D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
3
/
cwd
/
lib
/
fixperms
/
Filename :
fixperms_cwp.py
back
Copy
"""Fixperms class for CWP""" import os from stat import S_ISLNK, S_ISREG, S_ISDIR import cwp from fixperms_base import PermMap from fixperms_ids import IDCache from fixperms_cli import Args class CwpPermMap(PermMap): """Fixperms class for CWP""" def __init__(self, ids: IDCache, args: Args, user: str): super().__init__( ids=ids, args=args, user=user, all_docroots=list(cwp.get_docroots(user).values()), docroot_chmod=0o750, docroot_chown=(user, 'nobody'), ) # pylint: disable=duplicate-code # Order these rules more specific to less specific regex. uid, gid = self.uid, self.gid # sensitive passwords: ~/.pgpass, ~/.my.cnf self.add_rule(r"\/\.(?:pgpass|my\.cnf)$", (0o600, None), (uid, gid)) # ~/.imh directory and contents self.add_rule(r"\/\.imh(?:$|\/)", (0o644, 0o755), (0, 0)) # ~/.ssh directory and contents self.add_rule(r"\/\.ssh(?:$|\/)", (0o600, 0o700), (uid, gid)) # ~/.pki dir and subdirs self.add_rule(r"\/\.pki(?:$|\/)", (None, 0o740), (uid, gid)) # .cgi and .pl files self.add_rule(r"\/.*\.(?:pl|cgi)$", (0o755, None), (uid, gid)) # homedir folder itself self.add_rule("$", (None, 0o711), (uid, gid)) # restrict access to sensitive CMS config files self.add_rule( r"\/.+\/(?:(?:wp-config|conf|[cC]onfig|[cC]onfiguration|" r"LocalSettings|settings)(?:\.inc)?\.php|" r"local\.xml|mt-config\.cgi)$", (0o640, None), (uid, gid), ) # web log stats self.add_rule(r"\/cwp_stats\/.+\.html", (0o644, None), (0, 0)) # cwp user dashboard session dir self.add_rule(r"\/tmp\/session$", (None, 0o751), (uid, gid)) # cwp user dashboard session files self.add_rule(r"\/tmp\/session\/sess_.+", (0o600, None), (uid, gid)) # cwp user config dir self.add_rule(r"\/\.conf$", (None, 0o755), (uid, gid)) # cwp user config dir items self.add_rule(r"/\.conf/\..+\.sqlite$", (0o644, None), (0, 0)) self.add_rule( r"/.conf/(?:cache|reseller)(?:\/.+\.json)?$", (0o644, 0o755), (0, 0) ) # softaculous files self.add_rule(r"\/.softaculous(?:$|\/)", (0o600, 0o711), (uid, gid)) # contents of homedir which do not match a previous regex self.add_rule(r"\/", (0o644, 0o755), (uid, gid)) def fixperms(self) -> None: super().fixperms() if not self.args.skip_mail: self.mailperms() def iter_vmail(self): """Iterate all paths in the user's mail dirs""" for top_dir in cwp.vmail_paths(self.user, check_exists=True): yield from self.walk(str(top_dir)) def mailperms(self): """Fix permissions of a CWP user's mail dirs""" uid = self.uid gid = self.ids.getgrnam('mail').gr_gid vmail_uid = self.ids.getpwnam('vmail').pw_uid # fix the top-level vmail dir if needed try: stat = os.lstat('/var/vmail') except FileNotFoundError: self.log.warning("/var/vmail was missing; creating it.") os.mkdir('/var/vmail', mode=0o770) os.lchown('/var/vmail', vmail_uid, gid) else: self.lchown('/var/vmail', stat, vmail_uid, gid) self.lchmod('/var/vmail', stat, 0o775) # iterate each subdir owned by this user for stat, path in self.iter_vmail(): if S_ISLNK(stat.st_mode): self.log.warning("Skipping unexpected symlink at %s", path) continue if S_ISDIR(stat.st_mode): # directory mode = 0o700 elif S_ISREG(stat.st_mode): # regular file if os.path.basename(path).startswith('dovecot-uidvalidity.'): mode = 0o444 else: mode = 0o600 if self.uid != stat.st_uid and stat.st_nlink > 1: self.hard_links.add(path, stat, (uid, gid), mode) continue else: self.log.warning("Skipping unexpected path type at %s", path) continue self.lchown(path, stat, uid, gid) self.lchmod(path, stat, mode)