\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// File Manager

File Manager

Path: /usr/share/l.v.e-manager/utils/

Viewing File: set_env_vars.py

#!/opt/cloudlinux/venv/bin/python3 -sbb
# CLOS-5528 (F-14): -s skips the user-site directory so an accidental root
# invocation of this script (or a compromised user home) cannot inject a
# ~/.local/lib/pythonX.Y/site-packages module that shadows a stdlib name.
# All shipped callers (commons/bin/{python,node,npm}_wrapper) already reject
# EUID==0 and this script is not setuid, not sudoers-aliased, not called
# from RPM scriptlets — the flag is defence-in-depth. -bb (warn-then-error
# on implicit bytes/str mix) is preserved. Combined short flags parse
# correctly under Python (-sbb == -s -b -b).
# -*- coding: utf-8 -*-

# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2019 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

from __future__ import print_function
from __future__ import division
from __future__ import absolute_import
import os
import sys
import getpass

from future.utils import iteritems

from clselect.clselectnodejs.apps_manager import ApplicationsManager as NodeJsAppsManager
from clselect.clselectpython.apps_manager import ApplicationsManager as PythonAppsManager, get_venv_rel_path
from clselect.utils import get_using_realpath_keys


def get_app_name(interpreter):
    """
    Get application name via CL_APP_ROOT variable
    :param interpreter: interpreter name
    :return: str application name
    """
    if os.environ.get('CL_APP_ROOT'):
        return os.environ['CL_APP_ROOT']
    elif interpreter == 'python':
        abs_venv_path = os.environ['VIRTUAL_ENV']
        user_home = os.environ['HOME']
        # /home/<username>/virtualenv/<name>/<version> ->
        # /virtualenv/<name>
        vevn_rel_path = os.path.dirname(abs_venv_path).replace(user_home + '/', '', 1)
        # if VENV_REL_PATH contains _ we cannot
        # clearly define app_root and should guess
        if '_' in vevn_rel_path:
            # scanner-triage: set_env_vars.py hard-rejects root at __main__ via is_root()
            # and is installed 0755 with no setuid, so a spoofed getpass.getuser() only
            # reads files with the attacker's own UID — no elevation. User-side interpreter
            # invocations also run inside CageFS where other users' /home is invisible.
            username = getpass.getuser()
            # in python CL_APP_ROOT is not set, we must guess by env path
            for app_root in PythonAppsManager().get_user_config_data(username):
                _, rel_path = get_venv_rel_path(username, app_root)
                if rel_path == vevn_rel_path:
                    return app_root
            return None
        else:
            return vevn_rel_path.replace('virtualenv/', '', 1)
    else:
        raise NotImplementedError(
            'I don\'t know how to get app_root for %s' % interpreter)


def get_env_vars(_app_name, interpreter):
    """
    Get environment variables from user config for given application name
    :param _app_name: application name
    :param interpreter: interpreter name
    :return: dict {ENV_VAR_NAME: VALUE}
    """
    _env_vars = {}
    username = getpass.getuser()
    try:
        full_app_config = get_app_full_conf(username, _app_name, interpreter)
        if interpreter == 'nodejs':
            _env_vars['NODE_ENV'] = full_app_config['app_mode']
        _env_vars.update(full_app_config['env_vars'])
    except KeyError:
        pass
    return _env_vars


def set_env_vars(dict_env_vars):
    """
    Print to stdout bash strings with environment variables
    :param dict_env_vars: dict with environment variables
    :return: None
    """
    for key, var in iteritems(dict_env_vars):
        print('export {}="{}"'.format(key, var))


def is_root():
    return os.geteuid() == 0


def get_app_full_conf(user, app, interpreter):
    if interpreter == 'nodejs':
        manager = NodeJsAppsManager()
    elif interpreter == 'python':
        manager = PythonAppsManager()
    else:
        raise NotImplementedError()
    full_user_config = manager.get_user_config_data(user)
    if not full_user_config:
        print("User config was not found or empty")
        sys.exit(0)
    return get_using_realpath_keys(user, app, full_user_config)


if __name__ == "__main__":
    if is_root():
        print("This program is not intended to be run as root.")
        sys.exit(1)
    args = sys.argv
    if len(args) < 2:
        print("Interpreter is not passed.")
        sys.exit(1)
    app_name = get_app_name(sys.argv[1])
    if app_name is None:
        print("Unknown application.")
        sys.exit(1)
    env_vars = get_env_vars(app_name, sys.argv[1])
    set_env_vars(env_vars)