h2; r d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZmZ ddlZddlmZmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd l m Z dd
l m Z m Z ddl!m"Z"m#Z# ddl$m%Z%m&Z&m'Z' ddl(m)Z)m*Z* ddl+m,Z,m-Z- ddl.m/Z/ dZ0 ej1 e2 Z3 G d de4 Z5 G d de% Z6 G d de% Z7 G d de% Z8e
G d d Z9 G d d e&e Z: G d d!e:e' Z; G d" d#e:e Z< G d$ d%e< Z= G d& d'e< Z>dS )(u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)ABC) dataclass)Path)ListOptional)Message MessageType)g)TheSink)
hosting_panel)rmtree) to_thread)ExitDetachedScanTypeMalwareScanResourceType)ScanAlreadyCompleteError
ScanInfoError) DetachedDirDetachedOperation DetachedScan)MDSMDS_PATH)MalwareDatabaseHitInfo scan_report)trim_file_content c e Zd ZdS )DetachedOperationFailedN)__name__
__module__ __qualname__ V/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/mds/detached.pyr r B s Dr" r c P e Zd ZU dZeed< eed< eed< i ej ddddZdS ) MDSDetachedScanDirz /var/imunify360/dbscan/run/scan ignore_file report_filescan_info_fileignorezscan_info.json)r& r' r( Nr r r DETACHED_DIRr __annotations__r FILESr! r" r# r% r% F sc 4L
$*
EEEr" r% c 8 e Zd ZU dZeed< i ej ddiZdS )MDSDetachedCleanupDirz /var/imunify360/dbscan/run/cleanr' Nr* r! r" r# r/ r/ U sB 5L
}
EEEr" r/ c 8 e Zd ZU dZeed< i ej ddiZdS )MDSDetachedRestoreDirz"/var/imunify360/dbscan/run/restorer' Nr* r! r" r# r1 r1 ` sB 7L
}
EEEr" r1 c P e Zd ZU ee ed< dZeed< dZeed< dZe ed< dS )
DbScanInfocmdN scan_type initial_pathr started)
r r r r strr, r5 r6 r7 intr! r" r# r3 r3 k sO
cNNNIs L# GSr" r3 c & e Zd Zddef fd
Z xZS )MDSDetachedOperationr returnc H t | S )N)
start_time)superget_detached_process_state)selfr> __class__s r# r@ z/MDSDetachedOperation.get_detached_process_statet s ww11Z1HHHr" )r )r r r r8 r@
__classcell__)rB s @r# r; r; s sU I I# I I I I I I I I I Ir" r; c X e Zd Zej ZeZd Zd Z e
d Z e
d Z e
d Z
dee fdZd Zedefd Zdej fd
Zej fd Zej d d
d
d
d
dddde dedee dee dee dee e de de dd
fdZ d
S )MDSDetachedScanc > | j j S N) detached_dir done_fileexistsrA s r# _is_scan_finishedz!MDSDetachedScan._is_scan_finished| s *11333r" c | j j 5 }t j | cd d d S # 1 swxY w Y d S # t
t j f$ r i cY S w xY wrG )rH
progress_fileopenjsonloadFileNotFoundErrorJSONDecodeError)rA fps r# _get_progress_infoz"MDSDetachedScan._get_progress_info s "05577
%2y}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%!4#78 III s3 A A A AA A A A)(A)c | } t t |d S # t $ r | rdndcY S w xY w)N
progress_maind r )rU r9 floatKeyErrorrL )rA
progress_infos r# progresszMDSDetachedScan.progress so //11
:u]? ;<<== = : : : 0022933 9 9 9 :s !8 "A A c P | j dk rdS d t S )Nr z avd scanningz {} scanning)r\ formatr rK s r# phasezMDSDetachedScan.phase s( =A !> ##C(((r" c t t | d S # t $ r Y dS w xY w)Ntotal_db_countr )r9 rU rZ rK s r# total_resourcesz MDSDetachedScan.total_resources sI t..001ABCC C 11 s &)
77r< c d | j j 5 }t j | }d d d n # 1 swxY w Y | j j j }n # t t j f$ r Y d S w xY wt |d |d |d | S )Nr4 r5 r6 )r4 r5 r6 r7 ) rH r( rO rP rQ pathstatst_mtimerR rS r3 )rA rT infor7 s r# _load_scan_infoz MDSDetachedScan._load_scan_info s "16688
%By}}
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%',11338w+> >ur" c K x}t t j |j |j j |j } fd j j
d D }nj# t $ r
}t |d }~wt $ rH}t d | t# | |cY d }~S d }~ww xY w|s| d |S |D ]B}t j | j }t& j | d {V Ct- | j d {V }| | |S )N)argsrd scan_idtypec : g | ]} | S r! rl ).0r' rA s r#
z,MDSDetachedScan.complete.. s7 ((55 r" report*.jsonzUnable to parse MDS reportzNo reports foundrw )rh r r MalwareDatabaseScanr4 r6 detached_idr5 rH rd globrR r Exceptionlogger exceptionupdate_with_errorr8 MDSReportr
sinkprocess_messager update_with_report)rA scan_infomessagehit_report_listereport
report_msg
result_reports ` r# completezMDSDetachedScan.complete s --// /I 8 1 '$$
#'#4#9#>#>~#N#N OO ! 2 2 2* 1 9 : : : % %c!ff - - -NNNNNN
% %&8 9 9 9N% 5 5F$. 0 J &((44 4 4 4 4 4 4 4 4 )/4;K L LLLLLLL
""=111s* +A: :
C!B
C!=C C! C!c @ K d } | t z } | |k r^ | }nk# t t f$ r&}t j d d {V |}Y d }~nd }~ww xY w | |k ^t d| j | d S t j
| }| | r| d S d S # t j
$ r&}t d| Y d }~d S d }~ww xY w)N zICannot find the mds process to kill (%s): %r. Assuming it's already dead.z0Problem when killing the running mds process: %s)MDS_PID_WAIT_TIMEget_pidrR
ValueErrorasynciosleepr warningr psutilProcessrt killError)rA timererrordeadlinepiderrrs s r# kill_running_scan_processz)MDSDetachedScan.kill_running_scan_process sv 577 ..egg
llnn%z2
mA&&&&&&&&&
egg
NN/
F >#&&D''--
| NNBC
s- ; A2 A--A2'=C( (D 7DD TN ) exit_typer scan_pathr5 scan_startedr4 outr r r r r5 r r4 r r c K |r| d{V | pt g }
|p|
j }|p|
j }|p|
j }t
|p|
j }| t j
|||| j ||t
t j d{V | j
} |t j k rt! | j p|} t! | j p| }
t j }| |d< |
|d< t( d| j | |
||d< d|d < | j |d
< ||d < | | d{V | j s t( d | dS t1 t3 | dS )
a Removes aborted detached scan from scan_queue and writes it to DB.
- Parses data about scan from scan_queue and writes it to DB
- Kills scan process, if it exists
- Deletes scan_dir
- Processes MalwareScan and ScanFailed(in case of 'ABORTED') messages
:param sink: the sink to send messages
:param exit_type: 'ABORTED' by default,
if stopped by user, then 'STOPPED'
:param kill: try to kill a process
:param scan_path: which path was scanned
:param scan_type: what is the scan's type
:param scan_started: when was the scan started (if known)
:param cmd: command line arguments
:param out: command stdout
:param err: command stderr
N)r4 )rv r rd rw rx r7 completedr r zScan %s was aborted: %s, %scommandabortedr rw rd zNo such directory: %s)r rh r3 r4 r6 r5 r9 r7 r r r r timerH r ABORTEDr log_fileerr_file
ScanFailedr r rd is_dirr
r8 )rA r r r r r5 r r4 r r r scan_dirstdoutstderrmsgs r# handle_aborted_processz&MDSDetachedScan.handle_aborted_process s > 30022 2 2 2 2 2 2 2((**@jR.@.@.@ "Y] 7!7 4!4 <<9+<== "" + ( $ dikk**
$ ,4 4 4&x'899@SF&x'899@SF (**C CJ CJ NN-t/?
!C N &C N ! -C N#CK&&s++ + + + + + + +}##%% " NN2H = = = = = 3x== ! ! ! ! !r" )!r r r r DB
RESOURCE_TYPEr% DETACHED_DIR_CLSrL rU propertyr\ r_ rb r r3 rh rl classmethodboolrt r r r r monotonicr r r r8 rY r r r! r" r# rE rE x s +.M)4 4 4 : : X: ) ) X)
X
*!5
$ [ # ? # # # #J 59N > .5#'#'(,#'E" E" E" E"
E" C=
E" C=E" uoE" d3i
E" E" E"
E" E" E" E" E" E"r" rE c H e Zd ZdZdZdZdefdZed Z de
fdZ dS )MDSDetachedMutableOperationz=Parsing of operations that can succeed or fail for any DB hitNr< c K i } fd j j d D } | d {V }|s d j d S |D ]B}t
j | j }t j
| d {V C j d
i |S # t $ r
}t |d }~wt $ rb}t! | |d< t" d j d t! | cY d }~S d }~ww xY w) Nc : g | ]} | S r! rz )r{ r rA s r# r| z8MDSDetachedMutableOperation.complete..E s7 ((00 r" r} zNo z reports foundr r~ r zUnable to parse MDS z reportr! )rH rd r
_parse_reportFAIL_MSGNAMEr r r r
r r SUCCESS_MSGrR r r r8 r r )rA r r r r r s ` r# r z$MDSDetachedMutableOperation.completeB s / " / 4 9 9. I I O ! . . ? ???????G #
L}}+J+J+J+J}KKK)
9
9 ( 2D$4
f,,Z8888888888#4#..g.. .! ! 2 2 2* 1& / / / "1vvGG FDI F F F G G G==s1vv=.. . . . . . . /s+ AC
E
C
E AD<6E<Ec | 5 }t j | cd d d S # 1 swxY w Y d S rG rj )r' rk s r# rl z/MDSDetachedMutableOperation._load_single_report\ s
19Q<< rm c H K t t j d {V }t t
j d {V }t }t }|D ]}|d x}r3t d| j d| t | |d s0| t j
|||| j w| t j
|||| j ||dS )N
error_listzErrors in MDS z: %srows_with_error) succeededfailed)setr HostingPanel get_usersr pwdgetpwallr r r r addr from_reportr )rA r users_from_panelpw_allr r r errorss r# r z)MDSDetachedMutableOperation._parse_reporta sO ]%?%A%A%K%K%M%M M M M M M MNN ........EE % F --v
6 =di = = =vFFF-f555+,
*6 0&$:J
*6 0&$:J '&999r" ) r r r __doc__r r r r staticmethodrl dictr r! r" r# r r < su GGKH/ / / / /4 \ :d : : : : : :r" r c e Zd ZdZeZej Zej Z
e dej fd Z
ej dddededee ddfd Zedefd
ZdS ) MDSDetachedCleanupcleanupr< c 6 t j | j S Nr~ )r MalwareCleanCompleter rK s r# on_complete_messagez&MDSDetachedCleanup.on_complete_message s" /$
r" Nr r r r r c
K |t j k s
J d t d| j | t | j j }t | j j }t j
d| d| j d| d| }| | d {V t j
t | j j d d S )
Nz;Cleanup cannot be stopped, only aborted status is supportedzCleanup %s was %spath: , detached_id: , out: , err: r T
ignore_errors)r r r rg r r rH r r r MalwareDatabaseCleanupFailedr shutilr
r8 rd rA r r r r r r s r# r z)MDSDetachedCleanup.handle_aborted_process s
-5 5 5 5 H
6 5 5
')99EEE"4#4#=>>"4#4#=>>6! ! ! $ 0! ! ! ! ! !
""3'''''''''
c$+011FFFFFFr" c L |r!| }t |v od|v S dS )Nz--cleanFro rq s r# rt z&MDSDetachedCleanup.process_is_suitable s2 @llnnGw&?9+? ?ur" )r r r r r/ r r MalwareDatabaseCleanupr r r r r r r r r r8 r r r r rt r! r" r# r r { s D, 4K7H
[%E
X
.5#' G G G G G
C= G
G G G G: $ [ r" r c e Zd ZdZeZej Zej Z
e de fd Z
edej fd Zej dddeded ee ddfd
ZdS ) MDSDetachedRestorerestorer< c L |r!| }t |v od|v S dS )Nz --restoreFro rq s r# rt z&MDSDetachedRestore.process_is_suitable s2 BllnnGw&A;'+A Aur" c 6 t j | j S r )r MalwareRestoreCompleter rK s r# r z&MDSDetachedRestore.on_complete_message s" 1$
r" Nr r r r c
K |t j k s
J d t d| j | t | j j }t | j j }t j
d| d| j d| d| }| | d {V t j
t | j j d d S )
Nz;Restore cannot be stopped, only aborted status is supportedzRestore %s was %sr r r r r Tr )r r r rg r r rH r r r MalwareDatabaseRestoreFailedr r r
r8 rd r s r# r z)MDSDetachedRestore.handle_aborted_process s
-5 5 5 5 H
6 5 5 ')99EEE"4#4#=>>"4#4#=>>6! ! ! $ 0! ! ! ! ! !
""3'''''''''
c$+011FFFFFFr" )r r r r r1 r r MalwareDatabaseRestorer r r r r rt r r r r r r r8 r r r! r" r# r r s D, 4K7H$ [
[%G
X
.5#' G G G G G
C= G
G G G G G Gr" r )?r r rP loggingr r r abcr dataclassesr pathlibr typingr r r "defence360agent.contracts.messagesr r &defence360agent.internals.global_scoper
"defence360agent.internals.the_sinkr defence360agent.subsys.panelsr defence360agent.utilsr
defence360agent.utils.threadsr imav.malwarelib.configr r imav.malwarelib.scanr r imav.malwarelib.scan.detachedr r r imav.malwarelib.scan.mdsr r imav.malwarelib.scan.mds.reportr r imav.malwarelib.scan.utilsr r getLoggerr r r r r% r/ r1 r3 r; rE r r r r! r" r# r
s *
! ! ! ! ! ! ! ! ! ! ! ! ! !
C C C C C C C C 4 4 4 4 4 4 6 6 6 6 6 6 7 7 7 7 7 7 ( ( ( ( ( ( 3 3 3 3 3 3
3 2 2 2 2 2 2 2 9 8 8 8 8 8 8 $ $ i K K I I I I I,c I I I
A" A" A" A" A"*L A" A" A"H<: <: <: <: <:"6 <: <: <:~. . . . .4 . . .b,G ,G ,G ,G ,G4 ,G ,G ,G ,G ,Gr"