0 O 0:Qlz Jj"Tҁzţ y]a=JJj"T @S!Q#!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/check_security_advice_changes Copyright 2022 cPanel L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited package scripts::check_security_advice_changes; use strict; use Cpanel::Transaction::File::JSON (); use Cpanel::Hash (); use Cpanel::Locale (); use Cpanel::Usage (); use Cpanel::Alarm (); use Capture::Tiny (); my $WANT_TYPE = 'mod_advice'; my $CHANNEL = 'securityadvisor'; our $HISTORY_FILE = '/var/cpanel/security_advisor_history.json'; _run_from_command_line(@ARGV) if !caller(); sub _run_from_command_line { my (@args) = @_; if ( grep { index( $_, '-background' ) > -1 } @args ) { @args = grep { index( $_, '-background' ) == -1 } @args; # CPANEL-41626: we want to keep elements of @args which DON'T match '-background', so we should check for equality to -1, not non-equality. require Cpanel::Daemonizer::Tiny; require Cpanel::FileUtils::Open; require Cpanel::ConfigFiles; my $pid = Cpanel::Daemonizer::Tiny::run_as_daemon( sub { #### # The next two calls are unchecked because it cannot be captured when running as a daemon no warnings 'once'; Cpanel::FileUtils::Open::sysopen_with_real_perms( \*STDERR, $Cpanel::ConfigFiles::CPANEL_ROOT . '/logs/error_log', 'O_WRONLY|O_APPEND|O_CREAT', 0600 ); open( STDOUT, '>&', \*STDERR ) || warn "Failed to redirect STDOUT to STDERR"; return _exit( __PACKAGE__->script( \@args ) ); } ); return _exit(0); } return _exit( __PACKAGE__->script( \@args ) ); } sub _exit { my ($code) = @_; return exit($code); } sub script { my ( $class, $argv ) = @_; my %opts = ( notify => 0, quiet => 0, ); my $self = bless {}, $class; Cpanel::Usage::wrap_options( $argv, sub { my (@args) = @_; $self->usage(@args); }, { 'notify' => \$opts{'notify'}, 'quiet' => \$opts{'quiet'} }, ); $self->{'notify'} = $opts{'notify'}; $self->{'quiet'} = $opts{'quiet'}; local $Cpanel::Locale::Context::DEFAULT_OUTPUT_CONTEXT = 'html'; # Make sure Cpanel::Locale->get_handle() is invoked before being invoked # by the security advisor modules; otherwise Net::SMTP will throw warnings. $self->_locale(); # The yum calls can take a while if yum is in use so we now # wait up to 30m. Since v78+ does the security advisor # checks in the background this should be ok now. my $main_alarm = Cpanel::Alarm->new( 1800, sub { die "$0 timed out because it was running for longer than 30 minutes."; } ); #max 30m my $trans_obj = Cpanel::Transaction::File::JSON->new( 'path' => $HISTORY_FILE ); my $previous_run = $trans_obj->get_data(); my %prev_hashes = ( ref $previous_run eq 'HASH' and $previous_run->{'hashes'} ) ? %{ $previous_run->{'hashes'} } : (); my %prev_message_keys = ( ref $previous_run eq 'HASH' and $previous_run->{'message_keys'} ) ? %{ $previous_run->{'message_keys'} } : (); my ( %hashes, %message_keys ); require Cpanel::Security::Advisor; require Cpanel::Security::AdvisorFetch; my $msgs = Cpanel::Security::AdvisorFetch::fetch_security_advice(); my $highest_notice_type = 0; my %notices; foreach my $data ( @{$msgs} ) { my $block = ( $data->{'advice'}{'block_notify'} ) ? $data->{'advice'}{'block_notify'} : 0; if ( $data->{'type'} eq $WANT_TYPE && !$block ) { my $module = $data->{'module'}; my $text = $data->{'advice'}{'text'} . ( $data->{'advice'}{'suggestion'} ? " " . $d