Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support clear_env variable by PHP_CLEAR_ENV #406

Merged
merged 4 commits into from
Aug 28, 2023

Conversation

phracek
Copy link
Member

@phracek phracek commented Apr 19, 2023

This pull request fixes issue #403.

By parameter PHP_CLEAR_ENV=OFF user can set 'clear_env = false' in /etc/pphp-fpm.d/www.conf file.

@phracek phracek marked this pull request as draft April 19, 2023 08:28
@phracek phracek force-pushed the support_clean_env_variable branch from 6546d6c to 5c4aa5f Compare May 10, 2023 13:34
@phracek phracek marked this pull request as ready for review May 10, 2023 13:34
@phracek phracek force-pushed the support_clean_env_variable branch from 5c4aa5f to 45c8545 Compare May 10, 2023 13:37
@phracek
Copy link
Member Author

phracek commented May 10, 2023

[test]

@phracek
Copy link
Member Author

phracek commented May 11, 2023

@pkubatrh @hhorak @remicollet Tests passed. Can you please have a look at it and made a review? Your review is more than appropriate. Thanks. The change is valid only for RHEL9 and only in case of PHP_CLEAR_ENV is set to true.

@hhorak
Copy link
Member

hhorak commented May 15, 2023

It would be good to include more info in the commit messages, a summary from #403 might work to explain basic background why clearing environment is not desired sometimes.

@hhorak
Copy link
Member

hhorak commented May 15, 2023

We should likely document this new variable in the README.md, shouldn't we?

@phracek phracek force-pushed the support_clean_env_variable branch from 45c8545 to 82544b0 Compare May 22, 2023 11:13
@phracek
Copy link
Member Author

phracek commented May 22, 2023

e should likely document this new variable in the README.md, shouldn't we?

README.md files are updated. Thanks for the point.

@phracek
Copy link
Member Author

phracek commented May 22, 2023

It would be good to include more info in the commit messages, a summary from #403 might work to explain basic background why clearing environment is not desired sometimes.

I have tried to summarize it somehow. If something is still unclear, please let me know.

@phracek phracek force-pushed the support_clean_env_variable branch from 82544b0 to 70decf4 Compare May 22, 2023 11:43
@phracek
Copy link
Member Author

phracek commented May 22, 2023

[test]

@phracek
Copy link
Member Author

phracek commented May 26, 2023

@remicollet Hi Remi, once you have free or spare time. Can you please have a look at this pull request? Thank you.

8.0/Dockerfile.rhel9 Outdated Show resolved Hide resolved
@phracek phracek force-pushed the support_clean_env_variable branch 4 times, most recently from 78c5d8e to 6b7dcff Compare June 26, 2023 10:32
@phracek
Copy link
Member Author

phracek commented Jun 26, 2023

[test]

@xrow
Copy link
Contributor

xrow commented Jul 25, 2023

@phracek @remicollet @hhorak I would love to see this merged... I think it got stuck somewhere in the nirvana... :-)

@phracek
Copy link
Member Author

phracek commented Jul 27, 2023

I am gonna finish this next week, so also tests are passing. Please be patient.

@xrow
Copy link
Contributor

xrow commented Jul 28, 2023

Actually I didn`t see that someone worked on it last week. My bad.

@phracek phracek force-pushed the support_clean_env_variable branch from 6b7dcff to 431f16e Compare July 31, 2023 11:10
@phracek
Copy link
Member Author

phracek commented Jul 31, 2023

The pull request is ready for review. @xrow @pkubatrh @hhorak

[test]

@phracek
Copy link
Member Author

phracek commented Jul 31, 2023

[test-openshift]

@xrow
Copy link
Contributor

xrow commented Jul 31, 2023

Looks good to me, but i can only test once it is merged.

@phracek
Copy link
Member Author

phracek commented Aug 2, 2023

Let's re-run tests after fixing some issues which are fixed by 76d4cf1

[test]

@phracek
Copy link
Member Author

phracek commented Aug 4, 2023

[test-openshift]

@phracek
Copy link
Member Author

phracek commented Aug 15, 2023

@remicollet @pkubatrh @hhorak Please review it. So we can merge it.

@phracek
Copy link
Member Author

phracek commented Aug 23, 2023

Pull request was rebased against master

[test-all]

@phracek
Copy link
Member Author

phracek commented Aug 23, 2023

[test]

@remicollet
Copy link
Contributor

I don't understand the change

  • why making FPM configuration word writable?

  • about clear_env

We already have in https://github.com/sclorg/s2i-php-container/blob/master/8.1/root/usr/share/container-scripts/php/common.sh#L47

    sed -e 's/^(clear_env)\s+.*/clear_env = no/' -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}

This sed comment probably need to be fixed, as the default line in RPM provided file is

;clear_env = no

@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

fixed

Thanks for the review, I will fix it. You are right.

@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

We already have in https://github.com/sclorg/s2i-php-container/blob/master/8.1/root/usr/share/container-scripts/php/common.sh#L47

    sed -e 's/^(clear_env)\s+.*/clear_env = no/' -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}

This sed comment probably need to be fixed, as the default line in RPM provided file is

;clear_env = no

@remicollet Good comment. In case of PHP_CLEAR_ENV is set to false, than I add to configuration file at the end clear_env = no.
There are three posibbilities.

  • clear_env is not present in www.conf file and then it should be added
  • ;clear_env = no PHP_CLEAR_ENV is set to yes then clear_env = no is added at the end.
  • clear_env = no is present and then it will be mentioned twice in configuration file.

Do we want to handle all those states? The condition that will handled all those cases would be a bit complicated. I did not try it yet ;) But can try

@remicollet
Copy link
Contributor

remicollet commented Aug 25, 2023

AFAIK ;clear_env = no is present in configuration seems exists (PHP 5.6)

IIUC the current code, is that we always expect clear_env to be disabled (but is broken).

Perhaps a simple fix of the sed is enough.

- sed -e 's/^(clear_env)\s+.*/clear_env = no/' -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}
+ sed -e 's/^[;]*\s*clear_env\s*=.*$/clear_env = no/'  -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}

And If you really want a new config, PHP_CLEAR_ENV being true to disable, this name seems confusing
Also IMHO it should also allow both value

so:

if [ "${PHP_CLEAR_ENV:-ON}" == "ON" ]; then
    sed -e 's/^[;]*\s*clear_env\s*=.*$/clear_env = yes/'  -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}
else
    sed -e 's/^[;]*\s*clear_env\s*=.*$/clear_env = no/'  -i ${PHP_FPM_CONF_D_PATH}/${PHP_FPM_CONF_FILE}
fi

Closes #403

Setting variable PHP_CLEAR_ENV clears environment in FPM workers.
Prevents arbitrary environment variables from reaching FPM worker processes
by clearing the environment in workers before env vars
specified in this pool configuration are added. Default value: no.

Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>
Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>
@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

Rebased and added also to 8.2 version.

Add sed command instead of echo. Thanks to @remicollet

Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>
@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

[test]

@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

[test-openshift]

@phracek
Copy link
Member Author

phracek commented Aug 25, 2023

Tests are passing. Completely.

test/run Outdated Show resolved Hide resolved
Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>
@phracek
Copy link
Member Author

phracek commented Aug 28, 2023

[test]

Copy link
Contributor

@remicollet remicollet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@phracek phracek merged commit ab447e2 into master Aug 28, 2023
@phracek phracek mentioned this pull request Aug 28, 2023
@xrow
Copy link
Contributor

xrow commented Aug 28, 2023

Hi @phracek,

sorry for my late reply, but I just noticed it. It looks like having this functionality only in run script should be sufficent for all use cases. No need for functionality container-setup (unless it is also prt of some run activity) and assemble, but maybe there are reasons for it. Just a comment. No need to fix.

@zmiklank zmiklank deleted the support_clean_env_variable branch November 23, 2023 07:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

5 participants