passenger 5.3.3 → 5.3.4

data/src/agent/Shared/ApiServerUtils.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2015-2017 Phusion Holding B.V.
+ *  Copyright (c) 2015-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -460,7 +460,7 @@ apiServerMakeInternalHttpRequestThreadMain(ApiServerInternalHttpRequest<Server,
 			}
 		}
 
-		if (req.bodyProcessor != NULL) {
+		if (req.bodyProcessor) {
 			req.bodyProcessor(req, resp, io);
 		} else {
 			resp.body = io.readAll(&req.timeout);

data/src/agent/SpawnEnvSetupper/SpawnEnvSetupperMain.cpp

@@ -62,6 +62,7 @@
 #include <ProcessManagement/Spawn.h>
 #include <FileTools/FileManip.h>
 #include <FileTools/PathManip.h>
+#include <SystemTools/UserDatabase.h>
 #include <Utils.h>
 #include <Utils/StrIntUtils.h>
 #include <Core/SpawningKit/Handshake/WorkDir.h>
@@ -321,11 +322,18 @@ lookupUserGroup(const Context &context, uid_t *uid, struct passwd **userInfo,
 				SpawningKit::STEP_ERRORED);
 			recordErrorCategory(context.workDir,
 				SpawningKit::OPERATING_SYSTEM_ERROR);
-			recordAndPrintErrorSummary(context.workDir,
-				"Cannot lookup up system user database entry for user '"
-				+ args["user"].asString() + "': " + strerror(e)
-				+ " (errno=" + toString(e) + ")",
-				true);
+			if (e == 0) {
+				recordAndPrintErrorSummary(context.workDir,
+					"Cannot lookup system user database entry for user '"
+					+ args["user"].asString() + "': entry not found",
+					true);
+			} else {
+				recordAndPrintErrorSummary(context.workDir,
+					"Cannot lookup system user database entry for user '"
+					+ args["user"].asString() + "': " + strerror(e)
+					+ " (errno=" + toString(e) + ")",
+					true);
+			}
 			exit(1);
 		}
 	} else {
@@ -347,11 +355,18 @@ lookupUserGroup(const Context &context, uid_t *uid, struct passwd **userInfo,
 				SpawningKit::STEP_ERRORED);
 			recordErrorCategory(context.workDir,
 				SpawningKit::OPERATING_SYSTEM_ERROR);
-			recordAndPrintErrorSummary(context.workDir,
-				"Cannot lookup up system group database entry for group '"
-				+ args["group"].asString() + "': " + strerror(e)
-				+ " (errno=" + toString(e) + ")",
-				true);
+			if (e == 0) {
+				recordAndPrintErrorSummary(context.workDir,
+					"Cannot lookup up system group database entry for group '"
+					+ args["group"].asString() + "': entry not found",
+					true);
+			} else {
+				recordAndPrintErrorSummary(context.workDir,
+					"Cannot lookup up system group database entry for group '"
+					+ args["group"].asString() + "': " + strerror(e)
+					+ " (errno=" + toString(e) + ")",
+					true);
+			}
 			exit(1);
 		}
 	} else {
@@ -593,8 +608,8 @@ setCurrentWorkingDirectory(const Context &context) {
 			recordProblemDescriptionHTML(context.workDir,
 				"<p>"
 				"The " PROGRAM_NAME " application server tried to start the"
-				" web application as user '" + escapeHTML(getProcessUsername())
-				+ "' and group '" + escapeHTML(getGroupName(getgid()))
+				" web application as user '" + escapeHTML(lookupSystemUsernameByUid(getuid()))
+				+ "' and group '" + escapeHTML(lookupSystemGroupnameByGid(getgid()))
 				+ "'. During this process, " SHORT_PROGRAM_NAME
 				" must be able to access its application root directory '"
 				+ escapeHTML(appRoot) + "'. However, the parent directory '"
@@ -605,8 +620,8 @@ setCurrentWorkingDirectory(const Context &context) {
 				"<p class=\"sole-solution\">"
 				"Please fix the permissions of the directory '" + escapeHTML(appRoot)
 				+ "' in such a way that the directory is accessible by user '"
-				+ escapeHTML(getProcessUsername()) + "' and group '"
-				+ escapeHTML(getGroupName(getgid())) + "'."
+				+ escapeHTML(lookupSystemUsernameByUid(getuid())) + "' and group '"
+				+ escapeHTML(lookupSystemGroupnameByGid(getgid())) + "'."
 				"</p>");
 			exit(1);
 		} else if (ret == -1) {
@@ -637,16 +652,16 @@ setCurrentWorkingDirectory(const Context &context) {
 		if (e == EPERM || e == EACCES) {
 			recordProblemDescriptionHTML(context.workDir,
 				"<p>The " PROGRAM_NAME " application server tried to start the"
-				" web application as user " + escapeHTML(getProcessUsername())
-				+ " and group " + escapeHTML(getGroupName(getgid()))
+				" web application as user " + escapeHTML(lookupSystemUsernameByUid(getuid()))
+				+ " and group " + escapeHTML(lookupSystemGroupnameByGid(getgid()))
 				+ ", with a working directory of "
 				+ escapeHTML(appRoot) + ". However, it encountered a filesystem"
 				" permission error while doing this.</p>");
 		} else {
 			recordProblemDescriptionHTML(context.workDir,
 				"<p>The " PROGRAM_NAME " application server tried to start the"
-				" web application as user " + escapeHTML(getProcessUsername())
-				+ " and group " + escapeHTML(getGroupName(getgid()))
+				" web application as user " + escapeHTML(lookupSystemUsernameByUid(getuid()))
+				+ " and group " + escapeHTML(lookupSystemGroupnameByGid(getgid()))
 				+ ", with a working directory of "
 				+ escapeHTML(appRoot) + ". However, it encountered a filesystem"
 				" error while doing this.</p>");

data/src/agent/Watchdog/Config.h

@@ -146,7 +146,7 @@ using namespace std;
  *   security_update_checker_interval                                         unsigned integer   -          default(86400)
  *   security_update_checker_proxy_url                                        string             -          -
  *   security_update_checker_url                                              string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
- *   server_software                                                          string             -          default("Phusion_Passenger/5.3.3")
+ *   server_software                                                          string             -          default("Phusion_Passenger/5.3.4")
  *   setsid                                                                   boolean            -          default(false)
  *   show_version_in_header                                                   boolean            -          default(true)
  *   single_app_mode_app_root                                                 string             -          default,read_only

data/src/agent/Watchdog/WatchdogMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2017 Phusion Holding B.V.
+ *  Copyright (c) 2010-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -72,6 +72,7 @@
 #include <InstanceDirectory.h>
 #include <FileDescriptor.h>
 #include <FileTools/PathSecurityCheck.h>
+#include <SystemTools/UserDatabase.h>
 #include <RandomGenerator.h>
 #include <BackgroundEventLoop.h>
 #include <LoggingKit/LoggingKit.h>
@@ -915,15 +916,14 @@ lowerPrivilege() {
 	string userName = watchdogConfig->get("user").asString();
 
 	if (geteuid() == 0 && !userName.empty()) {
-		struct passwd *pwUser = getpwnam(userName.c_str());
-
-		if (pwUser == NULL) {
-			throw RuntimeException("Cannot lookup user information for user " +
-				userName);
+		OsUser osUser;
+		if (!lookupSystemUserByName(userName, osUser)) {
+			throw NonExistentUserException("Operating system user '" + userName
+				+ "' does not exist");
 		}
 
-		gid_t gid = pwUser->pw_gid;
-		string groupName = getGroupName(pwUser->pw_gid);
+		gid_t gid = osUser.pwd.pw_gid;
+		string groupName = lookupSystemGroupnameByGid(gid);
 
 		if (initgroups(userName.c_str(), gid) != 0) {
 			int e = errno;
@@ -937,11 +937,11 @@ lowerPrivilege() {
 				"to that of user '" + userName + "' and group '" + groupName +
 				"': cannot set group ID to " + toString(gid), e);
 		}
-		if (setuid(pwUser->pw_uid) != 0) {
+		if (setuid(osUser.pwd.pw_uid) != 0) {
 			int e = errno;
 			throw SystemException("Unable to lower " SHORT_PROGRAM_NAME " watchdog's privilege "
 				"to that of user '" + userName + "' and group '" + groupName +
-				"': cannot set user ID to " + toString(pwUser->pw_uid), e);
+				"': cannot set user ID to " + toString(osUser.pwd.pw_uid), e);
 		}
 		#ifdef __linux__
 			// When we change the uid, /proc/self/pid contents don't change owner,
@@ -952,8 +952,8 @@ lowerPrivilege() {
 			// http://man7.org/linux/man-pages/man5/proc.5.html (search for "dumpable")
 			prctl(PR_SET_DUMPABLE, 1);
 		#endif
-		setenv("USER", pwUser->pw_name, 1);
-		setenv("HOME", pwUser->pw_dir, 1);
+		setenv("USER", osUser.pwd.pw_name, 1);
+		setenv("HOME", osUser.pwd.pw_dir, 1);
 		setenv("UID", toString(gid).c_str(), 1);
 	}
 }
@@ -962,20 +962,20 @@ static void
 lookupDefaultUidGid(uid_t &uid, gid_t &gid) {
 	const string defaultUser = watchdogConfig->get("default_user").asString();
 	const string defaultGroup = watchdogConfig->get("default_group").asString();
-	struct passwd *userEntry;
 
-	userEntry = getpwnam(defaultUser.c_str());
-	if (userEntry == NULL) {
+	OsUser osUser;
+	if (!lookupSystemUserByName(defaultUser, osUser)) {
 		throw NonExistentUserException("Default user '" + defaultUser +
-			"' does not exist.");
+			"' does not exist");
 	}
-	uid = userEntry->pw_uid;
+	uid = osUser.pwd.pw_uid;
 
-	gid = lookupGid(defaultGroup);
-	if (gid == (gid_t) -1) {
+	OsGroup osGroup;
+	if (!lookupSystemGroupByName(defaultGroup, osGroup)) {
 		throw NonExistentGroupException("Default group '" + defaultGroup +
-			"' does not exist.");
+			"' does not exist");
 	}
+	gid = osGroup.grp.gr_gid;
 }
 
 static void

data/src/apache2_module/Config.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2017 Phusion Holding B.V.
+ *  Copyright (c) 2010-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -47,6 +47,7 @@
 #include "DirConfig/AutoGeneratedMergeFunction.cpp"
 #include "Utils.h"
 #include <JsonTools/Autocast.h>
+#include <SystemTools/UserDatabase.h>
 #include <Utils.h>
 #include <Constants.h>
 
@@ -131,16 +132,16 @@ mergeDirConfig(apr_pool_t *p, void *basev, void *addv) {
 void
 postprocessConfig(server_rec *s, apr_pool_t *pool, apr_pool_t *temp_pool) {
 	if (serverConfig.defaultGroup.empty()) {
-		struct passwd *userEntry = getpwnam(serverConfig.defaultUser.c_str());
-		if (userEntry == NULL) {
+		OsUser osUser;
+		if (!lookupSystemUserByName(serverConfig.defaultUser, osUser)) {
 			throw ConfigurationException(
 				"The user that PassengerDefaultUser refers to, '"
 				+ serverConfig.defaultUser
 				+ "', does not exist.");
 		}
 
-		struct group *groupEntry = getgrgid(userEntry->pw_gid);
-		if (groupEntry == NULL) {
+		OsGroup osGroup;
+		if (!lookupSystemGroupByGid(osUser.pwd.pw_gid, osGroup)) {
 			throw ConfigurationException(
 				"The option PassengerDefaultUser is set to '"
 				+ serverConfig.defaultUser
@@ -149,7 +150,7 @@ postprocessConfig(server_rec *s, apr_pool_t *pool, apr_pool_t *temp_pool) {
 				"is broken. Please fix it.");
 		}
 
-		serverConfig.defaultGroup = apr_pstrdup(pool, groupEntry->gr_name);
+		serverConfig.defaultGroup = apr_pstrdup(pool, osGroup.grp.gr_name);
 	}
 
 	serverConfig.manifest = ConfigManifestGenerator(s, temp_pool).execute();

data/src/cxx_supportlib/ConfigKit/Store.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2017 Phusion Holding B.V.
+ *  Copyright (c) 2017-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -207,7 +207,7 @@ private:
 		StringKeyTable<Entry>::ConstIterator it(entries);
 		while (*it != NULL) {
 			const Entry &entry = it.getValue();
-			if (entry.schemaEntry->inspectFilter == NULL) {
+			if (entry.schemaEntry->inspectFilter.empty()) {
 				it.next();
 				continue;
 			}

data/src/cxx_supportlib/Constants.h

@@ -81,7 +81,7 @@
 #define PASSENGER_API_VERSION_MAJOR 0
 #define PASSENGER_API_VERSION_MINOR 3
 #define PASSENGER_DEFAULT_USER "nobody"
-#define PASSENGER_VERSION "5.3.3"
+#define PASSENGER_VERSION "5.3.4"
 #define POOL_HELPER_THREAD_STACK_SIZE 262144
 #define PROCESS_SHUTDOWN_TIMEOUT 60
 #define PROCESS_SHUTDOWN_TIMEOUT_DISPLAY "1 minute"

data/src/cxx_supportlib/Exceptions.h

@@ -61,7 +61,6 @@ void pp_error_destroy(PP_Error *error);
 
 #include <oxt/tracable_exception.hpp>
 #include <string>
-#include <map>
 #include <exception>
 #include <sstream>
 #include <cstring>

data/src/cxx_supportlib/FileTools/PathSecurityCheck.cpp

@@ -31,6 +31,7 @@
 
 #include <FileTools/PathSecurityCheck.h>
 #include <FileTools/PathManip.h>
+#include <SystemTools/UserDatabase.h>
 #include <Utils.h>
 #include <Utils/StrIntUtils.h>
 
@@ -57,7 +58,7 @@ isSinglePathProbablySecureForRootUse(const string &path,
 
 	if (s.st_uid != 0) {
 		errors.push_back(path + " is not secure: it can be modified by user "
-			+ getUserName(s.st_uid));
+			+ lookupSystemUsernameByUid(s.st_uid));
 		return false;
 	}
 
@@ -67,7 +68,7 @@ isSinglePathProbablySecureForRootUse(const string &path,
 
 	if (s.st_mode & S_IWGRP) {
 		errors.push_back(path + " is not secure: it can be modified by group "
-			+ getGroupName(s.st_gid));
+			+ lookupSystemGroupnameByGid(s.st_gid));
 		return false;
 	}
 

data/src/cxx_supportlib/ResourceLocator.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2017 Phusion Holding B.V.
+ *  Copyright (c) 2010-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -36,6 +36,7 @@
 #include <Constants.h>
 #include <Exceptions.h>
 #include <FileTools/FileManip.h>
+#include <SystemTools/UserDatabase.h>
 #include <Utils.h>
 #include <Utils/IniFile.h>
 
@@ -136,26 +137,7 @@ public:
 	}
 
 	string getUserSupportBinariesDir() const {
-		struct passwd pwd, *user;
-		long bufSize;
-		shared_array<char> strings;
-
-		// _SC_GETPW_R_SIZE_MAX is not a maximum:
-		// http://tomlee.co/2012/10/problems-with-large-linux-unix-groups-and-getgrgid_r-getgrnam_r/
-		bufSize = std::max<long>(1024 * 128, sysconf(_SC_GETPW_R_SIZE_MAX));
-		strings.reset(new char[bufSize]);
-
-		user = (struct passwd *) NULL;
-		if (getpwuid_r(getuid(), &pwd, strings.get(), bufSize, &user) != 0) {
-			user = (struct passwd *) NULL;
-		}
-
-		if (user == (struct passwd *) NULL) {
-			int e = errno;
-			throw SystemException("Cannot lookup system user database", e);
-		}
-
-		string result(user->pw_dir);
+		string result(getHomeDir());
 		result.append("/");
 		result.append(USER_NAMESPACE_DIRNAME);
 		result.append("/support-binaries/");

data/src/cxx_supportlib/SafeLibev.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2017 Phusion Holding B.V.
+ *  Copyright (c) 2010-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -224,7 +224,7 @@ public:
 	}
 
 	void run(const Callback &callback) {
-		assert(callback != NULL);
+		assert(callback);
 		if (onEventLoopThread()) {
 			callback();
 		} else {
@@ -233,7 +233,7 @@ public:
 	}
 
 	void runSync(const Callback &callback) {
-		assert(callback != NULL);
+		assert(callback);
 		boost::unique_lock<boost::mutex> l(syncher);
 		bool done = false;
 		commands.push_back(Command(nextCommandId,
@@ -248,13 +248,13 @@ public:
 
 	/** Run a callback after a certain timeout. */
 	void runAfter(unsigned int timeout, const Callback &callback) {
-		assert(callback != NULL);
+		assert(callback);
 		ev_once(loop, -1, 0, timeout / 1000.0, timeoutHandler, new Callback(callback));
 	}
 
 	/** Thread-safe version of runAfter(). */
 	void runAfterTS(unsigned int timeout, const Callback &callback) {
-		assert(callback != NULL);
+		assert(callback);
 		if (onEventLoopThread()) {
 			runAfter(timeout, callback);
 		} else {
@@ -263,7 +263,7 @@ public:
 	}
 
 	unsigned int runLater(const Callback &callback) {
-		assert(callback != NULL);
+		assert(callback);
 		unsigned int result;
 		{
 			boost::unique_lock<boost::mutex> l(syncher);

data/src/cxx_supportlib/ServerKit/Channel.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014-2017 Phusion Holding B.V.
+ *  Copyright (c) 2014-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -478,7 +478,7 @@ protected:
 	void callConsumedCallback() {
 		unsigned int bytesConsumed = this->bytesConsumed;
 		this->bytesConsumed = 0;
-		if (consumedCallback != NULL) {
+		if (consumedCallback) {
 			consumedCallback(this, bytesConsumed);
 		}
 	}

data/src/cxx_supportlib/ServerKit/FileBufferedChannel.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014-2017 Phusion Holding B.V.
+ *  Copyright (c) 2014-2018 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -528,14 +528,14 @@ private:
 	}
 
 	void callBuffersFlushedCallback() {
-		if (buffersFlushedCallback != NULL) {
+		if (buffersFlushedCallback) {
 			FBC_DEBUG("Calling buffersFlushedCallback");
 			buffersFlushedCallback(this);
 		}
 	}
 
 	void callDataFlushedCallback() {
-		if (dataFlushedCallback != NULL) {
+		if (dataFlushedCallback) {
 			FBC_DEBUG("Calling dataFlushedCallback");
 			dataFlushedCallback(this);
 		}