}g:& ` d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z m Z ddl
mZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ej e Z ed Z g dZ g e dddZ g dZ! G d d Z"d Z#d Z$ G d d Z% G d d Z&dS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)ThreadPoolExecutorwraps)NamedTemporaryFile)AnyDict)uuid4)MalwareScanType)fill_results_owner)Malware) HookEvent)
hosting_panel)encode_filename ) max_workers)
intensity_cpu intensity_io
intensity_ram
detect_elf use_filtersfollow_symlinksexclude_patterns
file_patterns)r r r r r r c : e Zd Zd Zd Zd dZd Zd Zd Zd Z dS )
ScanResultc g | _ d| _ d | _ g | _ d x| _ | _ i | _ || _ || _ || _ d | _
d S )Nr ) scans total_fileserrorerrors _begin_time _end_time_aggregated_results_path_scan_id
_scan_typeargs)selfpathscan_id scan_types U/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/scan_result.py__init__zScanResult.__init__D sV
,004>#%
# c V | j t j t j t j fv S N)r& r
BACKGROUND ON_DEMANDUSERr( s r, is_detachedzScanResult.is_detachedR s( & % #
r. Nc . |r|| _ |r || _ d S d S r0 )r! r" )r(
begin_timeend_times r, set_start_stopzScanResult.set_start_stopY s/ * )D & %DNNN & &r. c | j | j | j | j | j | j | j | j d| rd ni d}| j r| j |d d< |S )N)scanidtyper) started completedr r r summaryresultsr@ r' )
r% r& r$ r! r" r r r r5 r' )r( results r, to_dict_initialzScanResult.to_dict_initial_ s -
+ !^ # / + $ / / 1 19ttr
9 2(, F9 f %
r. c B | }| j |d< |S )NrA )rC r )r( as_dicts r, to_dictzScanResult.to_dictt s$ &&(( !Z r. c F t t | j | _ | S r0 )aggregate_resultlistr r4 s r, _aggregate_resultz ScanResult._aggregate_resulty s %dDJ&788
r. c f K | t | j d {V | S r0 )rJ r r r4 s r, getzScanResult.get} s? ,,,,,,,,, r. )NN)
__name__
__module__ __qualname__r- r5 r9 rC rF rJ rL r. r, r r C s
& & & & *
r. r c B i }| D ]}|d |d | dd |d d}| d r#t d|d | h| |d g |d
|d | d d
| dd
d }| d rd|d< |d r |d | |d d
| |S )N signature
suspiciousextended_suspiciousF timestamp)matchesrS rT rU ignorez%File match for %s will be ignored: %s file_namesizehashctimer modification_time)hitsrY rZ r[ r\ curableTr] )rL loggerinfo
setdefaultappendinsert)r aggregated_resultsrecordrV rows r, rH rH sT )+ !+ !+ k* .#)::.CU#K#K ,
::h KK7{#
++ ; v v GQ//%+ZZ0CQ%G%G
::i &!%GI , + K w ' ' ' ' K q' * * * * r. c d fd}|S )Nc fd D S )Nc 4 i | ]}|t v || S rP )SCAN_HOOK_PARAMS.0optkwargss r,
zAevent_hook.._extract_scan_hook_params.. s* NNNSc=M6M6MVC[6M6M6Mr. rP rn s `r, _extract_scan_hook_paramsz-event_hook.._extract_scan_hook_params s NNNNFNNNNr. c F t d fd }|S )Nc
K |pt j }|pt j }
| }|r4t j ||| || } | d {V t j } | f||d| d {V }nk# t j $ r t $ rO} t
d ||| d|t j t | di d}Y d } ~ nd } ~ ww xY w|S )N)r* r+ r) r= scan_params)r* r+ zScan wrapper task failedr )r; r< r) r r= r> r r? ) r hextimer
MalwareScanningStartedprocess_messageasyncioCancelledError Exceptionr_ exceptionrepr)
r) r* r+ r= rn rt scan_started_event_started scan_resulterq fsinks
r, wrapperz)event_hook..wrap..wrapper s ,G ,G33F;;K
?%.%E # ' # + & & &" **+=>>>>>>>>>y{{H
$%A%")Y% %BH% % )
!;<<< #* ) $'(#+%)Y[[!%a "
s B C>/AC99C>NNNr )r r rq r s ` r, wrapzevent_hook..wrap sG q8<' ' ' ' ' ' '
' R r. rP )r r rq s ` @r,
event_hookr s< O O O+ + + + + +Z Kr. c \ e Zd Zd Zed Zed Zed Zd ZdS )
DirectAiBolitc d S r0 rP )r( ___s r, r- zDirectAiBolit.__init__ s r. c | K t j r-t j | }||d< d S d S )Ndb_dir)r
RAPID_SCANr HostingPanelget_rapid_scan_db_dir)home_dir scan_optionsds r, _add_db_dirzDirectAiBolit._add_db_dir sG ' *,,BB8LLA%&L " " " ' 'r. c fd D S )Nc 4 i | ]}|t v || S rP )DIRECT_SCAN_OPTIONSrk s r, ro z7DirectAiBolit._extract_scan_options.. s1
!$#9L2L2LC2L2L2Lr. rP rp s `r, _extract_scan_optionsz#DirectAiBolit._extract_scan_options s.
(.
r. c d| v r&| d d | d | d< d| v r&| d d | d | d< | S )Nr ,r )joinrp s r, _update_scan_optionsz"DirectAiBolit._update_scan_options sm
& ( ()*6),&9K2L)M)MF% & f $ $)@)L&)hhvo/F&G&GF? #
r. c D t d fd }|S )Nc | K | }|t j t j fv r | | d {V t
| || }| | d||| d| d {V \ |_ |_ t |j |_ |S )Nr7 )r+ r* scan_pathr0 ) r r r
r3 r1 r r r9 r r rI ) r) r* r+ r7 rn r r r r( s r, r z'DirectAiBolit.__call__..wrapper s 44**622 L _ 1?3M NNN&&t\:::::::::$T7I>>K & &* & = = =9::# : :
: : 4 4 4 4 4 4 0K { 0 !%k&7 8K r. r r r( r r s `` r, __call__zDirectAiBolit.__call__ sA q;?
* r. N) rM rN rO r- staticmethodr r r r rP r. r, r r s
' ' \'
\
\ r. r c R e Zd Zd ZdefdZed Zed Zd Z dS )PrepareFileListc || _ d S r0 )_tmpdir)r( tmpdirs r, r- zPrepareFileList.__init__ s
r. returnc 6 K | || }|S r0 )_write_list_to_file)r( fnamefilesrn r s r, prepare_filez PrepareFileList.prepare_file s! ..ue<< r. c t | d 5 }d}|D ])}|dz
}| t | *|cd d d S # 1 swxY w Y d S )Nwbr r )openwriter )r r r r files r, r z#PrepareFileList._write_list_to_file s
%
!K
/
/q --.... s 0AAAc fd D S )Nc 4 i | ]}|t v || S rP ) SCAN_OPTIONSrk s r, ro z9PrepareFileList._extract_scan_options..( s) JJJSc\6I6IVC[6I6I6Ir. rP rp s `r, r z%PrepareFileList._extract_scan_options& s JJJJFJJJJr. c D t d fd }|S )Nc K
| }t | || }| | t
j 5 }
j |j | fi | d {V } |f||d| d {V \ |_ |_ d d d n # 1 swxY w Y ||_ t |j |_ |S )Nr )dir)r+ r* ) r r r9 r r r namer r r rI ) r) r* r+ r7 rn r r tfr r r( s r, r z)PrepareFileList.__call__..wrapper+ sM 55f==L$T7I>>K & &* & = = =# 555
$5D$5bgt$N$Nv$N$N N N N N N N =>Q>"+W> >@L> > 8 8 8 8 8 84 !;#4
'2K # $k&7 8K s :BB "B r r r s `` r, r zPrepareFileList.__call__* sA q;?
r. N)
rM rN rO r- intr r r r r rP r. r, r r s C \ K K \K r. r )'__doc__ry loggingrv concurrent.futures.threadr functoolsr tempfiler typingr r uuidr imav.malwarelib.configr
imav.malwarelib.utils.user_listr defence360agent.contracts.configr %defence360agent.contracts.hook_eventsr
defence360agent.subsys.panelsr defence360agent.utilsr getLoggerrM r_ _executorr r rj r rH r r r rP r. r, r s * 8 8 8 8 8 8 ' ' ' ' ' ' 2 2 2 2 2 2 > > > > > > 4 4 4 4 4 4 ; ; ; ; ; ; 7 7 7 7 7 7 1 1 1 1 1 1 8 $ $ 1 - - - = = = = = = = =@& & & R1 1 1h2 2 2 2 2 2 2 2j' ' ' ' ' ' ' ' ' 'r.