File Manager

✏️ /

#!/opt/cloudlinux/venv/bin/python3 -bb
# coding=utf-8
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2026 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT
#
# isolatectl — unified end-user utility for per-domain resource limits
# and website isolation management.  JSON-only output.
#
# Subcommand groups:
#   isolatectl limits {list,set,apply}         — per-domain (LVD) resource limits
#   isolatectl site-isolation {enable,disable,list} — website isolation (CageFS)

import argparse
import json
import logging
import os
import subprocess
import sys

from clcommon.clpwd import ClPwd

from websiteisolation.commands import cmd_apply, cmd_list, cmd_set
from websiteisolation.exceptions import LvdError

VERSION = '1.0.0'

CAGEFSCTL_USER_BIN = '/usr/sbin/cagefsctl-user'

def _setup_logging():
    log_dir = os.path.join(ClPwd(min_uid=0).get_pw_by_uid(os.getuid())[0].pw_dir, '.lve')
    log_path = os.path.join(log_dir, 'isolatectl.log')
    logger = logging.getLogger('websiteisolation')
    logger.setLevel(logging.DEBUG)
    logger.propagate = False

fmt = logging.Formatter('[%(levelname)s | %(asctime)s]: %(message)s')

os.makedirs(log_dir, mode=0o700, exist_ok=True)
    fh = logging.FileHandler(log_path)
    fh.setLevel(logging.DEBUG)
    fh.setFormatter(fmt)
    logger.addHandler(fh)

def _output(data):
    """Print JSON response to stdout."""
    print(json.dumps(data, indent=2))

def _error(message, exit_code=1):
    """Print JSON error to stdout and exit."""
    _output({'result': 'error', 'message': str(message)})
    sys.exit(exit_code)

# ── limits helpers ────────────────────────────────────────────────

def _add_domain_arg(parser, required=True):
    parser.add_argument('--domain', required=required, metavar='NAME',
                        help='domain name')

def _add_limit_args(parser):
    parser.add_argument('--cpu', type=int, metavar='VAL',
                        help='CPU limit (hundredths of percent, 2500 = 25%%)')
    parser.add_argument('--pmem', type=int, metavar='VAL',
                        help='physical memory limit (bytes)')
    parser.add_argument('--io', type=int, metavar='VAL',
                        help='I/O limit (KB/s)')
    parser.add_argument('--nproc', type=int, metavar='VAL',
                        help='max processes')
    parser.add_argument('--iops', type=int, metavar='VAL',
                        help='I/O operations per second')
    parser.add_argument('--ep', type=int, metavar='VAL',
                        help='max entry processes (concurrent connections)')
    parser.add_argument('--vmem', type=int, metavar='VAL',
                        help='virtual memory limit (bytes)')

def _collect_limits(args):
    limits = {}
    for field in ('cpu', 'pmem', 'io', 'nproc', 'iops', 'ep', 'vmem'):
        val = getattr(args, field, None)
        if val is not None:
            limits[field] = val
    return limits

def handle_limits_list(args):
    return cmd_list(lve_id=os.geteuid(), domain=args.domain)

def handle_limits_set(args):
    limits = _collect_limits(args)
    if not limits:
        _error("at least one limit (--cpu, --pmem, --io, --nproc, --iops, --ep, --vmem) required")
    for field, val in limits.items():
        if val < 0:
            _error(f"limit --{field} must be non-negative (got {val})")
    return cmd_set(os.geteuid(), args.domain, limits)

def handle_limits_apply(args):
    return cmd_apply(os.geteuid(), args.domain)

# ── site-isolation helpers ────────────────────────────────────────

def _run_cagefsctl_user(subcmd, extra_args=None):
    """Delegate to cagefsctl-user and pass through its JSON output."""
    argv = [CAGEFSCTL_USER_BIN, 'site-isolation-' + subcmd]
    if extra_args:
        argv.extend(extra_args)

try:
        proc = subprocess.run(
            argv, capture_output=True, text=True, check=False,
        )
    except OSError as e:
        _error(f"failed to run {CAGEFSCTL_USER_BIN}: {e}")

parsed = None
    if proc.stdout.strip():
        try:
            parsed = json.loads(proc.stdout)
        except (json.JSONDecodeError, ValueError):
            pass

if proc.returncode != 0:
        if parsed is not None:
            _output(parsed)
            sys.exit(proc.returncode)
        stderr = proc.stderr.strip()
        _error(f"cagefsctl-user site-isolation-{subcmd} failed "
               f"(exit {proc.returncode}): {stderr}")

if parsed is not None:
        return parsed

_error('no output from cagefsctl-user')

def handle_site_isolation_enable(args):
    return _run_cagefsctl_user('enable', ['--domain', args.domain])

def handle_site_isolation_disable(args):
    return _run_cagefsctl_user('disable', ['--domain', args.domain])

def handle_site_isolation_list(args):
    return _run_cagefsctl_user('list')

# ── parser ────────────────────────────────────────────────────────

def build_parser():
    parser = argparse.ArgumentParser(
        prog='isolatectl',
        description='Unified utility for per-domain resource limits and '
                    'website isolation management. JSON-only output.\n\n'
                    'Note: domain limits require site isolation to be '
                    'enabled first (isolatectl site-isolation enable).',
        formatter_class=argparse.RawDescriptionHelpFormatter)
    parser.add_argument('--version', action='version',
                        version=json.dumps({'version': VERSION}))

groups = parser.add_subparsers(dest='group', metavar='command')

# ── limits ────────────────────────────────────────────────────
    limits_parser = groups.add_parser(
        'limits',
        help='manage per-domain (LVD) resource limits')
    limits_sub = limits_parser.add_subparsers(dest='subcommand', metavar='subcommand')

p = limits_sub.add_parser('list', help='show limits for all domains or a specific domain')
    _add_domain_arg(p, required=False)
    p.set_defaults(func=handle_limits_list)

p = limits_sub.add_parser(
        'set', help='store per-domain limits and apply them to kernel',
        epilog='Example:\n'
               '  isolatectl limits set --domain example.com --cpu 5000 --pmem 268435456 --io 2048 --nproc 30 --iops 500 --ep 20 --vmem 536870912\n'
               '\n'
               'This sets: CPU 50%%, 256 MB PMEM, 2048 KB/s IO, 30 procs, 500 IOPS, 20 entry procs, 512 MB VMEM.\n'
               'Use PYLVE_DEBUG=1 for verbose helper output.',
        formatter_class=argparse.RawDescriptionHelpFormatter)
    _add_domain_arg(p)
    _add_limit_args(p)
    p.set_defaults(func=handle_limits_set)

p = limits_sub.add_parser('apply', help="push one domain's limits from config to kernel")
    _add_domain_arg(p)
    p.set_defaults(func=handle_limits_apply)

# ── site-isolation ────────────────────────────────────────────
    si_parser = groups.add_parser(
        'site-isolation',
        help='manage website isolation (CageFS)')
    si_sub = si_parser.add_subparsers(dest='subcommand', metavar='subcommand')

p = si_sub.add_parser('enable', help='enable site isolation for domain(s)')
    p.add_argument('--domain', required=True,
                   help='domain name(s) to enable site isolation for (comma-separated)')
    p.set_defaults(func=handle_site_isolation_enable)

p = si_sub.add_parser('disable', help='disable site isolation for domain(s)')
    p.add_argument('--domain', required=True,
                   help='domain name(s) to disable site isolation for (comma-separated)')
    p.set_defaults(func=handle_site_isolation_disable)

p = si_sub.add_parser('list', help='list domains with site isolation enabled')
    p.set_defaults(func=handle_site_isolation_list)

return parser

def main():
    if os.getuid() == 0:
        _error("isolatectl must not be run as root; run as a regular user")

_setup_logging()
    log = logging.getLogger(__name__)
    log.debug('Executing "%s"', ' '.join(sys.argv))

is_debug = int(os.environ.get('PYLVE_DEBUG', 0))
    if is_debug:
        print(f"DEBUG [isolatectl]: uid={os.getuid()} argv={sys.argv}",
              file=sys.stderr)

parser = build_parser()
    args = parser.parse_args()

if not args.group:
        parser.print_help()
        sys.exit(1)

if not hasattr(args, 'func'):
        # Group given but no subcommand
        if args.group == 'limits':
            parser.parse_args(['limits', '--help'])
        elif args.group == 'site-isolation':
            parser.parse_args(['site-isolation', '--help'])
        sys.exit(1)

try:
        result = args.func(args)
        _output(result)
    except LvdError as e:
        log.error('%s', e)
        _error(str(e))
    except Exception as e:
        log.exception('unexpected error')
        _error(f"unexpected error: {e}")

if __name__ == '__main__':
    main()

Batal

⬅ usr 49 item

Nama	Tipe	Ukuran	Diubah	Aksi
📄cagefs_enter_site	file	1.8 KB	2026-07-31 12:31	✏️ 👁️
📄cagefsctl-user	file	15.6 KB	2026-07-31 12:31	✏️ 👁️
📄chroot	file	41.5 KB	2026-07-28 19:49	✏️ 👁️
📄cloudlinux-selector	file	654 B	2026-08-11 11:40	✏️ 👁️
📄consoletype	file	11.9 KB	2025-11-10 10:42	✏️ 👁️
📄cracklib-check	file	13 KB	2019-10-12 00:47	✏️ 👁️
📄cracklib-format	file	251 B	2019-10-12 00:47	✏️ 👁️
📄cracklib-packer	file	13.1 KB	2019-10-12 00:47	✏️ 👁️
📄cracklib-unpacker	file	9 KB	2019-10-12 00:47	✏️ 👁️
📄create-cracklib-dict	file	990 B	2019-10-12 00:47	✏️ 👁️
📄cxs	file	4.4 KB	2025-11-24 13:45	✏️ 👁️
📄ddns-confgen	file	20.5 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-checkds	file	936 B	2026-08-13 18:52	✏️ 👁️
📄dnssec-coverage	file	938 B	2026-08-13 18:52	✏️ 👁️
📄dnssec-dsfromkey	file	60.8 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-importkey	file	60.8 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-keyfromlabel	file	64.8 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-keygen	file	72.8 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-keymgr	file	934 B	2026-08-13 18:52	✏️ 👁️
📄dnssec-revoke	file	56.7 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-settime	file	60.8 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-signzone	file	117.2 KB	2026-08-13 18:53	✏️ 👁️
📄dnssec-verify	file	52.8 KB	2026-08-13 18:53	✏️ 👁️
📄exim	file	4.4 KB	2026-09-10 14:30	✏️ 👁️
📄faillock	file	20.5 KB	2026-08-18 13:12	✏️ 👁️
📄genrandom	file	12.4 KB	2026-08-13 18:53	✏️ 👁️
📄ip	file	693.3 KB	2024-05-23 08:36	✏️ 👁️
📄isc-hmac-fixup	file	11.9 KB	2026-08-13 18:53	✏️ 👁️
📄isolatectl	file	9.2 KB	2026-08-19 18:27	✏️ 👁️
📄ldconfig	file	986.1 KB	2026-07-21 14:52	✏️ 👁️
📄lvdctl	file	683 B	2026-08-19 18:27	✏️ 👁️
📄mkhomedir_helper	file	24.4 KB	2026-08-18 13:12	✏️ 👁️
📄named-checkzone	file	36.6 KB	2026-08-13 18:53	✏️ 👁️
📄named-compilezone	file	36.6 KB	2026-08-13 18:53	✏️ 👁️
📄nsec3hash	file	12.3 KB	2026-08-13 18:53	✏️ 👁️
📄pam_console_apply	file	45.2 KB	2026-08-18 13:12	✏️ 👁️
📄pam_timestamp_check	file	11.9 KB	2026-08-18 13:12	✏️ 👁️
📄pluginviewer	file	20.6 KB	2022-02-23 20:13	✏️ 👁️
📄proxyexec	file	25.4 KB	2026-08-17 19:22	✏️ 👁️
📄pwhistory_helper	file	20.4 KB	2026-08-18 13:12	✏️ 👁️
📄saslauthd	file	94.4 KB	2022-02-23 20:13	✏️ 👁️
📄sasldblistusers2	file	20.8 KB	2022-02-23 20:13	✏️ 👁️
📄saslpasswd2	file	16.4 KB	2022-02-23 20:13	✏️ 👁️
📄sendmail	file	4.4 KB	2026-09-10 14:30	✏️ 👁️
📄testsaslauthd	file	16.7 KB	2022-02-23 20:13	✏️ 👁️
📄tmpwatch	file	35.5 KB	2019-10-12 11:32	✏️ 👁️
📄tsig-keygen	file	20.5 KB	2026-08-13 18:53	✏️ 👁️
📄unix_chkpwd	file	36.9 KB	2026-08-18 13:12	✏️ 👁️
📄unix_update	file	36.9 KB	2026-08-18 13:12	✏️ 👁️

✏️ Rename