diff options
| author | Kunal Mehta <legoktm@member.fsf.org> | 2017-10-17 23:54:19 -0700 |
|---|---|---|
| committer | Tim Starling <tstarling@wikimedia.org> | 2017-11-28 00:06:40 +0000 |
| commit | bdb5b592f444f4670070808048afcb0bb1adcc5a (patch) | |
| tree | adbc1178addde9ce93983b9ecc7c8a9057298e7b /includes/shell/firejail.profile | |
| parent | e4e7c5acf3e59895dae977c65cbf75ee0c08257b (diff) | |
| download | mediawikicore-bdb5b592f444f4670070808048afcb0bb1adcc5a.tar.gz mediawikicore-bdb5b592f444f4670070808048afcb0bb1adcc5a.zip | |
shell: Optionally restrict commands' access with firejail
Introduces a FirejailCommand class, which can be used to add additional
restrictions to a command, for increased security. For now, firejail
containment needs to be enabled on a per-command basis.
The following restrictions are implemented:
* NO_ROOT - disallows any root access, including via setuid binaries
* SECCOMP - block dangerous syscalls with seccomp
* PRIVATE_DEV - create a private /dev
* NO_NETWORK - deny all network access
* NO_EXECVE - block the execve syscall
A convenient Shell::RESTRICT_DEFAULT is equivalent to NO_ROOT | SECCOMP
| PRIVATE_DEV, with the expectation that more restrictions may be added
to it in the future.
In addition, specific paths can be whitelisted with
Command::whitelistPaths(). Any file/directory that isn't whitelisted in
that top level directory (e.g. /srv) won't exist inside the firejail.
$wgShellRestrictionMethod can be set to false for no restriction system,
'firejail' to explicitly use it, or 'autodetect' to autodetect whatever
system is available. In the future the default should be changed to
autodetection once firejail is tested more.
Bug: T173370
Change-Id: Id74df0dbba40e1e7c07c4368aacffb6eb06a17c5
Diffstat (limited to 'includes/shell/firejail.profile')
| -rw-r--r-- | includes/shell/firejail.profile | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/includes/shell/firejail.profile b/includes/shell/firejail.profile new file mode 100644 index 000000000000..07f059bad034 --- /dev/null +++ b/includes/shell/firejail.profile @@ -0,0 +1,7 @@ +# Firejail profile used by MediaWiki when shelling out +# See <https://firejail.wordpress.com/features-3/man-firejail-profile/> for +# syntax documentation +# Persistent local customizations +include /etc/firejail/mediawiki.local +# Persistent global definitions +include /etc/firejail/globals.local |