unicorn-lockdown 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95a450be80782d592a0b960b2855f27332371039ede4ce5459df32a273985240
-  data.tar.gz: 9fb35bc3da1921fb3562bc4f1aa35962e08e628da61c33e14e9beac0b51696e4
+  metadata.gz: f379b63ba85656d84b40cbad69d4574e94ec19dfbccda67ebb92115b09de1b6b
+  data.tar.gz: 762030825817a4d2722b1d9a9019de636839ffb926e8e082e9a0344fe63a9935
 SHA512:
-  metadata.gz: dc4ca6d927ab239a144cc3b3f4f405c03d0280f2e6a1e148f32a8ac416d48eb7ebc898f7b7a7ff09b67863ea0676d0b2b8660e212347fe4466691c000eca591a
-  data.tar.gz: 3240933f222409c814dac82049c055cfd183c275e1a998cf2aa10f539d36a1c9dbec5abef32b35f8c5729dc32d9cc87e506e9d4bf6b2a602e026314dc7e3bd70
+  metadata.gz: 8e7d1b9357f5ef3545b929ab063f1dd31ec4786f8386f0282b6da8a3b92472fcf7f2071839a23dda6f6ea476a62840179c8c2f66cf0bf4866138e98c9c404fd9
+  data.tar.gz: 7c3fa555edec5bb533caab2f709c6f51a199528d669897de152aa1c7ac7230a5592f6709c25ada286a162a1078805662bde19779e51cedd8694975ae86a291d9

data/CHANGELOG

@@ -1,3 +1,9 @@
+= 0.11.0 (2019-03-18)
+
+* Support separate log group and process primary group on Unicorn 5.5.0+ using :group option (jeremyevans)
+
+* Make Roda pg_disconnect plugin support new Roda dispatch API (jeremyevans)
+
 = 0.10.0 (2018-05-21)
 
 * Use Mail.eager_autoload! if using the mail gem (jeremyevans)

data/README.rdoc

@@ -7,8 +7,8 @@ and pledge.
 With the configuration unicorn-lockdown uses, the unicorn process executes as root,
 and the unicorn master process continues to run as root.  The master process
 forks worker processes, which re-exec (fork+exec) so that a new memory layout
-is used in each worker process.  The work process then loads the application,
-after which it chroot's to the application's directory, drops root privileges
+is used in each worker process.  The worker process then loads the application,
+after which it chroots to the application's directory, drops root privileges
 and then runs as the application user (privdrop), then runs pledge to limit
 the allowed system calls to the minimum required to run the application.
 
@@ -90,6 +90,10 @@ Unicorn.lockdown options:
 :app :: (required) a short string for the name of the application, used
         for socket/log file names and in notifications
 :user :: (required) the user to drop privileges to
+:group :: (optional) the group to use to run the application.  On Unicorn
+          5.5.0+, can be an array with two entries, the first used as the
+          process primary group, the second as the owner of the unicorn
+          log files.
 :pledge :: (optional) a pledge string to limit the allowed system calls
            after privileges have been dropped
 :email :: (optional) an email address to use for notifications when the

data/bin/unicorn-lockdown-add

@@ -137,6 +137,13 @@ end
 
 # Setup unicorn configuration file
 unless File.file?(unicorn_conf_file)
+  unicorn_conf_dir = File.dirname(unicorn_conf_file)
+  unless File.directory?(unicorn_conf_dir)
+    puts "Creating #{unicorn_conf_dir}"
+    Dir.mkdir(unicorn_conf_dir)
+    File.chmod(0755, unicorn_conf_dir)
+    File.chown(owner_uid, owner_gid, unicorn_conf_dir) if owner
+  end
   puts "Creating #{unicorn_conf_file}"
   File.binwrite(unicorn_conf_file, <<END)
 require 'unicorn-lockdown'

data/lib/roda/plugins/pg_disconnect.rb

@@ -30,6 +30,16 @@ class Roda
           Process.kill(:QUIT, $$)
           raise
         end
+
+        # When database connection is lost, kill the worker process, so a new one will be generated.
+        # This is necessary because the unix socket used by the database connection is no longer available
+        # once the application is chrooted.
+        def _roda_handle_main_route
+          super
+        rescue Sequel::DatabaseDisconnectError, Sequel::DatabaseConnectionError, PG::ConnectionBad
+          Process.kill(:QUIT, $$)
+          raise
+        end
       end
     end
 

data/lib/unicorn-lockdown.rb

@@ -49,9 +49,13 @@ class << Unicorn
   # to enable programmers to debug and fix the issue.
   attr_accessor :request_logger
 
-  # The user and group name to run as.
+  # The user to run as. Also specifies the group to run as if group_name is not set.
   attr_accessor :user_name
 
+  # The group name to run as.  Can be an array of two strings, where the first string
+  # is the primary group, and the second string is the group used for the log files.
+  attr_accessor :group_name
+
   # The pledge string to use.
   attr_accessor :pledge
 
@@ -77,11 +81,15 @@ class << Unicorn
   # Options:
   # :app :: The name of the application (required)
   # :email : The email to notify for worker crashes
-  # :user :: The user/group to run as (required)
+  # :user :: The user to run as (required)
+  # :group :: The group to run as (if not set, uses :user as the group).
+  #           Can be an array of two strings, where the first string is the primary
+  #           group, and the second string is the group used for the log files.
   # :pledge :: The string to use when pledging
   def lockdown(configurator, opts)
     Unicorn.app_name = opts.fetch(:app)
     Unicorn.user_name = opts.fetch(:user)
+    Unicorn.group_name = opts[:group] || opts[:user]
     Unicorn.email = opts[:email]
     Unicorn.pledge = opts[:pledge]
 
@@ -164,7 +172,7 @@ class << Unicorn
 
         # Drop privileges.  This must be done after chrooting as
         # chrooting requires root privileges.
-        worker.user(Unicorn.user_name, Unicorn.user_name, pwd)
+        worker.user(Unicorn.user_name, Unicorn.group_name, pwd)
 
         if Unicorn.pledge
           # Pledge after dropping privileges, because dropping
@@ -222,7 +230,9 @@ class << Unicorn
 
                 # Then get information from /etc and drop group privileges
                 uid = Etc.getpwnam(Unicorn.user_name).uid
-                gid = Etc.getgrnam(Unicorn.user_name).gid
+                group = Unicorn.group_name
+                group = group.first if group.is_a?(Array)
+                gid = Etc.getgrnam(group).gid
                 if gid && Process.egid != gid
                   Process.initgroups(Unicorn.user_name, gid)
                   Process::GID.change_privilege(gid)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unicorn-lockdown
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-21 00:00:00.000000000 Z
+date: 2019-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pledge
@@ -75,8 +75,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Helper library for running Unicorn with chroot/privdrop/fork+exec/pledge