Merge "Improve the shell cgroup feature"

diff --combined RELEASE-NOTES-1.21
index 36e660e,d7666c0..bf1a20b
--- 1/RELEASE-NOTES-1.21
--- 2/RELEASE-NOTES-1.21
+++ b/RELEASE-NOTES-1.21
@@@ -16,8 -16,6 +16,8 @@@ production
    of page watchers required for the number to be accessible to users
    without the unwatchedpages permission.
  * $wgBug34832TransitionalRollback has been removed.
 +* (bug 29472) $wgUseDynamicDates has been removed and its functionality
 +  disabled.
  
  === New features in 1.21 ===
  * (bug 38110) Schema changes (adding or dropping tables, indicies and
@@@ -87,12 -85,13 +87,15 @@@
    a security fix (bug 42202).
  * Added the ability to limit the wall clock time used by shell processes,
    as well as the CPU time. Configurable with $wgMaxShellWallClockTime.
+ * Allow memory of shell subprocesses to be limited using Linux cgroups
+   instead of ulimit -v, which tends to cause deadlocks in recent versions
+   of ImageMagick. Configurable with $wgShellCgroup.
  * Added $wgWhitelistReadRegexp for regex whitelisting.
  * (bug 5346) Categories that are redirects will be displayed italic in
    the category links section at the bottom of a page.
  * (bug 43915) New maintenance script deleteEqualMessages.php.
 +* New collation uppercase-sv, which is like uppercase, but adapted
 +  to Swedish sort order.
  
  === Bug fixes in 1.21 ===
  * (bug 40353) SpecialDoubleRedirect should support interwiki redirects.
@@@ -198,14 -197,11 +201,14 @@@
  * (bug 43849) ApiQueryImageInfo no longer throws exceptions with ForeignDBRepo
    redirects.
  * On error, any warnings generated before that error will be shown in the result.
 +* action=help suports generalized submodules (modules=query+value), querymodules obsolete
  
  === API internal changes in 1.21 ===
  * For debugging only, a new global $wgDebugAPI removes many API restrictions when true.
    Never use on the production servers, as this flag introduces security holes.
    Whenever enabled, a warning will also be added to all output.
 +* ApiModuleManager now handles all submodules (actions,props,lists) and instantiation
 +* Query stores prop/list/meta as submodules
  
  === Languages updated in 1.21 ===
  

diff --combined includes/DefaultSettings.php
index d0eb89c,04a9004..3b76c57
--- 1/includes/DefaultSettings.php
--- 2/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@@ -2352,6 -2352,11 +2352,6 @@@ $wgBrowserBlackList = array
   */
  $wgLegacySchemaConversion = false;
  
 -/**
 - * Enable to allow rewriting dates in page text.
 - * DOES NOT FORMAT CORRECTLY FOR MOST LANGUAGES.
 - */
 -$wgUseDynamicDates  = false;
  /**
   * Enable dates like 'May 12' instead of '12 May', this only takes effect if
   * the interface is set to English.
@@@ -3765,13 -3770,6 +3765,13 @@@ $wgAllowPrefChange = array()
   */
  $wgSecureLogin = false;
  
 +/**
 + * By default, keep users logged in via HTTPS when $wgSecureLogin is also
 + * true. Users opt-out of HTTPS when they login by de-selecting the checkbox.
 + * @since 1.21
 + */
 +$wgSecureLoginDefaultHTTPS = true;
 +
  /** @} */ # end user accounts }
  
  /************************************************************************//**
@@@ -6188,6 -6186,31 +6188,31 @@@ $wgMaxShellTime = 180
   */
  $wgMaxShellWallClockTime = 180;
  
+ /**
+  * Under Linux: a cgroup directory used to constrain memory usage of shell 
+  * commands. The directory must be writable by the user which runs MediaWiki.
+  *
+  * If specified, this is used instead of ulimit, which is inaccurate, and
+  * causes malloc() to return NULL, which exposes bugs in C applications, making
+  * them segfault or deadlock.
+  *
+  * A wrapper script will create a cgroup for each shell command that runs, as
+  * a subgroup of the specified cgroup. If the memory limit is exceeded, the 
+  * kernel will send a SIGKILL signal to a process in the subgroup.
+  *
+  * @par Example:
+  * @code
+  *    mkdir -p /sys/fs/cgroup/memory/mediawiki
+  *    mkdir -m 0777 /sys/fs/cgroup/memory/mediawiki/job
+  *    echo '$wgShellCgroup = "/sys/fs/cgroup/memory/mediawiki/job";' >> LocalSettings.php
+  * @endcode
+  *
+  * The reliability of cgroup cleanup can be improved by installing a 
+  * notify_on_release script in the root cgroup, see e.g.
+  * https://gerrit.wikimedia.org/r/#/c/40784
+  */
+ $wgShellCgroup = false;
+ 
  /**
   * Executable path of the PHP cli binary (php/php5). Should be set up on install.
   */

diff --combined includes/GlobalFunctions.php
index 90bc891,ce52c74..3fa816f
--- 1/includes/GlobalFunctions.php
--- 2/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@@ -2622,14 -2622,12 +2622,14 @@@ function wfPercent( $nr, $acc = 2, $rou
  /**
   * Find out whether or not a mixed variable exists in a string
   *
 + * @deprecated Just use str(i)pos
   * @param $needle String
   * @param $str String
   * @param $insensitive Boolean
   * @return Boolean
   */
  function in_string( $needle, $str, $insensitive = false ) {
 +      wfDeprecated( __METHOD__, '1.21' );
        $func = 'strpos';
        if( $insensitive ) $func = 'stripos';
  
@@@ -2778,7 -2776,7 +2778,7 @@@ function wfEscapeShellArg( ) 
   */
  function wfShellExec( $cmd, &$retval = null, $environ = array(), $limits = array() ) {
        global $IP, $wgMaxShellMemory, $wgMaxShellFileSize, $wgMaxShellTime,
-               $wgMaxShellWallClockTime;
+               $wgMaxShellWallClockTime, $wgShellCgroup;
  
        static $disabled;
        if ( is_null( $disabled ) ) {
@@@ -2837,8 -2835,15 +2837,15 @@@
                $filesize = intval ( isset( $limits['filesize'] ) ? $limits['filesize'] : $wgMaxShellFileSize );
  
                if ( $time > 0 || $mem > 0 || $filesize > 0 || $wallTime > 0 ) {
-                       $cmd = '/bin/bash ' . escapeshellarg( "$IP/bin/ulimit5.sh" ) .
-                               " $time $mem $filesize $wallTime " . escapeshellarg( $cmd );
+                       $cmd = '/bin/bash ' . escapeshellarg( "$IP/includes/limit.sh" ) . ' ' .
+                               escapeshellarg( $cmd ) . ' ' .
+                               escapeshellarg(
+                                       "MW_CPU_LIMIT=$time; " .
+                                       'MW_CGROUP=' . escapeshellarg( $wgShellCgroup ) . '; ' .
+                                       "MW_MEM_LIMIT=$mem; " .
+                                       "MW_FILE_SIZE_LIMIT=$filesize; " .
+                                       "MW_WALL_CLOCK_LIMIT=$wallTime"
+                               );
                }
        }
        wfDebug( "wfShellExec: $cmd\n" );