OwlCyberSecurity - MANAGER
Edit File: mount_ordering.cpython-311.pyc
� ���i� � � � d Z ddlmZ ddlmZ ddlmZ ddlmZ ed�� � G d � d � � � � Z dd�Z dd�Z dS )a� Module for processing and ordering mount configurations for website isolation. This module handles the logic for ordering mounts with proper parent-child relationships, remounting parents after children, and adding mkdir attributes when paths are inside tmpfs mounts. Optimization: tmpfs mounts that are inside another tmpfs are skipped because the parent tmpfs already makes them inaccessible. � )� annotations)� dataclass� )� MountEntry)� MountTypeT)�frozenc �2 � e Zd ZU dZded< ded< ded< dS ) � DocrootTreez)Pre-computed tree structure for docroots.z!dict[str | None, tuple[str, ...]]�childrenztuple[str, ...]�rootszfrozenset[str]� all_docrootsN)�__name__� __module__� __qualname__�__doc__�__annotations__� � �[opt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/mount_ordering.pyr r s< � � � � � � �3�3�/�/�/�/����� � � � � � r r r �set[str]�returnc � � � d � fd� }d� � D � � }g |d< � D ](} ||� � }|| � |� � �)d� |� � � D � � }|d }t ||t � � � � � � S ) aT Build the parent-child tree structure from docroots. Call this once and pass the result to process_ordered_mounts() for each active docroot to avoid rebuilding the tree on every call. Args: all_docroots: Set of all docroot paths Returns: DocrootTree structure to pass to process_ordered_mounts() �path�strr � str | Nonec � �� | � d� � }|dk r+| d|� }|�v r|S |� d� � }|dk �+dS )z;Get the closest parent of path that exists in all_docroots.�/r N)�rfind)r �pos�parentr s �r �get_immediate_parentz0build_docroot_tree.<locals>.get_immediate_parent3 s[ �� ��j�j��o�o���A�g�g��$�3�$�Z�F�� �%�%� � ��,�,�s�#�#�C� �A�g�g� �tr c � � i | ]}|g ��S r r )�.0�ps r � <dictcomp>z&build_docroot_tree.<locals>.<dictcomp>= s � �2O�2O�2O�Q�1�b�2O�2O�2Or Nc �N � i | ]"\ }}|t t |� � � � ��#S r )�tuple�sorted)r# �k�vs r r% z&build_docroot_tree.<locals>.<dictcomp>D s, � �G�G�G���1��5�����#�#�G�G�Gr )r r r )r r r r )�append�itemsr � frozenset)r r! �children_listsr r r r s ` r �build_docroot_treer/ % s� �� � � � � � � � 3P�2O�,�2O�2O�2O�N� �N�4�� � ,� ,��%�%�d�+�+���v� �%�%�d�+�+�+�+� H�G��0D�0D�0F�0F�G�G�G�H� �T�N�E� ���I�l�D[�D[� \� \� \�\r �active_docrootr �tree�uid�int�gid�list[MountEntry]c � � ����� � |j �|j � hz �d|� �d|� �df�g �d � ����� fd� � |j D ]} � |d � � � ��S ) a� Process docroots and return ordered mounts list. Mounts are generated to a fake home directory structure. The active docroot is mounted from its real path to the corresponding path inside the fake home. Other docroots are hidden with tmpfs mounts in the fake home. Rules: 1. Only one record is marked as "docroot" (the active_docroot) 2. Parents must be mounted before children 3. If parent is mounted first, it must be rw mount with remount to ro after all child records mounted 4. If path is inside another path that we marked as tmpfs, we must add mkdir attribute Args: active_docroot: The docroot that should be marked as "docroot" in the output tree: Pre-computed DocrootTree from build_docroot_tree() uid: User ID for tmpfs mounts gid: Group ID for tmpfs mounts Returns: List of MountEntry in the correct order zuid=zgid=z mode=0750r r � inside_tmpfs�boolc �Z �� | � v }� | }t |� � }|r|r|D ]} � |d�� � �dS | �k r0� � t t j | | d� � � � ns|r<|rd� z nd� z }� � t t j d| |� � � � n5|rdnd}� � t t j | | |� � � � |p|}|D ]} � ||� � �|r4|r4� � t t j | | d�� � � � dS dS dS ) z,Process a path and its children recursively.T�r7 N)�mkdir)r; �ro�tmpfs)r< �remount)�options)r8 r+ r r �BIND)r r7 �is_tmpfs� path_children� has_children�child�opts�child_inside_tmpfsr0 r �mounts� tmpfs_attrs� tmpfs_paths�visits ������r rJ z%process_ordered_mounts.<locals>.visiti s� �� ��;�&�� ��� ��M�*�*� � � � � �&� 0� 0����e�$�/�/�/�/�/� �F� �>� !� !� �M�M�*�Y�^�T�4��L�L� M� M� M� M� � H�/;�^�:� �+�+� �S^�A^�D� �M�M�*�Y�^�W�d�D�I�I� J� J� J� J�!-�B�:�:�?�D� �M�M�*�Y�^�T�4��F�F� G� G� G� *� 5�X��"� -� -�E� �E�%�+� ,� ,� ,� ,� � ]�H� ]� �M�M�*�Y�^�T�4�IZ�[�[�[� \� \� \� \� \� ]� ]� ]� ]r Fr: )r r r7 r8 )r r r ) r0 r1 r2 r4 �rootr rG rH rI rJ s ` @@@@@r �process_ordered_mountsrL J s� ������� �2 �}�H��#�~�&6�6�K� �#�<�<� �� � �{�;�K� !�F� ]� ]� ]� ]� ]� ]� ]� ]� ]� ]� ]�D � � (� (�� ��d��'�'�'�'�'� �Mr N)r r r r ) r0 r r1 r r2 r3 r4 r3 r r5 ) r � __future__r � dataclassesr � mount_configr � mount_typesr r r/ rL r r r �<module>rQ s� �� � � #� "� "� "� "� "� !� !� !� !� !� !� $� $� $� $� $� $� "� "� "� "� "� "� ��$����!� !� !� !� !� !� !� ��!�"]� "]� "]� "]�JD� D� D� D� D� Dr