\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// File Manager

File Manager

Path: /opt/cloudlinux/venv/lib64/python3.11/site-packages/clcommon/public_hooks/lib/

Viewing File: __init__.py

# -*- coding: utf-8 -*-
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2022 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT
#

import glob
import importlib.util
import logging
import os
import stat
import sys

from .helpers import LISTENERS_DIRECTORY

logger = logging.getLogger(__name__)

from .modify_domain_hook import ModifyDomainHook
from .modify_admin_hook import ModifyAdminHook
from .modify_user_hook import ModifyUserHook
from .modify_package_hook import ModifyPackageHook


def _is_root_owned_unwritable(filepath):
    """
    Return True only if `filepath` is a regular file owned by root (uid 0) and
    not group- or world-writable. Used to gate a listener before its top-level
    code is exec_module()'d as root: a *.py (or a symlink whose real target) a
    non-root principal can write is refused rather than executed. os.stat
    follows symlinks, so it stats the real inode whose code would run.
    """
    try:
        st = os.stat(filepath)
    except OSError:
        return False
    return (stat.S_ISREG(st.st_mode) and
            st.st_uid == 0 and
            not (st.st_mode & (stat.S_IWGRP | stat.S_IWOTH)))


def import_file(filepath):
    # Fast path: see if the module has already been imported.
    name = os.path.basename(filepath)[:-3]
    if name in sys.modules:
        return sys.modules[name]

    # Defense-in-depth: exec_module() below runs the listener's top-level code
    # in this root process. Refuse a listener that is not root-owned or is
    # group/world-writable, so an attacker-influenceable file is not executed.
    if not _is_root_owned_unwritable(filepath):
        logger.warning('refusing to load listener %s: not root-owned or '
                       'group/world-writable', filepath)
        return None

    # If any of the following calls raises an exception,
    # there's a problem we can't handle -- let the caller handle it.
    module_spec = importlib.util.spec_from_file_location(name, filepath)
    if module_spec is None:
        raise ImportError(f"Can't find module {name} at {filepath}")

    # Load the module, potentially raising ImportError if the module cannot be loaded
    module = importlib.util.module_from_spec(module_spec)
    module_spec.loader.exec_module(module)

    # Add the module to sys.modules
    sys.modules[name] = module
    return module


# automatically scan directory for universal hooks
for hook_py in glob.glob(os.path.join(LISTENERS_DIRECTORY, '*.py')):
    import_file(hook_py)


__all__ = (
    'ModifyDomainHook',
    'ModifyAdminHook',
    'ModifyUserHook',
    'ModifyPackageHook',
)