Skip to content

Commit dc3482a

Browse files
author
Marius Burkard
committed
Merge branch 'jailkit_update_exclude_web_folders' into 'develop'
Jailkit update exclude web folders See merge request ispconfig/ispconfig3!1271
2 parents 505be17 + 8276280 commit dc3482a

6 files changed

Lines changed: 121 additions & 27 deletions

File tree

‎server/lib/classes/cron.d/600-jailkit_maintenance.inc.php‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,12 @@ public function onRunJob() {
5858
$jailkit_config = $app->getconf->get_server_config($conf['server_id'], 'jailkit');
5959
if (isset($this->jailkit_config) && isset($this->jailkit_config['jailkit_hardlinks'])) {
6060
if ($this->jailkit_config['jailkit_hardlinks'] == 'yes') {
61-
$update_options = array('hardlink');
61+
$options = array('hardlink');
6262
} elseif ($this->jailkit_config['jailkit_hardlinks'] == 'no') {
63-
$update_options = array();
63+
$options = array();
6464
}
6565
} else {
66-
$update_options = array('allow_hardlink');
66+
$options = array('allow_hardlink');
6767
}
6868

6969
// limit the number of jails we update at one time according to time of day
@@ -86,6 +86,14 @@ public function onRunJob() {
8686
// check for any cron job using this jail
8787
$cron_inuse = $app->db->queryOneRecord('SELECT id FROM `cron` WHERE `parent_domain_id` = ? AND `type` = ? AND `server_id` = ?', $rec['domain_id'], 'chrooted', $conf['server_id']);
8888

89+
$records2 = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $rec['domain_id'], $rec['document_root'], $conf['server_id']);
90+
foreach ($records2 as $record2) {
91+
if ($record2['web_folder'] == NULL || $record2['web_folder'] == '') {
92+
continue;
93+
}
94+
$options[] = 'skip='.$record2['web_folder'];
95+
}
96+
8997
if ($shell_user_inuse || $cron_inuse || $rec['php_fpm_chroot'] == 'y' || $rec['delete_unused_jailkit'] != 'y') {
9098
$sections = $jailkit_config['jailkit_chroot_app_sections'];
9199
if (isset($rec['jailkit_chroot_app_sections']) && $rec['jailkit_chroot_app_sections'] != '') {
@@ -104,7 +112,7 @@ public function onRunJob() {
104112

105113
if ($update_hash != $rec['last_jailkit_hash']) {
106114
$app->system->web_folder_protection($rec['document_root'], false);
107-
$app->system->update_jailkit_chroot($rec['document_root'], $sections, $programs, $update_options);
115+
$app->system->update_jailkit_chroot($rec['document_root'], $sections, $programs, $options);
108116
$app->system->web_folder_protection($rec['document_root'], true);
109117
$app->db->query("UPDATE `web_domain` SET `last_jailkit_update` = NOW(), `last_jailkit_hash` = ? WHERE `document_root` = ?", $update_hash, $rec['document_root']);
110118
} else {
@@ -114,7 +122,7 @@ public function onRunJob() {
114122
//$app->log('Removing unused jail: '.$rec['document_root'], LOGLEVEL_DEBUG);
115123
print 'Removing unused jail: '.$rec['document_root']."\n";
116124
$app->system->web_folder_protection($rec['document_root'], false);
117-
$app->system->delete_jailkit_chroot($rec['document_root']);
125+
$app->system->delete_jailkit_chroot($rec['document_root'], $options);
118126
$app->system->web_folder_protection($rec['document_root'], true);
119127

120128
$app->db->query("UPDATE `web_domain` SET `last_jailkit_update` = NOW(), `last_jailkit_hash` = NULL WHERE `document_root` = ?", $rec['document_root']);

‎server/lib/classes/system.inc.php‎

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2415,6 +2415,9 @@ public function create_jailkit_chroot($home_dir, $app_sections = array(), $optio
24152415
# /etc/jailkit/jk_init.ini is the default path, probably not needed?
24162416
$program_args .= ' -c /etc/jailkit/jk_init.ini -j ?';
24172417
foreach($app_sections as $app_section) {
2418+
if ($app_section == '') {
2419+
continue;
2420+
}
24182421
# should check that section exists with jk_init --list ?
24192422
$program_args .= ' ' . escapeshellarg($app_section);
24202423
}
@@ -2494,6 +2497,9 @@ public function create_jailkit_programs($home_dir, $programs = array(), $options
24942497

24952498
$bad_paths = array();
24962499
foreach($programs as $prog) {
2500+
if ($prog == '') {
2501+
continue;
2502+
}
24972503
foreach ($blacklisted_paths_regex as $re) {
24982504
if (preg_match($re, $prog, $matches)) {
24992505
$bad_paths[] = $matches[0];
@@ -2531,9 +2537,23 @@ public function update_jailkit_chroot($home_dir, $sections = array(), $programs
25312537
return false;
25322538
}
25332539

2540+
$jailkit_directories = array(
2541+
'bin',
2542+
'dev',
2543+
'etc',
2544+
'lib',
2545+
'lib32',
2546+
'lib64',
2547+
'opt',
2548+
'sys',
2549+
'usr',
2550+
'var',
2551+
);
2552+
25342553
$opts = array();
25352554
$jk_update_args = '';
25362555
$jk_cp_args = '';
2556+
$skips = '';
25372557
foreach ($options as $opt) {
25382558
switch ($opt) {
25392559
case '-k':
@@ -2547,27 +2567,23 @@ public function update_jailkit_chroot($home_dir, $sections = array(), $programs
25472567
$opts[] = 'force';
25482568
$jk_cp_args .= ' -f';
25492569
break;
2570+
default:
2571+
if (preg_match('@^skip[ =]/?(.+)$@', $opt, $matches) ) {
2572+
if (in_array($matches[1], $jailkit_directories)) {
2573+
$app->log("update_jailkit_chroot: skipping update of jailkit directory $home_dir/".$matches[1]
2574+
. "; if this is in use as a web folder, it is insecure and should be fixed.", LOGLEVEL_WARN);
2575+
}
2576+
$jailkit_directories = $app->functions->array_unset_by_value($jailkit_directories, $matches[1]);
2577+
$skips .= ' --skip=/'.escapeshellarg($matches[1]);
2578+
}
2579+
break;
25502580
}
25512581
}
25522582

25532583
// Change ownership of the chroot directory to root
25542584
$this->chown($home_dir, 'root');
25552585
$this->chgrp($home_dir, 'root');
25562586

2557-
$jailkit_directories = array(
2558-
'bin',
2559-
'dev',
2560-
'etc',
2561-
'lib',
2562-
'lib32',
2563-
'lib64',
2564-
'opt',
2565-
'sys',
2566-
'usr',
2567-
'var',
2568-
);
2569-
2570-
$skips = '';
25712587
$multiple_links = array();
25722588
foreach ($jailkit_directories as $dir) {
25732589
$root_dir = '/'.$dir;
@@ -2739,9 +2755,10 @@ public function update_jailkit_chroot($home_dir, $sections = array(), $programs
27392755
return true;
27402756
}
27412757

2742-
public function delete_jailkit_chroot($home_dir) {
2758+
public function delete_jailkit_chroot($home_dir, $options = array()) {
27432759
global $app;
27442760

2761+
$app->log("delete_jailkit_chroot called for $home_dir with options ".print_r($options, true), LOGLEVEL_DEBUG);
27452762
$app->uses('ini_parser');
27462763

27472764
// Disallow operating on root directory
@@ -2769,6 +2786,21 @@ public function delete_jailkit_chroot($home_dir) {
27692786
'run', # not used by jailkit, but added for cleanup
27702787
);
27712788

2789+
foreach ($options as $opt) {
2790+
switch ($opt) {
2791+
default:
2792+
if (preg_match('@^skip[ =]/?(.+)$@', $opt, $matches) ) {
2793+
$matches[1] = ltrim($matches[1], '/');
2794+
if (in_array($matches[1], $jailkit_directories)) {
2795+
$app->log("delete_jailkit_chroot: skipping removal of jailkit directory .$home_dir/".$matches[1]
2796+
. "; if this is in use as a web folder, it is insecure and should be fixed.", LOGLEVEL_WARN);
2797+
}
2798+
$jailkit_directories = $app->functions->array_unset_by_value($jailkit_directories, $matches[1]);
2799+
}
2800+
break;
2801+
}
2802+
}
2803+
27722804
$removed = '';
27732805
foreach ($jailkit_directories as $dir) {
27742806
$jail_dir = rtrim($home_dir, '/') . '/'.$dir;

‎server/plugins-available/apache2_plugin.inc.php‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -831,6 +831,11 @@ function update($event_name, $data) {
831831
$programs = $jailkit_config['jailkit_chroot_app_programs'] . ' '
832832
. $jailkit_config['jailkit_chroot_cron_programs'];
833833

834+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $data['new']['domain_id'], $data['new']['document_root'], $conf['server_id']);
835+
foreach ($records as $record) {
836+
$options[] = 'skip='.$record['web_folder'];
837+
}
838+
834839
// don't update if last_jailkit_hash is the same
835840
$tmp = $app->db->queryOneRecord('SELECT `last_jailkit_hash` FROM web_domain WHERE domain_id = ?', $data['new']['parent_domain_id']);
836841
if ($update_hash != $tmp['last_jailkit_hash']) {
@@ -3683,7 +3688,7 @@ private function get_seo_redirects($web, $prefix = ''){
36833688

36843689
function _setup_jailkit_chroot()
36853690
{
3686-
global $app;
3691+
global $app, $conf;
36873692

36883693
$app->uses('system');
36893694

@@ -3746,6 +3751,11 @@ function _setup_jailkit_chroot()
37463751
return;
37473752
}
37483753

3754+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $this->website['domain_id'], $this->website['document_root'], $conf['server_id']);
3755+
foreach ($records as $record) {
3756+
$options[] = 'skip='.$record['web_folder'];
3757+
}
3758+
37493759
$app->system->update_jailkit_chroot($this->website['document_root'], $sections, $programs, $options);
37503760
}
37513761

@@ -3824,7 +3834,13 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
38243834
return;
38253835
}
38263836

3827-
$app->system->delete_jailkit_chroot($parent_domain['document_root']);
3837+
$options = array();
3838+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $parent_domain_id, $parent_domain['document_root'], $conf['server_id']);
3839+
foreach ($records as $record) {
3840+
$options[] = 'skip='.$record['web_folder'];
3841+
}
3842+
3843+
$app->system->delete_jailkit_chroot($parent_domain['document_root'], $options);
38283844

38293845
// this gets last_jailkit_update out of sync with master db, but that is ok,
38303846
// as it is only used as a timestamp to moderate the frequency of updating on the slaves

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,11 @@ function _setup_jailkit_chroot()
296296
return;
297297
}
298298

299+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $this->parent_domain['domain_id'], $this->parent_domain['document_root'], $conf['server_id']);
300+
foreach ($records as $record) {
301+
$options[] = 'skip='.$record['web_folder'];
302+
}
303+
299304
$app->system->update_jailkit_chroot($this->parent_domain['document_root'], $sections, $programs, $options);
300305
}
301306

@@ -392,7 +397,13 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
392397
return;
393398
}
394399

395-
$app->system->delete_jailkit_chroot($parent_domain['document_root']);
400+
$options = array();
401+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $parent_domain_id, $parent_domain['document_root'], $conf['server_id']);
402+
foreach ($records as $record) {
403+
$options[] = 'skip='.$record['web_folder'];
404+
}
405+
406+
$app->system->delete_jailkit_chroot($parent_domain['document_root'], $options);
396407

397408
// this gets last_jailkit_update out of sync with master db, but that is ok,
398409
// as it is only used as a timestamp to moderate the frequency of updating on the slaves

‎server/plugins-available/nginx_plugin.inc.php‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -669,6 +669,11 @@ function update($event_name, $data) {
669669
$programs = $jailkit_config['jailkit_chroot_app_programs'] . ' '
670670
. $jailkit_config['jailkit_chroot_cron_programs'];
671671

672+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $data['new']['domain_id'], $data['new']['document_root'], $conf['server_id']);
673+
foreach ($records as $record) {
674+
$options[] = 'skip='.$record['web_folder'];
675+
}
676+
672677
// don't update if last_jailkit_hash is the same
673678
$tmp = $app->db->queryOneRecord('SELECT `last_jailkit_hash` FROM web_domain WHERE domain_id = ?', $data['new']['parent_domain_id']);
674679
if ($update_hash != $tmp['last_jailkit_hash']) {
@@ -3462,7 +3467,7 @@ private function get_seo_redirects($web, $prefix = '', $force_subdomain = false)
34623467

34633468
function _setup_jailkit_chroot()
34643469
{
3465-
global $app;
3470+
global $app, $conf;
34663471

34673472
$app->uses('system');
34683473

@@ -3525,6 +3530,11 @@ function _setup_jailkit_chroot()
35253530
return;
35263531
}
35273532

3533+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $this->website['domain_id'], $this->website['document_root'], $conf['server_id']);
3534+
foreach ($records as $record) {
3535+
$options[] = 'skip='.$record['web_folder'];
3536+
}
3537+
35283538
$app->system->update_jailkit_chroot($this->website['document_root'], $sections, $programs, $options);
35293539
}
35303540

@@ -3602,7 +3612,13 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
36023612
return;
36033613
}
36043614

3605-
$app->system->delete_jailkit_chroot($parent_domain['document_root']);
3615+
$options = array();
3616+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $parent_domain_id, $parent_domain['document_root'], $conf['server_id']);
3617+
foreach ($records as $record) {
3618+
$options[] = 'skip='.$record['web_folder'];
3619+
}
3620+
3621+
$app->system->delete_jailkit_chroot($parent_domain['document_root'], $options);
36063622

36073623
// this gets last_jailkit_update out of sync with master db, but that is ok,
36083624
// as it is only used as a timestamp to moderate the frequency of updating on the slaves

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ function delete($event_name, $data) {
286286

287287
function _setup_jailkit_chroot()
288288
{
289-
global $app;
289+
global $app, $conf;
290290

291291
if (isset($this->jailkit_config) && isset($this->jailkit_config['jailkit_hardlinks'])) {
292292
if ($this->jailkit_config['jailkit_hardlinks'] == 'yes') {
@@ -356,6 +356,11 @@ function _setup_jailkit_chroot()
356356
return;
357357
}
358358

359+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $this->data['new']['parent_domain_id'], $this->data['new']['dir'], $conf['server_id']);
360+
foreach ($records as $record) {
361+
$options[] = 'skip='.$record['web_folder'];
362+
}
363+
359364
$app->system->update_jailkit_chroot($this->data['new']['dir'], $sections, $programs, $options);
360365
}
361366

@@ -621,7 +626,13 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
621626
return;
622627
}
623628

624-
$app->system->delete_jailkit_chroot($parent_domain['document_root']);
629+
$options = array();
630+
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $parent_domain_id, $parent_domain['document_root'], $conf['server_id']);
631+
foreach ($records as $record) {
632+
$options[] = 'skip='.$record['web_folder'];
633+
}
634+
635+
$app->system->delete_jailkit_chroot($parent_domain['document_root'], $options);
625636

626637
// this gets last_jailkit_update out of sync with master db, but that is ok,
627638
// as it is only used as a timestamp to moderate the frequency of updating on the slaves

0 commit comments

Comments
 (0)