Skip to content

Commit 21d8980

Browse files
bukkabukka
committed
Fix bug #68591: Configuration test does not perform UID lookups
Addition check in fpm config test to verify existence of user, group, listen.owner and listen.group. Closes GH-10165
1 parent 0464524 commit 21d8980

9 files changed

+242
-25
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ PHP NEWS
66
. Fixed bug #77106 (Missing separator in FPM FastCGI errors). (Jakub Zelenka)
77
. Fixed bug GH-9981 (FPM does not reset fastcgi.error_header).
88
(Jakub Zelenka)
9+
. Fixed bug #68591 (Configuration test does not perform UID lookups).
10+
(Jakub Zelenka)
911

1012
- LDAP:
1113
. Fixed bug GH-10112 (LDAP\Connection::__construct() refers to ldap_create()).

‎sapi/fpm/fpm/fpm_conf.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
#include "fpm_status.h"
3535
#include "fpm_log.h"
3636
#include "fpm_events.h"
37+
#include "fpm_unix.h"
3738
#include "zlog.h"
3839
#ifdef HAVE_SYSTEMD
3940
#include "fpm_systemd.h"
@@ -1854,6 +1855,12 @@ int fpm_conf_init_main(int test_conf, int force_daemon) /* {{{ */
18541855
}
18551856

18561857
if (test_conf) {
1858+
for (struct fpm_worker_pool_s *wp = fpm_worker_all_pools; wp; wp = wp->next) {
1859+
if (!fpm_unix_test_config(wp)) {
1860+
return -1;
1861+
}
1862+
}
1863+
18571864
if (test_conf > 1) {
18581865
fpm_conf_dump();
18591866
}

‎sapi/fpm/fpm/fpm_unix.c

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,55 @@
4646

4747
size_t fpm_pagesize;
4848

49+
50+
static inline bool fpm_unix_is_id(const char* name)
51+
{
52+
return strlen(name) == strspn(name, "0123456789");
53+
}
54+
55+
static struct passwd *fpm_unix_get_passwd(struct fpm_worker_pool_s *wp, const char *name, int flags)
56+
{
57+
struct passwd *pwd = getpwnam(name);
58+
if (!pwd) {
59+
zlog(flags, "[pool %s] cannot get uid for user '%s'", wp->config->name, name);
60+
return NULL;
61+
}
62+
63+
return pwd;
64+
}
65+
66+
static inline bool fpm_unix_check_passwd(struct fpm_worker_pool_s *wp, const char *name, int flags)
67+
{
68+
return !name || fpm_unix_is_id(name) || fpm_unix_get_passwd(wp, name, flags);
69+
}
70+
71+
static struct group *fpm_unix_get_group(struct fpm_worker_pool_s *wp, const char *name, int flags)
72+
{
73+
struct group *group = getgrnam(name);
74+
if (!group) {
75+
zlog(flags, "[pool %s] cannot get gid for group '%s'", wp->config->name, name);
76+
return NULL;
77+
}
78+
79+
return group;
80+
}
81+
82+
static inline bool fpm_unix_check_group(struct fpm_worker_pool_s *wp, const char *name, int flags)
83+
{
84+
return !name || fpm_unix_is_id(name) || fpm_unix_get_group(wp, name, flags);
85+
}
86+
87+
bool fpm_unix_test_config(struct fpm_worker_pool_s *wp)
88+
{
89+
struct fpm_worker_pool_config_s *config = wp->config;
90+
return (
91+
fpm_unix_check_passwd(wp, config->user, ZLOG_ERROR) &&
92+
fpm_unix_check_group(wp, config->group, ZLOG_ERROR) &&
93+
fpm_unix_check_passwd(wp, config->listen_owner, ZLOG_SYSERROR) &&
94+
fpm_unix_check_group(wp, config->listen_group, ZLOG_SYSERROR)
95+
);
96+
}
97+
4998
int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp) /* {{{ */
5099
{
51100
struct fpm_worker_pool_config_s *c = wp->config;
@@ -105,11 +154,10 @@ int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp) /* {{{ */
105154
if ((end = strchr(p, ','))) {
106155
*end++ = 0;
107156
}
108-
pwd = getpwnam(p);
157+
pwd = fpm_unix_get_passwd(wp, p, ZLOG_SYSERROR);
109158
if (pwd) {
110159
zlog(ZLOG_DEBUG, "[pool %s] user '%s' have uid=%d", wp->config->name, p, pwd->pw_uid);
111160
} else {
112-
zlog(ZLOG_SYSERROR, "[pool %s] cannot get uid for user '%s'", wp->config->name, p);
113161
acl_free(acl);
114162
efree(tmp);
115163
return -1;
@@ -138,11 +186,10 @@ int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp) /* {{{ */
138186
if ((end = strchr(p, ','))) {
139187
*end++ = 0;
140188
}
141-
grp = getgrnam(p);
189+
grp = fpm_unix_get_group(wp, p, ZLOG_SYSERROR);
142190
if (grp) {
143191
zlog(ZLOG_DEBUG, "[pool %s] group '%s' have gid=%d", wp->config->name, p, grp->gr_gid);
144192
} else {
145-
zlog(ZLOG_SYSERROR, "[pool %s] cannot get gid for group '%s'", wp->config->name, p);
146193
acl_free(acl);
147194
efree(tmp);
148195
return -1;
@@ -175,14 +222,13 @@ int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp) /* {{{ */
175222
#endif
176223

177224
if (c->listen_owner && *c->listen_owner) {
178-
if (strlen(c->listen_owner) == strspn(c->listen_owner, "0123456789")) {
225+
if (fpm_unix_is_id(c->listen_owner)) {
179226
wp->socket_uid = strtoul(c->listen_owner, 0, 10);
180227
} else {
181228
struct passwd *pwd;
182229

183-
pwd = getpwnam(c->listen_owner);
230+
pwd = fpm_unix_get_passwd(wp, c->listen_owner, ZLOG_SYSERROR);
184231
if (!pwd) {
185-
zlog(ZLOG_SYSERROR, "[pool %s] cannot get uid for user '%s'", wp->config->name, c->listen_owner);
186232
return -1;
187233
}
188234

@@ -192,14 +238,13 @@ int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp) /* {{{ */
192238
}
193239

194240
if (c->listen_group && *c->listen_group) {
195-
if (strlen(c->listen_group) == strspn(c->listen_group, "0123456789")) {
241+
if (fpm_unix_is_id(c->listen_group)) {
196242
wp->socket_gid = strtoul(c->listen_group, 0, 10);
197243
} else {
198244
struct group *grp;
199245

200-
grp = getgrnam(c->listen_group);
246+
grp = fpm_unix_get_group(wp, c->listen_group, ZLOG_SYSERROR);
201247
if (!grp) {
202-
zlog(ZLOG_SYSERROR, "[pool %s] cannot get gid for group '%s'", wp->config->name, c->listen_group);
203248
return -1;
204249
}
205250
wp->socket_gid = grp->gr_gid;
@@ -279,7 +324,7 @@ static int fpm_unix_conf_wp(struct fpm_worker_pool_s *wp) /* {{{ */
279324

280325
if (is_root) {
281326
if (wp->config->user && *wp->config->user) {
282-
if (strlen(wp->config->user) == strspn(wp->config->user, "0123456789")) {
327+
if (fpm_unix_is_id(wp->config->user)) {
283328
wp->set_uid = strtoul(wp->config->user, 0, 10);
284329
pwd = getpwuid(wp->set_uid);
285330
if (pwd) {
@@ -289,9 +334,8 @@ static int fpm_unix_conf_wp(struct fpm_worker_pool_s *wp) /* {{{ */
289334
} else {
290335
struct passwd *pwd;
291336

292-
pwd = getpwnam(wp->config->user);
337+
pwd = fpm_unix_get_passwd(wp, wp->config->user, ZLOG_ERROR);
293338
if (!pwd) {
294-
zlog(ZLOG_ERROR, "[pool %s] cannot get uid for user '%s'", wp->config->name, wp->config->user);
295339
return -1;
296340
}
297341

@@ -304,14 +348,13 @@ static int fpm_unix_conf_wp(struct fpm_worker_pool_s *wp) /* {{{ */
304348
}
305349

306350
if (wp->config->group && *wp->config->group) {
307-
if (strlen(wp->config->group) == strspn(wp->config->group, "0123456789")) {
351+
if (fpm_unix_is_id(wp->config->group)) {
308352
wp->set_gid = strtoul(wp->config->group, 0, 10);
309353
} else {
310354
struct group *grp;
311355

312-
grp = getgrnam(wp->config->group);
356+
grp = fpm_unix_get_group(wp, wp->config->group, ZLOG_ERROR);
313357
if (!grp) {
314-
zlog(ZLOG_ERROR, "[pool %s] cannot get gid for group '%s'", wp->config->name, wp->config->group);
315358
return -1;
316359
}
317360
wp->set_gid = grp->gr_gid;

‎sapi/fpm/fpm/fpm_unix.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55

66
#include "fpm_worker_pool.h"
77

8+
bool fpm_unix_test_config(struct fpm_worker_pool_s *wp);
9+
810
int fpm_unix_resolve_socket_permissions(struct fpm_worker_pool_s *wp);
911
int fpm_unix_set_socket_permissions(struct fpm_worker_pool_s *wp, const char *path);
1012
int fpm_unix_free_socket_permissions(struct fpm_worker_pool_s *wp);

‎sapi/fpm/tests/bug68591-conf-test-group.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
FPM: bug68591 - config test group existence
3+
--SKIPIF--
4+
<?php
5+
include "skipif.inc";
6+
?>
7+
--FILE--
8+
<?php
9+
10+
require_once "tester.inc";
11+
12+
$cfg = <<<EOT
13+
[global]
14+
error_log = {{FILE:LOG}}
15+
[unconfined]
16+
listen = {{ADDR:UDS}}
17+
group = aaaaaa
18+
pm = dynamic
19+
pm.max_children = 5
20+
pm.start_servers = 2
21+
pm.min_spare_servers = 1
22+
pm.max_spare_servers = 3
23+
EOT;
24+
25+
$tester = new FPM\Tester($cfg);
26+
$tester->testConfig();
27+
28+
?>
29+
Done
30+
--EXPECT--
31+
ERROR: [pool unconfined] cannot get gid for group 'aaaaaa'
32+
ERROR: FPM initialization failed
33+
Done
34+
--CLEAN--
35+
<?php
36+
require_once "tester.inc";
37+
FPM\Tester::clean();
38+
?>

‎sapi/fpm/tests/bug68591-conf-test-listen-group.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
FPM: bug68591 - config test listen group existence
3+
--SKIPIF--
4+
<?php
5+
include "skipif.inc";
6+
?>
7+
--FILE--
8+
<?php
9+
10+
require_once "tester.inc";
11+
12+
$cfg = <<<EOT
13+
[global]
14+
error_log = {{FILE:LOG}}
15+
[unconfined]
16+
listen = {{ADDR:UDS}}
17+
listen.group = aaaaaa
18+
pm = dynamic
19+
pm.max_children = 5
20+
pm.start_servers = 2
21+
pm.min_spare_servers = 1
22+
pm.max_spare_servers = 3
23+
EOT;
24+
25+
$tester = new FPM\Tester($cfg);
26+
$tester->testConfig();
27+
28+
?>
29+
Done
30+
--EXPECTF--
31+
ERROR: [pool unconfined] cannot get gid for group 'aaaaaa': %s
32+
ERROR: FPM initialization failed
33+
Done
34+
--CLEAN--
35+
<?php
36+
require_once "tester.inc";
37+
FPM\Tester::clean();
38+
?>

‎sapi/fpm/tests/bug68591-conf-test-listen-owner.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
FPM: bug68591 - config test listen owner existence
3+
--SKIPIF--
4+
<?php
5+
include "skipif.inc";
6+
?>
7+
--FILE--
8+
<?php
9+
10+
require_once "tester.inc";
11+
12+
$cfg = <<<EOT
13+
[global]
14+
error_log = {{FILE:LOG}}
15+
[unconfined]
16+
listen = {{ADDR:UDS}}
17+
listen.owner = aaaaaa
18+
pm = dynamic
19+
pm.max_children = 5
20+
pm.start_servers = 2
21+
pm.min_spare_servers = 1
22+
pm.max_spare_servers = 3
23+
EOT;
24+
25+
$tester = new FPM\Tester($cfg);
26+
$tester->testConfig();
27+
28+
?>
29+
Done
30+
--EXPECTF--
31+
ERROR: [pool unconfined] cannot get uid for user 'aaaaaa': %s
32+
ERROR: FPM initialization failed
33+
Done
34+
--CLEAN--
35+
<?php
36+
require_once "tester.inc";
37+
FPM\Tester::clean();
38+
?>

‎sapi/fpm/tests/bug68591-conf-test-user.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
FPM: bug68591 - config test user existence
3+
--SKIPIF--
4+
<?php
5+
include "skipif.inc";
6+
?>
7+
--FILE--
8+
<?php
9+
10+
require_once "tester.inc";
11+
12+
$cfg = <<<EOT
13+
[global]
14+
error_log = {{FILE:LOG}}
15+
[unconfined]
16+
listen = {{ADDR:UDS}}
17+
user = aaaaaa
18+
pm = dynamic
19+
pm.max_children = 5
20+
pm.start_servers = 2
21+
pm.min_spare_servers = 1
22+
pm.max_spare_servers = 3
23+
EOT;
24+
25+
$tester = new FPM\Tester($cfg);
26+
$tester->testConfig();
27+
28+
?>
29+
Done
30+
--EXPECT--
31+
ERROR: [pool unconfined] cannot get uid for user 'aaaaaa'
32+
ERROR: FPM initialization failed
33+
Done
34+
--CLEAN--
35+
<?php
36+
require_once "tester.inc";
37+
FPM\Tester::clean();
38+
?>

0 commit comments

Comments
 (0)