71 lines
3.0 KiB
PHP
71 lines
3.0 KiB
PHP
<?php
|
|
|
|
use Illuminate\Support\Facades\File;
|
|
|
|
/**
|
|
* Nothing runs inside the app container without saying who it is running as.
|
|
*
|
|
* `docker compose exec` is root unless told otherwise, and the deployment
|
|
* scripts relied on that default. When `artisan optimize` failed during a
|
|
* deployment it wrote its error into storage/logs/laravel.log AS ROOT — and
|
|
* from that moment the application could not append to its own log. Monolog
|
|
* threw on every attempt, and a throw while logging is a 500 on every page that
|
|
* logs, with nothing written down to say why.
|
|
*
|
|
* It surfaced days later as a 500 on the VPN config download, that being one of
|
|
* the few pages writing a log line on its way through, and was chased through
|
|
* the VPN code, the encryption key and the session before anyone looked at the
|
|
* owner of a file.
|
|
*
|
|
* docker/entrypoint.sh had it right all along: it drops to www-data for exactly
|
|
* these commands. The rule is only that the user is named — `-u root` is a fine
|
|
* answer where root is what is wanted (the ownership repair in update.sh), as
|
|
* long as somebody chose it.
|
|
*/
|
|
it('never runs a command in the app container as whoever docker felt like', function () {
|
|
$offenders = [];
|
|
|
|
foreach (File::glob(base_path('deploy/*.sh')) as $path) {
|
|
foreach (preg_split('/\R/', File::get($path)) ?: [] as $i => $line) {
|
|
if (! str_contains($line, 'docker compose exec')) {
|
|
continue;
|
|
}
|
|
|
|
// Only the app container. The gateway and the queues are other
|
|
// images with other users, and none of them own this checkout.
|
|
if (! preg_match('/docker compose exec\b[^|]*?\bapp\b/', $line)) {
|
|
continue;
|
|
}
|
|
|
|
if (preg_match('/\s-u\s+\S+/', $line)) {
|
|
continue;
|
|
}
|
|
|
|
// Help text counts. Telling an operator to run it as root is how
|
|
// the file ends up owned by root in the first place.
|
|
$offenders[] = basename($path).':'.($i + 1).' — '.trim($line);
|
|
}
|
|
}
|
|
|
|
expect($offenders)->toBe([]);
|
|
});
|
|
|
|
it('repairs ownership before it needs it, not after', function () {
|
|
// A server already carrying the damage has to heal on its next deployment.
|
|
// Nothing else ever will: a root-owned log file stays root-owned, and the
|
|
// page that trips over it is nowhere near the deployment that caused it.
|
|
$update = File::get(base_path('deploy/update.sh'));
|
|
|
|
expect($update)->toContain('normalise_ownership')
|
|
->and($update)->toContain('chown -R www-data:www-data storage bootstrap/cache');
|
|
|
|
// Before the first unprivileged step, or it cannot help: composer and npm
|
|
// would already have failed on a root-owned vendor directory.
|
|
$repair = strpos($update, "\nnormalise_ownership\n");
|
|
$maintenance = strpos($update, 'php artisan down --retry=60');
|
|
|
|
expect($repair)->not->toBeFalse()
|
|
->and($maintenance)->not->toBeFalse()
|
|
->and($repair)->toBeLessThan($maintenance);
|
|
});
|