0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 46fe011796 fix(web-app-fusiondirectory): lift the PHP memory_limit in the FPM pool

#1259 moved the interim CVE-2026-109618 mitigation (memory_limit = -1)
out of the shared hardening.ini into memory-unlimited.ini and mounted it
only in the roles whose images it had inventoried. Its branch predates
#1263, which gave FusionDirectory the php_hardening mount, so after both
merged FusionDirectory ran with the image default of 128M again.

A conf.d mount would not have fixed it: the nfrastack image writes
php_admin_value[memory_limit] into its FPM pool
(/etc/php7/pools.d/www/www-settings.conf) from PHP_MEMORY_LIMIT, and a
pool php_admin_value outranks every conf.d ini. Measured on main: CLI
128M, FPM 128M. So even before #1259 the hardening ini only ever lifted
the CLI limit.

nfrastack/fusiondirectory:1.5 runs PHP 7.4.33 on Alpine 3.15, end of
life and never patched, so the role carries the mitigation until it
moves to a PHP 8 image.

- Set PHP_MEMORY_LIMIT=-1 in templates/env.j2. The image seds it into
  php.ini and the pool, so CLI and FPM both report -1.
- The root TODO lists FusionDirectory with the image and the reason it
  uses the variable instead of the mount; the role TODO names which
  setting carries which CVE mitigation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 08:57:44 +01:00

900 B

Raw Permalink Blame History

To-dos

Move off PHP 7.4. The pinned nfrastack/fusiondirectory:1.5 image builds on ghcr.io/nfrastack/container-nginx-php-fpm with PHP 7.4 on Alpine 3.15, which is end of life and gets no fix for CVE-2026-109618 and CVE-2026-109619.
- No FusionDirectory release runs on a supported PHP yet: upstream certifies 1.4 to 1.6 for PHP 7.4 only, nfrastack/container-fusiondirectory builds its image only on PHP 7.4 and Alpine 3.15, and the PHP 8 port lives on upstream's unreleased php8 branch. Until then the shared hardening ini mounted at /etc/php7/conf.d/zz-infinito-hardening.ini carries the CVE-2026-109619 mitigation and PHP_MEMORY_LIMIT=-1 in templates/env.j2 the CVE-2026-109618 one. Options: rebuild the image on upstream's first php8 release, or build nfrastack/container-fusiondirectory against a pinned php8 commit on container-nginx-php-fpm 8.4 before that release.

900 B Raw Permalink Blame History

To-dos

900 B

Raw Permalink Blame History