shell: Optionally restrict commands' access with firejail

[lhc/web/wiklou.git] / includes / shell / CommandFactory.php

diff --git a/includes/shell/CommandFactory.php b/includes/shell/CommandFactory.php
index 84dd50f..78f1d80 100644 (file)
--- a/includes/shell/CommandFactory.php
+++ b/includes/shell/CommandFactory.php
@@ -20,6 +20,7 @@
 
 namespace MediaWiki\Shell;
 
+use ExecutableFinder;
 use Psr\Log\LoggerAwareTrait;
 use Psr\Log\NullLogger;
 
@@ -40,18 +41,47 @@ class CommandFactory {
        /** @var bool */
        private $doLogStderr = false;
 
+       /**
+        * @var string|bool
+        */
+       private $restrictionMethod;
+
+       /**
+        * @var string|bool
+        */
+       private $firejail;
+
        /**
         * Constructor
         *
         * @param array $limits See {@see Command::limits()}
         * @param string|bool $cgroup See {@see Command::cgroup()}
+        * @param string|bool $restrictionMethod
         */
-       public function __construct( array $limits, $cgroup ) {
+       public function __construct( array $limits, $cgroup, $restrictionMethod ) {
                $this->limits = $limits;
                $this->cgroup = $cgroup;
+               if ( $restrictionMethod === 'autodetect' ) {
+                       // On Linux systems check for firejail
+                       if ( PHP_OS === 'Linux' && $this->findFirejail() !== false ) {
+                               $this->restrictionMethod = 'firejail';
+                       } else {
+                               $this->restrictionMethod = false;
+                       }
+               } else {
+                       $this->restrictionMethod = $restrictionMethod;
+               }
                $this->setLogger( new NullLogger() );
        }
 
+       private function findFirejail() {
+               if ( $this->firejail === null ) {
+                       $this->firejail = ExecutableFinder::findInDefaultPaths( 'firejail' );
+               }
+
+               return $this->firejail;
+       }
+
        /**
         * When enabled, text sent to stderr will be logged with a level of 'error'.
         *
@@ -68,7 +98,11 @@ class CommandFactory {
         * @return Command
         */
        public function create() {
-               $command = new Command();
+               if ( $this->restrictionMethod === 'firejail' ) {
+                       $command = new FirejailCommand( $this->findFirejail() );
+               } else {
+                       $command = new Command();
+               }
                $command->setLogger( $this->logger );
 
                return $command