includes/shell/FirejailCommand.php

   1 <?php
   2 /**
   3  * Copyright (C) 2017 Kunal Mehta <legoktm@member.fsf.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  */
  20
  21 namespace MediaWiki\Shell;
  22
  23 use RuntimeException;
  24
  25 /**
  26  * Restricts execution of shell commands using firejail
  27  *
  28  * @see https://firejail.wordpress.com/
  29  * @since 1.31
  30  */
  31 class FirejailCommand extends Command {
  32
  33         /**
  34          * @var string Path to firejail
  35          */
  36         private $firejail;
  37
  38         /**
  39          * @var string[]
  40          */
  41         private $whitelistedPaths = [];
  42
  43         /**
  44          * @param string $firejail Path to firejail
  45          */
  46         public function __construct( $firejail ) {
  47                 parent::__construct();
  48                 $this->firejail = $firejail;
  49         }
  50
  51         /**
  52          * @inheritDoc
  53          */
  54         public function whitelistPaths( array $paths ) {
  55                 $this->whitelistedPaths = array_merge( $this->whitelistedPaths, $paths );
  56                 return $this;
  57         }
  58
  59         /**
  60          * @inheritDoc
  61          */
  62         protected function buildFinalCommand( $command ) {
  63                 // If there are no restrictions, don't use firejail
  64                 if ( $this->restrictions === 0 ) {
  65                         return parent::buildFinalCommand( $command );
  66                 }
  67
  68                 if ( $this->firejail === false ) {
  69                         throw new RuntimeException( 'firejail is enabled, but cannot be found' );
  70                 }
  71                 // quiet has to come first to prevent firejail from adding
  72                 // any output.
  73                 $cmd = [ $this->firejail, '--quiet' ];
  74                 // Use a profile that allows people to add local overrides
  75                 // if their system is setup in an incompatible manner. Also it
  76                 // prevents any default profiles from running.
  77                 // FIXME: Doesn't actually override command-line switches?
  78                 $cmd[] = '--profile=' . __DIR__ . '/firejail.profile';
  79
  80                 // By default firejail hides all other user directories, so if
  81                 // MediaWiki is inside a home directory (/home) but not the
  82                 // current user's home directory, pass --allusers to whitelist
  83                 // the home directories again.
  84                 static $useAllUsers = null;
  85                 if ( $useAllUsers === null ) {
  86                         global $IP;
  87                         // In case people are doing funny things with symlinks
  88                         // or relative paths, resolve them all.
  89                         $realIP = realpath( $IP );
  90                         $currentUser = posix_getpwuid( posix_geteuid() );
  91                         $useAllUsers = ( strpos( $realIP, '/home/' ) === 0 )
  92                                 && ( strpos( $realIP, $currentUser['dir'] ) !== 0 );
  93                         if ( $useAllUsers ) {
  94                                 $this->logger->warning( 'firejail: MediaWiki is located ' .
  95                                         'in a home directory that does not belong to the ' .
  96                                         'current user, so allowing access to all home ' .
  97                                         'directories (--allusers)' );
  98                         }
  99                 }
 100
 101                 if ( $useAllUsers ) {
 102                         $cmd[] = '--allusers';
 103                 }
 104
 105                 if ( $this->whitelistedPaths ) {
 106                         // Always whitelist limit.sh
 107                         $cmd[] = '--whitelist=' . __DIR__ . '/limit.sh';
 108                         foreach ( $this->whitelistedPaths as $whitelistedPath ) {
 109                                 $cmd[] = "--whitelist={$whitelistedPath}";
 110                         }
 111                 }
 112
 113                 if ( $this->hasRestriction( Shell::NO_ROOT ) ) {
 114                         $cmd[] = '--noroot';
 115                 }
 116
 117                 $seccomp = [];
 118
 119                 if ( $this->hasRestriction( Shell::SECCOMP ) ) {
 120                         $seccomp[] = '@default';
 121                 }
 122
 123                 if ( $this->hasRestriction( Shell::NO_EXECVE ) ) {
 124                         $seccomp[] = 'execve';
 125                         // Normally firejail will run commands in a bash shell,
 126                         // but that won't work if we ban the execve syscall, so
 127                         // run the command without a shell.
 128                         $cmd[] = '--shell=none';
 129                 }
 130
 131                 if ( $seccomp ) {
 132                         $cmd[] = '--seccomp=' . implode( ',', $seccomp );
 133                 }
 134
 135                 if ( $this->hasRestriction( Shell::PRIVATE_DEV ) ) {
 136                         $cmd[] = '--private-dev';
 137                 }
 138
 139                 if ( $this->hasRestriction( Shell::NO_NETWORK ) ) {
 140                         $cmd[] = '--net=none';
 141                 }
 142
 143                 $builtCmd = implode( ' ', $cmd );
 144
 145                 // Prefix the firejail command in front of the wanted command
 146                 return parent::buildFinalCommand( "$builtCmd -- {$command}" );
 147         }
 148
 149 }