shadowdaoandClaude Opus 5.5
94a73ea8ab
drop_symlink and the logs/ symlink sweep now unlink AS THE CUSTOMER, and user_touch no longer falls back to a root chown -h (a parent dir swapped for a symlink between check and use could still redirect a root path operation). A root-owned leftover error_log is fixed by the existing chown -R, which never follows symlinks. Every operation these helpers perform is now safe even if the customer races it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
100 lines
4.4 KiB
Bash
100 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# shellcheck disable=SC2154 # $uid / $user come from the container environment
|
|
## safe-paths.sh — sourced by entrypoint.sh and entrypoint-fpm.sh. Not executed directly.
|
|
##
|
|
## /home/$user is the customer's bind-mounted site directory: the customer can
|
|
## create anything in it, including symlinks, from SFTP/FTP, cron, or PHP. The
|
|
## entrypoints run as root, and root following a customer symlink is a
|
|
## privilege escalation: `touch`/`chown`/`>` on logs/php-fpm/error.log ->
|
|
## /etc/shadow hands the customer /etc/shadow (container root).
|
|
##
|
|
## Rules the entrypoints follow:
|
|
## * /home/$user itself is the bind-mount point and must be a real directory.
|
|
## * logs/ is WHP-owned and apache / php-fpm open files in it as root, so it
|
|
## must be a real directory and every symlink under it is removed + logged.
|
|
## * Files and dirs are CREATED as the customer (as_user), so a symlink or a
|
|
## swapped path can only reach what the customer could reach anyway.
|
|
## * Ownership changes use `chown -h` / `chown -R` (GNU default -P: never
|
|
## follows symlinks, lchown()s them), never a dereferencing chown.
|
|
## * Customer files are READ as the customer (crontab), never as root.
|
|
|
|
# as_user CMD... : run CMD as the customer uid/gid (no root, no caps).
|
|
as_user() {
|
|
if command -v setpriv >/dev/null 2>&1; then
|
|
setpriv --reuid="$uid" --regid="$uid" --init-groups -- "$@"
|
|
else
|
|
runuser -u "$user" -- "$@"
|
|
fi
|
|
}
|
|
|
|
# drop_symlink PATH : if PATH is a symlink, unlink it and log it. The unlink
|
|
# runs AS THE CUSTOMER: if a parent dir is swapped for a symlink between the
|
|
# check and the rm, the customer can only unlink what they could already.
|
|
drop_symlink() {
|
|
if [ -L "$1" ]; then
|
|
echo "entrypoint: SECURITY: $1 was a symlink to '$(readlink "$1")' - removing" >&2
|
|
as_user rm -f -- "$1" || echo "entrypoint: WARNING: could not remove symlink $1" >&2
|
|
fi
|
|
}
|
|
|
|
# secure_home : run once, right after adduser, before anything else touches
|
|
# /home/$user.
|
|
secure_home() {
|
|
local h="/home/$user"
|
|
if [ -L "$h" ] || [ ! -d "$h" ]; then
|
|
echo "entrypoint: FATAL: $h is not a real directory (symlink or missing) - refusing to start" >&2
|
|
exit 1
|
|
fi
|
|
# The mount point itself: owned by the customer so as_user can create in it.
|
|
chown -h "$user:$user" "$h"
|
|
drop_symlink "$h/logs"
|
|
# public_html may legitimately be a symlink (release-dir deploys); it is left
|
|
# alone and every root-side operation on it runs as the customer instead.
|
|
if [ -d "$h/logs" ] && [ ! -L "$h/logs" ]; then
|
|
# As the customer, find without -L never follows symlinks; -delete unlinks.
|
|
as_user find "$h/logs" -xdev -type l \
|
|
-printf 'entrypoint: SECURITY: %p was a symlink to %l - removed\n' -delete >&2 || true
|
|
fi
|
|
}
|
|
|
|
# user_mkdir DIR... : create directories as the customer.
|
|
user_mkdir() {
|
|
as_user mkdir -p -- "$@"
|
|
}
|
|
|
|
# user_touch FILE : create FILE as the customer (a symlink there is dropped
|
|
# first). Root never touches/chowns it: if it already exists root-owned (left by
|
|
# an older image) the touch fails quietly and the entrypoint's chown -R, which
|
|
# never follows symlinks, fixes the owner.
|
|
user_touch() {
|
|
drop_symlink "$1"
|
|
as_user touch -- "$1" 2>/dev/null || true
|
|
}
|
|
|
|
# load_user_crontab : install /home/$user/crontab, read AS THE CUSTOMER. Root
|
|
# reading it (`crontab -u $user /home/$user/crontab`) would follow a symlink to
|
|
# any root-readable file and install it where the customer can `crontab -l` it.
|
|
load_user_crontab() {
|
|
local f="/home/$user/crontab"
|
|
if [ ! -e "$f" ] && [ ! -L "$f" ]; then
|
|
as_user sh -c 'printf "%s\n" "# User crontab for $1" "# Add your cron jobs here" "# Example: */5 * * * * /home/$1/scripts/my-script.sh" > "$2"' sh "$user" "$f"
|
|
fi
|
|
# No temp file: root writing a predictable /tmp path is the same bug class.
|
|
local content
|
|
if content=$(as_user cat -- "$f" 2>/dev/null); then
|
|
printf '%s\n' "$content" | crontab -u "$user" -
|
|
else
|
|
echo "entrypoint: WARNING: $f not readable as $user - user crontab not loaded" >&2
|
|
fi
|
|
}
|
|
|
|
# open_dir_traversal : chmod 755 the home dir, then add o+x to every directory
|
|
# lacking it (apache/nginx run as their own user and must traverse). Run AS THE
|
|
# CUSTOMER: `find -type d` without -L skips symlinks, but chmod would follow a
|
|
# dir swapped for a symlink between find and chmod; as the customer that can
|
|
# only reach what the customer already owns.
|
|
open_dir_traversal() {
|
|
chmod 755 "/home/$user"
|
|
as_user find "/home/$user" -type d ! -perm -o=x -exec chmod o+x {} + 2>/dev/null || true
|
|
}
|