Page MenuHomePhabricator

PdfHandler binaries should have shell restrictions applied to them
Closed, ResolvedPublic


PdfHandler shells out to pdftotext, convert, gs, and pdfinfo. All of these should be restricted using

convert and ps are already firejailed in Wikimedia production, but need to be converted to the MediaWiki framework

Event Timeline

Legoktm triaged this task as Medium priority.Dec 13 2017, 2:24 AM
Legoktm created this task.

The current command as I see it from pdftotext errors in Logstash:

/bin/bash '/srv/mediawiki/php-1.32.0-wmf.20/includes/shell/' ''\''/usr/bin/pdftotext'\'' '\''/tmp/0ZSSAt'\'' '\''-'\''' 'MW_INCLUDE_STDERR=;MW_CPU_LIMIT=50; MW_CGROUP='\''/sys/fs/cgroup/memory/mediawiki/job'\''; MW_MEM_LIMIT=1048576; MW_FILE_SIZE_LIMIT=524288; MW_WALL_CLOCK_LIMIT=180; MW_USE_LOG_PIPE=yes'

I don't know since when it started using shell/limit or whether it always was, but, does this suffice for this task?

TheDJ claimed this task.
TheDJ added a subscriber: TheDJ.

This is now using shellbox, so I’m assuming we can call this resolved. Pls reopen if not the case.