"""
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
"""
import asyncio
from functools import partial
from pathlib import Path
from defence360agent.contracts.config import Malware, PermissionsConfig
from defence360agent.contracts.messages import MessageType
from defence360agent.feature_management.constants import AV, AV_REPORT, FULL
from defence360agent.feature_management.lookup import feature
from imav.malwarelib.config import (
MalwareHitStatus,
MalwareScanResourceType,
)
from imav.malwarelib.model import MalwareHit
from imav.malwarelib.scan.queue_supervisor_sync import (
QueueSupervisorSync as ScanQueue,
)
from imav.malwarelib.utils.endpoints import MaliciousEndpointStatus
from imav.malwarelib.utils.submit import FALSE_POSITIVE
from defence360agent.model.simplification import run_in_executor
from defence360agent.rpc_tools.lookup import CommonEndpoints, bind
from defence360agent.utils import Scope
from imav.malwarelib.subsys.malware import HackerTrapHitsSaver, MalwareAction
class MalwareEndpoints(CommonEndpoints):
SCOPE = Scope.IM360
def __init__(self, sink):
super().__init__(sink)
self.queue = ScanQueue(sink=sink)
@feature(AV, [FULL, AV_REPORT])
@bind("malware", "malicious", "restore-from-backup")
async def restore_from_backup(self, ids, user=None) -> None:
"""Sends RestoreFromBackupTask message and releases the endpoint."""
hits = MalwareHit.malicious_select(ids, user=user)
if hits:
await self._sink.process_message(
MessageType.RestoreFromBackupTask(hits=hits, initiator=user)
)