bdb5b592f4
Introduces a FirejailCommand class, which can be used to add additional restrictions to a command, for increased security. For now, firejail containment needs to be enabled on a per-command basis. The following restrictions are implemented: * NO_ROOT - disallows any root access, including via setuid binaries * SECCOMP - block dangerous syscalls with seccomp * PRIVATE_DEV - create a private /dev * NO_NETWORK - deny all network access * NO_EXECVE - block the execve syscall A convenient Shell::RESTRICT_DEFAULT is equivalent to NO_ROOT | SECCOMP | PRIVATE_DEV, with the expectation that more restrictions may be added to it in the future. In addition, specific paths can be whitelisted with Command::whitelistPaths(). Any file/directory that isn't whitelisted in that top level directory (e.g. /srv) won't exist inside the firejail. $wgShellRestrictionMethod can be set to false for no restriction system, 'firejail' to explicitly use it, or 'autodetect' to autodetect whatever system is available. In the future the default should be changed to autodetection once firejail is tested more. Bug: T173370 Change-Id: Id74df0dbba40e1e7c07c4368aacffb6eb06a17c5
113 lines
2.7 KiB
PHP
113 lines
2.7 KiB
PHP
<?php
|
|
/**
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
* http://www.gnu.org/copyleft/gpl.html
|
|
*
|
|
* @file
|
|
*/
|
|
|
|
namespace MediaWiki\Shell;
|
|
|
|
use ExecutableFinder;
|
|
use Psr\Log\LoggerAwareTrait;
|
|
use Psr\Log\NullLogger;
|
|
|
|
/**
|
|
* Factory facilitating dependency injection for Command
|
|
*
|
|
* @since 1.30
|
|
*/
|
|
class CommandFactory {
|
|
use LoggerAwareTrait;
|
|
|
|
/** @var array */
|
|
private $limits;
|
|
|
|
/** @var string|bool */
|
|
private $cgroup;
|
|
|
|
/** @var bool */
|
|
private $doLogStderr = false;
|
|
|
|
/**
|
|
* @var string|bool
|
|
*/
|
|
private $restrictionMethod;
|
|
|
|
/**
|
|
* @var string|bool
|
|
*/
|
|
private $firejail;
|
|
|
|
/**
|
|
* Constructor
|
|
*
|
|
* @param array $limits See {@see Command::limits()}
|
|
* @param string|bool $cgroup See {@see Command::cgroup()}
|
|
* @param string|bool $restrictionMethod
|
|
*/
|
|
public function __construct( array $limits, $cgroup, $restrictionMethod ) {
|
|
$this->limits = $limits;
|
|
$this->cgroup = $cgroup;
|
|
if ( $restrictionMethod === 'autodetect' ) {
|
|
// On Linux systems check for firejail
|
|
if ( PHP_OS === 'Linux' && $this->findFirejail() !== false ) {
|
|
$this->restrictionMethod = 'firejail';
|
|
} else {
|
|
$this->restrictionMethod = false;
|
|
}
|
|
} else {
|
|
$this->restrictionMethod = $restrictionMethod;
|
|
}
|
|
$this->setLogger( new NullLogger() );
|
|
}
|
|
|
|
private function findFirejail() {
|
|
if ( $this->firejail === null ) {
|
|
$this->firejail = ExecutableFinder::findInDefaultPaths( 'firejail' );
|
|
}
|
|
|
|
return $this->firejail;
|
|
}
|
|
|
|
/**
|
|
* When enabled, text sent to stderr will be logged with a level of 'error'.
|
|
*
|
|
* @param bool $yesno
|
|
* @see Command::logStderr
|
|
*/
|
|
public function logStderr( $yesno = true ) {
|
|
$this->doLogStderr = $yesno;
|
|
}
|
|
|
|
/**
|
|
* Instantiates a new Command
|
|
*
|
|
* @return Command
|
|
*/
|
|
public function create() {
|
|
if ( $this->restrictionMethod === 'firejail' ) {
|
|
$command = new FirejailCommand( $this->findFirejail() );
|
|
} else {
|
|
$command = new Command();
|
|
}
|
|
$command->setLogger( $this->logger );
|
|
|
|
return $command
|
|
->limits( $this->limits )
|
|
->cgroup( $this->cgroup )
|
|
->logStderr( $this->doLogStderr );
|
|
}
|
|
}
|