FM / malwarelib

/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/

/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib

Name	Size	Mode	Actions
advanced/	-	0755	rm
api/	-	0755	rm
cleanup/	-	0755	rm
difflib/	-	0755	rm
plugins/	-	0755	rm
rpc/	-	0755	rm
scan/	-	0755	rm
subsys/	-	0755	rm
utils/	-	0755	rm
vulnerabilities/	-	0755	rm
__pycache__/	-	0755	rm
config.py	7800	0644	edit dl rm
engine.py	4178	0644	edit dl rm
model.py	38770	0644	edit dl rm
mrs_upload_queue.py	922	0644	edit dl rm
__init__.py	0	0644	edit dl rm

Edit: /opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/engine.py (4178B)

"""
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.

This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>

Single-source binary selector for the malware stack
(scanner / cleaner / vulnerability patcher).

All three on-demand call sites import from here so they cannot disagree by
construction. Realtime selection is gated independently in
``aibolit-resident.service``'s ``ExecStart=`` shell (aibolit repo) and
defended by a ``rustbolit --resident`` self-check (rustbolit repo) — see
DEF-43111.

PUBLIC HELPER for unit tests: patch ``imav.malwarelib.engine.use_rustbolit_stack``
or ``engine._is_enabled`` directly. NEVER patch consumer-side imports —
single-source patching guarantees scanner / cleaner / patcher all see the
same value in one fixture, and avoids the where-to-patch trap.
"""

import logging
import os

from defence360agent.contracts.config import ANTIVIRUS_MODE
from defence360agent.internals.feature_flags import is_enabled as _is_enabled
from imav.malwarelib.cleanup import PROCU2_BINARY, RUSTCURATOR_BINARY
from imav.malwarelib.scan.ai_bolit import AIBOLIT_BINARY, RUSTBOLIT_BINARY

logger = logging.getLogger(__name__)
FF_NAME = "force_aibolit_stack"

# Edge-trigger latch: log only on flag-state transitions, not on every call.
# A scheduled scan with thousands of malware hits would otherwise produce
# thousands of duplicate WARNING lines. Per-spawn observability lives in
# scanner/cleaner/patcher _cmd info-level logs; this stays as a once-per-
# transition signpost.
_last_logged_state: bool | None = None

def use_rustbolit_stack() -> bool:
    """Return True iff scans/cleans/patches should use the rustbolit stack.

A single decision drives scanner, cleaner, and vulnerability patcher.
    Reads the FF on every call; underlying file read is mtime-cached.
    """
    global _last_logged_state
    force_aibolit = _is_enabled(FF_NAME, default=False)
    if force_aibolit != _last_logged_state:
        _last_logged_state = force_aibolit
        if force_aibolit:
            message = (
                "feature flag %r is on; using ai-bolit stack instead of"
                " rustbolit"
            )
        else:
            message = (
                "feature flag %r is off; using rustbolit stack when available"
            )
        logger.warning(message, FF_NAME)
    if force_aibolit:
        return False
    if not os.path.exists(RUSTBOLIT_BINARY):
        return False
    if not (os.path.exists(RUSTCURATOR_BINARY) or ANTIVIRUS_MODE):
        return False
    return True

def scanner_path() -> str:
    """Return the chosen scanner binary path and log it for per-spawn forensics."""
    chosen = RUSTBOLIT_BINARY if use_rustbolit_stack() else AIBOLIT_BINARY
    logger.info("Using scanner: %s", chosen)
    return chosen

def curator_path() -> str:
    """Return the chosen curator binary path and log it for per-spawn forensics.

AV-mode caveat: ``use_rustbolit_stack()`` returns True in AV mode even when
    rustcurator is absent on disk (the scanner only needs rustbolit). The curator
    must independently check rustcurator presence and fall back to procu2 when
    it's missing — otherwise cleanup / patcher subprocesses spawn ENOENT.
    Restores the pre-DEF-43111 ``os.path.exists(RUSTCURATOR_BINARY)`` fallback.
    """
    chosen = (
        RUSTCURATOR_BINARY
        if use_rustbolit_stack() and os.path.exists(RUSTCURATOR_BINARY)
        else PROCU2_BINARY
    )
    logger.info("Using curator: %s", chosen)
    return chosen

cmd: