Snuffleupagus "allow" rules for Memories app

[archont00]

Hi,

Nextcloud Memories App https://apps.nextcloud.com/apps/memories depends on shell_exec function, whose execution is dropped by Snuffleupagus configuration in ghcr.io/hoellen/nextcloud:25 docker image.

{"reqId":"kSXRACAVK6v9d1dB9vGU","level":3,"time":"2023-05-08 19:54:11","remoteAddr":"172.17.26.1","user":"XXX","app":"PHP","method":"POST","url":"/settings/apps/enable","message":"[snuffleupagus][0.0.0.0][disabled_function][drop] Aborted execution on call of the function 'shell_exec', because its argument '$command' content (ps -ef | grep go-vod-ocwgkowh3q4h | grep -v grep | awk '{print $2}') matched a rule at /nextcloud/apps2/memories/lib/Util.php#461","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0","version":"25.0.6.1","data":{"app":"PHP"}}

In particular, these two files call shell_exec multiple times:

• https://github.com/pulsejet/memories/blob/master/lib/Util.php
• https://github.com/pulsejet/memories/blob/master/lib/Service/BinExt.php

I have temporarily worked around the issue by allowing the two files to run any (!) command:

$ grep "memories" /usr/local/etc/php/conf.d/nextcloud-php8.rules | grep -v grep
sp.disable_function.function("shell_exec").param("command").filename("/nextcloud/apps2/memories/lib/Util.php").allow();
sp.disable_function.function("shell_exec").param("command").filename("/nextcloud/apps2/memories/lib/Service/BinExt.php").allow();