diff --git a/sapi/fpm/config.m4 b/sapi/fpm/config.m4 index ba2b8e2d82b47..40cd69c7195f7 100644 --- a/sapi/fpm/config.m4 +++ b/sapi/fpm/config.m4 @@ -538,18 +538,18 @@ dnl }}} AC_DEFUN([AC_FPM_APPARMOR], [ - AC_MSG_CHECKING([for apparmor]) - - SAVED_LIBS="$LIBS" - LIBS="$LIBS -lapparmor" - - AC_TRY_LINK([ #include ], [change_hat("test", 0);], [ - AC_DEFINE([HAVE_APPARMOR], 1, [do we have apparmor support?]) - AC_MSG_RESULT([yes]) - ], [ - LIBS="$SAVED_LIBS" - AC_MSG_RESULT([no]) - ]) + AC_MSG_CHECKING([for apparmor]) + + SAVED_LIBS="$LIBS" + LIBS="$LIBS -lapparmor" + + AC_TRY_LINK([ #include ], [change_hat("test", 0);], [ + AC_DEFINE([HAVE_APPARMOR], 1, [do we have apparmor support?]) + AC_MSG_RESULT([yes]) + ], [ + LIBS="$SAVED_LIBS" + AC_MSG_RESULT([no]) + ]) ]) @@ -563,15 +563,15 @@ if test "$PHP_FPM" != "no"; then AC_FPM_TRACE AC_FPM_BUILTIN_ATOMIC AC_FPM_LQ - AC_FPM_SYSCONF - AC_FPM_TIMES - AC_FPM_KQUEUE - AC_FPM_PORT - AC_FPM_DEVPOLL - AC_FPM_EPOLL - AC_FPM_POLL - AC_FPM_SELECT - AC_FPM_APPARMOR + AC_FPM_SYSCONF + AC_FPM_TIMES + AC_FPM_KQUEUE + AC_FPM_PORT + AC_FPM_DEVPOLL + AC_FPM_EPOLL + AC_FPM_POLL + AC_FPM_SELECT + AC_FPM_APPARMOR PHP_ARG_WITH(fpm-user,, [ --with-fpm-user[=USER] Set the user for php-fpm to run as. (default: nobody)], nobody, no) diff --git a/sapi/fpm/fpm/fpm.c b/sapi/fpm/fpm/fpm.c index abfc78680151f..96a29c5f10209 100644 --- a/sapi/fpm/fpm/fpm.c +++ b/sapi/fpm/fpm/fpm.c @@ -39,7 +39,7 @@ struct fpm_globals_s fpm_globals = { .test_successful = 0, .heartbeat = 0, .run_as_root = 0, - .force_stderr = 0, + .force_stderr = 0, .send_config_pipe = {0, 0}, }; @@ -53,7 +53,7 @@ int fpm_init(int argc, char **argv, char *config, char *prefix, char *pid, int t fpm_globals.prefix = prefix; fpm_globals.pid = pid; fpm_globals.run_as_root = run_as_root; - fpm_globals.force_stderr = force_stderr; + fpm_globals.force_stderr = force_stderr; if (0 > fpm_php_init_main() || 0 > fpm_stdio_init_main() || diff --git a/sapi/fpm/fpm/fpm.h b/sapi/fpm/fpm/fpm.h index 68642a955d1b7..4916140e174f9 100644 --- a/sapi/fpm/fpm/fpm.h +++ b/sapi/fpm/fpm/fpm.h @@ -55,7 +55,7 @@ struct fpm_globals_s { int test_successful; int heartbeat; int run_as_root; - int force_stderr; + int force_stderr; int send_config_pipe[2]; }; diff --git a/sapi/fpm/fpm/fpm_conf.c b/sapi/fpm/fpm/fpm_conf.c index 9b699af99d8ef..20adf91df4449 100644 --- a/sapi/fpm/fpm/fpm_conf.c +++ b/sapi/fpm/fpm/fpm_conf.c @@ -150,7 +150,7 @@ static struct ini_value_parser_s ini_fpm_pool_options[] = { { "catch_workers_output", &fpm_conf_set_boolean, WPO(catch_workers_output) }, { "security.limit_extensions", &fpm_conf_set_string, WPO(security_limit_extensions) }, #ifdef HAVE_APPARMOR - { "apparmor_hat", &fpm_conf_set_string, WPO(apparmor_hat) }, + { "apparmor_hat", &fpm_conf_set_string, WPO(apparmor_hat) }, #endif { 0, 0, 0 } }; @@ -648,7 +648,7 @@ int fpm_worker_pool_config_free(struct fpm_worker_pool_config_s *wpc) /* {{{ */ free(wpc->chdir); free(wpc->security_limit_extensions); #ifdef HAVE_APPARMOR - free(wpc->apparmor_hat); + free(wpc->apparmor_hat); #endif for (kv = wpc->php_values; kv; kv = kv_next) { diff --git a/sapi/fpm/fpm/fpm_conf.h b/sapi/fpm/fpm/fpm_conf.h index 8cd8690f1874b..4b29749042225 100644 --- a/sapi/fpm/fpm/fpm_conf.h +++ b/sapi/fpm/fpm/fpm_conf.h @@ -88,7 +88,7 @@ struct fpm_worker_pool_config_s { struct key_value_s *php_admin_values; struct key_value_s *php_values; #ifdef HAVE_APPARMOR - char *apparmor_hat; + char *apparmor_hat; #endif }; diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c index fccb80c571f0d..93090832f5009 100644 --- a/sapi/fpm/fpm/fpm_main.c +++ b/sapi/fpm/fpm/fpm_main.c @@ -157,7 +157,7 @@ static const opt_struct OPTIONS[] = { {'R', 0, "allow-to-run-as-root"}, {'D', 0, "daemonize"}, {'F', 0, "nodaemonize"}, - {'O', 0, "force-stderr"}, + {'O', 0, "force-stderr"}, {'-', 0, NULL} /* end of args */ }; @@ -1575,7 +1575,7 @@ int main(int argc, char *argv[]) char *fpm_pid = NULL; int test_conf = 0; int force_daemon = -1; - int force_stderr = 0; + int force_stderr = 0; int php_information = 0; int php_allow_to_run_as_root = 0; @@ -1704,9 +1704,9 @@ int main(int argc, char *argv[]) force_daemon = 0; break; - case 'O': /* force stderr even on non tty */ - force_stderr = 1; - break; + case 'O': /* force stderr even on non tty */ + force_stderr = 1; + break; default: case 'h': diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c index 1159a132472a1..b32213fa74f9b 100644 --- a/sapi/fpm/fpm/fpm_unix.c +++ b/sapi/fpm/fpm/fpm_unix.c @@ -228,28 +228,33 @@ int fpm_unix_init_child(struct fpm_worker_pool_s *wp) /* {{{ */ } #ifdef HAVE_APPARMOR - if (wp->config->apparmor_hat) { - char *con, *new_con; - if (aa_getcon(&con, NULL) == -1) { - zlog(ZLOG_SYSERROR, "[pool %s] failed to query apparmor confinement. Please check if \"/proc/*/attr/current\" is read and writeable.", wp->config->name); - return -1; - } - new_con = malloc(strlen(con) + strlen(wp->config->apparmor_hat) + 3); // // + 0 Byte - if (!new_con) { - zlog(ZLOG_SYSERROR, "[pool %s] failed to allocate memory for apparmor hat change.", wp->config->name); - return -1; - } - if (0 > sprintf(new_con, "%s//%s", con, wp->config->apparmor_hat)) { - zlog(ZLOG_SYSERROR, "[pool %s] failed to construct apparmor confinement.", wp->config->name); - return -1; - } - if (0 > aa_change_profile(new_con)) { - zlog(ZLOG_SYSERROR, "[pool %s] failed to change to new confinement (%s). Please check if \"/proc/*/attr/current\" is read and writeable and \"change_profile -> %s//*\" is allowed.", wp->config->name, new_con, con); - return -1; - } - free(con); - free(new_con); - } + if (wp->config->apparmor_hat) { + char *con, *new_con; + + if (aa_getcon(&con, NULL) == -1) { + zlog(ZLOG_SYSERROR, "[pool %s] failed to query apparmor confinement. Please check if \"/proc/*/attr/current\" is read and writeable.", wp->config->name); + return -1; + } + + new_con = malloc(strlen(con) + strlen(wp->config->apparmor_hat) + 3); // // + 0 Byte + if (!new_con) { + zlog(ZLOG_SYSERROR, "[pool %s] failed to allocate memory for apparmor hat change.", wp->config->name); + return -1; + } + + if (0 > sprintf(new_con, "%s//%s", con, wp->config->apparmor_hat)) { + zlog(ZLOG_SYSERROR, "[pool %s] failed to construct apparmor confinement.", wp->config->name); + return -1; + } + + if (0 > aa_change_profile(new_con)) { + zlog(ZLOG_SYSERROR, "[pool %s] failed to change to new confinement (%s). Please check if \"/proc/*/attr/current\" is read and writeable and \"change_profile -> %s//*\" is allowed.", wp->config->name, new_con, con); + return -1; + } + + free(con); + free(new_con); + } #endif return 0;