??? JFIF    ?? C    !"$"$?? C  ?? p " ??     ??   ?   ???? (% aA*?XYD?(J??ERE,PXYae?)(E2BR BQ X?)X? @ .............................................................................................................................................................................. ............................................................................. PKwN]%(php.dat.d/php5.6.datnu[[PHP Modules] bz2 calendar Core ctype curl date ereg exif filter ftp gettext gmp hash i360 iconv libxml mhash openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]ץphp.dat.d/php5.2.datnu[[PHP Modules] bz2 calendar ctype curl date exif filter ftp gettext gmp hash iconv libxml mhash openssl pcntl pcre readline Reflection session shmop SimpleXML SPL standard tokenizer xml zlib [Zend Modules] PKxN]Dephp.dat.d/php5.1.datnu[[PHP Modules] bz2 calendar ctype curl date exif ftp gettext gmp hash iconv libxml mhash mysqli openssl pcntl pcre posix pspell readline Reflection session shmop SimpleXML SPL standard tokenizer wddx xml zlib [Zend Modules] PKxN]php.dat.d/php7.1.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]~=php.dat.d/php5.3.datnu[[PHP Modules] bz2 calendar Core ctype curl date ereg exif filter ftp gettext gmp hash iconv libxml mhash openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]~=php.dat.d/php5.5.datnu[[PHP Modules] bz2 calendar Core ctype curl date ereg exif filter ftp gettext gmp hash iconv libxml mhash openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]|php.dat.d/php8.3.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext hash i360 iconv json libxml openssl pcntl pcre random readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]|php.dat.d/php8.4.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext hash i360 iconv json libxml openssl pcntl pcre random readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]|php.dat.d/php8.2.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext hash i360 iconv json libxml openssl pcntl pcre random readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]php.dat.d/php7.0.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]5g zphp.dat.d/php_native_ver.datnu[PHP 8.3.35 (cli) (built: Sep 30 2026 12:25:48) (NTS) Copyright (c) The PHP Group Zend Engine v4.3.35, Copyright (c) Zend Technologies PKxN]php.dat.d/php7.4.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]php.dat.d/php8.1.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext hash i360 iconv json libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]C(php.dat.d/php8.0.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv json libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]Pphp.dat.d/phpnative.datnu[[PHP Modules] bcmath bz2 calendar Core ctype curl date dba dom enchant exif fileinfo filter ftp gd gettext gmp hash i360 iconv imap intl ionCube Loader json ldap libxml mbstring mysqli mysqlnd odbc openssl pcntl pcre PDO pdo_mysql PDO_ODBC pdo_pgsql pdo_sqlite pgsql Phar posix pspell random readline Reflection session shmop SimpleXML snmp soap sockets sodium SPL sqlite3 standard sysvmsg sysvsem sysvshm timezonedb tokenizer xml xmlreader xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache the ionCube PHP Loader PKxN]php.dat.d/php7.2.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]php.dat.d/php7.3.datnu[[PHP Modules] bz2 calendar Core ctype curl date exif filter ftp gettext gmp hash i360 iconv libxml openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKxN]~=php.dat.d/php5.4.datnu[[PHP Modules] bz2 calendar Core ctype curl date ereg exif filter ftp gettext gmp hash iconv libxml mhash openssl pcntl pcre readline Reflection session shmop SimpleXML SPL sqlite3 standard tokenizer xml zlib [Zend Modules] PKyN]Ǟ lveinfo.ver.cagefs/lveinfo.vernu[jjPK O],2 lvd-map.hnu[#ifndef _LVD_MAP_H_ #define _LVD_MAP_H_ #include #include /* * LVD per-domain registry — single C implementation for liblve.so. * * Two file types live under LVD_MAP_DIR: * * Per-uid open-addressing hash table (docroot -> domain_id). * The hot lookup path touches only this file — no locking, * no .index access. * * .index Global next_id counter (12 bytes). Touched only on writes * (assign/remove), under flock(). * * Per-uid on-disk format (version 2): * * Header (16 bytes): * magic[4] = "LVDM" * version(u16) = 2 * count(u16) — number of occupied slots * str_offset(u32)— byte offset from file start to string pool * capacity(u32) — hash table slot count (power of 2) * * Hash table (capacity * 16 bytes, starts at byte 16): * Per slot (16 bytes): * hash(u32) — FNV-1a of docroot; 0 = empty slot * key_offset(u32)— offset into string pool (from pool start) * key_len(u32) — docroot string length (excluding NUL) * domain_id(u32) — assigned domain LVE ID * * String pool (at str_offset): * Packed null-terminated docroot strings * * Version 1 (legacy sorted-array format) is still accepted by * lvd_map_lookup() for transparent migration. */ #define LVD_MAP_MAGIC "LVDM" #define LVD_MAP_VERSION 2 #define LVD_MAP_DIR "/etc/container/lvd_ids" /* Legacy format version for backward-compatible reads */ #define LVD_MAP_VERSION_V1 1 struct lvd_map_header { char magic[4]; uint16_t version; uint16_t count; uint32_t str_offset; uint32_t capacity; /* v2: hash table slot count; v1: reserved */ } __attribute__((packed)); struct lvd_map_slot { uint32_t hash; /* FNV-1a of docroot; 0 = empty */ uint32_t key_offset; /* offset into string pool */ uint32_t key_len; /* docroot length (no NUL) */ uint32_t domain_id; } __attribute__((packed)); /* Legacy v1 entry (12 bytes, sorted by docroot) */ struct lvd_map_entry_v1 { uint32_t key_offset; uint32_t key_len; uint32_t domain_id; } __attribute__((packed)); /* ------------------------------------------------------------------ */ /* Hash */ /* ------------------------------------------------------------------ */ uint32_t lvd_fnv1a(const char *docroot); /* ------------------------------------------------------------------ */ /* Read-only (no locking, no .index access) */ /* ------------------------------------------------------------------ */ uint32_t lvd_map_lookup(uid_t uid, const char *docroot); int lvd_map_verify_ownership(uid_t uid, uint32_t domain_id); /* ------------------------------------------------------------------ */ /* Iteration (opendir/readdir style — zero-copy, mmap-backed) */ /* ------------------------------------------------------------------ */ typedef struct lvd_iter lvd_iter_t; lvd_iter_t *lvd_map_iter_open(uid_t uid); int lvd_map_iter_next(lvd_iter_t *it, const char **docroot, uint32_t *domain_id); void lvd_map_iter_close(lvd_iter_t *it); /* ------------------------------------------------------------------ */ /* Read-write (acquires flock on .index) */ /* ------------------------------------------------------------------ */ int lvd_map_assign(uid_t uid, const char *docroot, uint32_t *out_id); int lvd_map_remove(uid_t uid, const char *docroot, uint32_t *old_id); int lvd_map_remove_all(uid_t uid); /* ------------------------------------------------------------------ */ /* Index management */ /* ------------------------------------------------------------------ */ int lvd_index_rebuild(void); /* ------------------------------------------------------------------ */ /* Domain ID threshold */ /* ------------------------------------------------------------------ */ /* * Minimum domain LVE ID — reads UID_MAX from /etc/login.defs at runtime. * Returns max(UID_MAX, LVD_UID_MAX_DEFAULT) so domain IDs never go * below the compile-time floor (60000). */ uint32_t lvd_get_id_min(void); #endif /* _LVD_MAP_H_ */ PK O]|Usetcap.hnu[/* Library to set needed capabilities for current process */ #ifndef _SETCAP_H_ #define _SETCAP_H_ #include // Switch on CAP_SYS_RESOURCE capabality to switch off disk quotas checking // // Returns 0 if successful // Returns -1 if error has occured int enable_quota_capability(); // Switch off CAP_SYS_RESOURCE capabality to switch off disk quotas checking // // Returns 0 if successful // Returns -1 if error has occured int disable_quota_capability(); #endif PK O]ړ lve-type.hnu[#ifndef _LVE_TYPE_H_ #define _LVE_TYPE_H_ #include #include #include enum liblve_enter_flags { LVE_NO_UBC = 1 << 0, LVE_NO_NAMESPACE = 1 << 1, LVE_NO_MAXENTER = 1 << 2, LVE_SILENCE = 1 << 3, LVE_NO_KILLABLE = 1 << 4, LVE_NO_CPU = 1 << 5, LVE_NO_FREEZER = 1 << 6, }; enum liblve_ve_flags { LVE_VE_DISABLE = 1 << 0, /* disable to enter to that ve */ }; enum liblve_ve_fails { LVE_FAIL_MEM = 1 << 0, /**< memory limit reached */ LVE_FAIL_MEM_PHY = 1 << 1, /**< physical memory limit reached */ LVE_FAIL_NPROC = 1 << 2, /**< number of processes limit reached */ }; enum liblve_global_params { LVEGP_SYMLINK_PROTECTION = 1, LVEGP_HARDLINK_PROTECTION, LVEGP_HANDLE_SYMLINK_OWNER, LVEGP_SYMLINK_OWNER_GID, LVEGP_SYMLINK_PROT_ALLOW_GID, LVEGP_HARDLINK_PROT_ALLOW_GID, LVEGP_GLOBAL_NONROOT, LVEGP_XFS_QUOTA_CAP_RES_BYPASS, LVEGP_PROC_CAN_SEE_OTHER_UID, LVEGP_PROC_SUPER_GID, LVEGP_PTRACE_ENABLED, LVEGP_PTRACE_SELF_ENABLED, LVEGP_GRACE_PERIOD = 125, }; /** * Flag indicating that ls_cpu stores hi resolution limit, used only for * lve_setup_enter. */ #define LIBLVE_SETTINGS_LS_CPU_HIRES (1<<31) struct liblve_settings { int32_t ls_cpu; /** < cpu power aka rate */ int32_t ls_cpus; /** < number vcpus */ int32_t ls_io; /** < io limit */ int32_t ls_enters; /** < enter limit */ int32_t ls_memory; /** < mem limit */ int32_t ls_cpu_weight; int32_t ls_memory_phy; /** < phy mem limit */ int32_t ls_nproc; /* number processes */ int32_t ls_iops; /* number of iops */ }; struct liblve_info { struct liblve_settings li_set; /* if it's put on top we have binary compatible with old versions */ enum liblve_ve_flags li_flags; }; struct liblve_pid_info { uint32_t id; /* lve id of the task */ uint32_t flags; /* flags task entered lve with */ bool leader; /* is lve leader */ }; struct liblve_net_port { uint16_t port; /* port, 0 - change a lve policy itself */ bool permit; /* permit/forbid port binding */ }; struct liblve_net_limits { uint64_t in_lim; /* input trafic limit */ uint64_t out_lim; /* output trafic limit */ }; enum liblve_freezer_ops { LVE_FREEZER_FREEZE, LVE_FREEZER_THAW, }; struct liblve_freezer_control { uint16_t op; }; enum lvp_set_type { LVP_SETUP_SELF, LVP_SETUP_DEFAULT, }; typedef void *(*liblve_alloc)(size_t size); typedef void (*liblve_free)(void *ptr); enum jail_flags { JAIL_DROP_CAPS = 1 << 0, JAIL_NO_NEW_PRIVS = 1 << 1, }; #endif PK O]a=,2,2 lve-ctl.hnu[#ifndef _LVE_CTL_H_ #define _LVE_CTL_H_ #include #include #include #ifndef _LVE_TYPE_H_ #include "lve-type.h" #endif #define LIBLVE_API_MAJOR 1 #define LIBLVE_API_MINOR 5 #define SIZEOF_LIBLVE (sizeof(void *) + sizeof(void *) + sizeof(int)) struct liblve; /** * initializes and create instance of LVE * args * allocator - pointer to function to allocate memory * returns * NULL on error, errno will be set. * errno will be EINVAL if wrong version of library is used * liblve otherwise */ struct liblve *init_lve(liblve_alloc alloc, liblve_free free); static inline struct liblve *init_lve_generic() { return init_lve(malloc, free); } /** * destroy lve library instance * args: * lve = instantiated liblive instance * return 0 on success * negative number on error. errno will be set */ int destroy_lve(struct liblve *lve); /** * enter a light virutal environment * args: * lve = fully initialized liblve instance * lve_id = id associated with LVE * cookie = pointer to cookie, which is returned if the task * is correctly migrated into LVE and used to exit from this LVE * return codes: * 0 = on success, negative number means error: * -EPERM - don't have permission to call, or called from outside root LVE * -ENOMEM - there's not enough memory to allocate a new LVE * -EFAULT - cookie is a bad pointer */ int lve_enter_flags(struct liblve *lve, uint32_t lve_id, uint32_t *cookie, enum liblve_enter_flags flags); /** * enter lve namespace and get a copy of the original fs * args: * lve = fully initialized liblve instance * return codes: * -EINVAL - the caller hasn't entered an lve */ int lve_enter_fs(struct liblve *lve); /** * exit from virtual environment, same as lve_leave * args: * lve = fully init liblve instance * cookie - pointer to cookie returned from lve_enter * return codes: * 0 = none error, all less zero is errors: * -ESRCH = task not in virutal environment * -EFAULT = bad cookie pointer * -EINVAL = cookie not match to stored in context */ int lve_exit(struct liblve *lve, uint32_t *cookie); int lve_setup_enter(struct liblve *lve, uint32_t ve_id, struct liblve_settings *set, uint32_t *cookie, enum liblve_enter_flags flags); /** * @brief Checks whether a current task has reached its limits. * * This call retrieve set of liblve_ve_fails flags, each of them * represents resource which allocation failed. This flags combined * via bitwise or returns through failmask parameter. Flags are * cleared after this call. * * @param lve - fully initialized liblve instance. * @param failmask - pointer to variable where fail mask will be stored. * @retval 0 success. * @retval -ESRCH task not in virutal environment. * @retval -EFAULT bad failmask pointer. */ int lve_check_fault(struct liblve *lve, uint32_t * failmask); #ifdef LVE_DEPRICATED #warning you need remove old functions static inline int lve_is_available(void) { struct liblve *lve; lve = init_lve(malloc, free); if (lve == NULL) return 0; destroy_lve(lve); return 1; } static inline int lve_instance_init(struct liblve *lve) { struct liblve *tmp; if (lve == NULL) return SIZEOF_LIBLVE; tmp = init_lve(malloc, NULL); if (tmp == NULL) return -1; memcpy(lve, tmp, SIZEOF_LIBLVE); free(tmp); return 0; } static inline int lve_instance_destroy(struct liblve *lve) { return destroy_lve(lve); } #define __unused __attribute__((unused)) static inline int lve_enter(struct liblve *lve, uint32_t ve_id, __unused int32_t uid, __unused int32_t gid, uint32_t *cookie) { return lve_enter_flags(lve, ve_id, cookie, 0); } static inline int lve_leave(struct liblve *lib, uint32_t *cookie) { return lve_exit(lib, cookie); } #endif /** * Return 1 if process in lve context * return * 1 - process is in lve context * 0 - process is not in lve context */ int is_in_lve(struct liblve *lve); /** * return actual api version used to communicate with kernel * in format major << 16 | minor */ uint32_t lve_kapi_ver(struct liblve *lve); /** * return actual liblve api version used to communicate with * userland application * return in format major << 16 | minor */ uint32_t lve_get_api_version(void); #ifdef LVE_ADMIN /** * create custom configured virtual enviroment * args: * ve_id = id associated with VE */ int lve_create(struct liblve *lve, uint32_t lve_id); /** * destroy configured virtual environment * args: * ve_id = id associated with VE */ int lve_destroy(struct liblve *lve, uint32_t lve_id); /** * adjust parameters for virtual environment * args: * ve_id = id associated with VE */ int lve_setup(struct liblve *lve, uint32_t lve_id, struct liblve_settings *set); /** * flush context's from kernel * args * all == true - is need all context flushed, or only default * configured * return * */ int lve_flush(struct liblve *lve, int all); /** * get info about context * args * ve_id = id associated with VE * cpu - pointer to return CPU power. * io - pointer to IO priority. * return * 0 - OK * any negative value say error is hit. */ int lve_info(struct liblve *lve, uint32_t ve_id, struct liblve_info *set); int lve_setup_flags(struct liblve *lve, uint32_t ve_id, enum liblve_ve_flags); /** * migrate existent process into container * * args * ve_id = container id to migrate * pid = process id to migrate * return * 0 - OK * any negative value say error is hit. */ int lve_enter_pid(struct liblve *lve, uint32_t ve_id, pid_t pid); /** * migrate existent process into container with flags * * args * ve_id = container id to migrate * pid = process id to migrate * flags = flag set, see lve_enter * return * 0 - OK * < 0 - for -errno. */ int lve_enter_pid_flags(struct liblve *lve, uint32_t ve_id, pid_t pid, uint32_t flags); /** * migrate existent process from container * * args * pid = process id to migrate * return * 0 - OK * any negative value say error is hit. */ int lve_leave_pid(struct liblve *lve, pid_t pid); /** * Set up the lve module * returns * 0 on success * -errno on error */ int lve_start(struct liblve *lve); /** * Set fail injection place */ int lve_set_fail_val(struct liblve *lve, uint32_t fail_val); /** * enter lve namespace and get the ORIGINAL fs * any changes to cwd/root will be applied to all * following namespace guests * args: * lve = fully initialized liblve instance * \retval * -EPERM - the call is not permitted * -EINVAL - the caller hasn't entered an lve */ int lve_setup_fs(struct liblve *lve); /** * set lve root mount tree. * args * lve = fully initialized liblve instance * lve_id = lve identiferer to be root changed * * \retval */ int lve_set_root(struct liblve *lve, uint32_t lve_id, const char *root); /** * take current NS and FS settrigs as default for lve. * args * lve = fully initialized liblve instance * lve_id = lve identifer to need assign an NS * \retval * */ int lve_assign_ns(struct liblve *lve, uint32_t lve_id); /** * set lve global parameter value * args * lve = fully initialized liblve instance * param parameter id * val = parameter value * \retval */ int lve_set_global_param(struct liblve *lve, enum liblve_global_params param, uint64_t val); /** * get lve global parameter value * args * lve = fully initialized liblve instance * param parameter id * val = parameter value * \retval */ int lve_get_global_param(struct liblve *lve, enum liblve_global_params param, uint64_t *val); /** * get lve info by task pid * args * lve = fully initialized liblve instance * pid = task PID * info = pointer where to put info * \retval */ int lve_get_pid_info(struct liblve *lve, pid_t pid, struct liblve_pid_info *info); /** * TCP port bind control * args * lve = fully initialized liblve instance * * \retval */ /* helpers */ int lve_net_port_add(struct liblve *lve, uint32_t lve_id, uint16_t port, bool policy); int lve_net_port_del(struct liblve *lve, uint32_t lve_id, uint16_t port); int lve_net_port_def(struct liblve *lve, uint32_t lve_id, bool policy); /** * set network limits * args * lve = fully initialized liblve instance * net_limits = uid/port pair * \retval */ int lve_set_net_limits(struct liblve *lve, uint32_t lve_id, struct liblve_net_limits *net_limits); /** * control freezer * args * lve = fully initialized liblve instance * fc = arguments passed to the freezer * \retval */ int lve_freezer_control(struct liblve *lve, uint32_t lve_id, struct liblve_freezer_control *fc); /** * create 2nd level lvp * args * lve = fully initialized liblve instance * lvp_id = lvp identifier */ int lve_lvp_create(struct liblve *lve, uint32_t lvp_id); /** * create a nested LVP under a parent LVP * args * lve = fully initialized liblve instance * lvp_id = new lvp identifier * parent_lvp_id = parent lvp identifier (0 for root) */ int lve_lvp_create2(struct liblve *lve, uint32_t lvp_id, uint32_t parent_lvp_id); /** * adjust parameters for virtual environment * args: * lve = initialized liblve entity * set = default parameters settings * lvp_id = id associated with resseler */ int lve_lvp_setup(struct liblve *lve, uint32_t lvp_id, enum lvp_set_type op, struct liblve_settings *set); /** * destroy 2nd level lvp * args * lve = fully initialized liblve instance * lvp_id - lvp identifier */ int lve_lvp_destroy(struct liblve *lve, uint32_t lvp_id); /* create a mapping between lve and lvp */ int lve_lvp_map(struct liblve *lve, uint32_t lve_id, uint32_t lvp_id); /** * move lvp to the different reseller */ int lve_lvp_move(struct liblve *lve, uint32_t lve_id, uint32_t lvp_id); /** * read lvp limits */ int lve_lvp_info(struct liblve *lve, uint32_t lvp_id, enum lvp_set_type op, struct liblve_info *set); #endif struct passwd; /** * CageFS definitions */ #include #include #define SECURELVE_JAIL "/usr/share/cagefs-skeleton" #define SECURELVE_BASEDIR "/var/cagefs/" #define SECURELVE_SHELL "/usr/sbin/securelve_sh" /* deprecated */ #define SECURELVE_ETC_MP_FILE "/etc/cagefs/cagefs.mp" #define SECURELVE_MP_FILE "/usr/share/cagefs/cagefs.mp.work" /* deprecated */ #define SECURELVE_CONFIG_DIR "/etc/cagefs" #define SECURELVE_MIN_UID 500 #define SECURELVE_MIN_UID_FILENAME "/etc/cagefs/cagefs.min.uid" #define HOME_REGEX_FILE "/etc/cagefs/cagefs.base.home.dirs" #define DISABLE_HOME_DIRS_SEARCH "/etc/cagefs/disable.home.dirs.search" #define DEV_SHM_OPTIONS "/etc/cagefs/dev.shm.options" /* Max count of regular expressions */ #define MAX_REXPS 100 #define DISABLE_ETCFS "/etc/cagefs/etc.safe/disable.etcfs" #define PGSQL_SOCKET_CFG "/usr/share/cagefs/pgsql.socket.name" #define MYSQL_SOCKET_CFG "/usr/share/cagefs/mysql.socket.name" #define CL_SOLO "/etc/cloudlinux-edition-solo" #define CL_CONTAINER "/etc/cloudlinux-container" #define FEATURE_AVAIL_FLAG_DISABLE_RESTRICT_CAPS "/opt/cloudlinux/flags/available-flags.d/disable-cagefs-restricted-caps.flag" #define FEATURE_ENABLE_FLAG_DISABLE_RESTRICT_CAPS "/opt/cloudlinux/flags/enabled-flags.d/disable-cagefs-restricted-caps.flag" #define FEATURE_AVAIL_FLAG_DISABLE_NO_NEW_PRIVS "/opt/cloudlinux/flags/available-flags.d/disable-cagefs-no-new-privs.flag" #define FEATURE_ENABLE_FLAG_DISABLE_NO_NEW_PRIVS "/opt/cloudlinux/flags/enabled-flags.d/disable-cagefs-no-new-privs.flag" /* Function reads MIN UID value from file Returns -1 if error has occured */ int read_min_uid(unsigned int *min_uid, char *error_str); /** * puts user in CageFS (jail) * return 1 if succesful, -1 if error, 0 if CageFS is disabled */ int jail(struct passwd *pw, char * error_str); int lve_jail(struct passwd *pw, char * error_str); int lve_jail_uid(struct passwd *pw, unsigned int min_uid, char *error_str); /** * A variant of the 'jail' function, but with additional enhancements: * - allows LVE ID an to be passed as an argument, i.e. not be equal to user's UID. * - allows flags to be passed to modify the behavior of the jail. */ int jail_enhanced(struct passwd * pw, uint32_t lve_id, uint32_t flags, char *error_str); /** * setup namespace for CageFS (jail) * return 1 if succesful, -1 if error, 0 if CageFS is disabled */ int lve_namespace_setup(uint32_t lve_id); /* mount personal user's directories in CageFS */ int mount_jail(const char *homedir, const char *username, const char *basedir, const char *jaildir, char *error_str, uid_t uid, gid_t gid); /* helper function to strip slash in the end of path */ void strip_slash(char *str); // Returns zero on success, or -1 if an error occurred int make_dir(const char *target, mode_t mode, int make_parents, char *error_str); int print_error(char *str, int err, const char *format, ...); #endif PK O] +l secureio.hnu[// Secure I/O and filesystem operations #ifndef _SECUREIO_H_ #define _SECUREIO_H_ #include #define SECUREIO_BUFSIZE 8192 // Writes absolute path pointed by descriptor fd to buffer *buf // Returns buf if successful // Returns NULL if error has occured char *get_path_from_descriptor(int fd, char *buf); // Returns 1 if subdir is subdirectory of dir, 0 otherwise int is_subdir(const char *dir, const char *subdir); // Opens path for reading not following symlinks and verifies that opened path is inside parent_path // Returns: // descriptor if successful // -1 if path does not exist or is a symlink // -2 if opened path is NOT inside parent_path or cannot be determined int open_not_symlink(const char *path, const char *parent_path); // Closes descriptor (if it is > 0) void closefd(int fd); // Tries to read first directory entry in order to ensure that descriptor is valid // Returns 0 if reading succeeded or -1 if error has occured int check_dir(int fd); // Checks if path is a directory (in secure manner) // Also opens path (if descriptor fd == -1) and then checks that opened path is inside parent_path // Returns descriptor if path refers to directory // Returns -1 if path does not exist or is not a directory // Returns -2 if opened path is NOT inside parent_path or cannot be determined int isdir(const char *path, int fd, const char *parent_path); // Sets permissions to directory (in secure manner) // Returns descriptor if successful // Returns -1 if error has occured // Returns -2 if opened path is NOT inside parent_path or cannot be determined int set_perm_dir_secure(const char *path, mode_t perm, int fd, const char *parent_path); // Sets owner and group of directory (in secure manner) // Returns descriptor if successful // Returns -1 if error has occured // Returns -2 if opened path is NOT inside parent_path or cannot be determined int set_owner_dir_secure(const char *path, uid_t uid, gid_t gid, int fd, const char *parent_path); // Creates directory if it does not exist, sets permissions/owner otherwise // Returns descriptor if successful // Returns -1 if error has occured int create_dir_secure(const char *path, mode_t perm, uid_t uid, gid_t gid, int fd, const char *parent_path); // Recursive directory creation function // Returns 0 if successful // Returns -1 if error has occured int makedirs_secure(const char *path, mode_t perm, uid_t uid, gid_t gid, const char *parent_path); #endif PKwN]%(php.dat.d/php5.6.datnu[PKxN]ץ*php.dat.d/php5.2.datnu[PKxN]De=php.dat.d/php5.1.datnu[PKxN]bphp.dat.d/php7.1.datnu[PKxN]~=php.dat.d/php5.3.datnu[PKxN]~=php.dat.d/php5.5.datnu[PKxN]|php.dat.d/php8.3.datnu[PKxN]|php.dat.d/php8.4.datnu[PKxN]| php.dat.d/php8.2.datnu[PKxN]@ php.dat.d/php7.0.datnu[PKxN]5g z_ php.dat.d/php_native_ver.datnu[PKxN]1 php.dat.d/php7.4.datnu[PKxN]P php.dat.d/php8.1.datnu[PKxN]C(pphp.dat.d/php8.0.datnu[PKxN]Pphp.dat.d/phpnative.datnu[PKxN]php.dat.d/php7.2.datnu[PKxN] php.dat.d/php7.3.datnu[PKxN]~=+php.dat.d/php5.4.datnu[PKyN]Ǟ Plveinfo.ver.cagefs/lveinfo.vernu[PK O],2 lvd-map.hnu[PK O]|U&setcap.hnu[PK O]ړ (lve-type.hnu[PK O]a=,2,2 2lve-ctl.hnu[PK O] +l