Skip to content

Commit 89ba0d1

Browse files
JSroka7JSroka7
committed
php-fpm chroot support
1 parent 87b3ba1 commit 89ba0d1

File tree

8 files changed

+57
-1
lines changed

8 files changed

+57
-1
lines changed

‎install/sql/incremental/upd_dev_collection.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
ALTER TABLE `web_domain` ADD COLUMN `ssl_letsencrypt_exclude` enum('n','y') NOT NULL DEFAULT 'n' AFTER `ssl_letsencrypt`;
22
ALTER TABLE `remote_user` ADD `remote_access` ENUM('y','n') NOT NULL DEFAULT 'y' AFTER `remote_password`;
33
ALTER TABLE `remote_user` ADD `remote_ips` TEXT AFTER `remote_access`;
4+
ALTER TABLE `web_domain` ADD `php_fpm_chroot` enum('n','y') NOT NULL DEFAULT 'n' AFTER `php_fpm_use_socket`;

‎install/sql/ispconfig3.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1963,6 +1963,7 @@ CREATE TABLE `web_domain` (
19631963
`apache_directives` mediumtext,
19641964
`nginx_directives` mediumtext,
19651965
`php_fpm_use_socket` ENUM('n','y') NOT NULL DEFAULT 'y',
1966+
`php_fpm_chroot` ENUM('n','y') NOT NULL DEFAULT 'n',
19661967
`pm` enum('static','dynamic','ondemand') NOT NULL DEFAULT 'dynamic',
19671968
`pm_max_children` int(11) NOT NULL DEFAULT '10',
19681969
`pm_start_servers` int(11) NOT NULL DEFAULT '2',

‎interface/web/sites/form/web_vhost_domain.tform.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -766,6 +766,12 @@
766766
'default' => 'n',
767767
'value' => array(0 => 'n', 1 => 'y')
768768
),
769+
'php_fpm_chroot' => array (
770+
'datatype' => 'VARCHAR',
771+
'formtype' => 'CHECKBOX',
772+
'default' => 'n',
773+
'value' => array(0 => 'n', 1 => 'y')
774+
),
769775
'pm' => array (
770776
'datatype' => 'VARCHAR',
771777
'formtype' => 'SELECT',

‎interface/web/sites/lib/lang/en_web_vhost_domain.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ $wb['vhost_type_txt'] = 'VHost Type';
2929
$wb['hd_quota_txt'] = 'Harddisk Quota';
3030
$wb['traffic_quota_txt'] = 'Traffic Quota';
3131
$wb['cgi_txt'] = 'CGI';
32+
$wb['php_fpm_chroot_txt'] = 'PHP-FPM Chroot';
3233
$wb['ssi_txt'] = 'SSI';
3334
$wb['errordocs_txt'] = 'Own Error-Documents';
3435
$wb['subdomain_txt'] = 'Auto-Subdomain';

‎interface/web/sites/templates/web_vhost_domain_advanced.htm‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ <h1><tmpl_var name="list_head_txt"></h1>
5757
{tmpl_var name='php_fpm_use_socket'}
5858
</div>
5959
</div>
60+
<div class="form-group nginx">
61+
<label class="col-sm-3 control-label">{tmpl_var name='php_fpm_chroot_txt'}</label>
62+
<div class="col-sm-9">
63+
{tmpl_var name='php_fpm_chroot'}
64+
</div>
65+
</div>
6066
<div class="form-group">
6167
<label for="pm" class="col-sm-3 control-label">{tmpl_var name='pm_txt'}</label>
6268
<div class="col-sm-9"><select name="pm" id="pm" class="form-control">

‎server/conf/nginx_vhost.conf.master‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,11 @@ server {
167167
fastcgi_pass unix:<tmpl_var name='fpm_socket'>;
168168
</tmpl_if>
169169
fastcgi_index index.php;
170+
<tmpl_if name='php_fpm_chroot'>
171+
fastcgi_param SCRIPT_FILENAME /web$fastcgi_script_name;
172+
</tmpl_else>
170173
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
174+
</tmpl_if>
171175
#fastcgi_param PATH_INFO $fastcgi_script_name;
172176
fastcgi_intercept_errors on;
173177
}

‎server/conf/php_fpm_pool.conf.master‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,20 +26,38 @@ pm.process_idle_timeout = <tmpl_var name='pm_process_idle_timeout'>s;
2626
</tmpl_if>
2727
pm.max_requests = <tmpl_var name='pm_max_requests'>
2828

29+
<tmpl_if name='php_fpm_chroot'>
30+
prefix = <tmpl_var name='document_root'>
31+
chroot = $prefix
32+
</tmpl_if>
2933
chdir = /
3034

3135
env[HOSTNAME] = $HOSTNAME
36+
<tmpl_if name='php_fpm_chroot'>
37+
env[TMP] = /tmp
38+
env[TMPDIR] = /tmp
39+
env[TEMP] = /tmp
40+
</tmpl_else>
3241
env[TMP] = <tmpl_var name='document_root'>/tmp
3342
env[TMPDIR] = <tmpl_var name='document_root'>/tmp
3443
env[TEMP] = <tmpl_var name='document_root'>/tmp
44+
</tmpl_if>
3545
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
3646

3747
<tmpl_if name='security_level' op='==' value='20'>
3848
<tmpl_var name='enable_php_open_basedir'>php_admin_value[open_basedir] = <tmpl_var name='php_open_basedir'>
3949
<tmpl_if name='custom_session_save_path' op='!=' value='y'>
50+
<tmpl_if name='php_fpm_chroot'>
51+
php_admin_value[session.save_path] = /tmp
52+
</tmpl_else>
4053
php_admin_value[session.save_path] = <tmpl_var name='document_root'>/tmp
4154
</tmpl_if>
55+
</tmpl_if>
56+
<tmpl_if name='php_fpm_chroot'>
57+
php_admin_value[upload_tmp_dir] = /tmp
58+
</tmpl_else>
4259
php_admin_value[upload_tmp_dir] = <tmpl_var name='document_root'>/tmp
60+
</tmpl_if>
4361
php_admin_value[sendmail_path] = "/usr/sbin/sendmail -t -i -f webmaster@<tmpl_var name='domain'>"
4462
</tmpl_if>
4563

‎server/plugins-available/nginx_plugin.inc.php‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1024,6 +1024,11 @@ function update($event_name, $data) {
10241024
$socket_dir = escapeshellcmd($web_config['php_fpm_socket_dir']);
10251025
if(substr($socket_dir, -1) != '/') $socket_dir .= '/';
10261026

1027+
if($data['new']['php_fpm_chroot'] == 'y'){
1028+
$php_fpm_chroot = 1;
1029+
} else {
1030+
$php_fpm_chroot = 0;
1031+
}
10271032
if($data['new']['php_fpm_use_socket'] == 'y'){
10281033
$use_tcp = 0;
10291034
$use_socket = 1;
@@ -1033,6 +1038,7 @@ function update($event_name, $data) {
10331038
}
10341039
$tpl->setVar('use_tcp', $use_tcp);
10351040
$tpl->setVar('use_socket', $use_socket);
1041+
$tpl->setVar('php_fpm_chroot', $php_fpm_chroot);
10361042
$fpm_socket = $socket_dir.$pool_name.'.sock';
10371043
$tpl->setVar('fpm_socket', $fpm_socket);
10381044
$tpl->setVar('rnd_php_dummy_file', '/'.md5(uniqid(microtime(), 1)).'.htm');
@@ -2653,6 +2659,11 @@ private function php_fpm_pool_update ($data, $web_config, $pool_dir, $pool_name,
26532659
$tpl = new tpl();
26542660
$tpl->newTemplate('php_fpm_pool.conf.master');
26552661

2662+
if($data['new']['php_fpm_chroot'] == 'y'){
2663+
$php_fpm_chroot = 1;
2664+
} else {
2665+
$php_fpm_chroot = 0;
2666+
}
26562667
if($data['new']['php_fpm_use_socket'] == 'y'){
26572668
$use_tcp = 0;
26582669
$use_socket = 1;
@@ -2663,6 +2674,7 @@ private function php_fpm_pool_update ($data, $web_config, $pool_dir, $pool_name,
26632674
}
26642675
$tpl->setVar('use_tcp', $use_tcp);
26652676
$tpl->setVar('use_socket', $use_socket);
2677+
$tpl->setVar('php_fpm_chroot', $php_fpm_chroot);
26662678

26672679
$fpm_socket = $socket_dir.$pool_name.'.sock';
26682680
$tpl->setVar('fpm_socket', $fpm_socket);
@@ -2702,7 +2714,14 @@ private function php_fpm_pool_update ($data, $web_config, $pool_dir, $pool_name,
27022714
$tpl->setVar('security_level', $web_config['security_level']);
27032715
$tpl->setVar('domain', $data['new']['domain']);
27042716
$php_open_basedir = ($data['new']['php_open_basedir'] == '')?escapeshellcmd($data['new']['document_root']):escapeshellcmd($data['new']['php_open_basedir']);
2705-
$tpl->setVar('php_open_basedir', $php_open_basedir);
2717+
if($php_fpm_chroot){
2718+
$document_root = $data['new']['document_root'];
2719+
$domain = $data['new']['domain'];
2720+
$php_open_basedir = str_replace(":/srv/www/$domain/web",'',$php_open_basedir);
2721+
$php_open_basedir = str_replace(":/var/www/$domain/web",'',$php_open_basedir);
2722+
$php_open_basedir = str_replace("$document_root",'',$php_open_basedir);
2723+
}
2724+
$tpl->setVar('php_open_basedir', $php_open_basedir);
27062725
if($php_open_basedir != ''){
27072726
$tpl->setVar('enable_php_open_basedir', '');
27082727
} else {

0 commit comments

Comments
 (0)