h' X d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z ddl
Z
ddlmZmZ ddlmZ ddlmZmZ dd lmZmZ dd
lmZmZ dd l m Z dd l m Z dd
l m!Z! ej" e# Z$dZ% G d de Z&e G d d Z' G d de Z(dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) dataclass)Path)ListOptional)ExitDetachedScanTypeMalwareScanResourceType)ScanAlreadyCompleteError)AIBOLIT AIBOLIT_PATH)parse_report_csvparse_report_json) DetachedDir DetachedScan)trim_file_content) MessageType)rmtree c x e Zd ZU dZeed< eed< eed< eed< i ej dddd d
Zd fd Z fd
Z xZ
S )AiBolitDetachedDirz/var/imunify360/aibolit/runcsv_report_pathjson_report_path listing_filescan_info_filez
report.csvz report.jsonfilezscan_info.json)r r r r Nc X t | || _ dS )zB
NOTE: Initialization should not create any files
N)super__init__tmp_listing_file)self detached_idr __class__s [/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/ai_bolit/detached.pyr zAiBolitDetachedDir.__init__F s+ %%% 0 c t | j 1t j | j j t
| j | S N)r __enter__r shutilcopyfilenamestrr )r r! s r" r& z AiBolitDetachedDir.__enter__M sL
, OD 1 6DA;c : | j j 5 }t j | di }ddd n # 1 swxY w Y d | D }d|v r |d |d< d|v r |d |d< |S )z6Get scan performance metrics if present in the summarysummaryNc " i | ] \ }}|d v ||
S )) scan_time report_time finder_timecas_timedeobfuscate_time scan_time_hsscan_time_preg
smart_time_hssmart_time_pregmem_peak total_filescpu_user
cpu_systemrcharwcharsyscrsyscw
read_bytes write_bytescancelled_write_bytesdecision_statserrorsr6 ).0kvs r"
z.t s@
1
q r#
ai_versionaibolit_version
db_versionsignatures_version)r: r r< r= r> getitems)r frC statss r" get_reported_summaryz(AiBolitDetachedScan.get_reported_summaryo s
/
4
4
6
6 6!ill&&y"55G 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
: 7 " "'.|' FileNotFoundErrorJSONDecodeError)r r? s r" _get_progress_infoz&AiBolitDetachedScan._get_progress_info s "05577
%2y}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%!4#78 III s3 A A A AA A A A)(A)c > | j j S r% )r: done_fileexistsr s r" _is_scan_finishedz%AiBolitDetachedScan._is_scan_finished s *11333r# c t t | d S # t $ r | rdndcY S w xY w)Nprogressd r )intfloatrl KeyErrorrq rp s r" rs z AiBolitDetachedScan.progress sj :uT 4 4 6 6z BCCDD D : : : 0022933 9 9 9 :s 36 "AAc t | d S # t t f$ r Y dS w xY w)N files_totalr )ru rl rw
ValueErrorrp s r" total_resourcesz#AiBolitDetachedScan.total_resources sM t..00 ?@@ @*% 11 s &) >>c P | j dk rdS d t S )Nr zpreparing file listz {} scanning)rs formatr
rp s r" phasezAiBolitDetachedScan.phase s) =A (( ##G,,,r# returnc F | j j 5 }t j | }d d d n # 1 swxY w Y n # t
t j f$ r i }Y nw xY wt | dg | d S )Nr4 r5 )r4 r5 ) r: r r< r= r> rj rk r3 rc )r r? infos r" _load_scan_infoz#AiBolitDetachedScan._load_scan_info s "16688
%By}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%!4#78 DDD ##txx /D/D
s3 A
A A
AA
A A
A('A(c | K | }d|j | j |j | | di} | }n# t $ r
}t |d }~ww xY w | }|d
| t | |d< nc# t $ r
}t |d }~wt $ rA}t | |d d< g |d< t d Y d }~nd }~ww xY wt! j | S )NrC )argsscanidtypestderrstdoutresultserrorz Unable to parse AI-BOLIT report)r r4 r r5 extract_stderrextract_stdoutrg rj r rA updatelist Exceptionr* logger exceptionr MalwareScan)r scan_infomessagereported_summarye scan_datas r" completez AiBolitDetachedScan.complete sy ((** !
*!+ --// --//
2 # 8 8 : : 2 2 2* 1 2
1 **,,I
I % %&6 7 7 7!%i GI ! 2 2 2* 1 @ @ @*-a&&GI w '!#GI > ? ? ? ? ? ? ? ? @ &w///s< A* *
B4A<<BC
D'C
D'&7D""D'c b | j j S # t $ r Y dS w xY wN )r: log_file read_textrj rp s r" r z"AiBolitDetachedScan.extract_stdout A $-7799 9 22
..c b | j j S # t $ r Y dS w xY wr )r: err_filer rj rp s r" r z"AiBolitDetachedScan.extract_stderr r r c @ |rt | v S dS )NF)r cmdline)clsprocs r" process_is_suitablez'AiBolitDetachedScan.process_is_suitable s" 2 4<<>>1 1ur# c @ K d } | t z } | |k r^ | }nk# t t f$ r&}t j d d {V |}Y d }~nd }~ww xY w | |k ^t d| j | d S t j
| }| | r| d S d S # t j
$ r&}t d| Y d }~d S d }~ww xY w)N zMCannot find the aibolit process to kill (%s): %r. Assuming it's already dead.z4Problem when killing the running aibolit process: %s)AIBOLIT_PID_WAIT_TIMEget_pidrj rz asynciosleepr warningr psutilProcessr killError)r timerr deadlinepiderrr s r" kill_running_scan_processz-AiBolitDetachedScan.kill_running_scan_process sv 577 22egg
llnn%z2
mA&&&&&&&&&
egg
NN/
F >#&&D''--
| NNF
s- ; A2 A--A2'=C( (D 7DD TN) exit_typer scan_pathr5 scan_startedr r r r5 r c K |r| d {V | j }t |j }t |j } | j }
|"|
r |
d } |
| dz }t d| j
| } | j
ddt j ||pd|p| j ||| |
p| j d i d}
|
t j di |
d {V |t j k r~t j }||d< | |d < t d
|d d z |d z |
|d < d
|d< | j
|d< ||d< |
| d {V |j s t d| d S t- t/ | d S )Nz--pathr zScan %s was abortedr g ) r rO total_malicious completedr startedr pathr r r )rC r outr zScan was aborted: %sz, commandabortedr scan_idr zNo such directory: %sr6 )r r: r r r r r4 indexr r r timer5 process_messager r r ABORTED
ScanFailedr r is_dirr r* )r sinkr r r r5 r scan_dirr r r4 r r scan_resultmsgs r" handle_aborted_processz*AiBolitDetachedScan.handle_aborted_process sL 30022 2 2 2 2 2 2 2$"8#455"8#455""$$( IIh''EEAII )4+;<<<((** * #$ !Y[["'.3!8Y%8! ,y}
"";#:#I#I[#I#IJJJJJJJJJ ,4 4 4 (**C CJ CJ NN&E
T(9CJ(F
!C N &C N ! -C N#CK&&s++ + + + + + + +}##%% " NN2H = = = = = 3x== ! ! ! ! !r# )#r+ r, r- r FILE
RESOURCE_TYPEr DETACHED_DIR_CLSrA rg rl rq propertyrs r{ r~ r3 r r r r r* r r classmethodboolr r monotonicr r r r rv r r6 r# r" r8 r8 ] s +0M) ) ) ) & & &P 4 4 4 : : X: X - - X-
0 7 0 0 0 0> $ [
59N > .5#'#'(,6" 6" 6" 6"
6" C=
6" C=6" uo6"
6" 6" 6" 6" 6" 6"r# r8 ))__doc__r r= loggingr' r dataclassesr pathlibr typingr r r imav.malwarelib.configr r imav.malwarelib.scanr imav.malwarelib.scan.ai_bolitr
r $imav.malwarelib.scan.ai_bolit.reportr r
imav.malwarelib.scan.detachedr r imav.malwarelib.scan.utilsr "defence360agent.contracts.messagesr defence360agent.utilsr getLoggerr+ r r r r3 r8 r6 r# r" r s *
! ! ! ! ! ! ! ! ! ! ! ! ! !
: 9 9 9 9 9 ? ? ? ? ? ? ? ? D C C C C C C C 8 8 8 8 8 8 : : : : : : ( ( ( ( ( ( 8 $ $ B
e" e" e" e" e", e" e" e" e" e"r#