[enh] Run under a specific agendav user, lock down write access to web/var

conf/nginx.conf

@@ -22,7 +22,7 @@ location {PATH}/ {
 
     location ~ ^{PATH}/index\.php(/|$) {
         fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-        fastcgi_pass unix:/var/run/php5-fpm-agendav.sock;
+        fastcgi_pass unix:/var/run/php5-fpm-{POOLNAME}.sock;
         fastcgi_index index.php;
         include fastcgi_params;
         fastcgi_param REMOTE_USER     $remote_user;

conf/php-fpm.conf

@@ -8,8 +8,8 @@ listen.group = www-data
 listen.mode = 0600
 
 ; Unix user/group of processes.
-user = www-data
+user = {USER}
-group = www-data
+group = {GROUP}
 
 ; Choose how the process manager will control the number of child processes.
 pm = dynamic

scripts/backup

@@ -3,7 +3,7 @@
 set -eu
 
 # Set app specific variables
-app="agendav"
+app="$YNH_APP_INSTANCE_NAME"
 dbname=$app
 dbuser=$app
 

scripts/install

@@ -11,7 +11,7 @@ language=$3
 source ./_common.sh
 
 # Set app specific variables
-app="agendav"
+app="$YNH_APP_INSTANCE_NAME"
 dbname=$app
 dbuser=$app
 
@@ -23,6 +23,9 @@ sudo yunohost app checkurl "${domain}${path}" -a "$app" \
 language=${LANGUAGES[$3]}
 ynh_app_setting_set "$app" language "$language"
 
+# Define LOGDIR (create it later when user is created)
+LOGDIR=/var/log/$app
+
 # Check destination directory
 DESTDIR="/var/www/${app}"
 [[ -d "$DESTDIR" ]] && ynh_die \
@@ -54,10 +57,6 @@ encryptkey=$(ynh_string_random 24)
 ynh_app_setting_set "$app" encryptkey "$encryptkey"
 ynh_app_setting_set "$app" mysqlpwd "$dbpass"
 
-# Create log directory
-LOGDIR=/var/log/agendav
-sudo install -m 750 -o www-data -d "$LOGDIR"
-
 # Copy and set AgenDAV configuration
 conf_path="${TMPDIR}/web/config/settings.php"
 cp ../conf/settings.php "$conf_path"
@@ -78,13 +77,19 @@ sed -i "s@{CALDAV_DOMAIN}@${caldav_domain}@g"                "$conf_path"
 
 # Install files and set permissions
 sudo mv "$TMPDIR" "$DESTDIR"
+sudo useradd -c "$app system account" \
+  -d /var/www/$app --system --user-group $app --shell /usr/sbin/nologin \
+  || ynh_die "Unable to create $app system account"
 sudo chown -hR root: "$DESTDIR"
-sudo chown -hR www-data: "${DESTDIR}/web"
+sudo chown -hR $app: "${DESTDIR}/web/var"
 sudo chmod -R 750 "${DESTDIR}/web/var"
 
+# Create log directory
+sudo install -m 750 -o $app -g adm -d "$LOGDIR"
+
 # Initialize database
 ynh_mysql_create_db "$dbname" "$dbuser" "$dbpass"
-(cd "$DESTDIR" && sudo sudo -u www-data \
+(cd "$DESTDIR" && sudo sudo -u $app \
     php agendavcli migrations:migrate --no-interaction) \
   || ynh_die "Unable to create AgenDAV tables"
 
@@ -93,6 +98,7 @@ nginx_conf="/etc/nginx/conf.d/${domain}.d/${app}.conf"
 sed -i "s@{PATH}@${path}@g"        ../conf/nginx.conf
 sed -i "s@{LOCATION}@${path:-/}@g" ../conf/nginx.conf
 sed -i "s@{DESTDIR}@${DESTDIR}@g"  ../conf/nginx.conf
+sed -i "s@{POOLNAME}@${app}@g"     ../conf/nginx.conf
 # comment redirection in case of an installation at root
 [[ -n "$path" ]] || sed -i '$s/^/#/' ../conf/nginx.conf
 sudo cp ../conf/nginx.conf "$nginx_conf"
@@ -101,6 +107,8 @@ sudo cp ../conf/nginx.conf "$nginx_conf"
 phpfpm_conf="/etc/php5/fpm/pool.d/${app}.conf"
 sed -i "s@{POOLNAME}@${app}@g"     ../conf/php-fpm.conf
 sed -i "s@{DESTDIR}@${DESTDIR}/@g" ../conf/php-fpm.conf
+sed -i "s@{USER}@${app}@g"     ../conf/php-fpm.conf
+sed -i "s@{GROUP}@${app}@g"     ../conf/php-fpm.conf
 sudo cp ../conf/php-fpm.conf "$phpfpm_conf"
 
 # Reload services

scripts/remove

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Set app specific variables
-app="agendav"
+app="$YNH_APP_INSTANCE_NAME"
 dbname=$app
 dbuser=$app
 
@@ -23,3 +23,9 @@ sudo rm -f "/etc/php5/fpm/pool.d/${app}.conf"
 # Reload services
 sudo service php5-fpm restart || true
 sudo service nginx reload || true
+
+# Remove the user account
+# (must be done after php-fpm restart)
+id "$app" >/dev/null 2>&1 \
+  && sudo deluser --quiet --remove-home "$app" >/dev/null \
+  || true

scripts/restore

@@ -3,7 +3,7 @@
 set -eu
 
 # Set app specific variables
-app="agendav"
+app="$YNH_APP_INSTANCE_NAME"
 dbname=$app
 dbuser=$app
 
@@ -46,10 +46,16 @@ else
     ynh_die "You must install Baïkal or Radicale before"
 fi
 
+if ! id -u $app > /dev/null 2>&1 ; then
+  sudo useradd -c "$app system account" \
+    -d /var/www/$app --system --user-group $app --shell /usr/sbin/nologin \
+    || ynh_die "Unable to create $app system account"
+fi
+
 # Restore the app files and set permissions
 sudo cp -a ./sources "$DESTDIR"
 sudo chown -hR root: "$DESTDIR"
-sudo chown -hR www-data: "${DESTDIR}/web"
+sudo chown -hR $app: "${DESTDIR}/web/var"
 sudo chmod -R 750 "${DESTDIR}/web/var"
 
 # Clean caches
@@ -66,7 +72,7 @@ sudo sed -i "s@^\(\$app\['caldav.baseurl.public'\] = \).*\
 @\1'${caldav_domain}';@g" "$conf_path"
 
 # Create log directory
-sudo install -m 750 -o www-data -d "/var/log/${app}"
+sudo install -m 750 -o www-data -g adm -d "/var/log/${app}"
 
 # Create and restore the database
 ynh_mysql_create_db "$dbname" "$dbuser" "$dbpass"

scripts/upgrade

@@ -6,7 +6,7 @@ set -eu
 source ./_common.sh
 
 # Set app specific variables
-app="agendav"
+app="$YNH_APP_INSTANCE_NAME"
 dbname=$app
 dbuser=$app
 
@@ -29,6 +29,9 @@ if [[ -z "$language" ]]; then
   ynh_app_setting_set "$app" language "$language"
 fi
 
+# Define LOGDIR (create it later when user is created)
+LOGDIR=/var/log/$app
+
 # Check destination directory
 DESTDIR="/var/www/$app"
 [[ ! -d $DESTDIR ]] && ynh_die \
@@ -54,10 +57,6 @@ ynh_package_is_installed "php5-cli" \
 TMPDIR=$(ynh_mkdir_tmp)
 extract_agendav "$TMPDIR"
 
-# Create log directory
-LOGDIR=/var/log/agendav
-sudo install -m 750 -o www-data -d "$LOGDIR"
-
 # Copy and set AgenDAV configuration
 conf_path="${TMPDIR}/web/config/settings.php"
 cp ../conf/settings.php "$conf_path"
@@ -79,12 +78,20 @@ sed -i "s@{CALDAV_DOMAIN}@${caldav_domain}@g"                "$conf_path"
 # Replace files and set permissions
 sudo rm -rf "$DESTDIR"
 sudo mv "$TMPDIR" "$DESTDIR"
+if ! id -u $app > /dev/null 2>&1 ; then
+  sudo useradd -c "$app system account" \
+    -d /var/www/$app --system --user-group $app --shell /usr/sbin/nologin \
+    || ynh_die "Unable to create $app system account"
+fi
 sudo chown -hR root: "$DESTDIR"
-sudo chown -hR www-data: "${DESTDIR}/web"
+sudo chown -hR $app: "${DESTDIR}/web/var"
 sudo chmod -R 750 "${DESTDIR}/web/var"
 
+# Create log directory
+sudo install -m 750 -o $app -g adm -d "$LOGDIR"
+
 # Run database migrations
-(cd "$DESTDIR" && sudo sudo -u www-data \
+(cd "$DESTDIR" && sudo sudo -u $app \
     php agendavcli migrations:migrate --no-interaction) \
   || ynh_die "Unable to run AgenDAV database migration"
 
@@ -93,6 +100,7 @@ nginx_conf="/etc/nginx/conf.d/${domain}.d/${app}.conf"
 sed -i "s@{PATH}@${path}@g"        ../conf/nginx.conf
 sed -i "s@{LOCATION}@${path:-/}@g" ../conf/nginx.conf
 sed -i "s@{DESTDIR}@${DESTDIR}@g"  ../conf/nginx.conf
+sed -i "s@{POOLNAME}@${app}@g"     ../conf/nginx.conf
 # comment redirection in case of an installation at root
 [[ -n "$path" ]] || sed -i '$s/^/#/' ../conf/nginx.conf
 sudo cp ../conf/nginx.conf "$nginx_conf"
@@ -101,6 +109,8 @@ sudo cp ../conf/nginx.conf "$nginx_conf"
 phpfpm_conf="/etc/php5/fpm/pool.d/${app}.conf"
 sed -i "s@{POOLNAME}@${app}@g"     ../conf/php-fpm.conf
 sed -i "s@{DESTDIR}@${DESTDIR}/@g" ../conf/php-fpm.conf
+sed -i "s@{USER}@${app}@g"     ../conf/php-fpm.conf
+sed -i "s@{GROUP}@${app}@g"     ../conf/php-fpm.conf
 sudo cp ../conf/php-fpm.conf "$phpfpm_conf"
 
 # Reload services