C///

\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5�\D6?\BD�\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2� \00$\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4�\E9\F2�\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// # -*- coding: utf-8 -*- # Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2019 All Rights Reserved # # Licensed under CLOUD LINUX LICENSE AGREEMENT # http://cloudlinux.com/docs/LICENSE.TXT from __future__ import print_function from __future__ import division from __future__ import absolute_import import glob import os import re import subprocess from clcommon import clcagefs from clselect.clselectexcept import ClSelectExcept from clselect.utils import run_process_in_cagefs ALT_PATH = '/opt/alt' # Separator-suffixed form used by the untrusted-interpreter guard so # '/opt/alternative/...' and '/opt/alt/../../evil' don't slip past the # startswith check. _TRUSTED_INTERPRETER_PREFIX = ALT_PATH.rstrip('/') + '/' INT_BASE = 'python' INT_VERS = '??' DIGITS_VERSION_PATTERN = re.compile(r'(?P\d\.?\d+)$') VERSION_PATTERN = re.compile(r'(^|.*/)python(?P\d\.\d+)$') WRAPPERS_PATH = '/usr/share/l.v.e-manager/utils' PYTHON_WRAPPER = 'python_wrapper' class Interpreter(object): def __init__(self, prefix=None, binary=None, version=None, version_full=None, target_user=None): self.binary_list = list() # accumulate list python bin in virtual environment (using for update python bin) self.user = target_user if prefix and binary: self.prefix = prefix self.binary = binary self.binary_list.append(self.binary) self.python_bin = binary elif prefix: self.python_bin = None self.prefix = prefix match = re.search(DIGITS_VERSION_PATTERN, self.prefix) suffix = match.group('version') if '.' not in suffix: suffix = f'{suffix[0]}.{suffix[1:]}' self.version_from_suffix = suffix python_realbin = os.path.join(self.prefix, 'bin', 'python') binaries_to_check = [ python_realbin, # bin/python python_realbin + suffix.split('.')[0], # bin/python2 python_realbin + suffix # bin/python2.* ] for bin_file in binaries_to_check: if self._is_real_file(bin_file): self.python_bin = bin_file self.binary_list.append(bin_file) if self._is_link_to_wrapper(bin_file): binary = bin_file real_binary = bin_file + "_bin" if self._is_real_file(real_binary): self.python_bin = real_binary self.binary_list.append(real_binary) # now python_bin is REAL BINARY in venv # for old selector: binary pythonX.Y # for new selector: binary pythonX.Y_bin if not self.python_bin: raise ClSelectExcept.InterpreterError( 'Can not find python binary in directory: "%s"' % os.path.dirname(python_realbin)) # if there is no symlink to wrapper (old selector) if not binary: binary = self.python_bin self.binary = binary elif binary: self.binary = binary self.binary_list = [binary] self.prefix = os.path.abspath(os.path.join( os.path.dirname(binary), os.path.pardir)) self.python_bin = binary else: interpreter = interpreters('version')['2.7'] self.binary = interpreter.binary self.prefix = interpreter.prefix self.version = interpreter.version self.version_full = interpreter.version_full self.python_bin = interpreter.binary if version: self.version = version else: self.version = None if version_full: self.version_full = version_full else: try: if self.user and not clcagefs.in_cagefs(): user = self.user result = run_process_in_cagefs(user, self.python_bin, ['-c', 'import sys; print(sys.version)']) if result['returncode'] != 0: raise OSError('Unable to get python version %s', result['output']) self.version_full = result['output'].split()[0] else: # already in cagefs OR no need to exec as user (e.g global alt python is called) canonical_bin = os.path.realpath(self.python_bin) if os.geteuid() == 0 and not clcagefs.in_cagefs() \ and not canonical_bin.startswith(_TRUSTED_INTERPRETER_PREFIX): raise ClSelectExcept.InterpreterError( "Refusing to exec untrusted interpreter '%s' as root outside " "CageFS without a target user" % self.python_bin) version_raw = subprocess.check_output( [canonical_bin, '-c', 'import sys; print(sys.version)'], text=True) self.version_full = version_raw.split()[0] except (OSError, IndexError, subprocess.CalledProcessError) as e: ver_ = VERSION_PATTERN.match(self.binary) if ver_: self.version = ver_.group('version') self.version_full = None elif self.version_from_suffix: self.version = self.version_from_suffix self.version_full = None else: raise ClSelectExcept.InterpreterError( 'Error detect python binary version "%s"; %s' % (self.binary, str(e))) if not self.version and self.version_full: self.version = '.'.join(self.version_full.split('.')[:2]) def _is_real_file(self, path): """Check that given path is a file and not symlink""" return os.path.isfile(path) and (not os.path.islink(path) or os.readlink(path).startswith('/opt/alt/python')) @staticmethod def _is_link_to_wrapper(path): """ Since we have python wrapper, all python files are symlinks now So real binary - path which must be written to .htaccess is considered symlink that links to python wrapper """ wrapper_pat