0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 e3d2a24bcd fix(sys-svc-compose-php): scope memory_limit -1 to unpatched images

The interim CVE-2026-109618 mitigation lived in the shared hardening.ini,
so every PHP role ran without a memory limit until the last image was
patched, and no role's service_memory_mb share applied.

Registry metadata of the images pinned on main shows that 16 of the 20
consumers already ship PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or the
Alpine/Debian build of it). Four predate the fix:
markoshust/magento-php:8.4-fpm (8.4.21), ghcr.io/heviat/webmail:2024.06
(the Mailu OIDC flavor, built 2025-04-04), phpldapadmin/phpldapadmin:2.3.11
(built 2026-05-15) and ghcr.io/shopware/docker-base:8.3 (8.3.25).

- Move memory_limit = -1 into its own content-addressed ini
  (FILE_PHP_MEMORY_UNLIMITED_INI) and mount it only in magento, mailu,
  phpldapadmin and shopware.
- hardening.ini keeps expose_php, session.upload_progress.enabled and
  fatal_error_backtraces as permanent hardening.
- Joomla's php-upload.ini loads as conf.d/uploads.ini again: no -1 has
  to be outranked anymore.
- The root TODO names the four images that still need the override.

Refs #1126

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-28 22:39:07 +01:00

2.3 KiB

Raw Permalink Blame History

sys-svc-compose-php

Description

Internal helper role that installs the shared PHP hardening assets on the stack host. PHP services of Docker Compose and Swarm stacks mount them as configs from their own meta/volumes.yml.

Overview

This role installs one PHP ini (FILE_PHP_HARDENING_INI), one interim PHP ini (FILE_PHP_MEMORY_UNLIMITED_INI) and one PHP-FPM pool drop-in (FILE_PHP_FPM_HARDENING_CONF). A PHP role opts in by declaring a type: config entry with that file as source and a file inside the scan dir of its image as target, e.g. conf.d/zz-infinito-hardening.ini or, for the pool, php-fpm.d/zz-infinito-hardening.conf. Only roles whose image still ships a PHP release without the CVE-2026-109618 fix also mount FILE_PHP_MEMORY_UNLIMITED_INI, as conf.d/zz-infinito-memory-unlimited.ini.

Cosmos

The diagram places sys-svc-compose-php in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-svc-compose-php 💻]
        svc_svc_compose_php["svc-compose-php"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

PHP ini hardening: expose_php off; session.upload_progress.enabled = 0 and, on PHP 8.5 only, fatal_error_backtraces = 0 against CVE-2026-109619.
Interim CVE-2026-109618 mitigation: memory_limit = -1 for images that predate PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
PHP-FPM worker recycling: pm.max_requests from PHP_FPM_MAX_REQUESTS for images whose [www] pool reads php-fpm.d/*.conf.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

2.3 KiB Raw Permalink Blame History