crontab-user-wrapper.py

#!/opt/cloudlinux/venv/bin/python3 -sbb
# -*- coding: utf-8 -*-
#
# Copyright  Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENCE.TXT
#
"""
Crontab wrapper for website isolation support.

This wrapper mimics crontab command-line interface:
- crontab -l: Lists current crontab entries, filtering isolation tool prefixes
- crontab [file]: Installs crontab from file (or '-' for stdin)

When website isolation is active (PROXYEXEC_DOCUMENT_ROOT is set):
1. List operations filter out isolation wrapper prefixes from output
2. Save operations automatically prepend isolation tool to commands

The isolation tool is prepended to commands to ensure they run within the
isolated website context.
"""

import argparse
import os
import sys

from clcagefslib.webisolation import crontab

def create_parser():
    """
    Create argument parser for the crontab wrapper.

Returns:
        argparse.ArgumentParser: Configured argument parser
    """
    parser = argparse.ArgumentParser(
        prog="crontab-user-wrapper",
        description="Crontab wrapper for website isolation support. "
                    "Filters and modifies crontab entries to support website isolation.",
    )

parser.add_argument(
        "-l",
        "--list",
        action="store_true",
        help="List current crontab entries (filters isolation prefixes)",
        dest="list_crontab",
    )

parser.add_argument(
        "file",
        nargs="?",
        default="-",
        help="File containing crontab entries to install, or '-' to read from stdin (default: '-')",
    )

return parser

def main(argv=None):
    """
    Main entry point.

Args:
        argv: Command line arguments (defaults to sys.argv[1:])

Returns:
        int: Exit code
    """
    parser = create_parser()
    args = parser.parse_args(argv)

try:
        if args.list_crontab:
            return crontab.process_list()

# Handle file argument: '-' means stdin, otherwise open the file
        if args.file == "-":
            stdin = sys.stdin.buffer
        else:
            # scanner-triage (F-03, CLOS-5941): the scanner reads this
            # `open(args.file, "rb")` as a root-context read of a caller-
            # controlled path. It is not. Every CRONTAB_* proxyexec alias
            # in proxyexec/proxy.commands is `:secure:noproceed=` (never
            # `root:`), so proxyexec/cagefs.server.c setuid(pw.pw_uid)-
            # drops to the authenticated caller before execv'ing
            # /usr/sbin/cloudlinux-user-cron, which securelve.spec ships
            # as a plain non-setuid symlink to this wrapper. By the time
            # main() runs, the process is already the caller  this open
            # is a caller-context read of the caller's own file, not a
            # cross-tenant read. See SECURITY-EXCEPTIONS.md for the
            # sibling get_document_root triage that pins the same
            # invariant. DiD: use os.open with O_NOFOLLOW/O_CLOEXEC so a
            # symlink swap between argparse and this line still fails
            # closed at the caller boundary, and refuse if the wrapper is
            # ever invoked with euid 0 (a future `root:` alias regression
            # or a setuid-root wrapper on top of cloudlinux-user-cron).
            if os.geteuid() == 0:
                sys.stderr.write("crontab: operation not permitted\n")
                return 1
            try:
                fd = os.open(
                    args.file,
                    os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW,
                )
                stdin = os.fdopen(fd, "rb")
            except OSError:
                sys.stderr.write("crontab: unable to read the requested file\n")
                return 1

try:
            return crontab.process_save(stdin=stdin)
        finally:
            if args.file != "-" and stdin != sys.stdin.buffer:
                stdin.close()
    except Exception as e:
        # Surface any failure (e.g. forged PROXYEXEC_DOCUMENT_ROOT rejected
        # by get_document_root) as a clean stderr message instead of a
        # Python traceback leaking into the user's terminal.
        sys.stderr.write(f"crontab: {type(e).__name__}: {e}\n")
        return 1

if __name__ == "__main__":
    sys.exit(main())

docroot: /home/induvedam/public_html

curdir: /opt/cloudlinux/venv/bin

	.	4096
	..	85
X	Activate.ps1	9033
X	activate	1691
X	activate.csh	915
X	activate.fish	2191
X	alembic	229
X	cagefs_enter_site.py	1877
X	cagefsctl_user.py	19091
X	chardetect	237
X	cl_sysctl	4620
X	clcpapi	5409
X	coverage	231
X	coverage-3.11	231
X	coverage3	231
X	cpanel-dbmapping	3929
X	crontab-user-wrapper.py	4401
X	da_suid_caller.py	686
X	detect-requirements	238
X	dodgy	224
X	epylint	235
X	f2py	232
X	f2py3	232
X	f2py3.11	232
X	flake8	230
X	futurize	231
X	get_gprof	1885
X	get_objgraph	1667
X	isort	225
X	isort-identify-imports	259
X	jsonschema	229
X	lvestats_config_reader.py	1145
X	mako-render	229
X	normalizer	260
X	pasteurize	233
X	pip	237
X	pip3	237
X	pip3.11	237
X	plesk_suid_caller.py	905
X	prospector	229
X	py.test	237
X	pycodestyle	228
X	pydocstyle	229
X	pyflakes	227
X	pylint	233
X	pylint-config	249
X	pyreverse	239
X	pysemver	225
X	pytest	237
X	python	15368
X	python3	15368
X	python3.11	15368
X	raven	235
X	symilar	235
X	tap	223
X	tappy	223
X	undill	603
X	virtualenv	254