shell: Optionally restrict commands' access with firejail

[lhc/web/wiklou.git] / includes / shell / Command.php

diff --git a/includes/shell/Command.php b/includes/shell/Command.php
index 1816c5a..264c3b4 100644 (file)
--- a/includes/shell/Command.php
+++ b/includes/shell/Command.php
@@ -57,7 +57,10 @@ class Command {
        private $method;
 
        /** @var bool */
-       private $useStderr = false;
+       private $doIncludeStderr = false;
+
+       /** @var bool */
+       private $doLogStderr = false;
 
        /** @var bool */
        private $everExecuted = false;
@@ -65,6 +68,13 @@ class Command {
        /** @var string|false */
        private $cgroup = false;
 
+       /**
+        * bitfield with restrictions
+        *
+        * @var int
+        */
+       protected $restrictions = 0;
+
        /**
         * Constructor. Don't call directly, instead use Shell::command()
         *
@@ -180,7 +190,19 @@ class Command {
         * @return $this
         */
        public function includeStderr( $yesno = true ) {
-               $this->useStderr = $yesno;
+               $this->doIncludeStderr = $yesno;
+
+               return $this;
+       }
+
+       /**
+        * When enabled, text sent to stderr will be logged with a level of 'error'.
+        *
+        * @param bool $yesno
+        * @return $this
+        */
+       public function logStderr( $yesno = true ) {
+               $this->doLogStderr = $yesno;
 
                return $this;
        }
@@ -197,6 +219,45 @@ class Command {
                return $this;
        }
 
+       /**
+        * Set additional restrictions for this request
+        *
+        * @since 1.31
+        * @param int $restrictions
+        * @return $this
+        */
+       public function restrict( $restrictions ) {
+               $this->restrictions |= $restrictions;
+
+               return $this;
+       }
+
+       /**
+        * Bitfield helper on whether a specific restriction is enabled
+        *
+        * @param int $restriction
+        *
+        * @return bool
+        */
+       protected function hasRestriction( $restriction ) {
+               return ( $this->restrictions & $restriction ) === $restriction;
+       }
+
+       /**
+        * If called, only the files/directories that are
+        * whitelisted will be available to the shell command.
+        *
+        * limit.sh will always be whitelisted
+        *
+        * @param string[] $paths
+        *
+        * @return $this
+        */
+       public function whitelistPaths( array $paths ) {
+               // Default implementation is a no-op
+               return $this;
+       }
+
        /**
         * String together all the options and build the final command
         * to execute
@@ -235,7 +296,7 @@ class Command {
                                $cmd = '/bin/bash ' . escapeshellarg( __DIR__ . '/limit.sh' ) . ' ' .
                                        escapeshellarg( $cmd ) . ' ' .
                                        escapeshellarg(
-                                               "MW_INCLUDE_STDERR=" . ( $this->useStderr ? '1' : '' ) . ';' .
+                                               "MW_INCLUDE_STDERR=" . ( $this->doIncludeStderr ? '1' : '' ) . ';' .
                                                "MW_CPU_LIMIT=$time; " .
                                                'MW_CGROUP=' . escapeshellarg( $this->cgroup ) . '; ' .
                                                "MW_MEM_LIMIT=$mem; " .
@@ -246,7 +307,7 @@ class Command {
                                $useLogPipe = true;
                        }
                }
-               if ( !$useLogPipe && $this->useStderr ) {
+               if ( !$useLogPipe && $this->doIncludeStderr ) {
                        $cmd .= ' 2>&1';
                }
 
@@ -424,6 +485,15 @@ class Command {
                        $this->logger->warning( "$logMsg: {command}", [ 'command' => $cmd ] );
                }
 
+               if ( $errBuffer && $this->doLogStderr ) {
+                       $this->logger->error( "Error running {command}: {error}", [
+                               'command' => $cmd,
+                               'error' => $errBuffer,
+                               'exitcode' => $retval,
+                               'exception' => new Exception( 'Shell error' ),
+                       ] );
+               }
+
                return new Result( $retval, $outBuffer, $errBuffer );
        }
 }