????
Your IP : 3.143.218.84
"""Services manager plugin.
It enables/disables various service based on an imunify360 config change.
"""
import logging
import shutil
from pathlib import Path
from random import randint
from tempfile import NamedTemporaryFile
from defence360agent import utils
from defence360agent.subsys import svcctl
from defence360agent.subsys.persistent_state import load_state, save_state
from imav.plugins.service_manager import ServiceManager as BaseServiceManager
from im360.contracts import config
__all__ = ["ServiceManager"]
logger = logging.getLogger(__name__)
UAL_CRON_TEMPLATE_PATH = Path(
"/opt/imunify360/venv/share/imunify360/imunify360-ual.cron.template"
)
UAL_OLD_CRON_PATH = Path("/etc/cron.d/imunify360-ual.cron")
UAL_CRON_PATH = Path("/etc/cron.d/imunify360-ual")
class ServiceManager(BaseServiceManager):
"""Service manager plugin: stop/start services based on config changes."""
SCOPE = utils.Scope.IM360
AUDITD_SHOULD_BE_RUNNING = config.FromConfig("LOGGER", "syscall_monitor")
def __init__(self, *, unitctl=None):
super().__init__(unitctl=unitctl)
self._services.extend(
[
self._ensure_consistent_dos_protector_state,
self._ensure_consistent_ual_state,
self._ensure_consistend_auditd_state,
self._ensure_consistent_scanlogd_state,
]
)
self._units.update(
{
"dos_protector": unitctl
or svcctl.imunify360_dos_protector_service(),
"ual": unitctl or svcctl.imunify360_ual_service(),
"auditd": unitctl or svcctl.imunify360_auditd_service(),
"scanlogd": unitctl or svcctl.imunify360_scanlogd_service(),
}
)
self._configs = load_state("service_manager")
if not self._configs:
self._configs = {"dos_protector": {}}
async def _ensure_consistent_dos_protector_state(self):
unitctl = self._units["dos_protector"]
if not unitctl:
# unsupported platform
return
old_config = self._configs["dos_protector"]
new_config = config.EnhancedDOS.as_dict()
should_be_running = config.EnhancedDOS.ENABLED
await self.__ensure_service_status(
unitctl,
"DosProtector",
should_be_running,
reload=(old_config != new_config),
)
self._configs["dos_protector"] = new_config
save_state("service_manager", self._configs)
async def _ensure_consistent_ual_state(self):
should_be_running = config.UnifiedAccessLogger.ENABLED
unitctl = self._units["ual"]
if should_be_running:
UAL_CRON_PATH.unlink(missing_ok=True)
await self.__ensure_service_status(
unitctl, "UnifiedAccessLogger", should_be_running, reload=False
)
if not should_be_running:
self._create_ual_cronjob()
def _create_ual_cronjob(self):
if UAL_OLD_CRON_PATH.exists():
UAL_OLD_CRON_PATH.unlink()
cronjob_content = UAL_CRON_TEMPLATE_PATH.read_text().format(
random_minute=randint(0, 59), report_interval="5m"
)
if UAL_CRON_PATH.exists():
old_cronjob_content = UAL_CRON_PATH.read_text()
identical = True
for old_line, new_line in zip(
old_cronjob_content.splitlines(), cronjob_content.splitlines()
):
# {random_minute} * * * * root /usr/sbin/imunify36...
if "* * *" in old_line: # is cronjob line
# ignore minute part
old_line = old_line[old_line.find(" ") + 1 :]
new_line = new_line[new_line.find(" ") + 1 :]
if old_line != new_line:
identical = False
break
if identical:
return
with NamedTemporaryFile("w", delete=False) as f:
temp_cronjob_path = Path(f.name)
f.write(cronjob_content)
temp_cronjob_path.chmod(0o644)
shutil.move(temp_cronjob_path, UAL_CRON_PATH)
async def _ensure_consistent_scanlogd_state(self):
should_be_running = config.Scanlogd.ENABLE
unitctl = self._units["scanlogd"]
await self.__ensure_service_status(
unitctl, "Scanlogd", should_be_running, reload=False
)
async def _ensure_consistend_auditd_state(self):
unitctl = self._units["auditd"]
if not unitctl:
# unsupported platform
return
await self.__ensure_service_status(
unitctl, "AuditD", self.AUDITD_SHOULD_BE_RUNNING, reload=False
)