name : fix_reseller_acls #!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/fix_reseller_acls Copyright 2022 cPanel, L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited package scripts::fix_reseller_acls; use cPstrict; use parent qw( Cpanel::HelpfulScript ); use Try::Tiny; use Cpanel::Exception (); use Cpanel::LoadModule (); use Cpanel::ConfigFiles (); use Whostmgr::ACLS::Data (); =encoding utf8 =head1 NAME fix_reseller_acls =head1 DESCRIPTION Utility to update reseller privileges and ACL lists. =head1 SYNOPSIS fix_reseller_acls [OPERATION] [MODE] Operations: --add-default-privs Add the default set of privileges. --fix-disallow-shell Clean up the 'disallow-shell' privilege. Modes: --reseller [reseller] Update the specified reseller. --all-resellers Update all resellers on the system. --acl-list [acl-list] Update the specified ACL list. --all-acl-lists Update all ACL lists on the system. --help This documentation. =head1 Operations Specify at least one operation. =over =item B<--add-default-privs> Add the default set of privileges, introduced in v68 and later, to the set of resellers and ACLS lists specified. acct-summary basic-system-info basic-whm-functions cors-proxy-get connected-applications cpanel-integration cpanel-api create-user-session digest-auth generate-email-config list-pkgs manage-api-tokens manage-dns-records manage-oidc manage-styles mysql-info ns-config ssl-info track-email =item B<--fix-disallow-shell> Remove the 'disallow-shell' privilege from the set of resellers and specified ACL lists. If the C<disallow-shell> privilege is set, then the script will remove it. If the C<disallow-shell> privilege is not set, then the script adds the C<allow-shell> privilege. =back =head1 Modes Specify at least one mode. =over =item B<--all-resellers> Process all of the resellers on the system. This option overrides B<--reseller>. B<Note>: The script does not process resellers without an associated domain in this mode. =item B<--reseller [reseller-username]> Process the reseller specified. Specify this option multiple times to process mutiple resellers. =item B<--all-acl-lists> Process all ACL lists on the system. This option overrides B<--acl-list>. =item B<--acl-list [acl-list]> Process the ACL list specified. Specify this option multiple times to process mutiple ACL lists. =back =head1 EXAMPLES =over =item C<--add-default-privs --fix-disallow-shell --all-resellers> Update the privileges for all resellers on the system to include the default privilege and clean up the C<disallow-shell> privilege. =item C<--add-default-privs --reseller myreseller> Update the privileges for the I<myreseller> reseller to include the new default privileges. =item C<--add-default-privs --fix-disallow-shell --all-acl-lists> Update all of the ACL lists on the system to include the default privileges, and clean up the C<disallow-shell> privilege. =back =cut sub _OPTIONS { return qw( add-default-privs fix-disallow-shell reseller=s@ all-resellers acl-list=s@ all-acl-lists ); } __PACKAGE__->new(@ARGV)->script() unless caller(); sub script ($self) { $self->ensure_root(); my $opts = $self->_parse_and_validate_opts(); # This only happens if there are no resellers and/or acl-lists on the system. # In that case, there is nothing to do and we do not want to return uncleanly # if that happens. return unless $opts; $self->process_users( $opts->{resellers}, $opts->{operations} ) if $opts->{resellers} && scalar @{ $opts->{resellers} }; $self->process_acl_lists( $opts->{'acl-lists'}, $opts->{operations} ) if $opts->{'acl-lists'} && scalar @{ $opts->{'acl-lists'} }; return; } sub process_users ( $self, $resellers_to_process_ar, $operations_hr ) { ## no critic qw(Subroutines::ProhibitManyArgs) adding prohibit due to bug with signatures Cpanel::LoadModule::load_perl_module('Cpanel::Reseller'); Cpanel::LoadModule::load_perl_module('Whostmgr::Resellers'); # TODO: The current interfaces to the RESELLERS_FILE do not provide # any way to do a 'mass-edit'. Depending on how slow this process is, # we might need to implement one. my %current_reseller_acls = Cpanel::Reseller::getresellersaclhash(); foreach my $reseller ( @{$resellers_to_process_ar} ) { # We validated resellers beforehand, but just in case something # changed between that check, and the getresellersaclhash call, check again. next unless exists $current_reseller_acls{$reseller}; print "[*] Processing reseller: '$reseller'...\n"; my $to_process_hr = { name => $reseller, current_acls => $current_reseller_acls{$reseller}, }; $self->add_default_privs($to_process_hr) if $operations_hr->{'add-default-privs'}; $self->fix_disallow_shell($to_process_hr) if $operations_hr->{'fix-disallow-shell'}; # set_reseller_acls requires the ACLs to have a 'acl-' prefix Whostmgr::Resellers::set_reseller_acls( $reseller, { map { 'acl-' . $_ => 1 } keys %{ $current_reseller_acls{$reseller} } } ); print "[+] Processed reseller: '$reseller'\n"; } return; } sub process_acl_lists ( $self, $acl_lists_to_process_ar, $operations_hr ) { ## no critic qw(Subroutines::ProhibitManyArgs) adding prohibit due to bug with signatures Cpanel::LoadModule::load_perl_module('Whostmgr::ACLS'); # This is required when loading Whostmgr::ACLS -- see the module for more details Whostmgr::ACLS::init_acls(); foreach my $acl_list ( @{$acl_lists_to_process_ar} ) { my $list_file = "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$acl_list"; next unless -f $list_file; print "[*] Processing ACL list: '$acl_list'...\n"; if ( open( my $acl_fh, '<', $list_file ) ) { my $acls = { map { split /=/, $_, 2 } grep { !/^\s*$/ } map { s/\n//r } readline($acl_fh) }; close($acl_fh); my $to_process_hr = { name => $acl_list, current_acls => $acls, }; $self->add_default_privs($to_process_hr) if $operations_hr->{'add-default-privs'}; $self->fix_disallow_shell($to_process_hr) if $operations_hr->{'fix-disallow-shell'}; Whostmgr::ACLS::save_acl_list( 'acllist' => $acl_list, ( map { 'acl-' . $_ => 1 } grep { $acls->{$_} } keys %{$acls} ) ); print "[+] Processed ACL list: '$acl_list'\n"; } else { print "[!] Failed to process ACL list '$acl_list': $!\n"; } } return; } my $defaults_to_apply_hr; sub add_default_privs ( $self, $to_process_hr ) { $defaults_to_apply_hr //= { map { $_ => 1 } @{ Whostmgr::ACLS::Data::get_default_acls() } }; print "\t[*] Adding default privileges to '$to_process_hr->{'name'}'...\n"; %{ $to_process_hr->{'current_acls'} } = ( %{ $to_process_hr->{'current_acls'} }, %{$defaults_to_apply_hr} ); print "\t[+] Added default privileges to '$to_process_hr->{'name'}'.\n"; return; } sub fix_disallow_shell ( $self, $to_process_hr ) { print "\t[*] Fixing 'disallow-shell' privilege for '$to_process_hr->{'name'}'...\n"; my $had_disallow_shell = delete $to_process_hr->{'current_acls'}->{'disallow-shell'}; if ( !$had_disallow_shell ) { %{ $to_process_hr->{'current_acls'} } = ( %{ $to_process_hr->{'current_acls'} }, 'allow-shell' => 1, ); } print "\t[+] Fixed 'disallow-shell' privilege for '$to_process_hr->{'name'}'.\n"; return; } sub _parse_and_validate_opts ($self) { unless ( $self->getopt('add-default-privs') || $self->getopt('fix-disallow-shell') ) { print $self->help(); return; } my $resellers = $self->getopt('reseller'); my %uniq_resellers = map { $_ => 1 } @$resellers if $resellers; my $acl_lists = $self->getopt('acl-list'); my %uniq_acl_lists = map { $_ => 1 } @$acl_lists if $acl_lists; my $opts = { 'operations' => { 'add-default-privs' => $self->getopt('add-default-privs'), 'fix-disallow-shell' => $self->getopt('fix-disallow-shell'), }, 'all-resellers' => $self->getopt('all-resellers'), 'specified_resellers' => \%uniq_resellers, 'all-acl-lists' => $self->getopt('all-acl-lists'), 'specified_acl_lists' => \%uniq_acl_lists, }; $opts->{'resellers'} = $self->_validate_resellers($opts); $opts->{'acl-lists'} = $self->_validate_acl_lists($opts); return unless $opts->{'resellers'} // $opts->{'acl-lists'}; return $opts; } sub _validate_resellers ( $self, $opts ) { if ( $opts->{'all-resellers'} ) { Cpanel::LoadModule::load_perl_module("Whostmgr::Resellers::List"); Cpanel::LoadModule::load_perl_module('Cpanel::Config::HasCpUserFile'); return [ # Skip 'resellers without a domain' when processing all resellers on the system: # https://go.cpanel.net/how-to-create-a-whm-reseller-without-an-associated-domain # # These resellers are created "out of band" by editing the resellers file, # so altering them should be left up to the server administrators. grep { Cpanel::Config::HasCpUserFile::has_cpuser_file($_) } keys %{ Whostmgr::Resellers::List::list() } ]; } elsif ( my @specified_resellers = keys %{ $opts->{'specified_resellers'} } ) { Cpanel::LoadModule::load_perl_module("Whostmgr::Resellers::Check"); if ( my @invalid_resellers = grep { !Whostmgr::Resellers::Check::is_reseller($_) } @specified_resellers ) { die Cpanel::Exception->create_raw( "[!] Invalid resellers specified:\n" . join( "\n", map { " " x 8 . $_ } @invalid_resellers ) . "\n" )->to_string_no_id(); } return \@specified_resellers; } return; } sub _validate_acl_lists ( $self, $opts ) { if ( $opts->{'all-acl-lists'} ) { if ( opendir my $dh, $Cpanel::ConfigFiles::ACL_LISTS_DIR ) { return [ grep { $_ !~ m/^\.+$/ && -f "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$_" } readdir($dh) ]; } } elsif ( my @specified_acl_lists = keys %{ $opts->{'specified_acl_lists'} } ) { if ( my @invalid_acl_lists = grep { !-f "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$_" } @specified_acl_lists ) { die Cpanel::Exception->create_raw( "[!] Invalid acl-lists specified:\n" . join( "\n", map { " " x 8 . $_ } @invalid_acl_lists ) . "\n" )->to_string_no_id(); } return \@specified_acl_lists; } return; } 1;