CommandFactory.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Shell;
 
use ExecutableFinder;
use Psr\Log\LoggerAwareTrait;
use Psr\Log\NullLogger;
use Shellbox\Command\BoxedCommand;
use Shellbox\Command\RemoteBoxedExecutor;
use Shellbox\Shellbox;
 
class CommandFactory {
    use LoggerAwareTrait;
 
    private $limits;
 
    private $cgroup;
 
    private $doLogStderr = false;
 
    private $restrictionMethod;
 
    private $firejail;
 
    private $useAllUsers;
 
    private $shellboxClientFactory;
 
    public function __construct( ShellboxClientFactory $shellboxClientFactory,
        array $limits, $cgroup, $restrictionMethod
    ) {
        $this->shellboxClientFactory = $shellboxClientFactory;
        $this->limits = $limits;
        $this->cgroup = $cgroup;
        if ( $restrictionMethod === 'autodetect' ) {
            // On Linux systems check for firejail
            if ( PHP_OS === 'Linux' && $this->findFirejail() ) {
                $this->restrictionMethod = 'firejail';
            } else {
                $this->restrictionMethod = false;
            }
        } else {
            $this->restrictionMethod = $restrictionMethod;
        }
        $this->setLogger( new NullLogger() );
    }
 
    protected function findFirejail() {
        if ( $this->firejail === null ) {
            $this->firejail = ExecutableFinder::findInDefaultPaths( 'firejail' );
        }
 
        return $this->firejail;
    }
 
    public function logStderr( bool $yesno = true ): void {
        $this->doLogStderr = $yesno;
    }
 
    private function getLocalShellboxOptions() {
        $options = [
            'tempDir' => wfTempDir(),
            'useBashWrapper' => file_exists( '/bin/bash' ),
            'cgroup' => $this->cgroup
        ];
        if ( $this->restrictionMethod === 'firejail' ) {
            $firejailPath = $this->findFirejail();
            if ( !$firejailPath ) {
                throw new \RuntimeException( 'firejail is enabled, but cannot be found' );
            }
            $options['useFirejail'] = true;
            $options['firejailPath'] = $firejailPath;
            $options['firejailProfile'] = __DIR__ . '/firejail.profile';
        }
        return $options;
    }
 
    public function create(): Command {
        $allUsers = false;
        if ( $this->restrictionMethod === 'firejail' ) {
            if ( $this->useAllUsers === null ) {
                global $IP;
                // In case people are doing funny things with symlinks
                // or relative paths, resolve them all.
                $realIP = realpath( $IP );
                $currentUser = posix_getpwuid( posix_geteuid() );
                $this->useAllUsers = str_starts_with( $realIP, '/home/' )
                    && !str_starts_with( $realIP, $currentUser['dir'] );
                if ( $this->useAllUsers ) {
                    $this->logger->warning( 'firejail: MediaWiki is located ' .
                        'in a home directory that does not belong to the ' .
                        'current user, so allowing access to all home ' .
                        'directories (--allusers)' );
                }
            }
            $allUsers = $this->useAllUsers;
        }
        $executor = Shellbox::createUnboxedExecutor(
            $this->getLocalShellboxOptions(), $this->logger );
 
        $command = new Command( $executor );
        $command->setLogger( $this->logger );
        if ( $allUsers ) {
            $command->allowPath( '/home' );
        }
        return $command
            ->limits( $this->limits )
            ->logStderr( $this->doLogStderr );
    }
 
    public function createBoxed( ?string $service = null, $wallTimeLimit = null ): BoxedCommand {
        $wallTimeLimit ??= $this->limits['walltime'];
        if ( $this->shellboxClientFactory->isEnabled( $service ) ) {
            $client = $this->shellboxClientFactory->getClient( [
                'timeout' => $wallTimeLimit + 1,
                'service' => $service,
            ] );
            $executor = new RemoteBoxedExecutor( $client );
            $executor->setLogger( $this->logger );
        } else {
            $executor = Shellbox::createBoxedExecutor(
                $this->getLocalShellboxOptions(),
                $this->logger );
        }
        return $executor->createCommand()
            ->cpuTimeLimit( $this->limits['time'] )
            ->wallTimeLimit( $wallTimeLimit )
            ->memoryLimit( $this->limits['memory'] * 1024 )
            ->fileSizeLimit( $this->limits['filesize'] * 1024 )
            ->logStderr( $this->doLogStderr );
    }
}