OwlCyberSecurity - MANAGER

Edit File: fix_reseller_acls

#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/fix_reseller_acls               Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::fix_reseller_acls;

use cPstrict;

use parent qw( Cpanel::HelpfulScript );

use Try::Tiny;

use Cpanel::Exception    ();
use Cpanel::LoadModule   ();
use Cpanel::ConfigFiles  ();
use Whostmgr::ACLS::Data ();

=encoding utf8

=head1 NAME

fix_reseller_acls

=head1 DESCRIPTION

Utility to update reseller privileges and ACL lists.

=head1 SYNOPSIS

fix_reseller_acls [OPERATION] [MODE]

Operations:
    --add-default-privs            Add the default set of privileges.
    --fix-disallow-shell           Clean up the 'disallow-shell' privilege.

Modes:
   --reseller [reseller]           Update the specified reseller.
   --all-resellers                 Update all resellers on the system.

--acl-list [acl-list]           Update the specified ACL list.
   --all-acl-lists                 Update all ACL lists on the system.

--help                          This documentation.

=head1 Operations

Specify at least one operation.

=over

=item B<--add-default-privs>

Add the default set of privileges, introduced in v68 and later, to the set of resellers
and ACLS lists specified.

acct-summary
    basic-system-info
    basic-whm-functions
    cors-proxy-get
    connected-applications
    cpanel-integration
    cpanel-api
    create-user-session
    digest-auth
    generate-email-config
    list-pkgs
    manage-api-tokens
    manage-dns-records
    manage-oidc
    manage-styles
    mysql-info
    ns-config
    ssl-info
    track-email

=item B<--fix-disallow-shell>

Remove the 'disallow-shell' privilege from the set of resellers and specified ACL lists.

If the C<disallow-shell> privilege is set, then the script will remove it.
If the C<disallow-shell> privilege is not set, then the script adds the C<allow-shell> privilege.

=back

=head1 Modes

Specify at least one mode.

=over

=item B<--all-resellers>

Process all of the resellers on the system. This option overrides B<--reseller>.

B<Note>: The script does not process resellers without an associated domain in this mode.

=item B<--reseller [reseller-username]>

Process the reseller specified.

Specify this option multiple times to process mutiple resellers.

=item B<--all-acl-lists>

Process all ACL lists on the system. This option overrides B<--acl-list>.

=item B<--acl-list [acl-list]>

Process the ACL list specified.

Specify this option multiple times to process mutiple ACL lists.

=back

=head1 EXAMPLES

=over

=item C<--add-default-privs --fix-disallow-shell --all-resellers>

Update the privileges for all resellers on the system to include the default privilege and clean
up the C<disallow-shell> privilege.

=item C<--add-default-privs --reseller myreseller>

Update the privileges for the I<myreseller> reseller to include the new default privileges.

=item C<--add-default-privs --fix-disallow-shell --all-acl-lists>

Update all of the ACL lists on the system to include the default privileges, and clean up the
C<disallow-shell> privilege.

=back

=cut

sub _OPTIONS {
    return qw( add-default-privs fix-disallow-shell reseller=s@ all-resellers acl-list=s@ all-acl-lists );
}

__PACKAGE__->new(@ARGV)->script() unless caller();

sub script ($self) {

$self->ensure_root();

my $opts = $self->_parse_and_validate_opts();

# This only happens if there are no resellers and/or acl-lists on the system.
    # In that case, there is nothing to do and we do not want to return uncleanly
    # if that happens.
    return unless $opts;

$self->process_users( $opts->{resellers}, $opts->{operations} )       if $opts->{resellers}   && scalar @{ $opts->{resellers} };
    $self->process_acl_lists( $opts->{'acl-lists'}, $opts->{operations} ) if $opts->{'acl-lists'} && scalar @{ $opts->{'acl-lists'} };

return;
}

sub process_users ( $self, $resellers_to_process_ar, $operations_hr ) {    ## no critic qw(Subroutines::ProhibitManyArgs) adding prohibit due to bug with signatures
    Cpanel::LoadModule::load_perl_module('Cpanel::Reseller');
    Cpanel::LoadModule::load_perl_module('Whostmgr::Resellers');

# TODO: The current interfaces to the RESELLERS_FILE do not provide
    # any way to do a 'mass-edit'. Depending on how slow this process is,
    # we might need to implement one.
    my %current_reseller_acls = Cpanel::Reseller::getresellersaclhash();
    foreach my $reseller ( @{$resellers_to_process_ar} ) {

# We validated resellers beforehand, but just in case something
        # changed between that check, and the getresellersaclhash call, check again.
        next unless exists $current_reseller_acls{$reseller};
        print "[*] Processing reseller: '$reseller'...\n";

my $to_process_hr = {
            name         => $reseller,
            current_acls => $current_reseller_acls{$reseller},
        };

$self->add_default_privs($to_process_hr)  if $operations_hr->{'add-default-privs'};
        $self->fix_disallow_shell($to_process_hr) if $operations_hr->{'fix-disallow-shell'};

# set_reseller_acls requires the ACLs to have a 'acl-' prefix
        Whostmgr::Resellers::set_reseller_acls( $reseller, { map { 'acl-' . $_ => 1 } keys %{ $current_reseller_acls{$reseller} } } );
        print "[+] Processed reseller: '$reseller'\n";
    }

return;
}

sub process_acl_lists ( $self, $acl_lists_to_process_ar, $operations_hr ) {    ## no critic qw(Subroutines::ProhibitManyArgs) adding prohibit due to bug with signatures
    Cpanel::LoadModule::load_perl_module('Whostmgr::ACLS');

# This is required when loading Whostmgr::ACLS -- see the module for more details
    Whostmgr::ACLS::init_acls();

foreach my $acl_list ( @{$acl_lists_to_process_ar} ) {
        my $list_file = "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$acl_list";
        next unless -f $list_file;

print "[*] Processing ACL list: '$acl_list'...\n";
        if ( open( my $acl_fh, '<', $list_file ) ) {
            my $acls = { map { split /=/, $_, 2 } grep { !/^\s*$/ } map { s/\n//r } readline($acl_fh) };
            close($acl_fh);

my $to_process_hr = {
                name         => $acl_list,
                current_acls => $acls,
            };

$self->add_default_privs($to_process_hr)  if $operations_hr->{'add-default-privs'};
            $self->fix_disallow_shell($to_process_hr) if $operations_hr->{'fix-disallow-shell'};

Whostmgr::ACLS::save_acl_list(
                'acllist' => $acl_list,
                ( map { 'acl-' . $_ => 1 } grep { $acls->{$_} } keys %{$acls} )
            );

print "[+] Processed ACL list: '$acl_list'\n";
        }
        else {
            print "[!] Failed to process ACL list '$acl_list': $!\n";
        }
    }

return;
}

my $defaults_to_apply_hr;

sub add_default_privs ( $self, $to_process_hr ) {
    $defaults_to_apply_hr //= { map { $_ => 1 } @{ Whostmgr::ACLS::Data::get_default_acls() } };
    print "\t[*] Adding default privileges to '$to_process_hr->{'name'}'...\n";
    %{ $to_process_hr->{'current_acls'} } = (
        %{ $to_process_hr->{'current_acls'} },
        %{$defaults_to_apply_hr}
    );
    print "\t[+] Added default privileges to '$to_process_hr->{'name'}'.\n";
    return;
}

sub fix_disallow_shell ( $self, $to_process_hr ) {
    print "\t[*] Fixing 'disallow-shell' privilege for '$to_process_hr->{'name'}'...\n";
    my $had_disallow_shell = delete $to_process_hr->{'current_acls'}->{'disallow-shell'};
    if ( !$had_disallow_shell ) {
        %{ $to_process_hr->{'current_acls'} } = (
            %{ $to_process_hr->{'current_acls'} },
            'allow-shell' => 1,
        );
    }
    print "\t[+] Fixed 'disallow-shell' privilege for '$to_process_hr->{'name'}'.\n";
    return;
}

sub _parse_and_validate_opts ($self) {

unless ( $self->getopt('add-default-privs') || $self->getopt('fix-disallow-shell') ) {
        print $self->help();
        return;
    }

my $resellers      = $self->getopt('reseller');
    my %uniq_resellers = map { $_ => 1 } @$resellers if $resellers;

my $acl_lists      = $self->getopt('acl-list');
    my %uniq_acl_lists = map { $_ => 1 } @$acl_lists if $acl_lists;

my $opts = {
        'operations' => {
            'add-default-privs'  => $self->getopt('add-default-privs'),
            'fix-disallow-shell' => $self->getopt('fix-disallow-shell'),
        },
        'all-resellers'       => $self->getopt('all-resellers'),
        'specified_resellers' => \%uniq_resellers,
        'all-acl-lists'       => $self->getopt('all-acl-lists'),
        'specified_acl_lists' => \%uniq_acl_lists,
    };

$opts->{'resellers'} = $self->_validate_resellers($opts);
    $opts->{'acl-lists'} = $self->_validate_acl_lists($opts);

return unless $opts->{'resellers'} // $opts->{'acl-lists'};
    return $opts;
}

sub _validate_resellers ( $self, $opts ) {
    if ( $opts->{'all-resellers'} ) {
        Cpanel::LoadModule::load_perl_module("Whostmgr::Resellers::List");
        Cpanel::LoadModule::load_perl_module('Cpanel::Config::HasCpUserFile');
        return [

# Skip 'resellers without a domain' when processing all resellers on the system:
            # https://go.cpanel.net/how-to-create-a-whm-reseller-without-an-associated-domain
            #
            # These resellers are created "out of band" by editing the resellers file,
            # so altering them should be left up to the server administrators.
            grep { Cpanel::Config::HasCpUserFile::has_cpuser_file($_) }
              keys %{ Whostmgr::Resellers::List::list() }
        ];
    }
    elsif ( my @specified_resellers = keys %{ $opts->{'specified_resellers'} } ) {
        Cpanel::LoadModule::load_perl_module("Whostmgr::Resellers::Check");
        if ( my @invalid_resellers = grep { !Whostmgr::Resellers::Check::is_reseller($_) } @specified_resellers ) {
            die Cpanel::Exception->create_raw( "[!] Invalid resellers specified:\n" . join( "\n", map { " " x 8 . $_ } @invalid_resellers ) . "\n" )->to_string_no_id();
        }

return \@specified_resellers;
    }

return;
}

sub _validate_acl_lists ( $self, $opts ) {
    if ( $opts->{'all-acl-lists'} ) {
        if ( opendir my $dh, $Cpanel::ConfigFiles::ACL_LISTS_DIR ) {
            return [ grep { $_ !~ m/^\.+$/ && -f "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$_" } readdir($dh) ];
        }
    }
    elsif ( my @specified_acl_lists = keys %{ $opts->{'specified_acl_lists'} } ) {
        if ( my @invalid_acl_lists = grep { !-f "$Cpanel::ConfigFiles::ACL_LISTS_DIR/$_" } @specified_acl_lists ) {
            die Cpanel::Exception->create_raw( "[!] Invalid acl-lists specified:\n" . join( "\n", map { " " x 8 . $_ } @invalid_acl_lists ) . "\n" )->to_string_no_id();
        }
        return \@specified_acl_lists;
    }

return;
}