import asyncio
import logging
import os
import shutil
import stat
import tempfile
import urllib.request
from pathlib import Path
from typing import Optional
from defence360agent.contracts.config import Packaging
from defence360agent.subsys.persistent_state import save_state
from defence360agent.utils import CheckRunError, check_run
_HTTP_TIMEOUT = 30
logger = logging.getLogger(__name__)
_SCRIPT_NAME = "imunify-doctor.sh"
_SCRIPT_URL = (
"https://repo.imunify360.cloudlinux.com/defence360/" + _SCRIPT_NAME
)
_SIG_URL = _SCRIPT_URL + ".sig"
_TMPDIR = Path("/var/imunify360/tmp")
_PUBKEY_PATHS = (
Path("/etc/pki/rpm-gpg/RPM-GPG-KEY-CloudLinux-Imunify"),
Path("/etc/apt/trusted.gpg.d/RPM-GPG-KEY-CloudLinux.gpg"),
)
def _find_pubkey() -> Optional[Path]:
for p in _PUBKEY_PATHS:
if p.is_file() and os.access(str(p), os.R_OK):
return p
return None
def _blocking_download(url: str, dst: Path) -> None:
req = urllib.request.Request(url)
with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT) as resp, dst.open(
"wb"
) as fp:
shutil.copyfileobj(resp, fp)
def _blocking_setup_workdir():
"""Locate the pubkey + gpg binary and create a validated 0700 workdir.
Returns (pubkey_path, workdir_path) on success or None on failure;
any partial state is removed before returning.
"""
pubkey = _find_pubkey()
if pubkey is None or not shutil.which("gpg"):
return None
try:
_TMPDIR.mkdir(mode=0o700, parents=True, exist_ok=True)
workdir = Path(
tempfile.mkdtemp(prefix="imunify-doctor.", dir=str(_TMPDIR))
)
except OSError as exc:
logger.info("cannot prepare workdir under %s: %s", _TMPDIR, exc)
return None
try:
# Single lstat — atomic snapshot of mode + uid. Path.is_dir() would
# follow symlinks and Path.is_symlink() would issue another lstat, so
# using st.st_mode here both eliminates the extra syscalls and keeps
# the symlink rejection semantically consistent with the lstat.
st = workdir.lstat()
if (
stat.S_ISLNK(st.st_mode)
or not stat.S_ISDIR(st.st_mode)
or st.st_uid != os.geteuid()
):
shutil.rmtree(str(workdir), ignore_errors=True)
return None
(workdir / "gnupg").mkdir(mode=0o700)
except OSError as exc:
logger.info("workdir setup failed: %s", exc)
shutil.rmtree(str(workdir), ignore_errors=True)
return None
return pubkey, workdir
def _blocking_rmtree(p: Path) -> None:
shutil.rmtree(str(p), ignore_errors=True)
def _blocking_chmod(p: Path, mode: int) -> None:
p.chmod(mode)
async def _download(url: str, dst: Path) -> None:
"""Fetch *url* to *dst* without blocking the event loop.
Raises urllib.error.URLError (subclass of OSError) on any HTTP/transport
error, which the caller's `except OSError` already handles.
"""
loop = asyncio.get_event_loop()
await loop.run_in_executor(None, _blocking_download, url, dst)
async def _verified_remote_script() -> Optional[Path]:
"""
Download imunify-doctor.sh + .sig into /var/imunify360/tmp and verify the
detached signature against an ephemeral keyring seeded with the
CloudLinux pubkey. Returns the verified script on success or None on
any failure (so the caller can fall back to the package copy).
"""
loop = asyncio.get_event_loop()
setup = await loop.run_in_executor(None, _blocking_setup_workdir)
if setup is None:
return None
pubkey, workdir = setup
script = workdir / _SCRIPT_NAME
sig = workdir / (_SCRIPT_NAME + ".sig")
gpghome = workdir / "gnupg"
success = False
try:
await _download(_SCRIPT_URL, script)
await _download(_SIG_URL, sig)
env = dict(os.environ, GNUPGHOME=str(gpghome))
await check_run(
["gpg", "--batch", "--quiet", "--import", str(pubkey)],
env=env,
)
await check_run(
["gpg", "--batch", "--quiet", "--verify", str(sig), str(script)],
env=env,
)
await loop.run_in_executor(None, _blocking_chmod, script, 0o700)
success = True
return script
except (CheckRunError, OSError) as exc:
logger.info("signed remote doctor fetch failed: %s", exc)
return None
finally:
if not success:
await loop.run_in_executor(None, _blocking_rmtree, workdir)
async def _repo_get_doctor_key() -> str:
script = await _verified_remote_script()
if script is None:
raise ValueError("Signed remote doctor script not available")
loop = asyncio.get_event_loop()
try:
out = await check_run([str(script)])
finally:
await loop.run_in_executor(None, _blocking_rmtree, script.parent)
key = out.decode().strip()
if not key:
raise ValueError("Doctor key is empty")
return key
async def _package_get_doctor_key() -> str:
dir_ = Packaging.DATADIR
if not Path(dir_).is_dir():
dir_ = "/opt/imunify360/venv/share/imunify360"
out = await check_run([Path(dir_, "scripts", _SCRIPT_NAME)])
key = out.decode().strip()
return key
async def get_doctor_key():
try:
key = await _repo_get_doctor_key()
except (CheckRunError, ValueError, OSError):
key = await _package_get_doctor_key()
save_state("doctor_key", {"doctor_key": key})
return key
|