OwlCyberSecurity - MANAGER

Edit File: cldiaglib.py

# coding=utf-8
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2019 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

from __future__ import print_function
from __future__ import absolute_import

import grp
import pwd
import sys
import json
import os
import random
import subprocess
import configparser
from collections import namedtuple
from pathlib import Path
import re
import uuid

from functools import wraps
from typing import AnyStr, List, Optional, Tuple  # NOQA

import cldetectlib as detect
from clcommon.cpapi import Feature, is_panel_feature_supported
from clcommon.lib.consts import DEFAULT_JWT_ES_TOKEN_PATH, DISABLE_CMT_FILE
from clcommon.lib.cledition import is_cl_solo_edition, CLEditionDetectionError
from clcommon.lib.jwt_token import jwt_token_check
from cllimits_validator import LimitsValidator
from clcommon.utils import (
    ExternalProgramFailed,
    service_is_enabled_and_present,
    run_command,
    process_is_running,
    is_litespeed_running,
    demote
)
from clcommon.lib.cmt_utils import (
    is_cmt_disabled,
    is_client_enabled,
)
from clcommon.lib.whmapi_lib import WhmApiRequest, WhmApiError
from clcommon.lib.cledition import is_ubuntu
from clsentry.utils import get_pkg_version
from clcommon.clpwd import ClPwd, drop_privileges
from cl_proc_hidepid import get_hidepid_typing_from_mounts

# Possible result types (ChkStatus?)

OK = 'OK'   # 'PASSED' is better?
FAILED = 'FAILED'
SKIPPED = 'SKIPPED'
INTERNAL_TEST_ERROR = 'INTERNAL_TEST_ERROR'

cldiag_doc_link = 'https://docs.cloudlinux.com/command-line_tools/'
cron_cldiag_checkers_param_name = 'disabled_cldiag_cron_checkers'
cron_cldiag_section_name = 'cldiag_cron'
cl_plus_doc_link = 'https://docs.cloudlinux.com/cloudlinux-os-plus/#faq-2'
cl_plus_doc_msg = f'Link to FAQ and troubleshooting {cl_plus_doc_link}'
write_to_support_msg = 'Please write to support ' \
                       'https://cloudlinux.zendesk.com/ ' \
                       'if you can\'t resolve the issue.'
cm_full_name = 'Centralized Monitoring'
SKIPPED_ON_SOLO_MSG = 'This checker is not supported on CloudLinux OS Solo edition'
SKIPPED_WITHOUT_LVE_MSG = 'This checker is not supported in environments without LVE support'

ChkResult = namedtuple('ChkResult', [
    'res',          # One of predefined checker result types
    'msg',          # Resulting msg from this checker
])

SUEXEC_PATH = {
    'cPanel':       '/usr/local/apache/bin/suexec',
    'cPanel_ea4':   '/usr/sbin/suexec',
    'DirectAdmin':  '/usr/sbin/suexec',
    'Plesk':        '/usr/sbin/suexec',
    'ISPManager':   '/usr/sbin/suexec',
    'InterWorx':    '/usr/sbin/suexec',
    'H-Sphere':     '/usr/sbin/suexec',
    'HostingNG':    '/usr/sbin/suexec',
    'Unknown':      '/usr/sbin/suexec',
}

SUPHP_PATH = {
    'cPanel': '/opt/suphp/sbin/suphp',
    'cPanel_ea4': '/usr/sbin/suphp',
    'DirectAdmin':  '/usr/local/suphp/sbin/suphp',
    'Plesk':        '/usr/sbin/suphp',
    'ISPManager':   '/usr/sbin/suphp',
    'InterWorx':    '/usr/sbin/suphp',
    'H-Sphere':     '/usr/sbin/suphp',
    'HostingNG':    '/usr/sbin/suphp',
    'Unknown':      '/usr/sbin/suphp',
}

BINARY_CHECK_PARAMETERS = dict()
BINARY_CHECK_PARAMETERS['suphp'] = {
    'name': 'SuPHP',
    'status_function': 'detect.get_suPHP_status()',
    'location': SUPHP_PATH,
}
BINARY_CHECK_PARAMETERS['suexec'] = {
    'name': 'SuEXEC',
    'status_function': 'detect.get_suEXEC_status()',
    'location': SUEXEC_PATH,
}

_CLDIAG_USERNAME_FILE = '/var/lve/cldiag_user'
_CLDIAG_TEST_USENAME_PREFIX = 'cldiaguser'

def pretty_name(name_of_checker):
    def decorator(func):
        func.pretty_name = name_of_checker
        return func
    return decorator

def _formatter(data, error_count, to_json=False):
    """
    Formatter of output from all of checkers
    """

msg = 'Command for disabling this cron checker: '
    cmd_tmp = 'cldiag --disable-cron-checkers'

if to_json:
        res = {
            checker_pretty_name: chk_result._asdict() for
            checker_pretty_name, _, chk_result in data
        }
        res['total_errors'] = error_count
        return json.dumps(res)
    res = []
    for checker_pretty_name, checker_public_name, chk_result in data:
        checker_result = f'{checker_pretty_name}:\n    {chk_result.res}: ' \
                         f'{chk_result.msg}'
        if checker_public_name is not None:
            checker_result = f'{checker_result}\n' \
                             f'{msg} "{cmd_tmp} {checker_public_name}"'
        res.append(checker_result)
    res = '\n\n'.join(res + [f'There are {error_count} errors found.'])
    return res

def runner(checkers, to_json=False, do_exit=True):
    if callable(checkers):  # allow single checker as input too
        checkers = [checkers]

results = []
    errors = 0
    for f in checkers:
        try:
            chk_result = f()
        except Exception as e:
            chk_result = ChkResult(INTERNAL_TEST_ERROR, repr(e))
        if chk_result.res in (FAILED, INTERNAL_TEST_ERROR,):
            errors += 1
        results.append((
            f.pretty_name,
            f.public_name if hasattr(f, 'public_name') else None,
            chk_result,
        ))

res = _formatter(results, errors, to_json)

if do_exit:
        print(res)
        exit(errors)
    return errors, res

def wrapper(func):
    try:
        return eval(func)
    except AttributeError:
        print('WARNING\n missing {} function in cldetectlib.'.format(func))
        return False

def skip_checker_on_cl_solo(f):
    @wraps(f)
    def checker(*args, **kwargs):
        try:
            is_solo_edition = is_cl_solo_edition(skip_jwt_check=True)
        except CLEditionDetectionError:
            is_solo_edition = False
        if is_solo_edition:
            return ChkResult(SKIPPED, SKIPPED_ON_SOLO_MSG)
        return f(*args, **kwargs)
    return checker

def skip_check_without_lve(f):
    @wraps(f)
    def checker(*args, **kwargs):
        if not is_panel_feature_supported(Feature.LVE):
            return ChkResult(SKIPPED, SKIPPED_WITHOUT_LVE_MSG)
        return f(*args, **kwargs)
    return checker

@pretty_name('Check cagefs')
def fake_cagefs_checker():
    return ChkResult(SKIPPED, 'Cagefs version is too old. '
                              'Please run cagefsctl --sanity-check directly '
                              'or upgrade it to have full cldiag integration')

def _is_cmt_allowed_for_server() -> Tuple[bool, Optional[str]]:
    """
    Check that a server is cl+, enabled and CM isn't disabled locally
    The function returns True if the client has CL+ license, didn't disable CM
        localy and activated CM on https://cm.cloudlinux.com. The function also
        returns True if we can't read or parse JWT token, because
        we want to continue and show to client CM related errors
    """
    cm_is_not_activated_msg = f'{cm_full_name} is not activated' \
                              ' on https://cm.cloudlinux.com'
    cm_is_disabled_localy_msg = f'The {cm_full_name} is disabled localy' \
                                f' by creating file "{DISABLE_CMT_FILE}"'
    no_cl_plus_license_msg = 'The server has no CL+ license'

from clsummary.cl_summary_utils import get_client_data_from_jwt_token
    jwt_token = get_client_data_from_jwt_token()
    if jwt_token is not None and not jwt_token['cl_plus']:
        # we do nothing if client doesn't have CL+ license
        return False, no_cl_plus_license_msg
    # we should check the state of JWT token if we didn't take data from it
    elif jwt_token is None:
        is_valid, message, _ = jwt_token_check()
        if not is_valid:
            return is_valid, message
    if is_cmt_disabled():
        # we do nothing if cmt is disabled locally
        return False, cm_is_disabled_localy_msg
    # we do nothing if client isn't enabled in CM
    if not is_client_enabled():
        return False, cm_is_not_activated_msg
    # We want to continue checks in case of problems with jwt token
    # because we want to show cmt related errors to client.
    return True, None

def skip_if_cmt_not_used_enabled_allowed(f):
    """
    Decorator: Skip check if a server isn't cl+, disabled and
               CM is disabled locally
    """

@wraps(f)
    def decorated_function(*args, **kwargs):
        """
        Decorated function
        """
        result, message = _is_cmt_allowed_for_server()
        if result:
            return f(*args, **kwargs)
        else:
            return ChkResult(
                SKIPPED,
                message,
            )
    return decorated_function

@pretty_name('Check existing JWT token')
def check_jwt_token():
    """
    Check an existing JWT token
    """
    token_is_absent_msg = ' Absence of JWT token is normal for the ' \
                          'clients with volume license like GoDaddy. '
    main_msg = 'Please check for JWT token in path ' \
               f'"{DEFAULT_JWT_ES_TOKEN_PATH}". %sTry running "rhn_check"' \
               ' for getting a new token if it is absent. Server can\'t ' \
               f'collect and send statistics to {cm_full_name} if you ' \
               f'don\'t have a correct JWT token. {cl_plus_doc_msg}. ' \
               f'{write_to_support_msg}'
    token_is_not_cl_plus = "JWT token doesn't have CL+ service"
    from clsummary.cl_summary_utils import get_client_data_from_jwt_token
    if os.path.exists(DEFAULT_JWT_ES_TOKEN_PATH):
        result, message, _ = jwt_token_check()
        if result:
            jwt_token = get_client_data_from_jwt_token()
            return ChkResult(OK, f'JWT token is valid: "{jwt_token}"')
        elif message == token_is_not_cl_plus:
            return ChkResult(
                SKIPPED,
                'The server has no CL+ license',
            )
        else:
            main_msg = main_msg % ''
            return ChkResult(
                FAILED,
                f'{message}. {main_msg}'
            )
    else:
        return ChkResult(
            SKIPPED,
            main_msg % token_is_absent_msg,
        )

def _check_service_state(
        service_name: str,
        process_file_path: str
) -> ChkResult:
    """
    Check that a service is present, enabled and active
    :param service_name: name of a service
    :param process_file_path: path to a file which is run by a service
    """
    is_present, is_enabled = service_is_enabled_and_present(service_name)
    try:
        is_active = process_is_running(process_file_path, False)
    except FileNotFoundError:
        is_active = False
    if is_present and is_enabled and is_active:
        return ChkResult(
            OK,
            f'Service "{service_name}" is present, enabled and active',
        )
    else:
        messages = []
        if not is_present:
            messages.append('Service is not present.')
        if not is_enabled:
            messages.append('Service is not enabled.')
        if not is_active:
            messages.append('Service is not active.')
        return ChkResult(
            FAILED,
            f"{' '.join(messages)} The server can't collect and send "
            f"statistics to {cm_full_name} if service {service_name} isn't "
            f"present, enabled and active. {cl_plus_doc_msg}. "
            f"{write_to_support_msg}"
        )

@pretty_name('Check service `cl_plus_sender` is present, enabled and active')
@skip_checker_on_cl_solo
@skip_if_cmt_not_used_enabled_allowed
def check_cl_plus_sender_service():
    """
    Check that service `cl_plus_sender` is present, enabled and active
    """
    from clsummary.cl_summary_utils import CL_PLUS_SENDER_FILE_PATH
    service_name = 'cl_plus_sender'

return _check_service_state(service_name, CL_PLUS_SENDER_FILE_PATH)

@pretty_name('Check service `node_exporter` is present, enabled and active')
@skip_checker_on_cl_solo
@skip_if_cmt_not_used_enabled_allowed
def check_node_exporter_service():
    """
    Check that service `node_exporter` or `cl_node_exporter` is present,
    enabled and active
    Since it was renamed node_exporter -> cl_node_exporter
    let`s handle both cases:
     - old `node_exporter` service
     - renamed `cl_node_exporter` service
    """
    base_service_path = '/usr/share/cloudlinux/cl_plus/service/'
    process_file_path = '/usr/share/cloudlinux/cl_plus/node_exporter'
    # looking for cl_node_exporter on cl6, cl_node_exporter.service on cl7+
    if os.path.exists(os.path.join(base_service_path, 'cl_node_exporter')) or \
            os.path.exists(os.path.join(base_service_path, 'cl_node_exporter.service')):
        service_name = 'cl_node_exporter'
    else:
        service_name = 'node_exporter'
    return _check_service_state(service_name, process_file_path)

@pretty_name('Check service `lvestats` is present, enabled and active')
@skip_checker_on_cl_solo
@skip_if_cmt_not_used_enabled_allowed
def check_lvestats_service():
    """
    Check that service `lvestats` is present, enabled and active
    """
    service_name = 'lvestats'
    process_file_path = '/usr/share/lve-stats/lvestats-server.py'
    return _check_service_state(service_name, process_file_path)

@pretty_name(
    'Check that the server has the minimal required '
    'packages for correct working of Centralized Monitoring'
)
@skip_checker_on_cl_solo
@skip_if_cmt_not_used_enabled_allowed
def check_cmt_packages():
    """
    Check that the server has minimal required packages for CM
    """
    for package_name in ['cl-end-server-tools', 'cl-node-exporter']:
        if get_pkg_version(package_name) is None:
            return ChkResult(
                FAILED,
                'System doesn\'t have the package '
                f'"{package_name}". It\'s required for {cm_full_name} '
                'feature to work and it usually installed '
                f'automatically by cron. {cl_plus_doc_msg}. '
                f'{write_to_support_msg}',
            )
    return ChkResult(
        OK,
        'System has the minimal required packages for '
        'correct working of Centralized Monitoring'
    )

@pretty_name("Check control panel and it's configuration (for DirectAdmin only)")
def check_cp_diag():
    fix_motivation = ' Fixing the issue will provide CloudLinux support ' \
                     'on your control panel. \nSee details: {}'.format(cldiag_doc_link + '#diag-cp')
    detect.getCP()
    cp_name = detect.getCPName()
    if cp_name == 'Unknown':
        return ChkResult(SKIPPED, "Can't detect contol panel")

res_msg = "Control Panel - {}; Version {};".format(
        cp_name, detect.CP_VERSION)
    # we are not setting cloudlinux yes on CL SOLO
    if not is_cl_solo_edition(skip_jwt_check=True) and cp_name == 'DirectAdmin':
        if detect.da_check_options():
            return ChkResult(OK, res_msg + ' File "options.conf" is fine')
        else:
            return ChkResult(FAILED, res_msg + ' File "options.conf" '
                                               'has no line "cloudlinux=yes"' + fix_motivation)
    else:
        return ChkResult(OK, res_msg)

@pretty_name('Check fs.enforce_symlinksifowner is correctly enabled in sysctl conf')
@skip_check_without_lve
def check_symlinksifowner():
    fix_motivation = ' Fixing that issue makes server more secure against ' \
                     'symlink attacks and enables protection of PHP configs ' \
                     'or other sensitive files. \nSee details: {}'.format(cldiag_doc_link + '#symlinksifowner')

if detect.is_openvz():
        return ChkResult(SKIPPED, 'Not supported for OpenVZ environment')

try:
        symlinks_if_owner = detect.get_symlinksifowner()
    except ExternalProgramFailed as e:
        detailed_out = 'To see full error run /sbin/sysctl --system'
        return ChkResult(FAILED, 'Some parameter in sysctl config has wrong configuration. '
                                 'Error: {} It`s recommended to fix it and try again '.format(
                                  get_short_error_message(str(e), detailed_out)))
    if symlinks_if_owner == 2:
        return ChkResult(FAILED, 'fs.enforce_symlinksifowner = 2' + fix_motivation)
    return ChkResult(OK, 'fs.enforce_symlinksifowner = {}'
                     .format(symlinks_if_owner))

def binary_check(params):
    module_name = params['name'].lower()
    link = cldiag_doc_link + '#check-' + module_name
    fix_motivation = ' Fix that issue to be sure that users run their sites inside CageFS and provide stable ' \
                     'work of sites that are using apache {} module. This may improve server security' \
                     '\nSee details: {}'.format(module_name, link)
    if not os.path.exists('/usr/sbin/cagefsctl'):
        return ChkResult(SKIPPED, "Cagefs is not installed")
    if not wrapper(params['status_function']):
        return ChkResult(SKIPPED, "{} is not enabled".format(params['name']))

has_jail = detect.check_binary_has_jail(params['location'])
    if has_jail is None:
        return ChkResult(SKIPPED, "Unable to check {} module binary for "
                                  "custom control panel. This feature may be "
                                  "added in future updates.".format(params['name']))
    elif not has_jail:
        return ChkResult(FAILED, "Binary without CageFS jail " + fix_motivation)
    return ChkResult(OK, "binary has jail")

@pretty_name('Check suexec has cagefs jail')
def check_suexec():
    # Check that LiteSpeed is installed and run
    if detect.detect_litespeed() and is_litespeed_running():
        return ChkResult(SKIPPED, "Current PHP selector uses LiteSpeed, "
                                  "which doesn't require the patches in suEXEC bin.")
    else:
        return binary_check(BINARY_CHECK_PARAMETERS['suexec'])

@pretty_name('Check suphp has cagefs jail')
def check_suphp():
    return binary_check(BINARY_CHECK_PARAMETERS['suphp'])

@pretty_name('Check usepam in sshd config')
def check_use_pam():
    fix_motivation = 'Fix the issue to provide correct work of pam_lve module with sshd and ' \
                     'CageFS ssh sessions' \
                     '\nSee details: {}'.format(cldiag_doc_link + '#check-usepam')
    check_result = detect.check_SSHd_UsePAM()
    if check_result is None:
        return ChkResult(SKIPPED, 'Unable to run "/usr/sbin/sshd -T"')
    if check_result:
        return ChkResult(OK, 'Config is fine')
    else:
        return ChkResult(FAILED, 'There is "usepam no" in "/usr/sbin/sshd -T" output ' + fix_motivation)

@pretty_name('Check the validity of LVE limits on server')
@skip_check_without_lve
def check_lve_limits():
    # type: () -> ChkResult
    """
    Validate lve limits
    """
    doc_link = 'https://docs.cloudlinux.com/lve-limits-validation.html'
    failed_message = 'Invalid LVE limits on server. See doc: ' + doc_link
    passed_message = 'Valid LVE limits on server.'

limits_validator = LimitsValidator()

result = limits_validator.validate_existing_limits()
    if result is None:
        return ChkResult(OK, passed_message)
    else:
        return ChkResult(FAILED, failed_message + '\n' + result)

@pretty_name('Check compatibility for PHP Selector')
def check_phpselector():
    """
    1. mod_ruid not present
    2. suphp
    3. mod_lsapi
    4. suexec and (fcgi or cgi)
    5. litespeed
    6. do not support other
    """

ok_prefix = 'It looks ok [%s]'
    fail_prefix = (
        "Looks like your PHP handler doesn't support CloudLinux PHP Selector "
        "and as a result does not work "
        "http://docs.cloudlinux.com/index.html?compatiblity_matrix.html [%s]"
        "\nPlease, see: {} and try to fix issue to have working selector".format(cldiag_doc_link + '#check-phpselector')
    )

# LU-3041: no support for PHP-Selector on Ubuntu
    is_ubuntu_os = is_ubuntu()
    if is_ubuntu_os:
        return ChkResult(SKIPPED, 'PHP Selector is not supported. Skipping check')

# do not check for EA3
    if not os.path.exists("/etc/cpanel/ea4/is_ea4"):
        return ChkResult(SKIPPED, "It is not cPanel with EA4, can diag nothing")

# litespeed check
    if detect.detect_litespeed() and is_litespeed_running():
        return ChkResult(OK, ok_prefix % 'Litespeed')

status = {'suexec': False,
              'suphp': False,
              'lsapi': False}

handler = None
    # check /etc/cpanel/ea4/php.conf for EA4
    conf_path = "/etc/cpanel/ea4/php.conf"
    if os.path.exists(conf_path):
        try:
            fd = open(conf_path, "r")
            config = [x.strip() for x in fd.readlines()]
            fd.close()
        except IOError as e:
            err = "Can not read %s (%s)" % (conf_path, str(e))
            return ChkResult(FAILED, fail_prefix % err)
        # some stub version string
        for line in config:
            if line.startswith("default:"):
                default_ver = (line.split(':')[1]).strip()
                break
        else:
            err = "%s config should have default php version" % conf_path
            return ChkResult(FAILED, fail_prefix % err)

for line in config:
            if line.startswith("%s:" % default_ver):
                handler = (line.split(':')[1]).strip()
        if handler not in ['cgi', 'fcgi', 'suphp', 'lsapi']:
            err = "doesn't support %s handler in ea4/php.conf" % handler
            return ChkResult(FAILED, fail_prefix % err)

modules = detect.get_apache_modules()
    if modules is not None:
        if 'ruid2_module' in modules:
            return ChkResult(
                FAILED,
                fail_prefix % "It looks like you use mod_ruid. CloudLinux PHP Selector doesn't work properly with it. "
                              "How to delete mod_ruid and install mod_suexec in cPanel "
                              "https://docs.cloudlinux.com/cloudlinux_os_components/#installation-5"
            )
        status['suphp'] = 'suphp_module' in modules
        status['lsapi'] = 'lsapi_module' in modules
        status['suexec'] = 'suexec_module' in modules
    if not any([status['suphp'], status['suexec']]):
        return ChkResult(
            FAILED,
            fail_prefix % "It looks like you do not have mod_suphp or mod_suexec installed. "
                          "CloudLinux PHP Selector doesn't work properly without it"
        )
    if status['suphp'] or status['suexec'] and handler in ["suphp", "cgi", "fcgi", "lsapi"]:
        current = "php.conf:%s with %s" % (handler, ', '.join(s for s in status if status[s]))
        return ChkResult(OK, ok_prefix % current)
    err = "Some unknown php handler, perhaps we don't support it [found handler: %s and apache modules: %s]" % (
        '-' if handler is None else handler,
        ', '.join(module for module in status if status[module]))
    return ChkResult(FAILED, fail_prefix % err)

@pretty_name('Check fs.symlinkown_gid')
@skip_check_without_lve
def check_symlinkowngid():
    fix_motivation = 'Fix the issue to provide symlink protection for apache user ' \
                     'and as a result make your Web Server more secure. ' \
                     '\nSee details: {}'.format(cldiag_doc_link + '#check-symlinkowngid')
    ok_res = ChkResult(
        OK, 'Web-server user is protected by Symlink Owner Match Protection')
    warn_msg_tpl = ("Web-server user '{}' is not in protected group "
                    "specified in {}. " + fix_motivation)
    symlinkown_gid_file = "/proc/sys/fs/symlinkown_gid"

if detect.is_openvz():
        return ChkResult(SKIPPED, 'Not supported for OpenVZ environment')

detect.get_apache_gid()  # This function fills few module-level variables
    apache_uname = detect.APACHE_UNAME

try:
        pwd.getpwnam(apache_uname)
    except KeyError:
        return ChkResult(SKIPPED, 'There is no web-server user [{}] in system. '
                                  'Nothing to check'.format(apache_uname))

try:
        current_symlinkown_gid = int(open(symlinkown_gid_file).read().strip())
    except Exception as e:
        return ChkResult(FAILED, "Can't read GID from {} with error: {}"
                         .format(symlinkown_gid_file, repr(e)))

if detect.APACHE_GID == current_symlinkown_gid:
        return ok_res

try:
        grp_members = grp.getgrgid(current_symlinkown_gid).gr_mem
    except KeyError:    # no such group
        grp_members = []
    if grp_members:
        # Most often both LiteSpeed and Apache runs under the same user
        if apache_uname in grp_members:
            return ok_res

return ChkResult(FAILED, warn_msg_tpl.format(apache_uname,
                                                 symlinkown_gid_file))

@pretty_name('Check existence of all user\'s packages')
@skip_checker_on_cl_solo
def check_existence_of_all_users_packages():
    """
    Return user's packages that do not exist in /var/cpanel/packages/

"""
    packages_dir_path = '/var/cpanel/packages/'
    users_dir_path = '/var/cpanel/users/'
    suspended_dir_path = '/var/cpanel/suspended/'
    excluded_packages_names = [
        'undefined',
        'default',
        'cPanel Ticket System temporary user',
        'Custom'
    ]
    user_plan_cmd = ['/bin/grep', '-e', 'PLAN=', '-r']
    suspended_users = []

if detect.getCPName() != 'cPanel':
        return ChkResult(SKIPPED, "should be run on cPanel only")

if not os.listdir(users_dir_path):
        return ChkResult(SKIPPED, "no users on this server")

if os.path.exists(suspended_dir_path):
        suspended_users = os.listdir(suspended_dir_path)

# getting users packages
    process = subprocess.Popen(user_plan_cmd,
                               stdout=subprocess.PIPE,
                               stderr=subprocess.PIPE,
                               cwd=users_dir_path,
                               text=True)
    std_out, std_err = process.communicate()
    ret_code = process.returncode

if ret_code != 0:
        msg = "error getting user's packages: {}".format(std_err)
        return ChkResult(FAILED, msg)
    else:
        try:
            # std_out sample: <username1>:PLAN=<package_name>\n <username2>:PLAN=<package_name>\n...
            all_users_packages = [(plan.split('=')[0].split(':')[0], plan.split('=')[1].strip())
                                  for plan in std_out.strip().split('\n')]
            # filter suspended users
            all_users_packages = [(user, pkg) for user, pkg in all_users_packages
                                  if user not in suspended_users]
        except Exception as e:
            msg = "error processing user's packages: {}".format(e)
            return ChkResult(FAILED, msg)
    # getting exists packages
    exists_packages = [package for package in os.listdir(packages_dir_path)
                       if os.path.isfile(os.path.join(packages_dir_path, package))]
    # getting not exists users packages
    not_exists_users_packages = ['{}: {}'.format(user, package) for user, package in all_users_packages
                                 if package not in excluded_packages_names and package not in exists_packages]
    if not_exists_users_packages:
        msg = (
            "Found some nonexistent user's packages. "
            "List of \"user: package\" separated by semicolon: {}. "
            "If you want to apply package limits for those users - assign existing packages to them, "
            "otherwise limits will be applied incorrectly or not applied at all."
            .format('; '.join(not_exists_users_packages))
        )
        return ChkResult(FAILED, msg)
    else:
        return ChkResult(OK, "nonexistent user's packages aren't found")

@pretty_name('Check all resellers\'s packages files')
@skip_checker_on_cl_solo
def check_da_resellers_packages_files():
    """
    Check reseller packages files reading on any errors
    Caused by LU-2374

"""
    if detect.getCPName() != 'DirectAdmin':
        return ChkResult(SKIPPED, "should be run on DirectAdmin only")

class HiddenPrints:
        """
        Redirect stdout to /dev/null to hide output
        """
        def __enter__(self):
            self._original_stdout = sys.stdout
            sys.stdout = open(os.devnull, 'w')

def __exit__(self, exc_type, exc_val, exc_tb):
            sys.stdout.close()
            sys.stdout = self._original_stdout

from clcontrollib import DirectAdmin
    try:
        with HiddenPrints():
            DirectAdmin().list_resellers_packages()
        return ChkResult(OK, "all resellers packages are written in correct encoding")
    except Exception as e:
        return ChkResult(FAILED, str(e))

DEFAULTS_CFG_PATH = '/etc/cl.selector/defaults.cfg'
PHP_CONF_PATH = '/etc/cl.selector/php.conf'
PARAM_NAME_LIST = ['Directive', 'Default', 'Type', 'Comment', 'Range', 'Remark']
TYPES = ['value', 'list', 'bool']

def parse_php_conf():
    """
    Parse php.conf and split it into blocks by empty line
    :return:
    """
    line_blocks = []
    block_index = 0
    # we can`t just ignore empty lines
    # new_block flag helps to define when empty line is delimiter of block
    # and when it is just unnecessary line
    # 1st non-empty and non-comment line is new block by default
    new_block = True
    with open(PHP_CONF_PATH, 'r') as conf:
        data = conf.readlines()
    for line in data:
        if line.startswith('#'):
            continue
        if len(line.strip()) > 0:
            # found 1st non-empty line
            # consider next lines as part of block, until empty line found
            new_block = False
            try:
                line_blocks[block_index]
            except:
                line_blocks.append([])
            line_blocks[block_index].append(line.strip())
        elif not new_block:
            # empty line found
            # ignore more than one empty line
            new_block = True
            block_index += 1
    return line_blocks

def check_block(block):
    result = True
    msg = ''
    for line in block:
        line_parts = line.split('=')
        if line_parts[0].strip() not in PARAM_NAME_LIST:
            result = False
            msg = msg + '\n' + 'Block %s has wrong param \n' % block_to_string(block)
        if line_parts[0].strip() == 'Type':
            if line_parts[1].strip() not in TYPES:
                result = False
                msg = msg + '\n' + 'Block %s has wrong directive \n' % block_to_string(block)
    return [result, msg]

def block_to_string(block):
    res_string = '\n'
    for line in block:
        res_string = res_string + str(line) + '\n'
    return res_string

@pretty_name('Checking /etc/cl.selector/php.conf')
def check_php_conf():
    php_ini_doc_link = 'https://docs.cloudlinux.com/custom_php_ini_options.html'
    fix_motivation = 'To fix the issue provide valid format for /etc/cl.selector/php.conf file. ' \
                     'It is used for PHP Selector and invalid format lead to directives misconfiguration ' \
                     'and as a result misconfiguration of selector' \
                     '\nPlease, read more about php.conf file in {}'.format(php_ini_doc_link)
    result = True
    msg = ''
    if not os.path.exists(PHP_CONF_PATH):
        return ChkResult(SKIPPED, 'File %s does not exist\n' % PHP_CONF_PATH)
    blocks = parse_php_conf()
    for block in blocks:
        r1, msg1 = check_block(block)
        result = result and r1
        if msg1:
            msg = msg + '\n' + msg1
    if not result:
        return ChkResult(FAILED, msg + fix_motivation)
    else:
        return ChkResult(OK, 'Ok')

@pretty_name('Checking /etc/cl.selector/defaults.cfg')
def check_defaults_cfg():
    fix_motivation = 'Details: this config file is used by php selector and stores it`s global options, ' \
                     'so it is important to keep needed configurations and valid syntax for PHP modules ' \
                     'settings to avoid selector`s misconfiguration' \
                     '\nSee details: {}'.format(cldiag_doc_link + '#cldiag')
    if not os.path.exists(DEFAULTS_CFG_PATH):
        return ChkResult(SKIPPED, '%s does not exist' % DEFAULTS_CFG_PATH)
    try:
        defaults_cfg = configparser.ConfigParser(interpolation=None,
                                                     strict=False)
        defaults_cfg.read(DEFAULTS_CFG_PATH)
    except Exception as e:
        return ChkResult(FAILED, str(e))
    try:
        default_php_version = defaults_cfg.get('versions', 'php')
    except (configparser.NoOptionError, configparser.NoSectionError):
        return ChkResult(FAILED, 'Default php version is undefined\n' + fix_motivation)
    for section in defaults_cfg.sections():
        if section.startswith('php'):
            php_version = section[3:]
            try:
                state = defaults_cfg.get(section, 'state')
            except configparser.NoOptionError:
                state = 'enable'
            try:
                modules = defaults_cfg.get(section, 'modules')
            except configparser.NoOptionError:
                modules = ''
            if default_php_version == php_version and state == 'disabled':
                return ChkResult(FAILED, 'Default php version {} is disabled\n{}'.format(php_version,
                                                                                                fix_motivation))
            if modules:
                if ',' in modules:
                    module_names = modules.split(',')
                    for name in module_names:
                        if not name:
                            sys.stderr.write('Warning: Modules list for version %s is strange\n' % php_version)
    return ChkResult(OK, 'OK')

@pretty_name('Checking domains compatibility')
def check_domains_compatibility():
    if detect.getCPName() != 'cPanel':
        return ChkResult(SKIPPED, "should be run on cPanel only")

failed_message = 'Some domains/subdomains don\'t use PHP Selector because they have a non-system default ' \
                     'version (in MultiPHP Manager) or PHP_FPM enabled. You can find their list on domains tab ' \
                     'and pass control to PHP Selector if necessary.'
    passed_message = 'Ok'

result = domains_compatibility_checker()
    if result is None:
        return ChkResult(OK, passed_message)
    else:
        return ChkResult(FAILED, failed_message)

def domains_compatibility_checker():
    try:
        domains = WhmApiRequest('php_get_vhost_versions').call()
        system_version = WhmApiRequest('php_get_system_default_version').call()
    except WhmApiError:
        return None
    for domain in domains.get('versions'):
        if system_version.get('version') != domain.get('version') or domain.get('php_fpm'):
            return 'Incompatible version'

def get_dir_mountpoint(dirpath: str) -> Optional[str]:
    """
    Get mountpoint for dirpath directory from output of
    df -h {dirpath} utility.
    """
    if not os.path.isdir(dirpath):
        return None
    get_mountpoint_cmd = f'df -h {dirpath}'
    process = subprocess.run(get_mountpoint_cmd.split(' '),
                             stdout=subprocess.PIPE,
                             stderr=subprocess.PIPE,
                             text=True)
    # example stdout:
    # [root@localhost ~]  # df -h /var/cagefs
    # Filesystem      Size  Used Avail Use% Mounted on
    # /dev/vda1        10G  3.1G  7.0G  31% /
    if process.returncode != 0:
        return None
    try:
        mounted_on = process.stdout.split('\n')[1].split(' ')[-1]
    except IndexError:
        return None
    return mounted_on

def get_max_uid() -> int:
    """
    Returns maximum uid from /etc/login.defs
    If file does not exist returns 60000
    """
    max_uid = 60000
    if os.path.isfile('/etc/login.defs'):
        with open('/etc/login.defs') as f:
            for line in f:
                if line.startswith('UID_MAX '):
                    max_uid = int(line.split(' ')[-1])
    return max_uid

def get_min_uid() -> int:
    """
    Returns min cagefs uid
    """
    get_min_uid_cmd = '/usr/sbin/cagefsctl --get-min-uid'
    stdout = run_command(get_min_uid_cmd.split(' '), convert_to_str=True)
    min_uid = int(stdout)
    return min_uid

def useradd(username: str) -> int:
    """
    Creates user with max available uid that greater than min cagefs uid
    and less than max system uid.
    Does nothing if user already exists.
    """
    min_uid = get_min_uid()
    max_uid = get_max_uid()
    if max_uid < min_uid:
        raise Exception(f'Can\'t create {username} user: '
                        f'min_uid {min_uid} is greater than max_uid {max_uid}')
    clpwd = ClPwd(min_uid=min_uid)
    if username in clpwd.get_user_full_dict():
        return clpwd.get_uid(username)

if not clpwd.get_uid_dict():
        custom_uid = min_uid
    else:
        custom_uid = max_uid
        used_uids_dict = clpwd.get_uid_dict()
        for _uid in range(min_uid, max_uid):
            if _uid not in used_uids_dict:
                custom_uid = _uid
                break
    if custom_uid >= max_uid:
        raise Exception(f'Can\'t create {username} user: uid {custom_uid} is too big')
    useradd_cmd = f'/usr/sbin/useradd -s /bin/false -u {custom_uid} -m {username}'
    returncode, _, err = run_command(useradd_cmd.split(' '), return_full_output=True)
    if returncode != 0:
        raise Exception(err)
    return custom_uid

def get_username_from_file() -> Optional[str]:
    """
    Retrive cldiag username from file
    :return: username from file or None
    """
    try:
        with open(_CLDIAG_USERNAME_FILE, 'r') as f:
            content = f.read()
        return content.strip()
    except (OSError, IOError):
        # No file
        pass
    return None

def remove_all_trash_cldiag_users():
    """
    Remove all trash cldiag users from system
    """
    cl_pwd = ClPwd()
    re_pattern = re.compile('^cldiaguser_[a-f0-9]{21}$')
    users_dict = cl_pwd.get_user_full_dict()
    for username, _ in users_dict.items():
        # skip non-test users
        if not re_pattern.match(username):
            continue
        try:
            userdel_cmd = f'/usr/sbin/userdel -r {username}'
            run_command(userdel_cmd.split(' '))
        except (OSError, IOError, ExternalProgramFailed):
            pass

def is_quota_active():
    """
    Detect quota is activated
    :return: True/False - quotas activated/not activated
    """
    _REPQUOTA_PATH = '/usr/sbin/repquota'
    cmd = [_REPQUOTA_PATH, '-nva']
    try:
        stdout = run_command(cmd)
    except ExternalProgramFailed:
        return False
    # quotas not supported if repqouta returns nothing
    if not stdout:
        return False
    return True

@pretty_name('Checking if /var/cagefs is located on partition with disk quota enabled')
@skip_checker_on_cl_solo  # TODO: Remove this skip if cl-quota will be enabled on CL Solo
def check_cagefs_partition_disk_quota():
    """
    Checker for check if /var/cagefs is located on partition
    with disk quota enabled.

Algorithm for check: we trying to set cldiaguser's quota to 1 inode
    (so that this user can't create any file if the quota activated on
    this partition). Then we change uid of process to cldiaguser's uid,
    and try to create file with his permissions.
    If we can't create file (Disk quota exceeded) then it's alright and
    disc quota enabled. Else we warn user to enable quota on that partition.
    """
    ok_message = '/var/cagefs located on partition with quota enabled'
    failed_message = 'Details: /var/cagefs located on partition with quota disabled.\n' \
                     'Please, activate quota for /var/cagefs for better security.\n' \
                     'See details: ' \
                     'https://docs.cloudlinux.com/cloudlinux_os_components/#installation-and-update-2'
    quota_unworkable_message = 'Quotas seems unworkable on this server. Please correctly setup quotas to run this checker'
    cagefsctl = '/usr/sbin/cagefsctl'
    setquota = '/usr/sbin/setquota'
    # get mountpoint from output of "df -h /var/cagefs"
    cagefs_mountpoint = get_dir_mountpoint('/var/cagefs')
    if cagefs_mountpoint is None or not os.path.isdir('/var/cagefs') \
            or not os.path.isfile(cagefsctl):
        return ChkResult(SKIPPED, 'Cagefs is not installed')

if not os.path.isdir('/usr/share/cagefs-skeleton/bin'):
        return ChkResult(SKIPPED, 'Cagefs is not initialized')

if not is_quota_active():
        return ChkResult(FAILED, failed_message)

username = None
    is_testuser_exists = False
    if os.path.isfile(_CLDIAG_USERNAME_FILE):
        # Get test username from file
        username = get_username_from_file()
        if username is not None:
            try:
                user_pw = pwd.getpwnam(username)
                user_uid, user_gid = user_pw.pw_uid, user_pw.pw_gid
            except KeyError:
                # test user absent
                pass
            else:
                is_testuser_exists = True
    else:
        # File absent - clean system from trash (old) test users
        remove_all_trash_cldiag_users()
    if not is_testuser_exists:
        username = '{}_{}'.format(_CLDIAG_TEST_USENAME_PREFIX, uuid.uuid4().hex)[:32]
        useradd(username)
        user_pw = pwd.getpwnam(username)
        user_uid, user_gid = user_pw.pw_uid, user_pw.pw_gid
        try:
            # save username to file
            with open(_CLDIAG_USERNAME_FILE, 'w') as f:
                f.write(username)
        except (OSError, IOError):
            pass
    create_cagefs_dir_cmd = f'{cagefsctl} --cpetc {user_uid}'
    set_quota_limit_cmd = f'{setquota} -u {username} 0 0 1 1 {cagefs_mountpoint}'
    reset_quota_limit_cmd = f'{setquota} -u {username} 0 0 0 0 {cagefs_mountpoint}'
    try:
        try:
            prefix = "%02d" % (user_uid % 100)  # getting last 2 digits from uid
            tempfile_dir = f'/var/cagefs/{prefix}/{username}/etc/cl.selector/'
            tempfile_name = str(random.random())
            tempfile_full_path = Path(tempfile_dir, tempfile_name)
            if not os.path.isdir(tempfile_dir):
                run_command(create_cagefs_dir_cmd.split(' '))  # creating user directory
            run_command(set_quota_limit_cmd.split(' '))  # setting quota limit to 1 inode
            # trying to create empty file on the partition with quota
            # and expect it fails with Disk quota exceeded error
            p = subprocess.Popen(['/bin/touch', tempfile_name],
                                 stdout=subprocess.PIPE,
                                 stderr=subprocess.STDOUT,
                                 text=True,
                                 start_new_session=True,
                                 cwd=tempfile_dir,
                                 preexec_fn=demote(user_uid, user_gid),
                                 env={**os.environ, **{'LC_ALL': 'C'}})
            stdout, _ = p.communicate()

with drop_privileges(username):
                if not tempfile_full_path.exists() and 'Disk quota exceeded' in stdout:
                    return ChkResult(OK, ok_message)
                elif not tempfile_full_path.exists():
                    raise OSError(stdout)
                else:
                    tempfile_full_path.unlink()
        finally:
            run_command(reset_quota_limit_cmd.split(' '))
    except ExternalProgramFailed:
        return ChkResult(FAILED, quota_unworkable_message)
    return ChkResult(FAILED, failed_message)

def get_short_error_message(error, detailed_out, max_error_lines=10):
    """
    Handles error message making it shorter, if it is bigger than max limit
    :param error: error message to make shorter
    :param detailed_out: way for user to get full error manually
    :param max_error_lines: max lines for error
    :return: initial error (less than 10 lines) short error
    """
    error_lines = error.split('\n')
    if len(error_lines) > max_error_lines:
        return '\n'.join(error_lines[:max_error_lines // 2] + ['...'] + error_lines[-max_error_lines // 2:] +
                         [detailed_out])
    return error

def is_email_notification_enabled() -> bool:
    """
    Return true if automatic cldiag email notifications
    about problems enabled.
    """
    enable_cldiag = detect.get_boolean_param(
        detect.CL_CONFIG_FILE, 'ENABLE_CLDIAG',
        separator='=', default_val=True)
    return enable_cldiag

def get_list_of_disabled_cron_checkers() -> List[Optional[AnyStr]]:
    """
    Get list of disabled cldiag checkers which run by cron
    from /etc/sysconfig/cloudlinux
    """

try:
        config = configparser.ConfigParser(
            interpolation=None,
            strict=False,
            defaults={
                cron_cldiag_checkers_param_name: '',
            }
        )
        config.read(detect.CL_CONFIG_FILE)
        result = config.get(
            cron_cldiag_section_name,
            cron_cldiag_checkers_param_name,
        )
    except configparser.Error:
        return []

return [item.strip() for item in result.strip().split(',') if item]

def set_list_of_disabled_cron_checkers(disabled_cron_cherkers: List[Optional[AnyStr]]) -> None:
    """
    Set list of disabled cldiag checker which run by cron
    in /etc/sysconfig/cloudlinux
    """
    try:
        config = configparser.ConfigParser(
            interpolation=None,
            strict=False,
        )
        config.read(detect.CL_CONFIG_FILE)
        if cron_cldiag_section_name not in config.sections():
            config.add_section(cron_cldiag_section_name)
        current_disabled_checkers = get_list_of_disabled_cron_checkers()
        if disabled_cron_cherkers:
            disabled_cron_cherkers.extend(current_disabled_checkers)
        config.set(
            cron_cldiag_section_name,
            cron_cldiag_checkers_param_name,
            ','.join(disabled_cron_cherkers),
        )
        with open(detect.CL_CONFIG_FILE, 'w+') as f:
            config.write(f)
    except (configparser.Error, IOError, OSError) as err:
        print(f"Can't set list of disabled cron checkers to config"
              f"\"{detect.CL_CONFIG_FILE}\" because \"{err}\"")
        print("Please check config's existence, integrity and permissions")
        print(write_to_support_msg)
        sys.exit(1)

@pretty_name('Check mount with hidepid=2 option')
@skip_check_without_lve
def check_hidepid():
    # type: () -> ChkResult
    """
    Check if system mounted with hidepid=2 option
    """
    hidepid_doc_link = 'https://docs.cloudlinux.com/cloudlinux_os_kernel/' \
                       '#remounting-procfs-with-hidepid-option'
    fix_motivation = f'Details: hidepid protection disabled.\n' \
                     f'Please, mount system with hidepid=2 for better security.\n' \
                     f'Read more about hidepid option here: {hidepid_doc_link}'
    passed_message = 'hidepid protection enabled'
    skipped_message = 'Cagefs is not installed'

# this checker only works with cagefs installed
    if not os.path.isfile('/usr/sbin/cagefsctl'):
        return ChkResult(SKIPPED, skipped_message)
    # looking for the line like this in /proc/mounts
    # proc /proc proc rw,nosuid,nodev,noexec,relatime,gid=1000,hidepid=2 0 0
    # if such line does no exist, then it's bad for user
    if get_hidepid_typing_from_mounts() != 2:
        return ChkResult(FAILED, fix_motivation)
    return ChkResult(OK, passed_message)

@pretty_name('Check user\'s low PMEM limits')
@skip_check_without_lve
def check_low_pmem_limits() -> ChkResult:
    """
    Checks low PMEM limits availability on server
    """
    doc_link = 'https://docs.cloudlinux.com/limits/#limits-validation'
    failed_message = 'Some user(s) on server has low PMEM LVE limit (lower than 512 MB). See doc: ' + doc_link
    passed_message = 'Check low PMEM limits passed'

result = LimitsValidator.is_low_pmem_limit_present()
    if result:
        return ChkResult(FAILED, failed_message)
    return ChkResult(OK, passed_message)