# -*- coding: utf-8 -*-
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENCE.TXT
#
"""Utility functions for crontab operations."""
import os
import pwd
from clcommon.cpapi import userdomains
from .constants import DOCUMENT_ROOT_ENV
def get_document_root() -> str | None:
"""
Get the document root from environment variable.
When PROXYEXEC_DOCUMENT_ROOT is set, validate that it is one of the
calling user's real document roots — defence in depth against a user
invoking the wrapper directly with a forged value.
Returns:
Optional[str]: The document root path if PROXYEXEC_DOCUMENT_ROOT is set,
None otherwise.
Raises:
ValueError: If PROXYEXEC_DOCUMENT_ROOT is set but does not appear in
the calling user's docroot list.
"""
document_root = os.environ.get(DOCUMENT_ROOT_ENV)
if document_root is None:
return None
# normally this logic is called under user
uid = os.getuid()
# scanner-triage: the `uid == 0` branch is only reachable for root
# invoking this helper directly (root-to-root, outside the threat model).
# All CRONTAB_* proxyexec aliases carry `:secure:noproceed` (never
# `root:`) and the dispatcher setuid()s to the caller before execv, so
# a CageFS tenant always arrives with a non-zero UID.
if uid == 0:
return document_root
username = pwd.getpwuid(uid).pw_name
user_docroots = {docroot for _, docroot in userdomains(username)}
if document_root not in user_docroots:
raise ValueError(
f"Document root path {document_root!r} is not found for user"
)
return document_root
|