Merge "Add support for 'hu-formal'"

[lhc/web/wiklou.git] / includes / shell / FirejailCommand.php

diff --git a/includes/shell/FirejailCommand.php b/includes/shell/FirejailCommand.php
index 0338b53..d818930 100644 (file)
--- a/includes/shell/FirejailCommand.php
+++ b/includes/shell/FirejailCommand.php
@@ -62,6 +62,11 @@ class FirejailCommand extends Command {
        protected function buildFinalCommand( $command ) {
                // If there are no restrictions, don't use firejail
                if ( $this->restrictions === 0 ) {
+                       $splitCommand = explode( ' ', $command, 2 );
+                       $this->logger->debug(
+                               "firejail: Command {$splitCommand[0]} {params} has no restrictions",
+                               [ 'params' => isset( $splitCommand[1] ) ? $splitCommand[1] : '' ]
+                       );
                        return parent::buildFinalCommand( $command );
                }
 
@@ -110,26 +115,32 @@ class FirejailCommand extends Command {
                        }
                }
 
+               if ( $this->hasRestriction( Shell::NO_LOCALSETTINGS ) ) {
+                       $cmd[] = '--blacklist=' . realpath( MW_CONFIG_FILE );
+               }
+
                if ( $this->hasRestriction( Shell::NO_ROOT ) ) {
                        $cmd[] = '--noroot';
                }
 
-               $seccomp = [];
-
-               if ( $this->hasRestriction( Shell::SECCOMP ) ) {
-                       $seccomp[] = '@default';
-               }
+               $useSeccomp = $this->hasRestriction( Shell::SECCOMP );
+               $extraSeccomp = [];
 
                if ( $this->hasRestriction( Shell::NO_EXECVE ) ) {
-                       $seccomp[] = 'execve';
+                       $extraSeccomp[] = 'execve';
                        // Normally firejail will run commands in a bash shell,
                        // but that won't work if we ban the execve syscall, so
                        // run the command without a shell.
                        $cmd[] = '--shell=none';
                }
 
-               if ( $seccomp ) {
-                       $cmd[] = '--seccomp=' . implode( ',', $seccomp );
+               if ( $useSeccomp ) {
+                       $seccomp = '--seccomp';
+                       if ( $extraSeccomp ) {
+                               // The "@default" seccomp group will always be enabled
+                               $seccomp .= '=' . implode( ',', $extraSeccomp );
+                       }
+                       $cmd[] = $seccomp;
                }
 
                if ( $this->hasRestriction( Shell::PRIVATE_DEV ) ) {