malware_filters.py

"""
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.

This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>

MalwareIgnorePath plugin will update malware paths filters.

It listens for MalwareIgnorePathUpdated message, and calls
realtime_av.update() on receiving it. This call also is performed on
plugin initialization.
"""

import asyncio
import logging

from defence360agent.contracts.config import Malware
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import MessageSink, expect
from defence360agent.files import REALTIME_AV_CONF
from defence360agent.subsys.persistent_state import load_state, save_state
from defence360agent.utils import recurring_check, safe_cancel_task
from imav.malwarelib.ignore_export import export_ignore_paths
from imav.subsys import realtime_av

logger = logging.getLogger(__name__)

class BaseMalwareFilters(MessageSink):
    def __init__(self):
        self._reload_task = None
        _state = load_state("MalwareFilters").get("crontabs_scan_enabled")
        self._crontabs_scan_enabled = _state or Malware.CRONTABS_SCAN_ENABLED
        self._reload_event = asyncio.Event()

async def create_sink(self, loop) -> None:
        self._loop = loop
        self._reload_task = self._loop.create_task(self.reload_services())
        await self.call_update()

@recurring_check(0)
    async def reload_services(self):
        await self._reload_event.wait()
        self._reload_event.clear()
        if not realtime_av.is_installed():
            logger.warning("Realtime is not installed. Nothing to reload.")
            return
        try:
            await realtime_av.reload_services()
        except Exception as e:
            logger.warning("failed to reload realtime services: %s", e)

async def shutdown(self):  # pragma: no cover
        save_state(
            "MalwareFilters",
            {"crontabs_scan_enabled": self._crontabs_scan_enabled},
        )
        if self._reload_task:
            await safe_cancel_task(self._reload_task)

@expect(MessageType.ConfigUpdate)
    async def on_config_update(self, _) -> None:
        enabled = Malware.CRONTABS_SCAN_ENABLED
        if self._crontabs_scan_enabled != enabled:
            self._crontabs_scan_enabled = enabled
            await self.call_update()

@expect(MessageType.MalwareIgnorePathUpdated)
    @expect(MessageType.FilesUpdated, files_type=REALTIME_AV_CONF)
    async def on_message(self, _) -> None:
        await self.call_update()

@expect(
        MessageType.EnsureServiceState,
        service=realtime_av.REALTIME_SERVICE_NAME,
    )
    async def ensure_realtime_service_state(self, _) -> None:
        realtime_av.generate_configs()
        self._reload_event.set()

async def call_update(self) -> None:
        try:
            export_ignore_paths()
        except Exception as e:
            logger.warning("failed to export malware ignore paths: %s", e)
        try:
            if realtime_av.generate_configs():
                # reload services only if configs were changed
                self._reload_event.set()
        except Exception as e:
            logger.warning("failed to update malware path filters: %s", e)
        try:
            # K8s: write per-user ignore files for external consumption
            await realtime_av.write_k8s_ignore_lists()
        except Exception as e:
            logger.warning("failed to write k8s ignore lists: %s", e)

docroot: /home/induvedam/public_html

curdir: /opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins

	.	4096
	..	4096
X	__init__.py	0
	__pycache__	4096
X	aibolit_resident_ff_watcher.py	10300
X	check_license.py	9492
X	conflicts.py	3255
X	detect_admin_tools_watcher.py	2708
X	event_hook_executor.py	3890
X	event_hooks.py	3549
X	generic_sensor.py	6940
X	im360_register.py	2890
X	imunify_patch_id.py	2381
X	inotify.py	1787
X	malware_filters.py	4137
X	mr_proper.py	2856
X	plesk_notifications.py	4704
X	post_action.py	1758
X	restore_from_backup.py	3611
X	send_malware_infection_state.py	12119
X	server_pull.py	3797
X	service_manager.py	2692