk_lib.pyt test_user_exist s c C s t | d | � S( Ni ( R� ( t groupt groupfile( ( s /usr/share/jailkit/jk_lib.pyt test_group_exist s c
C s� | d d k r | d } n t | d | d d d d d d �t j d d !d
k r� t | d d � j � t | d
d � j � t | d d � j � t | d d � j � nt j j | d � s� t | d d � } nzt | d d � } | j � } t j d k r2t
| t � r2| j d d � } n xt
| � d k rI| j d � } t
| � d k r| d | k s�| d | k r| r�t d | d d | d � n y | j | d � Wn t k
r�n Xy | j | d � Wqt k
r qXqn | j � } t j d k r5t
| t � r5| j d d � } q5q5W| j d d � t
| � d k r�t d d � } | j � } t j d! k r�t
| t � r�| j d d � } n x� t
| � d k r�| j d � } t
| � d k rn| d | k s| d | k rn| j | � | rDt d | d d | d � n | d | k rk| | d g 7} qkqnn | j � } t j d" k r�t
| t � r�| j d d � } q�q�W| j � n | j � t j j | d � s�t | d d � } nzt | d d � } | j � } t j d# k rFt
| t � rF| j d d � } n xt
| � d k r]| j d � } t
| � d k r| d | k s�| d | k r| r�t d | d d | d � n y | j | d � Wn t k
r�n Xy | j | d � Wqt k
rqXqn | j � } t j d$ k rIt
| t � rI| j d d � } qIqIW| j d d � t
| � d k r�t d d � } | j � } t j d% k r�t
| t � r�| j d d � } n x� t
| � d k r�| j d � } t
| � d k r^| d | k s$| d | k r^| j | � | r[t d | d d | d � q[q^n | j � } t j d& k r�t
| t � r�| j d d � } q�q�W| j � n | j � d S(' Ni����R) s /etc/R4 i R5 R6 i i R s /etc/passwdt as /etc/spwd.dbs /etc/pwd.dbs /etc/master.passwdt ws r+i s utf-8R? RV i s user s exists in R� s
writing user s to s
/etc/groups group s writing group ( i i ( i i ( i i ( i i ( i i ( i i ( i i ( i i ( R7 R R R� R� R R t isfileRJ RK RL RM RN RO RP R t removet
ValueErrort seekR ( Rg t userst groupsR} t fd2RS R� R� t groupstruct( ( s /usr/share/jailkit/jk_lib.pyt init_passwd_and_group s�
" !
!
!
'
c C sj t j d � } | j d � } xE | D]= } t j j | | � } t j j | � r% t j j | � Sq% Wd S( Nt PATHRV ( R t getenvRP R Rc RQ R* R ( R� t search_patht pathsR t joined( ( s /usr/share/jailkit/jk_lib.pyt find_file_in_pathx s
c C s] g } xP | D]H } | d d k r3 | j | � q
t | � } | r
| j | � q
q
W| S( Ni R) ( R� R ( R t paths2Ro t tmp2( ( s /usr/share/jailkit/jk_lib.pyt find_files_in_path� s
(, t
__future__R t os.pathR R� R R R� R� RF R� R R R! R/ R2 R: RU RZ R\ R` Rp Rt R R� R� R� Rb R� R7 R� R� R� R� R� R� R� R� R� R� R� R R R ( ( ( s /usr/share/jailkit/jk_lib.pyt <module> sR * * ! D > ( !!h c