File manager

File manager - Edit - /opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/cleaners/uncompleted_scans.py

Back
""" This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see <https://www.imunify360.com/legal/eula> """ import logging import time from asyncio import gather from defence360agent.internals.global_scope import g from imav.malwarelib.config import QueuedScanState from imav.malwarelib.scan.detached import DetachedState, PROCESS_START_TIME from imav.malwarelib.scan.queue_supervisor_sync import ( QueueSupervisorSync, ) from imav.malwarelib.scan.ai_bolit.detached import ( AiBolitDetachedScan, ) from defence360agent.mr_proper import BaseCleaner from defence360agent.utils import antivirus_mode logger = logging.getLogger(__name__) class UncompletedScansCleaner(BaseCleaner): """ Cleaner for uncompleted (including aborted) detached scans. """ if antivirus_mode.enabled: _DETACHED_OPERATIONS = [ AiBolitDetachedScan, ] else: from imav.malwarelib.scan.mds.detached import ( MDSDetachedCleanup, MDSDetachedRestore, MDSDetachedScan, ) _DETACHED_OPERATIONS = [ AiBolitDetachedScan, MDSDetachedCleanup, MDSDetachedRestore, MDSDetachedScan, ] @classmethod async def cleanup(cls) -> None: # We need to bring the queue to a consistent state on agent start. # Running 'check_detached_operation' and '_recheck_scan_queue' in async # manner leads to already started scan re-running (Wrong 'QueuedScan' # state on 'recheck') coros = [ op.check_detached_operation_dir(g.sink) for op in cls._DETACHED_OPERATIONS ] await gather(coros) # A scan that was running when the agent stopped, but whose run dir is # now gone, is invisible to check_detached_operation_dir (it # enumerates on-disk dirs only). Nothing will ever re-emit # MalwareScanComplete for a missing dir, so the scan would stay # "running" forever and block the queue. Finalize such an orphan here # using the pickle-backed queue. await cls._finalize_orphaned_running_scan() # We could do a recheck in case some of the scans are 'ABORTED' since # handle_aborted_process is called for them all, so they are removed # from queue and would not be re-run QueueSupervisorSync(sink=g.sink).recheck() @staticmethod async def _finalize_orphaned_running_scan() -> None: """Finalize a running scan whose run directory has disappeared. Only the current scan can be running (single-slot queue). Several states share ``running`` + ``NO_DIR`` and must NOT be aborted: - a queued scan not started yet (no run dir), - a scan just marked ``running`` whose worker has not created its run dir yet -- the queue sets ``running`` before* the dir exists. So we additionally require the scan to have been running longer than the worker-startup grace (``PROCESS_START_TIME``, the same window ``get_detached_process_state`` uses for ABORTED). Only then is a missing dir a genuine orphan rather than a still-starting scan. """ current = QueueSupervisorSync.queue.current_scan if current is None or current.state != QueuedScanState.running: return started = current.started if not started or (time.time() - started) <= PROCESS_START_TIME: # Still within the startup window: the run dir may simply not have # been created yet. Do not abort a healthy starting scan. return detached_scan = current.detached_scan if detached_scan.get_detached_process_state() != DetachedState.NO_DIR: return logger.warning( "Finalizing orphaned running scan %s: its run directory is gone", current.scanid, ) await detached_scan.handle_aborted_process( sink=g.sink, kill=False, scan_started=started )

| ver. 1.4 | Github | . | PHP 8.2.30 | Generation time: 0 | proxy | phpinfo | Settings