Skip to content

Commit 8ab148b

Browse files
author
Marius Burkard
committed
- added debug log to exec_safe including returncode
- moved jailkit functions from bash files to system library
1 parent 8f35cdb commit 8ab148b

File tree

3 files changed

+97
-39
lines changed

3 files changed

+97
-39
lines changed

‎server/lib/classes/system.inc.php‎

Lines changed: 84 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2070,6 +2070,8 @@ public function last_exec_retcode() {
20702070
}
20712071

20722072
public function exec_safe($cmd) {
2073+
global $app;
2074+
20732075
$arg_count = func_num_args();
20742076
if($arg_count != substr_count($cmd, '?') + 1) {
20752077
trigger_error('Placeholder count not matching argument list.', E_USER_WARNING);
@@ -2096,12 +2098,93 @@ public function exec_safe($cmd) {
20962098

20972099
$this->_last_exec_out = null;
20982100
$this->_last_exec_retcode = null;
2099-
return exec($cmd, $this->_last_exec_out, $this->_last_exec_retcode);
2101+
$ret = exec($cmd, $this->_last_exec_out, $this->_last_exec_retcode);
2102+
2103+
$this->app->log("safe_exec cmd: " . $cmd . " - return code: " . $this->_last_exec_retcode, LOGLEVEL_DEBUG);
2104+
2105+
return $ret;
21002106
}
21012107

21022108
public function system_safe($cmd) {
21032109
call_user_func_array(array($this, 'exec_safe'), func_get_args());
21042110
return implode("\n", $this->_last_exec_out);
21052111
}
21062112

2113+
public function create_jailkit_user($username, $home_dir, $user_home_dir, $shell = '/bin/bash', $p_user = null, $p_user_home_dir = null) {
2114+
// Check if USERHOMEDIR already exists
2115+
if(!is_dir($home_dir . '/.' . $user_home_dir)) {
2116+
$this->mkdirpath($home_dir . '/.' . $user_home_dir, 0755, $username);
2117+
}
2118+
2119+
// Reconfigure the chroot home directory for the user
2120+
$cmd = 'usermod --home=? ? 2>/dev/null';
2121+
$this->exec_safe($cmd, $home_dir . '/.' . $user_home_dir, $username);
2122+
2123+
// Add the chroot user
2124+
$cmd = 'jk_jailuser -n -s ? -j ? ?';
2125+
$this->exec_safe($cmd, $shell, $home_dir, $username);
2126+
2127+
// We have to reconfigure the chroot home directory for the parent user
2128+
if($p_user !== null) {
2129+
$cmd = 'usermod --home=? ? 2>/dev/null';
2130+
$this->exec_safe($cmd, $home_dir . '/.' . $p_user_home_dir, $p_user);
2131+
}
2132+
2133+
return true;
2134+
}
2135+
2136+
public function create_jailkit_programs($home_dir, $programs = array()) {
2137+
if(empty($programs)) {
2138+
return true;
2139+
}
2140+
$program_args = '';
2141+
foreach($programs as $prog) {
2142+
$program_args .= ' ' . escapeshellarg($prog);
2143+
}
2144+
2145+
$cmd = 'jk_cp -k ?' . $program_args;
2146+
$this->exec_safe($cmd, $home_dir);
2147+
2148+
return true;
2149+
}
2150+
2151+
public function create_jailkit_chroot($home_dir, $app_sections = array()) {
2152+
if(empty($app_sections)) {
2153+
return true;
2154+
}
2155+
2156+
// Change ownership of the chroot directory to root
2157+
$app->system->chown($home_dir, 'root');
2158+
$app->system->chgrp($home_dir, 'root');
2159+
2160+
$app_args = '';
2161+
foreach($app_sections as $app_section) {
2162+
$app_args .= ' ' . escapeshellarg($app_section);
2163+
}
2164+
2165+
// Initialize the chroot into the specified directory with the specified applications
2166+
$cmd = 'jk_init -f -k -c /etc/jailkit/jk_init.ini -j ?' . $app_args;
2167+
$this->exec_safe($cmd, $home_dir);
2168+
2169+
// Create the temp directory
2170+
if(!is_dir($home_dir . '/tmp')) {
2171+
$this->mkdirpath($home_dir . '/tmp', 0777);
2172+
} else {
2173+
$this->chmod($home_dir . '/tmp', 0777);
2174+
}
2175+
2176+
// Fix permissions of the root firectory
2177+
$this->chmod($home_dir . '/bin', 0755); // was chmod g-w $CHROOT_HOMEDIR/bin
2178+
2179+
// mysql needs the socket in the chrooted environment
2180+
$this->mkdirpath($home_dir . '/var/run/mysqld');
2181+
2182+
// ln /var/run/mysqld/mysqld.sock $CHROOT_HOMEDIR/var/run/mysqld/mysqld.sock
2183+
if(!file_exists("/var/run/mysqld/mysqld.sock")) {
2184+
$this->exec_safe('ln ? ?', '/var/run/mysqld/mysqld.sock', $home_dir . '/var/run/mysqld/mysqld.sock');
2185+
}
2186+
2187+
return true;
2188+
}
2189+
21072190
}

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 8 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -216,12 +216,9 @@ function _setup_jailkit_chroot()
216216
//check if the chroot environment is created yet if not create it with a list of program sections from the config
217217
if (!is_dir($this->parent_domain['document_root'].'/etc/jailkit'))
218218
{
219-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_chroot.sh';
220-
$command .= ' ?';
221-
$command .= ' ?';
222-
$app->system->exec_safe($command.' 2>/dev/null', $this->parent_domain['document_root'], $this->jailkit_config['jailkit_chroot_app_sections']);
219+
$app->system->create_jailkit_chroot($this->parent_domain['document_root'], preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_sections']));
223220

224-
$this->app->log("Added jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
221+
$this->app->log("Added jailkit chroot", LOGLEVEL_DEBUG);
225222

226223
$this->app->load('tpl');
227224

@@ -259,19 +256,11 @@ function _add_jailkit_programs()
259256
global $app;
260257

261258
//copy over further programs and its libraries
262-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh';
263-
$command .= ' ?';
264-
$command .= ' ?';
265-
$app->system->exec_safe($command.' 2>/dev/null', $this->parent_domain['document_root'], $this->jailkit_config['jailkit_chroot_app_programs']);
266-
267-
$this->app->log("Added programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
268-
269-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh';
270-
$command .= ' ?';
271-
$command .= ' ?';
272-
$app->system->exec_safe($command.' 2>/dev/null', $this->parent_domain['document_root'], $this->jailkit_config['jailkit_chroot_cron_programs']);
273-
274-
$this->app->log("Added cron programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
259+
$app->system->create_jailkit_programs($this->parent_domain['document_root'], preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_programs']));
260+
$this->app->log("Added app programs to jailkit chroot", LOGLEVEL_DEBUG);
261+
262+
$app->system->create_jailkit_programs($this->parent_domain['document_root'], preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_cron_programs']));
263+
$this->app->log("Added cron programs to jailkit chroot", LOGLEVEL_DEBUG);
275264
}
276265

277266
function _add_jailkit_user()
@@ -288,14 +277,7 @@ function _add_jailkit_user()
288277
// ALWAYS create the user. Even if the user was created before
289278
// if we check if the user exists, then a update (no shell -> jailkit) will not work
290279
// and the user has FULL ACCESS to the root of the server!
291-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_user.sh';
292-
$command .= ' ?';
293-
$command .= ' ?';
294-
$command .= ' ?';
295-
$command .= ' /bin/bash';
296-
$app->system->exec_safe($command.' 2>/dev/null', $this->parent_domain['system_user'], $this->parent_domain['document_root'], $jailkit_chroot_userhome);
297-
298-
$this->app->log("Added jailkit user to chroot with command: ".$command, LOGLEVEL_DEBUG);
280+
$app->system->create_jailkit_user($this->parent_domain['system_user'], $this->parent_domain['document_root'], $jailkit_chroot_userhome);
299281

300282
$app->system->mkdir($this->parent_domain['document_root'].$jailkit_chroot_userhome, 0755, true);
301283
$app->system->chown($this->parent_domain['document_root'].$jailkit_chroot_userhome, $this->parent_domain['system_user']);

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -273,10 +273,8 @@ function _setup_jailkit_chroot()
273273
//check if the chroot environment is created yet if not create it with a list of program sections from the config
274274
if (!is_dir($this->data['new']['dir'].'/etc/jailkit'))
275275
{
276-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_chroot.sh ? ?';
277-
$app->system->exec_safe($command.' 2>/dev/null', $this->data['new']['dir'], $this->jailkit_config['jailkit_chroot_app_sections']);
278-
279-
$this->app->log("Added jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
276+
$app->system->create_jailkit_chroot($this->data['new']['dir'], preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_sections']));
277+
$this->app->log("Added jailkit chroot", LOGLEVEL_DEBUG);
280278

281279
$this->_add_jailkit_programs();
282280

@@ -323,10 +321,8 @@ function _add_jailkit_programs()
323321
$jailkit_chroot_app_program = trim($jailkit_chroot_app_program);
324322
if(is_file($jailkit_chroot_app_program) || is_dir($jailkit_chroot_app_program)){
325323
//copy over further programs and its libraries
326-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh ? ?';
327-
$app->system->exec_safe($command.' 2>/dev/null', $this->data['new']['dir'], $jailkit_chroot_app_program);
328-
329-
$this->app->log("Added programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
324+
$app->system->create_jailkit_programs($this->data['new']['dir'], $jailkit_chroot_app_program);
325+
$this->app->log("Added programs to jailkit chroot", LOGLEVEL_DEBUG);
330326
}
331327
}
332328
}
@@ -357,17 +353,14 @@ function _add_jailkit_user()
357353
// ALWAYS create the user. Even if the user was created before
358354
// if we check if the user exists, then a update (no shell -> jailkit) will not work
359355
// and the user has FULL ACCESS to the root of the server!
360-
$command = '/usr/local/ispconfig/server/scripts/create_jailkit_user.sh ? ? ? ? ? ?';
361-
$app->system->exec_safe($command.' 2>/dev/null', $this->data['new']['username'], $this->data['new']['dir'], $jailkit_chroot_userhome, $this->data['new']['shell'], $this->data['new']['puser'], $jailkit_chroot_puserhome);
356+
$app->system->create_jailkit_user($this->data['new']['username'], $this->data['new']['dir'], $jailkit_chroot_userhome, $this->data['new']['shell'], $this->data['new']['puser'], $jailkit_chroot_puserhome);
362357

363358
$shell = '/usr/sbin/jk_chrootsh';
364359
if($this->data['new']['active'] != 'y') $shell = '/bin/false';
365360

366361
$app->system->usermod($this->data['new']['username'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, $shell);
367362
$app->system->usermod($this->data['new']['puser'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_puserhome, '/usr/sbin/jk_chrootsh');
368363

369-
$this->app->log("Added jailkit user to chroot with command: ".$command, LOGLEVEL_DEBUG);
370-
371364
if(!is_dir($this->data['new']['dir'].$jailkit_chroot_userhome)) {
372365
if(is_dir($this->data['old']['dir'].$jailkit_chroot_userhome_old)) {
373366
$app->system->rename($this->data['old']['dir'].$jailkit_chroot_userhome_old,$this->data['new']['dir'].$jailkit_chroot_userhome);

0 commit comments

Comments
 (0)