set open_basedir in php.ini to stop leaks

[myplc.git] / plc.d / httpd

diff --git a/plc.d/httpd b/plc.d/httpd
index 30e5ce3..3d21644 100755 (executable)
--- a/plc.d/httpd
+++ b/plc.d/httpd
@@ -1,14 +1,12 @@
 #!/bin/bash
 #
-# priority: 700
+# priority: 600
 #
 # Configure Apache web server
 #
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id$
-#
 
 # Source function library and configuration
 . /etc/plc.d/functions
@@ -24,6 +22,15 @@ httpd_conf=/etc/httpd/conf/httpd.conf
 ssl_conf=/etc/httpd/conf.d/ssl.conf
 plc_conf=/etc/httpd/conf.d/plc.conf
 
+function disable_file () {
+    file=$1; shift
+    [ -f $file ] && mv -f $file $file.disabled
+}
+function enable_file () {
+    file=$1; shift
+    [ ! -f $file ] && mv -f $file.disabled $file
+}
+
 case "$1" in
     start)
        if [ "$PLC_API_ENABLED" != "1" -a \
@@ -35,21 +42,35 @@ case "$1" in
        MESSAGE=$"Starting web server"
        dialog "$MESSAGE"
 
-       # Set the document root to /data/var/www/html (static files
-       # and PlanetLabConf only, no Drupal or admin pages) if the web
-       # server should not run on this machine.
+       # set document root - not really useful on fedora but just in case
+       sed -i -e "s@^DocumentRoot.*@DocumentRoot \"$DocumentRoot\"@" $httpd_conf
+       # whether WWW is enabled or not : 
        if [ "$PLC_WWW_ENABLED" != "1" ] ; then
-           sed -i -e "s@^DocumentRoot.*@DocumentRoot \"/data$DocumentRoot\"@" $httpd_conf
-           ln -nsf $DocumentRoot/PlanetLabConf /data$DocumentRoot/PlanetLabConf
+           # avoid hitting drupal, that would try to connect to the db and create noise
+           disable_file $DocumentRoot/index.php
        else
-           sed -i -e "s@^DocumentRoot.*@DocumentRoot \"$DocumentRoot\"@" $httpd_conf
-           rm -f /data$DocumentRoot/PlanetLabConf
+           enable_file $DocumentRoot/index.php
        fi
 
        # Set the default include path
-       include_path=".:$DocumentRoot/planetlab/includes:$DocumentRoot/plkit/php:/etc/planetlab/php:/usr/share/plc_api/php"
+       include_path=".:$DocumentRoot/planetlab/includes:$DocumentRoot/plekit/php:$DocumentRoot/generated:/etc/planetlab/php:/usr/share/plc_api/php"
        sed -i -e "s@[;]*include_path = \"\.:.*\"@include_path = \"$include_path\"@" $php_ini
 
+       # Set open_basedir so as to avoid leaks
+       open_basedir="$DocumentRoot:/etc/planetlab/php:/usr/share/plc_api/php:/var/log/myslice:/var/tmp/bootmedium:/tmp"
+       sed -i -e "s@[;]*open_basedir =.*@open_basedir = \"$open_basedir\"@" $php_ini
+       
+       # for php-5.3 under fedora12, otherwise issues tons of warning messages
+       # Set timezone in php.ini if not already there
+       if grep '^;date.timezone' $php_ini >& /dev/null; then
+           dialog 'Setting PHP timezone to GMT'
+           sed -i -e 's,^;date.timezone.*,date.timezone = GMT,' $php_ini
+       fi
+
+       if grep '^short_open_tag = Off' $php_ini >& /dev/null; then
+           sed -i -e 's,^short_open_tag = Off,short_open_tag = On,' $php_ini
+       fi
+
        # Disable default Listen directive
        sed -i -e '/^Listen/d' $httpd_conf
 
@@ -91,15 +112,26 @@ case "$1" in
                fi
            done
 
+        # Create a separate path for mod_wsgi until we are ready to replace 
+        # mod_python
+        PLC_API_WSGI_PATH=/PLCAPIWSGI 
+
            # HTTP configuration
            if [ $skip_http -eq 0 -a -n "${!http_port}" ] ; then
                cat <<EOF
 Listen ${!http_port}
+# create wsgi socket where we have the permission
+### WSGISocketPrefix run/wsgi
 # Make sure that the admin web pages and API are always accessed via SSL
 <VirtualHost *:${!http_port}>
     Redirect /db https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/db
     Redirect /planetlab https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/planetlab
     Redirect /$PLC_API_PATH https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_PATH
+###     Redirect /$PLC_API_WSGI_PATH/ https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_WSGI_PATH/
+###     WSGIScriptAlias $PLC_API_WSGI_PATH /usr/share/plc_api/ModWSGI.wsgi
+    # XX make processes and threads configurable 
+###     WSGIDaemonProcess plcapi-wsgi user=apache group=apache processes=1 threads=25
+###     WSGIProcessGroup plcapi-wsgi
 </VirtualHost>
 EOF
            fi
@@ -121,17 +153,29 @@ EOF
        (
            if [ "$PLC_API_ENABLED" = "1" ] ; then
                cat <<EOF
+# mod_python location
 <Location $PLC_API_PATH>
     SetHandler mod_python
     PythonPath "sys.path + ['/usr/share/plc_api']"
     PythonHandler ModPython
 </Location>
+
+# mod_wsgi location
+### <Location $PLC_API_WSGI_PATH/>
+###     SetHandler mod_wsgi
+### </Location>
 EOF
            else
                cat <<EOF
+# mod_python location
 <Location $PLC_API_PATH>
     Deny from all
 </Location>
+
+# mod_wsgi location
+### <Location $PLC_API_WSGI_PATH/>
+###     Deny from all
+### </Location> 
 EOF
            fi
 
@@ -197,7 +241,7 @@ EOF
 
        ## patch php.ini
        # memory limit
-       sed -i -e 's,^memory_limit = 8M *;,memory_limit = 24M ; patch myplc -- ,' $php_ini 
+       sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini 
        # log_errors : is On by default
        # error_log
        if ! grep '^error_log *=' $php_ini > /dev/null ; then