feat(cac-lsphp): guarantee $_SERVER path parity via a PHP extension
A site moved from cac-fpm to cac-lsphp must see byte-identical $_SERVER['DOCUMENT_ROOT'] and ['SCRIPT_FILENAME'] (/home/<user>/...). The auto_prepend_file normaliser that did this was PHP_INI_PERDIR, so any site with its own .user.ini auto_prepend_file silently displaced it — the state 7 live shared_ols sites (Wordfence, cPanel imports) are actually in. Hardening the hook was not an option either: making our prepend win would have disabled those Wordfence WAFs. Replace it with cac_path_parity, a small PHP extension that rewrites the filesystem-path $_SERVER keys from RINIT. RINIT cannot be displaced by .user.ini, and it occupies no userland hook, so the customer's own auto_prepend_file stays the only prepend in play and keeps working. The mapping lives in two PHP_INI_SYSTEM settings, which .user.ini (PERDIR / USER only) and ini_set() cannot reach. Mechanism is a path-component-bounded string prefix swap, not realpath(): byte-identical to cac-fpm by construction (realpath would resolve a customer's own symlinked public_html to some third path), no syscall, and no failure path. Every guard fails open and leaves $_SERVER untouched; nothing here can warn, throw or 500 a site. Unconfigured it is fully inert, so cac-fpm and cac-litespeed are unaffected. Built in a separate Dockerfile stage keyed off the existing ARG PHPVER — gcc/phpize/headers never reach the shipped image (verified absent; the image grows ~155kB), and a base-image PHP bump recompiles with no human step. A `lsphp -i | grep` assertion fails the build if the .so does not load, so an image can never ship having silently lost parity. The entrypoint selects the extension when present and removes any stale prepend ini left by an older image; if the extension is somehow not loadable it falls back to the old normaliser and logs a WARNING rather than losing normalisation entirely. It also now logs the active parity mode, and warns when lsphp reports no ini scan dir (previously silent). Probe lsphp with `-i` only: it is the LSAPI SAPI, not the CLI, and answers `-m`/`-r` by printing usage and exiting 0 — a `lsphp -m | grep` check never matches and never errors, which is the exact class of silent always-false assertion this change exists to remove. Verified: 6 .phpt tests; tests/fpm-parity-check.sh proves under the FPM SAPI that with a customer .user.ini auto_prepend_file present both keys are still corrected AND the customer's prepend still runs, and that the old mechanism does not; and in a real built cac-lsphp:php83 container that SCRIPT_FILENAME is rewritten, the customer prepend still fires, and another tenant's path is left untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -22,6 +22,14 @@
|
||||
## /home/$user/public_html files. PHP canonicalises the symlink, so
|
||||
## __FILE__/__DIR__/realpath all report /home/$user/public_html (verified
|
||||
## 2026-06-10) — the customer never sees the /mnt/users path.
|
||||
##
|
||||
## THE $_SERVER STRINGS: the symlink makes paths RESOLVE, but the raw strings OLS
|
||||
## put in $_SERVER['DOCUMENT_ROOT']/['SCRIPT_FILENAME'] still read /mnt/users.
|
||||
## The cac_path_parity extension (baked into the image, configured per-site
|
||||
## below) rewrites those two at request start, so a site moved from cac-fpm to
|
||||
## cac-lsphp sees byte-identical values. It replaced an auto_prepend_file
|
||||
## normaliser that any site's own .user.ini silently displaced — see
|
||||
## ext/cac-path-parity/cac_path_parity.c.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
@@ -60,8 +68,13 @@ SAFE_DOMAIN="$domain"
|
||||
case "$domain" in
|
||||
\*.*) SAFE_DOMAIN="wildcard.${domain#\*.}" ;;
|
||||
esac
|
||||
## The exact path prefix the shared-ols container serves this site from — the
|
||||
## string OLS puts in SCRIPT_FILENAME/DOCUMENT_ROOT. Used twice: for the symlink
|
||||
## that makes it RESOLVE, and for the cac_path_parity mapping that makes it READ
|
||||
## like cac-fpm. Deriving both from one variable keeps them in lockstep.
|
||||
OLS_SITE_PATH="/mnt/users/$user/$SAFE_DOMAIN"
|
||||
mkdir -p "/mnt/users/$user"
|
||||
ln -sfn "/home/$user" "/mnt/users/$user/$SAFE_DOMAIN"
|
||||
ln -sfn "/home/$user" "$OLS_SITE_PATH"
|
||||
|
||||
## ---- detached-lsphp pool sizing ----
|
||||
# shellcheck source=/dev/null
|
||||
@@ -102,7 +115,13 @@ echo "Container memory: ${CONTAINER_MEMORY_MB}MB | PHP_LSAPI_CHILDREN=${PHP_LSAP
|
||||
## ---- per-site ini drop-ins (identical mechanism to entrypoint-litespeed.sh) ----
|
||||
## error_log → the same customer-visible path cac:phpNN / cac-litespeed use, so
|
||||
## "where's my PHP error log?" is answered identically across all site types.
|
||||
SCAN_DIR=$("$LSPHP_BIN" -i 2>/dev/null | awk -F'=> ' '/^Scan this dir/ {print $2; exit}')
|
||||
## Capture lsphp's own info once and read both answers out of it. Probe with
|
||||
## `-i` ONLY: lsphp is the LSAPI SAPI, not the CLI — it accepts just
|
||||
## -[b|c|n|h|i|q|s|v|?] and answers `-m`/`-r` by printing usage and exiting 0, so
|
||||
## a `lsphp -m | grep` test never matches and never errors either.
|
||||
PATH_PARITY_MODE="none"
|
||||
LSPHP_INFO=$("$LSPHP_BIN" -i 2>/dev/null || true)
|
||||
SCAN_DIR=$(printf '%s\n' "$LSPHP_INFO" | awk -F'=> ' '/^Scan this dir/ {print $2; exit}')
|
||||
if [ -n "$SCAN_DIR" ]; then
|
||||
mkdir -p "$SCAN_DIR"
|
||||
cat > "$SCAN_DIR/99-user-error-log.ini" <<EOF
|
||||
@@ -110,15 +129,42 @@ if [ -n "$SCAN_DIR" ]; then
|
||||
error_log = /home/${user}/logs/php-fpm/error.log
|
||||
log_errors = On
|
||||
EOF
|
||||
## Normalise \$_SERVER['DOCUMENT_ROOT']/['SCRIPT_FILENAME'] from the OLS-sent
|
||||
## /mnt/users path back to /home/<user> so cac-lsphp is byte-for-byte 1:1 with
|
||||
## cac-fpm. Customer sites have no auto_prepend by default, so this is safe; a
|
||||
## site that sets its own .user.ini auto_prepend overrides it (paths still
|
||||
## resolve via the symlink either way).
|
||||
cat > "$SCAN_DIR/99-cac-lsphp-normalize.ini" <<'EOF'
|
||||
## ---- $_SERVER path parity with cac-fpm ----
|
||||
## Point the cac_path_parity extension at THIS site's mapping. Same two
|
||||
## values the compatibility symlink above is built from, so the rewrite and
|
||||
## the symlink can never disagree.
|
||||
##
|
||||
## Both settings are PHP_INI_SYSTEM: a customer's .user.ini (PHP_INI_PERDIR /
|
||||
## PHP_INI_USER only) cannot redirect or disable them, and the extension
|
||||
## occupies no userland hook — so the customer's own auto_prepend_file (the
|
||||
## Wordfence WAF on several live sites) keeps working untouched. That
|
||||
## combination is why this is an extension: the previous auto_prepend_file
|
||||
## normaliser was itself PHP_INI_PERDIR and any site with its own prepend
|
||||
## silently displaced it, while making OUR prepend win would have disabled
|
||||
## THEIRS. See ext/cac-path-parity/cac_path_parity.c.
|
||||
if printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$'; then
|
||||
cat > "$SCAN_DIR/99-cac-path-parity.ini" <<EOF
|
||||
; rendered at container start by entrypoint-lsphp.sh
|
||||
cac_path_parity.from = ${OLS_SITE_PATH}
|
||||
cac_path_parity.to = /home/${user}
|
||||
EOF
|
||||
## Drop the pre-extension fallback if an older image left one here — the
|
||||
## container filesystem survives a "docker restart", so an in-place upgrade
|
||||
## must not keep a stale auto_prepend pointing at the old normaliser.
|
||||
rm -f "$SCAN_DIR/99-cac-lsphp-normalize.ini"
|
||||
PATH_PARITY_MODE="extension"
|
||||
else
|
||||
## Degraded fallback for an image built before the extension existed (or one
|
||||
## where it failed to load). Restores the old, .user.ini-defeatable
|
||||
## behaviour rather than losing normalisation entirely — but say so loudly,
|
||||
## because in this mode parity is NOT guaranteed.
|
||||
cat > "$SCAN_DIR/99-cac-lsphp-normalize.ini" <<'EOF'
|
||||
; rendered at container start by entrypoint-lsphp.sh (DEGRADED FALLBACK)
|
||||
auto_prepend_file = /scripts/cac-lsphp-normalize.php
|
||||
EOF
|
||||
PATH_PARITY_MODE="auto_prepend (DEGRADED)"
|
||||
echo "WARNING: entrypoint-lsphp: cac_path_parity extension not loadable in this image — falling back to the auto_prepend normaliser, which a site's own .user.ini auto_prepend_file will silently displace. Rebuild/repull cac-lsphp:php${PHPVER}." >&2
|
||||
fi
|
||||
## Per-site opcache override (panel: Advanced Tuning → OpCache size); falls
|
||||
## back to the baked lsphp-overrides.ini defaults when unset.
|
||||
if [ -n "${OPCACHE_MEMORY_MB:-}" ] || [ -n "${OPCACHE_MAX_FILES:-}" ]; then
|
||||
@@ -129,8 +175,15 @@ EOF
|
||||
[ -n "${OPCACHE_MAX_FILES:-}" ] && echo "opcache.max_accelerated_files = ${OPCACHE_MAX_FILES}"
|
||||
} > "$SCAN_DIR/99-user-opcache.ini"
|
||||
fi
|
||||
else
|
||||
## No scan dir means none of the per-site ini drop-ins land — including the
|
||||
## path-parity mapping. Previously this failed silently; it must not, because
|
||||
## the tier's cac-fpm parity guarantee is one of the things lost.
|
||||
echo "WARNING: entrypoint-lsphp: lsphp reports no additional-ini scan dir — per-site error_log, opcache and \$_SERVER path-parity settings were NOT applied." >&2
|
||||
fi
|
||||
|
||||
echo "entrypoint-lsphp: \$_SERVER path parity = ${PATH_PARITY_MODE} (${OLS_SITE_PATH} -> /home/${user})"
|
||||
|
||||
## ---- ownership ----
|
||||
## Ensure the dirs we created + the log file are customer-owned so lsphp (running
|
||||
## as $user) can read code and write logs. Customer content is already
|
||||
|
||||
Reference in New Issue
Block a user