passenger 5.2.1 → 5.2.2

data/src/agent/ExecHelper/ExecHelperMain.cpp

@@ -0,0 +1,295 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2018 Phusion Holding B.V.
+ *
+ *  "Passenger", "Phusion Passenger" and "Union Station" are registered
+ *  trademarks of Phusion Holding B.V.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <cstdio>
+#include <cstdlib>
+#include <cerrno>
+#include <limits.h>
+#include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
+
+#include <string>
+#include <boost/scoped_array.hpp>
+
+#include <Constants.h>
+#include <ProcessManagement/Utils.h>
+#include <Utils/OptionParsing.h>
+#include <Utils/StrIntUtils.h>
+
+namespace Passenger {
+namespace ExecHelper {
+
+using namespace std;
+
+
+struct Options {
+	string user;
+	int programArgStart;
+
+	Options()
+		: programArgStart(2)
+		{ }
+};
+
+static void
+usage() {
+	// ....|---------------Keep output within standard terminal width (80 chars)------------|
+	printf("Usage: " AGENT_EXE " exec-helper [OPTIONS...] <PROGRAM> [ARGS...]\n");
+	printf("Executes the given program under a specific environment.\n");
+	printf("\n");
+	printf("Options:\n");
+	printf("  --user <USER>   Execute as the given user. The GID will be set to the\n");
+	printf("                  user's primary group. Supplementary groups will also\n");
+	printf("                  be set.\n");
+	printf("  --help          Show this help message.\n");
+}
+
+static bool
+parseOption(int argc, const char *argv[], int &i, Options &options) {
+	OptionParser p(usage);
+
+	if (p.isValueFlag(argc, i, argv[i], '\0', "--user")) {
+		options.user = argv[i + 1];
+		i += 2;
+	} else {
+		return false;
+	}
+	return true;
+}
+
+static bool
+parseOptions(int argc, const char *argv[], Options &options) {
+	OptionParser p(usage);
+	int i = 2;
+
+	while (i < argc) {
+		if (parseOption(argc, argv, i, options)) {
+			continue;
+		} else if (p.isFlag(argv[i], 'h', "--help")) {
+			usage();
+			exit(0);
+		} else if (*argv[i] == '-') {
+			fprintf(stderr, "ERROR: unrecognized argument %s. Please type "
+				"'%s exec-helper --help' for usage.\n", argv[i], argv[0]);
+			exit(1);
+		} else {
+			options.programArgStart = i;
+			return true;
+		}
+	}
+
+	return true;
+}
+
+static string
+describeCommand(int argc, const char *argv[], const Options &options) {
+	string result = "'";
+	result.append(argv[options.programArgStart]);
+	result.append("'");
+
+	if (argc > options.programArgStart + 1) {
+		result.append(" (with params '");
+
+		int i = options.programArgStart + 1;
+		while (i < argc) {
+			if (i != options.programArgStart + 1) {
+				result.append(" ");
+			}
+			result.append(argv[i]);
+			i++;
+		}
+
+		result.append("')");
+	}
+
+	return result;
+}
+
+static void
+reportGetpwuidError(const string &user, int e) {
+	if (e == 0) {
+		fprintf(stderr,
+			"ERROR: Cannot lookup up system user database entry for user '%s':"
+			" user does not exist\n", user.c_str());
+	} else {
+		fprintf(stderr,
+			"ERROR: Cannot lookup up system user database entry for user '%s':"
+			" %s (errno=%d)\n",
+			user.c_str(), strerror(e), e);
+	}
+}
+
+static void
+lookupUserGroup(const string &user, uid_t *uid, struct passwd **userInfo, gid_t *gid) {
+	errno = 0;
+	*userInfo = getpwnam(user.c_str());
+	if (*userInfo == NULL) {
+		if (looksLikePositiveNumber(user)) {
+			int e = errno;
+			fprintf(stderr,
+				"Warning: error looking up system user database"
+				" entry for user '%s': %s (errno=%d)\n",
+				user.c_str(), strerror(e), e);
+			*uid = (uid_t) atoi(user.c_str());
+			*userInfo = getpwuid(*uid);
+			if (*userInfo == NULL) {
+				reportGetpwuidError(user, errno);
+				exit(1);
+			} else {
+				*gid = (*userInfo)->pw_gid;
+			}
+		} else {
+			reportGetpwuidError(user, errno);
+			exit(1);
+		}
+	} else {
+		*uid = (*userInfo)->pw_uid;
+		*gid = (*userInfo)->pw_gid;
+	}
+}
+
+static void
+switchGroup(uid_t uid, const struct passwd *userInfo, gid_t gid) {
+	if (userInfo != NULL) {
+		bool setgroupsCalled = false;
+
+		#if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__)
+			#ifdef __APPLE__
+				int groups[1024];
+				int ngroups = sizeof(groups) / sizeof(int);
+			#else
+				gid_t groups[1024];
+				int ngroups = sizeof(groups) / sizeof(gid_t);
+			#endif
+			boost::scoped_array<gid_t> gidset;
+
+			int ret = getgrouplist(userInfo->pw_name, gid,
+				groups, &ngroups);
+			if (ret == -1) {
+				int e = errno;
+				fprintf(stderr, "ERROR: getgrouplist(%s, %d) failed: %s (errno=%d)\n",
+					userInfo->pw_name, (int) gid, strerror(e), e);
+				exit(1);
+			}
+
+			if (ngroups <= NGROUPS_MAX) {
+				setgroupsCalled = true;
+				gidset.reset(new gid_t[ngroups]);
+				if (setgroups(ngroups, gidset.get()) == -1) {
+					int e = errno;
+					fprintf(stderr, "ERROR: setgroups(%d, ...) failed: %s (errno=%d)\n",
+						ngroups, strerror(e), e);
+					exit(1);
+				}
+			}
+		#endif
+
+		if (!setgroupsCalled && initgroups(userInfo->pw_name, gid) == -1) {
+			int e = errno;
+			fprintf(stderr, "ERROR: initgroups(%s, %d) failed: %s (errno=%d)\n",
+				userInfo->pw_name, (int) gid, strerror(e), e);
+			exit(1);
+		}
+	}
+
+	if (setgid(gid) == -1) {
+		int e = errno;
+		fprintf(stderr, "ERROR: setgid(%d) failed: %s (errno=%d)\n",
+			(int) gid, strerror(e), e);
+		exit(1);
+	}
+}
+
+static void
+switchUser(uid_t uid, const struct passwd *userInfo) {
+	if (setuid(uid) == -1) {
+		int e = errno;
+		fprintf(stderr, "setuid(%d) failed: %s (errno=%d)\n",
+			(int) uid, strerror(e), e);
+		exit(1);
+	}
+	if (userInfo != NULL) {
+		setenv("USER", userInfo->pw_name, 1);
+		setenv("LOGNAME", userInfo->pw_name, 1);
+		setenv("SHELL", userInfo->pw_shell, 1);
+		setenv("HOME", userInfo->pw_dir, 1);
+	} else {
+		unsetenv("USER");
+		unsetenv("LOGNAME");
+		unsetenv("SHELL");
+		unsetenv("HOME");
+	}
+}
+
+int
+execHelperMain(int argc, char *argv[]) {
+	if (argc < 3) {
+		usage();
+		exit(1);
+	}
+
+	Options options;
+	if (!parseOptions(argc, (const char **) argv, options)) {
+		fprintf(stderr, "Error parsing arguments.\n");
+		usage();
+		exit(1);
+	}
+
+	resetSignalHandlersAndMask();
+	disableMallocDebugging();
+
+	if (!options.user.empty()) {
+		struct passwd *userInfo;
+		uid_t uid;
+		gid_t gid;
+
+		lookupUserGroup(options.user, &uid, &userInfo, &gid);
+		switchGroup(uid, userInfo, gid);
+		switchUser(uid, userInfo);
+	}
+
+	execvp(argv[options.programArgStart],
+		(char * const *) &argv[options.programArgStart]);
+	int e = errno;
+	fprintf(stderr, "ERROR: unable to execute %s: %s (errno=%d)\n",
+		describeCommand(argc, (const char **) argv, options).c_str(),
+		strerror(e),
+		e);
+	return 1;
+}
+
+
+} // namespace ExecHelper
+} // namespace Passenger
+
+
+int
+execHelperMain(int argc, char *argv[]) {
+	return Passenger::ExecHelper::execHelperMain(argc, argv);
+}

data/src/agent/Shared/Fundamentals/Initialization.cpp

@@ -481,9 +481,14 @@ maybeInitializeSyscallFailureSimulation(const char *processName) {
 
 static void
 initializeLoggingKit(const char *processName, ConfigKit::Store &config,
-	const ConfigKit::Translator &loggingKitTranslator)
+	const ConfigKit::Translator &loggingKitTranslator,
+	const LoggingKitPreInitFunc &loggingKitPreInitFunc)
 {
-	LoggingKit::initialize(config.inspectEffectiveValues(), loggingKitTranslator);
+	Json::Value initialConfig = config.inspectEffectiveValues();
+	if (loggingKitPreInitFunc != NULL) {
+		loggingKitPreInitFunc(initialConfig);
+	}
+	LoggingKit::initialize(initialConfig, loggingKitTranslator);
 	Json::Value dump = LoggingKit::context->inspectConfig();
 
 	if (!dump["file_descriptor_log_target"]["effective_value"].isNull()) {
@@ -548,7 +553,8 @@ void
 initializeAgent(int argc, char **argv[], const char *processName,
 	ConfigKit::Store &config, const ConfigKit::Translator &loggingKitTranslator,
 	OptionParserFunc optionParser,
-	PreinitializationFunc preinit, int argStartIndex)
+	const LoggingKitPreInitFunc &loggingKitPreInitFunc,
+	int argStartIndex)
 {
 	const char *seedStr;
 
@@ -601,11 +607,8 @@ initializeAgent(int argc, char **argv[], const char *processName,
 			}
 		}
 
-		if (preinit != NULL) {
-			preinit(config);
-		}
-
-		initializeLoggingKit(processName, config, loggingKitTranslator);
+		initializeLoggingKit(processName, config, loggingKitTranslator,
+			loggingKitPreInitFunc);
 	} catch (const tracable_exception &e) {
 		P_ERROR("*** ERROR: " << e.what() << "\n" << e.backtrace());
 		exit(1);

data/src/agent/Shared/Fundamentals/Initialization.h

@@ -50,7 +50,7 @@ struct Context {
 };
 
 typedef void (*OptionParserFunc)(int argc, const char **argv, ConfigKit::Store &config);
-typedef void (*PreinitializationFunc)(ConfigKit::Store &config);
+typedef void (*LoggingKitPreInitFunc)(Json::Value &config);
 
 extern Context *context;
 
@@ -58,7 +58,7 @@ extern Context *context;
 void initializeAgent(int argc, char **argv[], const char *processName,
 	ConfigKit::Store &config, const ConfigKit::Translator &loggingKitTranslator,
 	OptionParserFunc optionParser = NULL,
-	PreinitializationFunc preinit = NULL,
+	const LoggingKitPreInitFunc &loggingKitPreInitFunc = NULL,
 	int argStartIndex = 1);
 void shutdownAgent(ConfigKit::Schema *schema, ConfigKit::Store *config);
 

data/src/agent/Watchdog/Config.h

@@ -46,10 +46,12 @@ using namespace std;
  * (do not edit: following text is automatically generated
  * by 'rake configkit_schemas_inline_comments')
  *
- *   admin_panel_authentication                                               object             -          secret
+ *   admin_panel_auth_type                                                    string             -          default("basic")
  *   admin_panel_close_timeout                                                float              -          default(10.0)
  *   admin_panel_connect_timeout                                              float              -          default(30.0)
  *   admin_panel_data_debug                                                   boolean            -          default(false)
+ *   admin_panel_password                                                     string             -          secret
+ *   admin_panel_password_file                                                string             -          -
  *   admin_panel_ping_interval                                                float              -          default(30.0)
  *   admin_panel_ping_timeout                                                 float              -          default(30.0)
  *   admin_panel_proxy_password                                               string             -          secret
@@ -58,6 +60,7 @@ using namespace std;
  *   admin_panel_proxy_username                                               string             -          -
  *   admin_panel_reconnect_timeout                                            float              -          default(5.0)
  *   admin_panel_url                                                          string             -          read_only
+ *   admin_panel_username                                                     string             -          -
  *   admin_panel_websocketpp_debug_access                                     boolean            -          default(false)
  *   admin_panel_websocketpp_debug_error                                      boolean            -          default(false)
  *   app_output_log_level                                                     string             -          default("notice")
@@ -142,7 +145,7 @@ using namespace std;
  *   security_update_checker_interval                                         unsigned integer   -          default(86400)
  *   security_update_checker_proxy_url                                        string             -          -
  *   security_update_checker_url                                              string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
- *   server_software                                                          string             -          default("Phusion_Passenger/5.2.1")
+ *   server_software                                                          string             -          default("Phusion_Passenger/5.2.2")
  *   setsid                                                                   boolean            -          default(false)
  *   show_version_in_header                                                   boolean            -          default(true)
  *   single_app_mode_app_root                                                 string             -          default,read_only

data/src/apache2_module/Config.cpp

@@ -153,6 +153,19 @@ postprocessConfig(server_rec *s, apr_pool_t *pool, apr_pool_t *temp_pool) {
 	}
 
 	serverConfig.manifest = ConfigManifestGenerator(s, temp_pool).execute();
+
+	if (!serverConfig.dumpConfigManifest.empty()) {
+		FILE *f = fopen(serverConfig.dumpConfigManifest.c_str(), "w");
+		if (f == NULL) {
+			fprintf(stderr, "Error opening %s for writing\n",
+				serverConfig.dumpConfigManifest.c_str());
+		} else {
+			string dumpContent = serverConfig.manifest.toStyledString();
+			size_t ret = fwrite(dumpContent.data(), 1, dumpContent.size(), f);
+			(void) ret; // Ignore compilation warning.
+			fclose(f);
+		}
+	}
 }
 
 

data/src/apache2_module/ConfigGeneral/AutoGeneratedDefinitions.cpp

@@ -38,6 +38,26 @@
  *   rake src/apache2_module/ConfigGeneral/AutoGeneratedDefinitions.cpp
  */
 
+AP_INIT_TAKE1("PassengerAdminPanelAuthType",
+	(Take1Func) cmd_passenger_admin_panel_auth_type,
+	NULL,
+	RSRC_CONF,
+	"The authentication type to use when connecting to the admin panel"),
+AP_INIT_TAKE1("PassengerAdminPanelPassword",
+	(Take1Func) cmd_passenger_admin_panel_password,
+	NULL,
+	RSRC_CONF,
+	"The password to use when connecting to the admin panel using basic authentication"),
+AP_INIT_TAKE1("PassengerAdminPanelUrl",
+	(Take1Func) cmd_passenger_admin_panel_url,
+	NULL,
+	RSRC_CONF,
+	"Connect to an admin panel at the given connector URL"),
+AP_INIT_TAKE1("PassengerAdminPanelUsername",
+	(Take1Func) cmd_passenger_admin_panel_username,
+	NULL,
+	RSRC_CONF,
+	"The username to use when connecting to the admin panel using basic authentication"),
 AP_INIT_FLAG("PassengerAllowEncodedSlashes",
 	(FlagFunc) cmd_passenger_allow_encoded_slashes,
 	NULL,
@@ -133,6 +153,11 @@ AP_INIT_FLAG("PassengerDisableSecurityUpdateCheck",
 	NULL,
 	RSRC_CONF,
 	"Whether to disable the Phusion Passenger security update check & notification."),
+AP_INIT_TAKE1("PassengerDumpConfigManifest",
+	(Take1Func) cmd_passenger_dump_config_manifest,
+	NULL,
+	RSRC_CONF,
+	"Dump the Passenger config manifest to the given file, for debugging purposes."),
 AP_INIT_FLAG("PassengerEnabled",
 	(FlagFunc) cmd_passenger_enabled,
 	NULL,
@@ -253,6 +278,11 @@ AP_INIT_TAKE1("PassengerMinInstances",
 	NULL,
 	RSRC_CONF | ACCESS_CONF,
 	"The minimum number of application instances to keep when cleaning idle instances."),
+AP_INIT_TAKE1("PassengerMonitorLogFile",
+	(Take1Func) cmd_passenger_monitor_log_file,
+	NULL,
+	RSRC_CONF | ACCESS_CONF,
+	"Log file path to monitor."),
 AP_INIT_TAKE1("PassengerNodejs",
 	(Take1Func) cmd_passenger_nodejs,
 	NULL,