h F d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ ddlmZ ddlmZ dd lmZmZ dd
lmZ dd lmZ dd lm Z dd
l m Z ej e Z!dZ"dZ# G d de$ Z% G d dej& Z' G d d Z(dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)cached_property)BytesIO)Path) DoesNotExist) safe_fileops)Malware)MalwareHitStatusMalwareScanResourceType)MalwareCleaner)CleanupStorage)
MalwareHit)get_files_diff_imunifyc e Zd ZdS ) DiffErrorN)__name__
__module__ __qualname__ S/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/difflib/differ.pyr r 0 s Dr r c < e Zd Zd dZd Zd Zd ZdefdZd d
Z dS )
SafeFilePathNFc J t | | _ || _ || _ d S N)r _path_user _missing_ok)selfpathuser
missing_oks r __init__zSafeFilePath.__init__5 s$ $ZZ
%r c * t | j S r )strr r s r __str__zSafeFilePath.__str__: s 4: r c * | S r )r' r& s r
__fspath__zSafeFilePath.__fspath__= s ||~~ r c , t | j | S r )getattrr )r attrs r __getattr__zSafeFilePath.__getattr__@ s tz4(((r returnc b | 5 ddd dS # 1 swxY w Y dS )zp
Return True if the file is readable by the user or
raise UnsafeFileOperation otherwise
NT) safe_openr& s r check_readabilityz SafeFilePath.check_readabilityC s{
^^
s $((rbc | j r(| j st d S | j r"t j | j || j d S | | S )Nr F)moder! respect_homedir)r r existsr r r safe_open_fileopen)r r4 s r r0 zSafeFilePath.safe_openK st DJ$5$5$7$7 3<< : # .
Z %
99T?? "r )NF)r2 )
r r r r# r' r) r- boolr1 r0 r r r r r 4 s & & & &
) ) )4 # # # # # #r r c f e Zd ZdZddedefdZed Zde fdZ
de fd Z d
e d e d e
fd
ZdS )MalwareHitDiffzL
Used to compare infected and cleaned versions of a malicious file.
Nidr! c P || _ || _ t d d d | _ d S )NF)loopsinkwatch_progress)_idr r _cleaner)r r< r! s r r# zMalwareHitDiff.__init__^ s1
&D
r c V t j t j | j k t j t
j j k t j dk gt j | j
k gt | j
z R S # t $ r! t d| j d| j
d w xY w)NTz No malware file hit found (id=z, user=).)r
getr< rA
resource_typer
FILEvalue maliciousr! r r9 r r r& s r hitzMalwareHitDiff.hite s >
)(,C,H,NN$, ?dj01D4D4DD
( ( ( ( ( (
s A:A= =+B(r. c l K d}| j j t j v rrt | j j | j d }t t j | j d }| ||| j j
d {V }n%t d| j j |S )Nr Tr! r" r!
cleaned_at9Malware hit has unexpected status=%s. Use the empty diff.)
rJ statusr CLEANEDr orig_file_pathr r get_hit_store_path _get_diffrO loggerwarning)r diffcleaned_file_pathinfected_file_paths r !get_unified_diff_for_cleaned_filez0MalwareHitDiff.get_unified_diff_for_cleaned_filet s 8? . 6 6 6 ,'Z ! ! !
". 1$(;;" " " "! 8. ( DD
NNK
r c K d}| j j t j k rt | j j | j }| t j dt j 5 }t |j d d }t j | j j |dddd d {V t! j |t$ t& | j t$ t- | g d {V \ }}}| t- | }|rX| s| r0| ||t7 j
d {V }n(t8 d | j j ||| d d d n # 1 swxY w Y n%t8 d | j j |S )
Nr rM zw+)r4 dirTrL F)
src_unlink
dst_overwritesafe_srcsafe_dst)r! grouprN z1File %s was not cleaned to check diff: %s, %s, %srP ) rJ rQ r FOUNDr rS r r1 tempfileNamedTemporaryFileConfigTEMP_CLEANUP_DIRnamer safe_move orig_fileshutilchown IMUNIFY_USER
IMUNIFY_GROUPrB startr% rE
is_cleaned
is_removedrU timerV rW ) r rX rZ temp_filerY resulterrorcmd
hit_results r clean_and_get_unified_diffz)MalwareHitDiff.clean_and_get_unified_diff s 8? . 4 4 4!-'dj" " "
0 0 2 2 2,v 6 %
$0 N$% % %! #,H&% $"& " !
%L
,0=+>+> 3'8#9#9":, , & & & & & &"s $ZZ,=(>(> ? ?
))++/9/D/D/F/F "& *)#'9;; "0 " " DD NNK * ?%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
N
NNK
s 4D?F??GGrZ rY rO c " K | s t d| j j d | r,| j |k rt
d | 5 }| 5 }t j }|
d t || d {V cd d d cd d d S # 1 swxY w Y d d d d S # 1 swxY w Y d S )Nz#Original file not found for hit(id=rD z8The file was modified after cleaning, diff is not valid.) r6 FileNotFoundErrorrJ r< statst_ctimer r0 asyncioget_event_looprun_in_executorr )r rZ rY rO
infected_file cleaned_filer> s r rU zMalwareHitDiff._get_diff s "((** #EdhkEEE
$ $ & & !&&((1J>>J
)
)
+
+ }>O>Y>Y>[>[ _k)++D --nm\ s6 D 6C, D,C0 0D3C0 4DD Dr )r r r __doc__intr% r# r rJ bytesr[ rx r floatrU r r r r; r; Y s
3
c
_ 25% 5 5 5 5n ( (
r r; ))r r} loggingosrk rd rr functoolsr ior pathlibr peeweer defence360agent.utilsr imav.contracts.configr rf imav.malwarelib.configr r
imav.malwarelib.cleanup.cleanerr imav.malwarelib.cleanup.storager imav.malwarelib.modelr
imav.utilsr getLoggerr rV rm rn Exceptionr PathLiker r; r r r r s *
% % % % % % . . . . . . 3 3 3 3 3 3 L L L L L L L L : : : : : : : : : : : : , , , , , , % % % % % % 8 $ $
"# "# "# "# "#2; "# "# "#JB B B B B B B B B Br