__ __ __ __ _____ _ _ _____ _ _ _
| \/ | \ \ / / | __ \ (_) | | / ____| | | | |
| \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | |
| |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | |
| | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | |
|_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1
if you need WebShell for Seo everyday contact me on Telegram
Telegram Address : @jackleet
For_More_Tools:
# -*- coding: utf-8 -*-
#
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENCE.TXT
#
"""Utility functions for crontab operations."""
import os
import pwd
from clcommon.cpapi import userdomains
from .constants import DOCUMENT_ROOT_ENV
def get_document_root() -> str | None:
"""
Get the document root from environment variable.
When PROXYEXEC_DOCUMENT_ROOT is set, validate that it is one of the
calling user's real document roots — defence in depth against a user
invoking the wrapper directly with a forged value.
Returns:
Optional[str]: The document root path if PROXYEXEC_DOCUMENT_ROOT is set,
None otherwise.
Raises:
ValueError: If PROXYEXEC_DOCUMENT_ROOT is set but does not appear in
the calling user's docroot list.
"""
document_root = os.environ.get(DOCUMENT_ROOT_ENV)
if document_root is None:
return None
# normally this logic is called under user
uid = os.getuid()
# scanner-triage: the `uid == 0` branch is only reachable for root
# invoking this helper directly (root-to-root, outside the threat model).
# All CRONTAB_* proxyexec aliases carry `:secure:noproceed` (never
# `root:`) and the dispatcher setuid()s to the caller before execv, so
# a CageFS tenant always arrives with a non-zero UID.
if uid == 0:
return document_root
username = pwd.getpwuid(uid).pw_name
user_docroots = {docroot for _, docroot in userdomains(username)}
if document_root not in user_docroots:
raise ValueError(
f"Document root path {document_root!r} is not found for user"
)
return document_root