|
 |
cfc571 |
From eb6941e902e02332019d8cba2ed7a9100fd914b3 Mon Sep 17 00:00:00 2001
|
|
|
cfc571 |
From: Paul Annesley <paul@annesley.cc>
|
|
|
cfc571 |
Date: Wed, 19 Feb 2014 11:48:40 -0800
|
|
|
cfc571 |
Subject: [PATCH] add clear_env option to FPM config
|
|
|
cfc571 |
|
|
|
cfc571 |
This makes it possible to leave the envoronment as is on startup and
|
|
|
cfc571 |
pass all the variables to the workers.
|
|
|
cfc571 |
The default value of clear_env is "yes", preserving previous behaviour.
|
|
|
cfc571 |
Patch by Paul Annesley.
|
|
|
cfc571 |
---
|
|
|
cfc571 |
sapi/fpm/fpm/fpm_conf.c | 3 +++
|
|
|
cfc571 |
sapi/fpm/fpm/fpm_conf.h | 1 +
|
|
|
cfc571 |
sapi/fpm/fpm/fpm_env.c | 4 +++-
|
|
|
cfc571 |
sapi/fpm/php-fpm.conf.in | 9 +++++++++
|
|
|
cfc571 |
4 files changed, 16 insertions(+), 1 deletion(-)
|
|
|
cfc571 |
|
|
|
cfc571 |
diff --git a/sapi/fpm/fpm/fpm_conf.c b/sapi/fpm/fpm/fpm_conf.c
|
|
|
cfc571 |
index cd5fc34d0f2d..688c6402505e 100644
|
|
|
cfc571 |
--- a/sapi/fpm/fpm/fpm_conf.c
|
|
|
cfc571 |
+++ b/sapi/fpm/fpm/fpm_conf.c
|
|
|
cfc571 |
@@ -148,6 +148,7 @@ static struct ini_value_parser_s ini_fpm_pool_options[] = {
|
|
|
cfc571 |
{ "chroot", &fpm_conf_set_string, WPO(chroot) },
|
|
|
cfc571 |
{ "chdir", &fpm_conf_set_string, WPO(chdir) },
|
|
|
cfc571 |
{ "catch_workers_output", &fpm_conf_set_boolean, WPO(catch_workers_output) },
|
|
|
cfc571 |
+ { "clear_env", &fpm_conf_set_boolean, WPO(clear_env) },
|
|
|
cfc571 |
{ "security.limit_extensions", &fpm_conf_set_string, WPO(security_limit_extensions) },
|
|
|
cfc571 |
{ 0, 0, 0 }
|
|
|
cfc571 |
};
|
|
|
cfc571 |
@@ -603,6 +604,7 @@ static void *fpm_worker_pool_config_alloc() /* {{{ */
|
|
|
cfc571 |
wp->config->listen_backlog = FPM_BACKLOG_DEFAULT;
|
|
|
cfc571 |
wp->config->pm_process_idle_timeout = 10; /* 10s by default */
|
|
|
cfc571 |
wp->config->process_priority = 64; /* 64 means unset */
|
|
|
cfc571 |
+ wp->config->clear_env = 1;
|
|
|
cfc571 |
|
|
|
cfc571 |
if (!fpm_worker_all_pools) {
|
|
|
cfc571 |
fpm_worker_all_pools = wp;
|
|
|
cfc571 |
@@ -1600,6 +1602,7 @@ static void fpm_conf_dump() /* {{{ */
|
|
|
cfc571 |
zlog(ZLOG_NOTICE, "\tchroot = %s", STR2STR(wp->config->chroot));
|
|
|
cfc571 |
zlog(ZLOG_NOTICE, "\tchdir = %s", STR2STR(wp->config->chdir));
|
|
|
cfc571 |
zlog(ZLOG_NOTICE, "\tcatch_workers_output = %s", BOOL2STR(wp->config->catch_workers_output));
|
|
|
cfc571 |
+ zlog(ZLOG_NOTICE, "\tclear_env = %s", BOOL2STR(wp->config->clear_env));
|
|
|
cfc571 |
zlog(ZLOG_NOTICE, "\tsecurity.limit_extensions = %s", wp->config->security_limit_extensions);
|
|
|
cfc571 |
|
|
|
cfc571 |
for (kv = wp->config->env; kv; kv = kv->next) {
|
|
|
cfc571 |
diff --git a/sapi/fpm/fpm/fpm_conf.h b/sapi/fpm/fpm/fpm_conf.h
|
|
|
cfc571 |
index efd65dc6d9d7..19bd7ff1f806 100644
|
|
|
cfc571 |
--- a/sapi/fpm/fpm/fpm_conf.h
|
|
|
cfc571 |
+++ b/sapi/fpm/fpm/fpm_conf.h
|
|
|
cfc571 |
@@ -83,6 +83,7 @@ struct fpm_worker_pool_config_s {
|
|
|
cfc571 |
char *chroot;
|
|
|
cfc571 |
char *chdir;
|
|
|
cfc571 |
int catch_workers_output;
|
|
|
cfc571 |
+ int clear_env;
|
|
|
cfc571 |
char *security_limit_extensions;
|
|
|
cfc571 |
struct key_value_s *env;
|
|
|
cfc571 |
struct key_value_s *php_admin_values;
|
|
|
cfc571 |
diff --git a/sapi/fpm/fpm/fpm_env.c b/sapi/fpm/fpm/fpm_env.c
|
|
|
cfc571 |
index 6b64fedfec47..2ff0bdc0e4bc 100644
|
|
|
cfc571 |
--- a/sapi/fpm/fpm/fpm_env.c
|
|
|
cfc571 |
+++ b/sapi/fpm/fpm/fpm_env.c
|
|
|
cfc571 |
@@ -143,7 +143,9 @@ int fpm_env_init_child(struct fpm_worker_pool_s *wp) /* {{{ */
|
|
|
cfc571 |
fpm_env_setproctitle(title);
|
|
|
cfc571 |
efree(title);
|
|
|
cfc571 |
|
|
|
cfc571 |
- clearenv();
|
|
|
cfc571 |
+ if (wp->config->clear_env) {
|
|
|
cfc571 |
+ clearenv();
|
|
|
cfc571 |
+ }
|
|
|
cfc571 |
|
|
|
cfc571 |
for (kv = wp->config->env; kv; kv = kv->next) {
|
|
|
cfc571 |
setenv(kv->key, kv->value, 1);
|
|
|
cfc571 |
diff --git a/sapi/fpm/php-fpm.conf.in b/sapi/fpm/php-fpm.conf.in
|
|
|
cfc571 |
index af4f2fa325a3..6ce9b6325636 100644
|
|
|
cfc571 |
--- a/sapi/fpm/php-fpm.conf.in
|
|
|
cfc571 |
+++ b/sapi/fpm/php-fpm.conf.in
|
|
|
cfc571 |
@@ -475,6 +475,15 @@ pm.max_spare_servers = 3
|
|
|
cfc571 |
; Default Value: no
|
|
|
cfc571 |
;catch_workers_output = yes
|
|
|
cfc571 |
|
|
|
cfc571 |
+; Clear environment in FPM workers
|
|
|
cfc571 |
+; Prevents arbitrary environment variables from reaching FPM worker processes
|
|
|
cfc571 |
+; by clearing the environment in workers before env vars specified in this
|
|
|
cfc571 |
+; pool configuration are added.
|
|
|
cfc571 |
+; Setting to "no" will make all environment variables available to PHP code
|
|
|
cfc571 |
+; via getenv(), $_ENV and $_SERVER.
|
|
|
cfc571 |
+; Default Value: yes
|
|
|
cfc571 |
+;clear_env = no
|
|
|
cfc571 |
+
|
|
|
cfc571 |
; Limits the extensions of the main script FPM will allow to parse. This can
|
|
|
cfc571 |
; prevent configuration mistakes on the web server side. You should only limit
|
|
|
cfc571 |
; FPM to .php extensions to prevent malicious users to use other extensions to
|