...instead of the manual firejailing that Wikimedia currently uses. Moritz suggested to start with this one since it has a pretty low usage.
https://phabricator.wikimedia.org/source/operations-puppet/browse/production/modules/mediawiki/files/mediawiki-firejail-lilypond
https://phabricator.wikimedia.org/source/operations-puppet/browse/production/modules/mediawiki/files/mediawiki-converters.profile
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Legoktm | T173370 Support restricted execution of external commands (via firejail) | |||
| Resolved | Legoktm | T181535 Convert Score binaries to use MediaWiki shell restrictions |
Change 393830 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/extensions/Score@master] Enable shell restrictions for lilypond
I tested the patch with https://en.wikipedia.org/wiki/Pastime_with_Good_Company and I also set $wgScoreLilypond to point to mediawiki-firejail-lilypond (firejail inside a firejail) and it all worked.
Change 393830 merged by jenkins-bot:
[mediawiki/extensions/Score@master] Enable shell restrictions for all binaries
Change 394913 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[operations/mediawiki-config@master] Remove manual firejailing of Score binaries
Change 394914 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[operations/puppet@production] mediawiki: Remove Score firejail wrappers
Change 394913 merged by jenkins-bot:
[operations/mediawiki-config@master] Remove manual firejailing of Score binaries
Mentioned in SAL (#wikimedia-operations) [2017-12-12T00:53:08Z] <legoktm@tin> Synchronized wmf-config/CommonSettings.php: Remove manual firejailing of Score binaries (T181535) (duration: 00m 56s)
Change 394914 merged by Muehlenhoff:
[operations/puppet@production] mediawiki: Remove Score firejail wrappers