gq* d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZ ddlmZmZ ddlmZ ddlmZ dd lmZ dd
lm Z m Z m Z dd l m Z m!Z! dd l"m#Z# dd
l$m%Z% ej& e' Z(d Z)d Z*d Z+de,fdZ-d Z.d Z/d Z0d Z1dee2ee e3e f f fdZ4dddZ5d%d Z6d e3d ee3 d eej7 fd Z8d! Z9d"e3de:fd#Z;de3fd$Z.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)Path)AnyDictIterableListLiteralSetTuple)Casefn)
hosting_panel) get_results_iterable_expression) to_thread)MalwareHitStatusMalwareScanResourceTypeQueuedScanState)
MalwareHit MalwareScan)
is_crontab)
CloudwaysUserc
d d dddd d d d d S )Nr ) userhomeinfected infected_db_infected_totalscan_id scan_date scan_statuscleanup_status r" T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/utils/user_list.py
stub_entryr% 0 s,
r# c # K t j D ](} t }| j |d< | j |d< |V )dS )z
Get all system users and initialize a dict for them.
If a user has leftover config files after being deleted then
the panel API might treat him as existent. This is resolved by checking
that a system user is a panel user.
r r N)pwdgetpwallr% pw_namepw_dir)entryus r$ system_usersr- > sQ LLM& L& r# c K t j d {V fdt D S )Nc ( g | ]}|d v |S r r" ).0r, userss r$
z panel_users..P s' < < .U s% 555da! 555r# )allitemsr% ) user_listkwargsr, s @r$ getr@ S sY
5555fllnn555 6 6 HHH <<r# c F d | D }d }t j t j t j d t j t j t j
j k z t j }t j t j t j d t j t j t j
j k z t j }d |D }d |D }t || }|D ]U}t | |j } | | d d | d< t" j j | d
< |j | d < V| D ]\ }
} t | |
} | | d< | D ]} | d | d z | d
< d S )Nc g | ]
}|d S r r" r1 r, s r$ r3 z7update_infected_count_and_last_scan..\ * * *1QvY * * *r# c t j t j t j t j t j t j t j t j k t j
| }|S N) r selectscanid completedpathgroup_byhavingr
Maxwherein_)_homesqs r$ exprz1update_infected_count_and_last_scan..expr^ s "K$9;;K
Xk&
'
'
VK)RVK4I-J-JJ
K
K
U;#''//
0
0
r# r r c ( i | ]}|j |j S r" )r r r1 r+ s r$
z7update_infected_count_and_last_scan..| s NNNU^NNNr# c ( i | ]}|j |j S r" )r r rU s r$ rV z7update_infected_count_and_last_scan..} s, */
E% r# rC r r r r r0 r )r rH r r
COUNTaliasrO is_infected
resource_typer FILEvaluerL DBr r@ rK r stoppedrI r= ) r> homesrS grouped_hitsgrouped_db_hitsgrouped_hits_dictgrouped_db_hits_dict actual_scansr+ r, r r s r$ #update_infected_count_and_last_scanrf [ s" * * * * *E */28::+;+;J+G+GHH " $ $'+B+G+MM
O
*/ " "
*/28::+;+;M+J+JKK " $ $'+B+E+KK
M
*/ " "
ON NNN 3B 34??L $ $
+ + +)--ai;;*
*28- |) 1 7 7 9 9 ' 'k % % %&-
@ @ }q /? ?
@ @r# c d | D } || D ]4\ }}t | |j }|j |d< ||d< |j |d< 5d S )Nc g | ]
}|d S rC r" rD s r$ r3 z.update_running_scan_status.. rE r# rC r r scan_type)r@ rK rI ri )r> get_scanspathsscanstatusr, s r$ update_running_scan_statusrn sr * * * * *E! %(( ( ( f * * *{) !- + ( (r# c d | D }dt t t d f fd}t || D ]\ }}t | | }||d< dS )a
Updates cleanup status for the list of panel users
If at least on cleanup is running for user then status is 'running'
Else if there are any finished cleanups then status is 'stopped'
If no started and finished cleanups then status is not set
:param user_list:
c g | ]
}|d S r0 r" rD s r$ r3 z)update_cleanup_status.. rE r# r7 )runningr_ Nc
t dt j t j t j f dffd }t dt j t j t j f dffd }t j t j
t dt j | dk dft j | dk dff
d t j
| t j
}| S )z
Returns a list of (user, cleanup_status) tuples where `cleanup_status`
can take one of the values: "running", "stopped", or None
N r rq r_ r! )r r rm rP r CLEANUP_PENDINGCLEANUP_STARTED CLEANUP_DONECLEANUP_REMOVEDrH r r
SumrY rO rL tuples)r2 case_running case_stoppedquerys r$
expressionz)update_cleanup_status..expression sQ
%)) , < , <
%)) , 9 , <
--19= --19= %())
U:?&&u--
.
.
Xjo
&
& ||~~ r# r0 r! N)r strr r r@ )r> r2 r} r rm r, s r$ update_cleanup_statusr s
+ * * * *E1 U30J(K#K L 1 1 1 1 f 8
EJJ % % f % % % $
% %r# c d }t t }| D ]#}||d | $t |t | D ] }||j D ] }|j |d<
d S )Nc h t j t j t j t j | t j t j t j t j k S rG )
r rH rK rJ rO rP rL rM r
rN )r` s r$ r} z)update_last_scan_date..expression sm { /1F G G
U;#''..
/
/
Xk&
'
'
VK)RVK4I-J-JJ
K
K
r# r r )r listappendr rK rJ )r> r}
home_to_usersr rl s r$ update_last_scan_dater s
%%M 1 1d6l#**40000/D '' / / "$), / /D $D // /r# c t K t d {V }t | t rt j d| d nUt | t
r,t j dd | d nt j d fd|D }t | |fS )Nz.*z^(|z)$c J g | ] } |d | S r0 match)r1 r, patterns r$ r3 z%get_matched_users.. s. FFF1W]]1V9-E-EFQFFFr# )r6
isinstancer~ recompiler joinlen)r r>
matched_usersr s @r$ get_matched_usersr s !mm######I% #*^%^^^,, E8 $ $ #* 5#((5// 5 5 566*T""FFFF FFFM y>>= ((r# r c K t | d {V \ }}t | t || t | t | ||fS rG )r rf rn r r )rj r max_countr> s r$ fetch_user_listr so !25!9!9999999Iy' 222 y)444)$$$)$$$ i r# r Tc fd}| || dk r| D ]}| d | S )Nc dv rt nt }|t k rt d nd}| }||}|S )N)r r r r r )intr~ chrr@ )element
field_typemin_valr] fields r$ getterzsort..getter sc JK K
C '# - -#a&&&1 E"" =E r# )keyreverser )sortpop)r> r descr r s ` r$ r r sk NNvtN,,, !!! ( (D HH& ' ' ' ' r# rK users_from_panelpw_allc K t j | }|j x}x}}|j x}}t | } |dk rNt | r?|D ];}
|
j | j k r)|
j |v r |
j |
j |
j }}}|
j x}} nz&get_username_by_uid..f s1 99 S(8(8(8(8(8(899r# )r r r' r( next)r r s ` r$ get_username_by_uidr b s_
c((C S\**
*
*
*
*
*
*F 9999f999 r# )r T)=__doc__r loggingr r' r collectionsr pathlibr typingr r r r r r
r peeweer r
defence360agent.subsys.panelsr defence360agent.utilsr defence360agent.utils.threadsr imav.malwarelib.configr r r imav.malwarelib.modelr r imav.malwarelib.scan.crontabr imav.malwarelib.utils.cloudwaysr getLogger__name__loggerr% r- r6 dictr@ rf rn r r r r~ r r r
struct_passwdr r boolr r r" r# r$ r s *
# # # # # # A A A A A A A A A A A A A A A A A A 7 7 7 7 7 7 A A A A A A 3 3 3 3 3 3
: 9 9 9 9 9 9 9 3 3 3 3 3 3 9 9 9 9 9 9 8 $ $ = = = 2@ 2@ 2@j( ( (@% @% @%F/ / /& )eCd38n1E,E&F ) ) ) ) /3 *&(
&(!$S&(378I3J&( &( &( &(R 0S T c r#