PK���ȼRY��������€��� �v3.phpUT �øŽg‰gñ“gux �õ��õ��½T]kÛ0}߯pEhìâÙM7X‰çv%”v0֐µ{)Aå:6S$!ÉMJèߕ?R÷!>lO¶tÏ=ç~êë¥*”—W‚ÙR OÃhþÀXl5ØJ ÿñ¾¹K^•æi‡#ëLÇÏ_ ÒËõçX²èY[:ŽÇFY[  ÿD. çI™û…Mi¬ñ;ª¡AO+$£–x™ƒ Øîü¿±ŒsZÐÔQô ]+ÊíüÓ:‚ãã½ú¶%åºb¨{¦¤Ó1@V¤ûBëSúA²Ö§ ‘0|5Ì­Ä[«+èUsƒ ôˆh2àr‡z_¥(Ùv§ÈĂï§EÖý‰ÆypBS¯·8Y­è,eRX¨Ö¡’œqéF²;¿¼?Ø?Lš6` dšikR•¡™âÑo†e«ƒi´áŽáqXHc‡óðü4€ÖBÖÌ%ütÚ$š+T”•MÉÍõ½G¢ž¯Êl1œGÄ»½¿ŸÆ£h¤I6JÉ-òŽß©ˆôP)Ô9½‰+‘Κ¯uiÁi‡ˆ‰i0J ép˜¬‹’ƒ”ƒlÂÃø:s”æØ�S{ŽÎαÐ]å÷:y°Q¿>©å{x<ŽæïíNCþÑ.Mf?¨«2ý}=ûõýî'=£§ÿu•Ü(—¾IIa­"éþ@¶�¿ä9?^-qìÇÞôvŠeÈc ðlacã®xèÄ'®âd¶ çˆSEæódP/ÍÆv{Ô)Ó ?>…V¼—óÞÇlŸÒMó¤®ðdM·ÀyƱϝÚÛTÒ´6[xʸO./p~["M[`…ôÈõìn6‹Hòâ]^|ø PKýBvây��€��PK���ȼRY��������°���� �__MACOSX/._v3.phpUT �øŽg‰gþ“gux �õ��õ��c`cg`b`ðMLVðVˆP€'qƒøˆŽ!!AP&HÇ %PDF-1.7 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R >> >> /MediaBox [0.000 0.000 595.280 841.890] >> endobj 4 0 obj [/PDF /Text ] endobj 5 0 obj << /Producer (���d�o�m�p�d�f� �2�.�0�.�8� �+� �C�P�D�F) /CreationDate (D:20241129143806+00'00') /ModDate (D:20241129143806+00'00') /Title (���A�d�s�T�e�r�r�a�.�c�o�m� �i�n�v�o�i�c�e) >> endobj 6 0 obj << /Type /Page /MediaBox [0.000 0.000 595.280 841.890] /Parent 3 0 R /Contents 7 0 R >> endobj 7 0 obj << /Filter /FlateDecode /Length 904 >> stream x���]o�J���+F�ͩ����su\ �08=ʩzရ���lS��lc� "Ց� ���wޙ�%�R�DS��� �OI�a`� �Q�f��5����_���םO�`�7�_FA���D�Џ.j�a=�j����>��n���R+�P��l�rH�{0��w��0��=W�2D ����G���I�>�_B3ed�H�yJ�G>/��ywy�fk��%�$�2.��d_�h����&)b0��"[\B��*_.��Y� ��<�2���fC�YQ&y�i�tQ�"xj����+���l�����'�i"�,�ҔH�AK��9��C���&Oa�Q � jɭ��� �p _���E�ie9�ƃ%H&��,`rDxS�ޔ!�(�X!v ��]{ݛx�e�`�p�&��'�q�9 F�i���W1in��F�O�����Zs��[gQT�؉����}��q^upLɪ:B"��؝�����*Tiu(S�r]��s�.��s9n�N!K!L�M�?�*[��N�8��c��ۯ�b�� ��� �YZ���SR3�n�����lPN��P�;��^�]�!'�z-���ӊ���/��껣��4�l(M�E�QL��X ��~���G��M|�����*��~�;/=N4�-|y�`�i�\�e�T�<���L��G}�"В�J^���q��"X�?(V�ߣXۆ{��H[����P�� �c���kc�Z�9v�����? �a��R�h|��^�k�D4W���?Iӊ�]<��4�)$wdat���~�����������|�L��x�p|N�*��E� �/4�Qpi�x.>��d����,M�y|4^�Ż��8S/޾���uQe���D�y� ��ͧH�����j�wX � �&z� endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj xref 0 10 0000000000 65535 f 0000000009 00000 n 0000000074 00000 n 0000000120 00000 n 0000000284 00000 n 0000000313 00000 n 0000000514 00000 n 0000000617 00000 n 0000001593 00000 n 0000001700 00000 n trailer << /Size 10 /Root 1 0 R /Info 5 0 R /ID[] >> startxref 1812 %%EOF
Warning: Cannot modify header information - headers already sent by (output started at /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php:1) in /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php on line 128

Warning: Cannot modify header information - headers already sent by (output started at /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php:1) in /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php on line 129

Warning: Cannot modify header information - headers already sent by (output started at /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php:1) in /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php on line 130

Warning: Cannot modify header information - headers already sent by (output started at /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php:1) in /home/u697396820/domains/smartriegroup.com/public_html/assets/images/partners/logo_69cec45839613.php on line 131
# coding=utf-8 # Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2018 All Rights Reserved # # Licensed under CLOUD LINUX LICENSE AGREEMENT # http://cloudlinux.com/docs/LICENSE.TXT # This module provides functions for secure I/O and filesystem operations import grp import sys import tempfile import contextlib import os from functools import lru_cache from typing import TYPE_CHECKING from ctypes import (cdll, c_long, Structure, c_ushort, c_ubyte, c_char, POINTER, c_int, c_void_p, c_char_p) from clcommon import ClPwd from clcommon.clpwd import drop_user_privileges def __getattr__(name): # NOTE(vlebedev): Delay shared libraries loading until they are actually used. # It makes module loadable even in case those shared libraries are not available # and that is useful for e.g. unit testing on local non-CL system. if name == 'libc': return _load_libc() elif name == 'liblve': return _load_liblve() raise AttributeError(f"module {__name__} has no attribute {name}") def __dir__(): return ['libc', 'liblve', *globals().keys()] # --- libc functions ----------------------------------------------- @lru_cache(maxsize=None) def _load_libc(): libc = cdll.LoadLibrary("libc.so.6") libc.fchown.argtypes = [c_int, c_int, c_int] libc.fchown.restype = c_int libc.fchmod.argtypes = [c_int, c_int] libc.fchmod.restype = c_int # accepts file/dir descriptor (integer) libc.fdopendir.argtypes = [c_int] # returns pointer to DIR structure libc.fdopendir.restype = c_void_p # accepts pointer to DIR structure libc.readdir.argtypes = [c_void_p] # returns pointer to DIRENTRY structure libc.readdir.restype = DIRENTRY_P # accepts pointer to DIR structure libc.rewinddir.argtypes = [c_void_p] # returns void libc.rewinddir.restype = None # accepts pointer to DIR structure libc.closedir.argtypes = [c_void_p] libc.closedir.restype = c_int return libc if TYPE_CHECKING: libc = _load_libc() ino_t = c_long off_t = c_long class DIRENTRY(Structure): _fields_ = [ ('d_ino', ino_t), # inode number ('d_off', off_t), # offset to the next dirent ('d_reclen', c_ushort), # length of this record ('d_type', c_ubyte), # type of file; not supported by all file system types ('d_name', c_char * 256), # filename ] DIRENTRY_P = POINTER(DIRENTRY) def fchown(fd, uid, gid): return _load_libc().fchown(fd, uid, gid) def fchmod(fd, mode): return _load_libc().fchmod(fd, mode) def fdopen(fd): return _load_libc().fdopen(fd) def readdir(dirp): return _load_libc().readdir(dirp) def rewinddir(dirp): return _load_libc().rewinddir(dirp) def closedir(dirp): return _load_libc().closedir(dirp) # --- liblve functions ----------------------------------------------- @lru_cache(maxsize=None) def _load_liblve(): try: liblve = cdll.LoadLibrary("libsecureio.so.0") except OSError: liblve = cdll.LoadLibrary("liblve.so.0") # Opens path for reading not following symlinks and verifies that opened path is inside parent_path # Returns: # descriptor if successful # -1 if path does not exist or is a symlink # -2 if opened path is NOT inside parent_path or cannot be determined # accepts path, parent_path liblve.open_not_symlink.argtypes = [c_char_p, c_char_p] liblve.open_not_symlink.restype = c_int # Closes descriptor (if it is not equal -1) # accepts file/dir descriptor (integer) liblve.closefd.argtypes = [c_int] # returns void liblve.closefd.restype = None # Tries to read first directory entry in order to ensure that descriptor is valid # Returns 0 if reading succeeded or -1 if error has occured # accepts descriptor liblve.check_dir.argtypes = [c_int] liblve.check_dir.restype = c_int # Checks if path is a directory (in secure manner) # Also opens path (if descriptor fd == -1) and then checks that opened path is inside parent_path # Returns descriptor if path refers to directory # Returns -1 if path does not exist or is not a directory # Returns -2 if opened path is NOT inside parent_path or cannot be determined # accepts path, descriptor, parent_path liblve.isdir.argtypes = [c_char_p, c_int, c_char_p] liblve.isdir.restype = c_int # Sets permissions to directory (in secure manner) # Returns descriptor if successful # Returns -1 if error has occured # Returns -2 if opened path is NOT inside parent_path or cannot be determined # accepts: const char *path, mode_t perm, int fd, const char *parent_path liblve.set_perm_dir_secure.argtypes = [c_char_p, c_int, c_int, c_char_p] liblve.set_perm_dir_secure.restype = c_int # Sets owner and group of directory (in secure manner) # Returns descriptor if successful # Returns -1 if error has occured # Returns -2 if opened path is NOT inside parent_path or cannot be determined # accepts: const char *path, uid_t uid, gid_t gid, int fd, const char *parent_path liblve.set_owner_dir_secure.argtypes = [c_char_p, c_int, c_int, c_int, c_char_p] liblve.set_owner_dir_secure.restype = c_int # Creates directory if it does not exist, sets permissions/owner otherwise # Returns descriptor if successful # Returns -1 if error has occured # accepts: const char *path, mode_t perm, uid_t uid, gid_t gid, int fd, const char *parent_path liblve.create_dir_secure.argtypes = [c_char_p, c_int, c_int, c_int, c_int, c_char_p] liblve.create_dir_secure.restype = c_int # Recursive directory creation function # Returns 0 if successful # Returns -1 if error has occured # accepts: const char *path, mode_t perm, uid_t uid, gid_t gid, const char *parent_path liblve.makedirs_secure.argtypes = [c_char_p, c_int, c_int, c_int, c_char_p] liblve.makedirs_secure.restype = c_int # Writes absolute path pointed by descriptor fd to buffer *buf # Returns buf if successful # Returns NULL if error has occured liblve.get_path_from_descriptor.argtypes = [c_int, c_char_p] liblve.get_path_from_descriptor.restype = c_char_p # Returns 1 if subdir is subdirectory of dir, 0 otherwise liblve.is_subdir.argtypes = [c_char_p, c_char_p] liblve.is_subdir.restype = c_int return liblve if TYPE_CHECKING: liblve = _load_liblve() def _open_not_symlink(path, parent_path): return _load_liblve().open_not_symlink(path, parent_path) def check_dir(fd): return _load_liblve().check_dir(fd) def isdir(path, descriptor, parent_path): return _load_liblve().isdir(path, descriptor, parent_path) def get_path_from_descriptor(fd, buf): return _load_liblve().get_path_from_descriptor(fd, buf) def is_subdir(dir, subdir): return _load_liblve().is_subdir(dir, subdir) # True : euid/egid == 0/0 # False : euid/egid == user/user # set by set_user_perm() and set_root_perm() functions root_flag = True LOGFILE = "/var/log/cagefs-update.log" MIN_UID = 500 SILENT_FLAG = False def open_not_symlink(path): return os.open(path, os.O_RDONLY | os.O_NOFOLLOW) def open_file_not_symlink(path): return os.fdopen(open_not_symlink(path), 'r') def flistdir(fd): """Returns list of entries of directory pointed by descriptor""" # Duplicate descriptor, because closedir() closes descriptor associated with directory stream fd2 = os.dup(fd) # Open directory stream dirp = fdopendir(fd2) # NOQA if not dirp: raise RuntimeError("fdopendir error") # Reset position of directory stream # (so it will be possible to read content of directory multiple times # via other descriptors that refer to the directory) rewinddir(dirp) dirlist = [] while True: entryp = readdir(dirp) if not entryp: break entry = entryp.contents dirlist.append(entry.d_name) rewinddir(dirp) closedir(dirp) return dirlist def closefd(fd): if fd is not None: try: os.close(fd) except OSError: pass def set_perm_dir_secure(path, perm, parent_path, fd=None, logger=None): """Sets permissions to directory (in secure manner) Returns descriptor if successful Returns None if error has occured""" if fd is None: fd = -1 fd = _load_liblve().set_perm_dir_secure(path.encode(), perm, fd, parent_path.encode()) if fd > 0: return fd if logger is not None: logger('Error: failed to set permissions of directory ' + path, False, True) return None def set_owner_dir_secure(path, uid, gid, parent_path, fd=None, logger=None): """Sets owner and group of directory (in secure manner) Returns descriptor if successful Returns None if error has occured""" if fd is None: fd = -1 fd = _load_liblve().set_owner_dir_secure(path.encode(), uid, gid, fd, parent_path.encode()) if fd > 0: return fd if logger is not None: logger('Error: failed to set owner of directory ' + path, False, True) return None def create_dir_secure(path, perm, uid, gid, parent_path, fd=None, logger=None): """Creates directory if it does not exist, sets permissions/owner otherwise Returns descriptor if successful Returns None if error has occured""" if fd is None: fd = -1 fd = _load_liblve().create_dir_secure(path.encode(), perm, uid, gid, fd, parent_path.encode()) if fd > 0: return fd if logger is not None: logger('Error : failed to create directory ' + path, False, True) return None def makedirs_secure(path, perm, uid, gid, parent_path, logger=None): """Recursive directory creation function Returns 0 if successful Returns -1 if error has occured""" res = _load_liblve().makedirs_secure(path.encode(), perm, uid, gid, parent_path.encode()) if res and logger: logger('Error : failed to create directory ' + path, False, True) return res def read_file_secure(filename, uid=None, gid=None, exit_on_error=True, write_log=True): """read file not following symlinks""" if (uid is None and gid is not None) or (uid is not None and gid is None): raise RuntimeError("read_file_secure: uid and gid should be both null or be both not null") drop_perm = (uid is not None) and (gid is not None) if drop_perm: set_user_perm(uid, gid) try: file_object = open_file_not_symlink(filename) content = file_object.readlines() file_object.close() if drop_perm: set_root_perm() return content except (OSError, IOError) as e: if drop_perm: set_root_perm() logging('Error: failed to read ' + filename + ' : ' + str(e), SILENT_FLAG, 1, write_log) if not exit_on_error: raise sys.exit(1) def write_file_secure(content, ini_path, uid, gid, drop_perm=True, perm=0o644, write_log=True): """Returns True if error has occured""" dirpath = os.path.dirname(ini_path) if drop_perm: set_user_perm(uid, gid) fd = None temp_path = None try: fd, temp_path = tempfile.mkstemp(prefix='cagefs_', dir=dirpath) file_object = os.fdopen(fd, 'w') file_object.write(''.join(content)) if not drop_perm and uid is not None and gid is not None: if fchown(fd, uid, gid): raise OSError('fchown failed') if fchmod(fd, perm): raise OSError('fchmod failed') file_object.close() except (IOError, OSError) as e: try: file_object.close() except Exception: pass try: os.close(fd) except Exception: pass try: os.unlink(temp_path) except Exception: pass if drop_perm: set_root_perm() logging( f"Error: failed to write file {ini_path} : {str(e).replace('Errno', 'Err code')}", SILENT_FLAG, 1, write_log, ) return True except Exception as e: logging(f'Error: {str(e)}', SILENT_FLAG, 1) sys.exit(1) error = False try: os.rename(temp_path, ini_path) except OSError as e: error = True logging('Error: failed to rename tempfile to ' + ini_path + ' : ' + str(e), SILENT_FLAG, 1, write_log) try: os.unlink(temp_path) except OSError: pass if drop_perm: set_root_perm() return error def write_file_via_tempfile( content, dest_path, perm, prefix='', suffix='', as_user=None, copy_owner: bool = False): """ Safely write string content to a file :param content: str :param dest_path: str -> path to a file :param perm: int -> permissions for the file :param prefix: str -> add to temporary file name :param suffix: str -> add to temporary file name :param as_user: str -> name of the user to drop privileges to :param copy_owner: bool -> whether to copy original uid/gid to new file if original exists """ if as_user is not None: old_groups = os.getgroups() drop_user_privileges(as_user, effective_or_real=True, set_env=False) dirpath = os.path.dirname(dest_path) fd, temp_path = None, None try: fd, temp_path = tempfile.mkstemp( prefix=prefix, suffix=suffix, dir=dirpath) with os.fdopen(fd, 'w', errors='surrogateescape') as f_temp: f_temp.write(content) except (IOError, OSError): if fd is None or temp_path is None: raise try: os.close(fd) except (IOError, OSError): pass try: os.unlink(temp_path) except (IOError, OSError): pass raise try: os.chmod(temp_path, perm) if copy_owner and os.path.isfile(dest_path): stat_ = os.stat(dest_path) os.chown(temp_path, stat_.st_uid, stat_.st_gid) os.rename(temp_path, dest_path) except (OSError, IOError, TypeError): try: os.unlink(temp_path) except (OSError, IOError): pass raise if as_user is not None: ruid = os.getuid() os.seteuid(ruid) os.setegid(os.getgid()) # All of the above can be called from user named as_user if ruid == 0: os.setgroups(old_groups) def set_user_perm(uid, gid, exit=True): global root_flag try: os.setegid(gid) except (OSError,) as e: if exit: print_error('failed to set egid to ' + str(gid) + ': ' + str(e)) sys.exit(1) else: return -1 groups = get_groups(uid, gid) try: os.setgroups(groups) except (OSError,) as e: if exit: print_error('failed to set supplementary groups to :', groups, str(e)) sys.exit(1) else: return -1 try: os.seteuid(uid) except (OSError,) as e: if exit: print_error('failed to set euid to ' + str(uid) + ': ' + str(e)) sys.exit(1) else: return -1 if uid == 0: root_flag = True else: # If it's possible, switch on CAP_SYS_RESOURCE _load_liblve().enable_quota_capability() root_flag = False def set_root_perm(exit=True): global root_flag try: os.seteuid(0) except (OSError,) as e: if exit: print_error('failed to set euid to 0 :', str(e)) sys.exit(1) else: return -1 try: os.setegid(0) except (OSError,) as e: if exit: print_error('Error: failed to set egid to 0 :', str(e)) sys.exit(1) else: return -1 groups = get_groups(0, 0) try: os.setgroups(groups) except (OSError,) as e: if exit: print_error('Error: failed to set supplementary groups to :', groups, str(e)) sys.exit(1) else: return -1 root_flag = True def print_error(*args): print("Error:", end=' ', file=sys.stderr) for a in args: print(a, end=' ', file=sys.stderr) print(file=sys.stderr) def get_groups(uid, gid): """Returns supplementary groups for uid""" gr = get_grp_dict() pw = get_pwd_dict() groups = set() for group in gr: members = gr[group].gr_mem for user in members: try: member_uid = pw[user].pw_uid except KeyError: continue if member_uid == uid: groups.add(gr[group].gr_gid) groups.add(gid) return list(groups) grp_dict = None def get_grp_dict(): global grp_dict if grp_dict is None: grp_dict = {} gr = grp.getgrall() for line in gr: grp_dict[line.gr_name] = line return grp_dict clpwd = ClPwd(min_uid=MIN_UID) def get_pwd_dict(): return clpwd.get_user_dict() log_file = None def logging(msg, silent=False, verbose=True, write_log=True): global log_file if not silent: if verbose: print(msg) if write_log: root_flag_saved = root_flag if not root_flag: uid, gid = get_perm() set_root_perm() try: if log_file is None: umask_saved = os.umask(0o22) # log_file is opened in "line buffered" mode log_file = open(LOGFILE, 'w', 1) # NOQA os.umask(umask_saved) log_file.write(msg) log_file.write("\n") except (OSError, IOError) as e: print_error("writing to ", LOGFILE, str(e)) sys.exit(1) if not root_flag_saved: set_user_perm(uid, gid) def get_perm(): try: uid = os.geteuid() gid = os.getegid() except (OSError,) as e: print_error('failed to get (euid,egid)', str(e)) sys.exit(1) return uid, gid def set_capability(clear=False): """ Set CAP_SYS_RESOURCE capability :param bool clear: Set on if it's true, set off otherwise :return: 0 for success, -1 otherwise :rtype: int """ return _load_liblve().disable_quota_capability() if clear \ else _load_liblve().enable_quota_capability() def change_uid(uid): """ Change effective uid of current process and set CAP_SYS_RESOURCE capbality to prevent "Disk quota exceeded" error :param int euid: User ID to set it as current effective UID :return: 0 if capability was set successfuly, -1 otherwise :rtype: int """ os.seteuid(uid) return set_capability() def _set_quota_checks_status(enabled): """ Disable quota kernel check to allow us to write more than user can by quota. """ if not enabled: _load_liblve().enable_quota_capability() else: _load_liblve().disable_quota_capability() @contextlib.contextmanager def disable_quota(): _set_quota_checks_status(enabled=False) try: yield finally: _set_quota_checks_status(enabled=True) @contextlib.contextmanager def set_umask(umask_value): saved_umask = os.umask(umask_value) try: yield finally: os.umask(saved_umask)