Gecko [ www.leshallesdegournay.geraud-market.com ]

Name	Size	Permission	Date
NetworkManager	[ DIR ]	drwxr-xr-x	2020-11-16 21:25
audit	[ DIR ]	drwxr-xr-x	2026-08-17 17:03
binfmt.d	[ DIR ]	drwxr-xr-x	2026-04-23 16:18
cloud-init	[ DIR ]	drwxr-xr-x	2022-10-24 22:54
debug	[ DIR ]	drwxr-xr-x	2016-10-02 20:58
dracut	[ DIR ]	drwxr-xr-x	2023-09-11 20:59
elfutils	[ DIR ]	drwxr-xr-x	2020-11-16 21:19
exim	[ DIR ]	drwxr-xr-x	2017-07-03 22:07
firewalld	[ DIR ]	drwxr-xr-x	2021-05-01 14:21
firmware	[ DIR ]	drwxr-xr-x	2024-07-26 17:42
fontconfig	[ DIR ]	drwxr-xr-x	2018-12-19 18:47
games	[ DIR ]	dr-xr-xr-x	2016-10-02 20:58
gcc	[ DIR ]	drwxr-xr-x	2026-04-27 16:00
gconv	[ DIR ]	drwxr-xr-x	2026-08-17 17:03
gems	[ DIR ]	drwxr-xr-x	2022-04-06 09:38
grub	[ DIR ]	drwxr-xr-x	2026-02-13 10:02
i686	[ DIR ]	drwxr-xr-x	2026-04-16 13:53
java	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
java-1.5.0	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
java-1.6.0	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
java-1.7.0	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
java-1.8.0	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
java-ext	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
jvm	[ DIR ]	drwxr-xr-x	2026-08-17 17:56
jvm-commmon	[ DIR ]	drwxr-xr-x	2015-11-25 10:58
jvm-exports	[ DIR ]	drwxr-xr-x	2026-08-17 17:56
jvm-private	[ DIR ]	drwxr-xr-x	2026-08-17 17:56
kbd	[ DIR ]	drwxr-xr-x	2021-11-24 08:55
kcare	[ DIR ]	drwxr-xr-x	2026-07-08 02:58
kdump	[ DIR ]	drwxr-xr-x	2022-05-22 19:26
kernel	[ DIR ]	drwxr-xr-x	2026-04-23 16:18
locale	[ DIR ]	drwxr-xr-x	2026-08-17 15:43
modprobe.d	[ DIR ]	drwxr-xr-x	2023-02-07 03:38
modules	[ DIR ]	drwxr-xr-x	2024-07-26 17:42
modules-load.d	[ DIR ]	drwxr-xr-x	2026-04-23 16:18
oracle	[ DIR ]	drwxr-xr-x	2017-07-03 23:05
polkit-1	[ DIR ]	drwxr-xr-x	2022-01-26 19:34
python2.7	[ DIR ]	drwxr-xr-x	2026-08-05 22:06
python3.6	[ DIR ]	drwxr-xr-x	2026-08-05 22:58
rpm	[ DIR ]	drwxr-xr-x	2026-08-17 17:15
rtkaio	[ DIR ]	drwxr-xr-x	2026-08-17 17:03
security	[ DIR ]	drwxr-xr-x	2026-08-17 17:32
sse2	[ DIR ]	dr-xr-xr-x	2016-10-02 20:58
sysctl.d	[ DIR ]	drwxr-xr-x	2026-08-17 15:31
systemd	[ DIR ]	drwxr-xr-x	2026-08-17 15:31
sysusers.d	[ DIR ]	drwxr-xr-x	2022-05-23 22:35
tmpfiles.d	[ DIR ]	drwxr-xr-x	2026-08-17 17:30
tuned	[ DIR ]	drwxr-xr-x	2024-06-17 20:37
udev	[ DIR ]	drwxr-xr-x	2026-08-17 15:31
yum-plugins	[ DIR ]	drwxr-xr-x	2022-08-15 15:42
.libgcrypt.so.11.hmac	65 B	-rw-r--r--	2017-06-02 23:52
cpp	754.58 KB	-rwxr-xr-x	2026-04-27 16:01
ld-2.17.so	155.05 KB	-rwxr-xr-x	2026-04-16 15:11
ld-linux.so.2	155.05 KB	-rwxr-xr-x	2026-04-16 15:11
libBrokenLocale-2.17.so	7.08 KB	-rwxr-xr-x	2026-04-16 15:11
libBrokenLocale.so.1	7.08 KB	-rwxr-xr-x	2026-04-16 15:11
libSegFault.so	19.97 KB	-rwxr-xr-x	2026-04-16 15:11
libanl-2.17.so	17.41 KB	-rwxr-xr-x	2026-04-16 15:11
libanl.so.1	17.41 KB	-rwxr-xr-x	2026-04-16 15:11
libasm-0.176.so	31.21 KB	-rwxr-xr-x	2020-06-30 03:29
libasm.so.1	31.21 KB	-rwxr-xr-x	2020-06-30 03:29
libattr.so.1	18.65 KB	-rwxr-xr-x	2018-01-27 14:50
libattr.so.1.1.0	18.65 KB	-rwxr-xr-x	2018-01-27 14:50
libaudit.so.1	119.16 KB	-rwxr-xr-x	2019-06-10 00:25
libaudit.so.1.0.0	119.16 KB	-rwxr-xr-x	2019-06-10 00:25
libauparse.so.0	124.39 KB	-rwxr-xr-x	2019-06-10 00:25
libauparse.so.0.0.0	124.39 KB	-rwxr-xr-x	2019-06-10 00:25
libbz2.so.1	69.88 KB	-rwxr-xr-x	2026-04-23 11:28
libbz2.so.1.0.6	69.88 KB	-rwxr-xr-x	2026-04-23 11:28
libc-2.17.so	2.01 MB	-rwxr-xr-x	2026-04-16 15:11
libc.so.6	2.01 MB	-rwxr-xr-x	2026-04-16 15:11
libcap-ng.so.0	18.55 KB	-rwxr-xr-x	2015-11-24 08:09
libcap-ng.so.0.0.0	18.55 KB	-rwxr-xr-x	2015-11-24 08:09
libcap.so.2	18.7 KB	-rwxr-xr-x	2020-04-13 15:37
libcap.so.2.22	18.7 KB	-rwxr-xr-x	2020-04-13 15:37
libcidn-2.17.so	190.52 KB	-rwxr-xr-x	2026-04-16 15:11
libcidn.so.1	190.52 KB	-rwxr-xr-x	2026-04-16 15:11
libcrack.so.2	30.7 KB	-rwxr-xr-x	2014-09-12 01:45
libcrack.so.2.9.0	30.7 KB	-rwxr-xr-x	2014-09-12 01:45
libcrypt-2.17.so	37.7 KB	-rwxr-xr-x	2026-04-16 15:11
libcrypt.so.1	37.7 KB	-rwxr-xr-x	2026-04-16 15:11
libdb-5.3.so	1.78 MB	-rwxr-xr-x	2019-06-10 12:05
libdb-5.so	1.78 MB	-rwxr-xr-x	2019-06-10 12:05
libdl-2.17.so	17.3 KB	-rwxr-xr-x	2026-04-16 15:11
libdl.so.2	17.3 KB	-rwxr-xr-x	2026-04-16 15:11
libdw-0.176.so	365.64 KB	-rwxr-xr-x	2020-06-30 03:29
libdw.so.1	365.64 KB	-rwxr-xr-x	2020-06-30 03:29
libelf-0.176.so	104.83 KB	-rwxr-xr-x	2020-06-30 03:29
libelf.so.1	104.83 KB	-rwxr-xr-x	2020-06-30 03:29
libfreebl3.chk	84 B	-rw-r--r--	2023-10-18 08:57
libfreebl3.so	10.44 KB	-rwxr-xr-x	2023-10-18 08:57
libfreeblpriv3.chk	84 B	-rw-r--r--	2023-10-18 08:57
libfreeblpriv3.so	750.63 KB	-rwxr-xr-x	2023-10-18 08:57
libgcc_s-4.8.5-20150702.so.1	101.78 KB	-rwxr-xr-x	2026-04-27 14:51
libgcc_s.so.1	101.78 KB	-rwxr-xr-x	2026-04-27 14:51
libgcrypt.so.11	546.95 KB	-rwxr-xr-x	2017-06-02 23:52
libgcrypt.so.11.8.2	546.95 KB	-rwxr-xr-x	2017-06-02 23:52
libgpg-error.so.0	18.25 KB	-rwxr-xr-x	2014-09-14 16:02
libgpg-error.so.0.10.0	18.25 KB	-rwxr-xr-x	2014-09-14 16:02
liblz4.so.1	63.57 KB	-rwxr-xr-x	2020-07-03 11:43
liblz4.so.1.8.3	63.57 KB	-rwxr-xr-x	2020-07-03 11:43
liblzma.so.5	164.93 KB	-rwxr-xr-x	2022-06-16 08:53
liblzma.so.5.2.2	164.93 KB	-rwxr-xr-x	2022-06-16 08:53
libm-2.17.so	297.46 KB	-rwxr-xr-x	2026-04-16 15:11
libm.so.6	297.46 KB	-rwxr-xr-x	2026-04-16 15:11
libmemusage.so	20.89 KB	-rwxr-xr-x	2026-04-16 15:11
libnsl-2.17.so	109.95 KB	-rwxr-xr-x	2026-04-16 15:11
libnsl.so.1	109.95 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_compat-2.17.so	42.96 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_compat.so.2	42.96 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_db-2.17.so	34.89 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_db.so.2	34.89 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_dns-2.17.so	25.04 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_dns.so.2	25.04 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_files-2.17.so	53.19 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_files.so.2	53.19 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_hesiod-2.17.so	21.3 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_hesiod.so.2	21.3 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_myhostname.so.2	79.86 KB	-rwxr-xr-x	2026-04-23 16:01
libnss_mymachines.so.2	308.74 KB	-rwxr-xr-x	2026-04-23 16:01
libnss_nis-2.17.so	48.54 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_nis.so.2	48.54 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_nisplus-2.17.so	61.22 KB	-rwxr-xr-x	2026-04-16 15:11
libnss_nisplus.so.2	61.22 KB	-rwxr-xr-x	2026-04-16 15:11
libpam.so.0	59.36 KB	-rwxr-xr-x	2025-09-10 16:34
libpam.so.0.83.1	59.36 KB	-rwxr-xr-x	2025-09-10 16:34
libpam_misc.so.0	10.52 KB	-rwxr-xr-x	2025-09-10 16:34
libpam_misc.so.0.82.0	10.52 KB	-rwxr-xr-x	2025-09-10 16:34
libpamc.so.0	14.51 KB	-rwxr-xr-x	2025-09-10 16:34
libpamc.so.0.82.1	14.51 KB	-rwxr-xr-x	2025-09-10 16:34
libpcprofile.so	7.32 KB	-rwxr-xr-x	2026-04-16 15:09
libpcre.so.1	400.14 KB	-rwxr-xr-x	2017-05-26 03:37
libpcre.so.1.2.0	400.14 KB	-rwxr-xr-x	2017-05-26 03:37
libpcre16.so.0	364.14 KB	-rwxr-xr-x	2017-05-26 03:37
libpcre16.so.0.2.0	364.14 KB	-rwxr-xr-x	2017-05-26 03:37
libpcre32.so.0	348.11 KB	-rwxr-xr-x	2017-05-26 03:37
libpcre32.so.0.0.0	348.11 KB	-rwxr-xr-x	2017-05-26 03:37
libpcrecpp.so.0	34.64 KB	-rwxr-xr-x	2017-05-26 03:37
libpcrecpp.so.0.0.0	34.64 KB	-rwxr-xr-x	2017-05-26 03:37
libpcreposix.so.0	10.2 KB	-rwxr-xr-x	2017-05-26 03:37
libpcreposix.so.0.0.1	10.2 KB	-rwxr-xr-x	2017-05-26 03:37
libpthread-2.17.so	130.63 KB	-rwxr-xr-x	2026-04-16 15:11
libpthread.so.0	130.63 KB	-rwxr-xr-x	2026-04-16 15:11
libresolv-2.17.so	96.72 KB	-rwxr-xr-x	2026-04-16 15:11
libresolv.so.2	96.72 KB	-rwxr-xr-x	2026-04-16 15:11
librt-2.17.so	38.8 KB	-rwxr-xr-x	2026-04-16 15:11
librt.so.1	38.8 KB	-rwxr-xr-x	2026-04-16 15:11
libselinux.so.1	150.73 KB	-rwxr-xr-x	2020-01-21 09:52
libsepol.so.1	663.88 KB	-rwxr-xr-x	2018-10-26 15:37
libstdc++.so.6	912.74 KB	-rwxr-xr-x	2026-04-27 14:51
libstdc++.so.6.0.19	912.74 KB	-rwxr-xr-x	2026-04-27 14:51
libsystemd-daemon.so.0	30.8 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-daemon.so.0.0.12	30.8 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-id128.so.0	22.77 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-id128.so.0.0.28	22.77 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-journal.so.0	165.3 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-journal.so.0.11.5	165.3 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-login.so.0	63.61 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd-login.so.0.9.3	63.61 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd.so.0	214.34 KB	-rwxr-xr-x	2026-04-23 16:01
libsystemd.so.0.6.0	214.34 KB	-rwxr-xr-x	2026-04-23 16:01
libthread_db-1.0.so	34.99 KB	-rwxr-xr-x	2026-04-16 15:11
libthread_db.so.1	34.99 KB	-rwxr-xr-x	2026-04-16 15:11
libudev.so.1	92.3 KB	-rwxr-xr-x	2026-04-23 16:01
libudev.so.1.6.2	92.3 KB	-rwxr-xr-x	2026-04-23 16:01
libutil-2.17.so	12.46 KB	-rwxr-xr-x	2026-04-16 15:11
libutil.so.1	12.46 KB	-rwxr-xr-x	2026-04-16 15:11
libz.so.1	87.45 KB	-rwxr-xr-x	2026-02-27 12:38
libz.so.1.2.7	87.45 KB	-rwxr-xr-x	2026-02-27 12:38
os-release	319 B	-rw-r--r--	2026-06-24 21:13
sendmail	5.88 KB	-rwxr-xr-x	2026-07-24 22:35

Rename

#!/bin/bash
##CageFS proxyexec wrapper - ver 18

if [[ $EUID -eq 0 ]]; then
    echo 'Cannot be run as root'
    exit 1
fi

# POSIX single-quote escaping for values embedded in the ssh remote
# command. Unlike `printf %q`, single-quoted output re-parses correctly
# under any POSIX shell (the origin login shell need not be bash) and is
# lossless for arbitrary bytes. Each embedded ' becomes the '\'' sequence.
sq() {
    local s=${1//\'/\'\\\'\'}
    printf "'%s'" "$s"
}

USR=`/usr/bin/whoami`
USER_TOKEN_PATH="/var/.cagefs/.cagefs.token"
WEBSITE_ISOLATION_FLAG="/opt/cloudlinux/flags/enabled-flags.d/website-isolation.flag"
# Trust boundary for the website-isolation token path: it must point
# directly at the regular file that create_website_token_directory()
# creates inside its root-owned per-user storage area. That area is
# /var/cagefs/<prefix>/<user>/.cagefs/website/... on the host and is
# bind-mounted into the cage at /var/.cagefs/website/... — both views
# are accepted because libenter.enter_site() picks one or the other
# depending on whether it runs inside or outside the cage. The file
# itself is never a symlink, so we reject symlinks outright rather
# than canonicalizing with realpath. Without this gate the attacker
# controls both the env var WEBSITE_TOKEN_PATH and the file contents
# at that path; the file contents land in $TOKEN, which is embedded
# into the ssh remote command argv below and re-parsed by the remote
# shell — so shell metacharacters in the file would execute on the
# origin host. (Slite #7 / CLOS-4490)
if [[ -f "$WEBSITE_ISOLATION_FLAG" && -n "$WEBSITE_TOKEN_PATH" ]]; then
    if [[ -L "$WEBSITE_TOKEN_PATH" ]]; then
        echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not be a symlink" >&2
        exit 1
    fi
    if [[ ! -f "$WEBSITE_TOKEN_PATH" ]]; then
        echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' is not an existing regular file" >&2
        exit 1
    fi
    # Reject `..` as a path component so the prefix check below cannot
    # be bypassed via traversal (e.g. /var/cagefs/../etc/passwd matches
    # the /var/cagefs/* glob but resolves outside the trusted area).
    case "$WEBSITE_TOKEN_PATH" in
        */../*|*/..)
            echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not contain '..' path components" >&2
            exit 1
            ;;
    esac
    case "$WEBSITE_TOKEN_PATH" in
        /var/cagefs/*|/var/.cagefs/*) ;;
        *)
            echo "cagefs.proxy: WEBSITE_TOKEN_PATH must be under /var/cagefs/ or /var/.cagefs/ (got '$WEBSITE_TOKEN_PATH')" >&2
            exit 1
            ;;
    esac
    USER_TOKEN_PATH="$WEBSITE_TOKEN_PATH"
fi
# The -L/-f/prefix gate above is defense-in-depth, TOCTOU is not exploitable because the
# forwarded $TOKEN must still equal the legit on-disk bytes that the
# origin's cagefs.server reads with open(..., O_NOFOLLOW) from a
# uid-derived path (see find_website_by_token() in
# proxyexec/cagefs.server.c) — a swapped symlink redirects what we
# cat, never what the server reads, so a TOCTOU substitution can only
# replace the forwarded bytes with something that fails the server's
# constant-time comparison.
TOKEN=`/bin/cat ${USER_TOKEN_PATH}`
# Tokens are generated as fixed-length alphanumerics by
# _generate_password() in py/clcagefslib/webisolation/jail_utils.py and
# by the corresponding C helper. Any non-alphanumeric byte means the
# token file was tampered with — refuse to forward it into the ssh
# remote command, where the remote shell would re-parse metacharacters.
# Use POSIX `case` rather than `[[ =~ ]]` because the wrapper is also
# invoked through `sh` (e.g. jenkins_tests/rpm_tests/p_cagefs/
# 939-environment_var-check.sh), and dash treats `[[` as a missing
# command — the regex form would falsely trip and exit the script.
case "$TOKEN" in
    "" | *[!A-Za-z0-9]*)
        echo "cagefs.proxy: refusing to forward malformed token from $USER_TOKEN_PATH" >&2
        exit 1
        ;;
esac
# It's user's tmp directory and write to it is secure procedure
# because this script is running only under usual user
PIDFILE="/tmp/.cagefs.proxy.$$"
USER_INTERRUPT=13
CWD=`pwd`

ctrl_c_handler() {
    if [[ -f "$PIDFILE" ]]; then
        pid=`/bin/cat $PIDFILE`
        /bin/rm -f $PIDFILE > /dev/null 2>&1
        /bin/kill -s SIGINT "$pid" > /dev/null 2>&1
    fi
    exit $USER_INTERRUPT
}

if [[ -e /var/.cagefs/origin ]]; then
    ORIGIN=`/bin/cat /var/.cagefs/origin`
    # ssh(1) joins the remote-command argv with single spaces and ships
    # the result for the origin user's login shell to re-parse. The local
    # bash double-quotes around "$CWD" and "$@" only protect parsing on
    # THIS host — once ssh has taken the argv, the quoting is gone and
    # any shell metacharacter embedded in $CWD (`pwd`, attacker controls
    # via mkdir+cd inside the cage) or in any "$@" element (caller argv
    # for sendmail/crontab/etc.) is interpreted by the remote shell.
    # CLOS-4490 hardened $TOKEN by content validation; that approach
    # does not work for $CWD or $@ (legitimate paths/args may contain
    # spaces, parens, ampersands), so we single-quote each caller-
    # controlled element with sq() before composing the remote command.
    # ssh re-parses the command only once (the origin login shell), so a
    # single quoting pass per value is enough here. $USR is `whoami` so
    # it cannot contain metacharacters in any sane account database, but
    # we quote it too for defense in depth. (CLOS-4596)
    Q_ARGS=
    for _arg in "$@"; do
        Q_ARGS="$Q_ARGS $(sq "$_arg")"
    done
    /usr/bin/ssh -F /etc/ssh/cagefs-rexec_config "$USR@$ORIGIN" \
        "CAGEFS_TOKEN=$TOKEN /usr/sbin/proxyexec -c cagefs.sock $(sq "$USR") $(sq "$CWD") SENDMAIL $$$Q_ARGS"
    RETVAL=$?
else
    trap 'ctrl_c_handler' 2
    CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock "$USR" "$CWD" SENDMAIL $$ "$@"
    RETVAL=$?
    /bin/rm -f $PIDFILE > /dev/null 2>&1
fi

exit $RETVAL