Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

phpfpm: do not run anything as root #63156

Merged
merged 11 commits into from Jun 27, 2019
Merged

phpfpm: do not run anything as root #63156

merged 11 commits into from Jun 27, 2019

Conversation

Izorkin
Copy link
Contributor

@Izorkin Izorkin commented Jun 15, 2019

Motivation for this change

Work phpfpm in rootless mode.

Services who use php-fpm:

  • roundcube
  • zoneminder
  • icingaweb2
  • limesurvey
  • matomo
  • nextcloud
  • restya-board
  • selfoss
  • tt-rss
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@Izorkin
Copy link
Contributor Author

Izorkin commented Jun 15, 2019

cc @aanderse @Mic92

@aanderse
Copy link
Member

@Izorkin there are many modules using phpfpm I suggest a checklist might be worth making.

@Izorkin Izorkin force-pushed the phpfpm-rootless branch 5 times, most recently from 6c390a5 to 8d1be87 Compare June 16, 2019 09:31
@Izorkin
Copy link
Contributor Author

Izorkin commented Jun 17, 2019

сс @etu

@etu
Copy link
Contributor

etu commented Jun 27, 2019

I've been testing through bits and bobs and yeah, I can't seem to find any breakage. So I think we should pull it in and hope that people report errors if something breaks.

@etu etu merged commit b5478fd into NixOS:master Jun 27, 2019
@Izorkin Izorkin deleted the phpfpm-rootless branch June 27, 2019 18:44
@aanderse
Copy link
Member

@Izorkin I'm having a few issues with this module now.

Also, I don't recall why the socket location was changed from /run/phpfpm/ to /run/phpfpm-${name}. This is a breaking change and I can't seem to remember the justification for it at the moment. Something to do with permissions?

@Izorkin
Copy link
Contributor Author

Izorkin commented Jun 28, 2019

Also, I don't recall why the socket location was changed from /run/phpfpm/ to /run/phpfpm-${name}. This is a breaking change and I can't seem to remember the justification for it at the moment. Something to do with permissions?

To prevent the user "user1" View the contents of the folder / run / phpfpm-example-php73.
Example:

sudo ls -lah /run | grep phpfpm
drwxr-x---  2 user1   user1    60 июн 27 22:05 phpfpm-example-php72
drwxr-x---  2 user2   user2    60 июн 27 22:05 phpfpm-example-php73

sudo ls -lah /run/phpfpm-example-php72

drwxr-x---  2 user1   user1    60 июн 27 22:05 .
drwxr-xr-x 22 root    root    620 июн 28 13:28 ..
srw-------  1 user1   user1     0 июн 27 22:05 php72.sock.sock

sudo ls -lah /run/phpfpm-example-php73

drwxr-x---  2 user2   user2    60 июн 27 22:05 .
drwxr-xr-x 22 root    root    620 июн 28 13:28 ..
srw-------  1 user2   user2     0 июн 27 22:05 php73.sock.sock

@Izorkin
Copy link
Contributor Author

Izorkin commented Jun 28, 2019

@aanderse cheked with RuntimeDirectory = "phpfpm"; and runnig two php-fpm service. Found this error on the second service:

php-fpm[712]: [ERROR] unable to bind listening socket for address '/run/phpfpm/php72.sock': Permission denied (13)
php-fpm[712]: [ERROR] FPM initialization failed
php-fpm[712]: [ERROR] unable to bind listening socket for address '/run/phpfpm/php72.sock': Permission denied (13)
php-fpm[712]: [ERROR] FPM initialization failed

Full access is granted to the first user.

aanderse added a commit to aanderse/nixpkgs that referenced this pull request Jun 29, 2019
This was referenced Jun 29, 2019
aanderse added a commit that referenced this pull request Jul 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants