Re: Unveil makes PHP behave strange with "Primary script unknown" errors

Mar 4, 2022, 22:12 by stu@spacehopper.org:

> You really need to be able to do fairly low level debugging if you want to
> use this stuff in a high level language like php
>
> For pledge/unveil you need to take into account everything that might be
> needed by the PHP process (for the script you're running or *any other
> script* that is run afterwards in the same process)
>
You're quite right. I used it wrong in the test I did. Sorry!

From what I can tell by looking at the source, the  PHP unveil function (in
C code) does very little.

https://github.com/tvlooy/php-pledge/blob/master/pledge.c#L100

It has only 5 exceptions available, none of which are related to the issue
I am reporting here.

  zend_throw_exception"Attempt to increase permissions"
  zend_throw_exception(unveil_exception_ce, "Too many unveiled paths", errno);
  zend_throw_exception(unveil_exception_ce, "No such directory", errno);
  zend_throw_exception(unveil_exception_ce, "Unveil error", errno);

However, I used unveil "backwards", thinking it only prevented access to the
specific directory listed, whereas the documentation clearly states:

  The first call to unveil <http://man.openbsd.org/unveil#unveil>() that specifies a path removes visibility of the entire
  filesystem from all other filesystem-related system calls (such as open(2) <http://man.openbsd.org/open.2>,
  chmod(2) <http://man.openbsd.org/chmod.2> and rename(2) <http://man.openbsd.org/rename.2>), except for the specified path and permissions.

"Removes visibility of the entire filesystem.."
  zend_throw_exception(unveil_exception_ce, "Invalid permission value", errno);
(unveil_exception_ce, , errno);
Sorry again! And thanks a lot for your time :)

> On 2022/03/04 23:01, iio7@tutanota.com wrote:
>
>> How to reproduce:
>>
>> 1. Install PHP-FPM 8.1 and pecl81-pledge-2.0.2p3
>> 2. Enable the module in php-8.1.ini
>>
>>     extension=pledge
>>
>> 3. Make a simple PHP script that prints "Hello world"
>>
>>     <?php
>>     echo '<p>Hello world</p>';
>>
>> 4. Run the script to see all is working normally.
>> 5. Then add an unveil call:
>>
>>     <?php
>>     echo '<p>Hello world</p>';
>>     unveil('/var', 'r');
>>
>> 6. Run the script a couple of times. Refresh. Until the error occurs.
>>
>>     PHP message: PHP Warning:  Unknown: Failed to open stream: No
>>     such file or directory in Unknown on line 0Unable to open
>>     primary script: /htdocs/foo.example.com/public/foo.php <http://foo.example.com/public/foo.php> (No such
>>     file or directory)
>>
>> If you keep refreshing, the browser will then eventually print the error:
>>
>>     File not found.
>>
>> And the log error message will change to:
>>
>>     Primary script unknown
>>     Primary script unknown
>>     Primary script unknown
>>
>> You then have to restart PHP-FPM to make it work again.
>>
>> Kind regards.
>>
>> --
>> Sent with Tutanota, the secure & ad-free mailbox.
>>