OwlCyberSecurity - MANAGER

Edit File: pagely-fpm-loader.sh

#!/bin/bash
set -e

umask 0002

output_with_date() {
  echo "[$(date +"%d-%b-%Y %H:%M:%S")] $1";
}

# Run userini parser before starting FPM
RUN_USERINI_PARSER_WRAPPER="/platform/bin/run-userini-parser-wrapper.sh"
if [[ -x ${RUN_USERINI_PARSER_WRAPPER} ]]; then
  output_with_date "Running userini parser..."
  ${RUN_USERINI_PARSER_WRAPPER}
fi

if [[ "$1" == "php-fpm" ]]; then
  # Override this var with fpm replacements
  export PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR//cli/fpm}"
fi
CURRENT_UID=$(id -u)

FPM_RESTART_THRESHOLD=2
FPM_RESTART_DELAY_MIN=10
FPM_RESTART_DELAY_MAX=60

# Make sure we only run this logic when running php-fpm
if [[ "$1" == "php-fpm" ]] && [[ -z "${PAGELY_FPM_SKIP_THROTTLE}" ]]; then
  # See if we have a variables file that we can use
  if [[ -e /pagely-fpm-restart-vars.env ]]; then
    output_with_date "Loading FPM restart vars from vars file.";
    # Just as a security precaution only load this if it's owned by root
    VARS_FILE_OWNERSHIP="$(stat -c '%u:%g' /pagely-fpm-restart-vars.env)"
    if [[ "$VARS_FILE_OWNERSHIP" == "0:0" ]]; then
      source /pagely-fpm-restart-vars.env;
    fi;
  fi;
  # Setup defaults
  PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS="${PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS:-0}"
  PAGELY_FPM_LAST_RESTART="${PAGELY_FPM_LAST_RESTART:-0}"
  LAST_RESTART_SECS=-1
  # See if this was a fast restart
  if [[ $PAGELY_FPM_LAST_RESTART -gt 0 ]]; then
    # Last restart > 0 means that we actually have a last restart time
    LAST_RESTART_SECS=$(($(date +%s) - ${PAGELY_FPM_LAST_RESTART}))
  fi;
  # If LAST_RESTART_SECS != -1 then this is a real restart time
  if [[ $LAST_RESTART_SECS -ne -1 ]]; then
    output_with_date "Last restart was ${LAST_RESTART_SECS} seconds ago.";
    # If LAST_RESTART_SECS is < 10, increase the recorded number of fast restarts
    if [[ $LAST_RESTART_SECS -le 10 ]]; then
      PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS=$(($PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS + 1))
    else
      # Reset everything if our last restart was outside the time period
      PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS=0
    fi;
    output_with_date "Detected ${PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS} consecutive fast restarts so far.";
    # If we had >= 2 consecutive fast restarts, throttle
    if [[ $PAGELY_FPM_CONSECUTIVE_FAST_RESTARTS -ge $FPM_RESTART_THRESHOLD ]]; then
      SLEEP_TIME="$(shuf -i ${FPM_RESTART_DELAY_MIN}-${FPM_RESTART_DELAY_MAX} -n1)"
      output_with_date "Throttling for ${SLEEP_TIME} seconds.";
      sleep $SLEEP_TIME;
    fi;
  fi;
  # Set last restart to now
  PAGELY_FPM_LAST_RESTART=$(date +%s)
  if [[ $CURRENT_UID -eq 0 ]]; then
    # Dump out vars to our storage file
    set | grep PAGELY_FPM > /pagely-fpm-restart-vars.env;
  fi;
fi;

# Nomad provisions /alloc and /local as 0777 nobody:nogroup so tasks in the
# same group can share them, but app-unit runs FPM workers as the customer
# UID. Tighten to 0755 root-owned before exec so customer PHP cannot drop
# executable files there. The FPM master (root) still creates the FPM/stats
# sockets, PID, and opcache lockfile in /alloc/tmp, and customer workers only
# need traverse to connect to the 0666 sockets. /alloc is shared with the
# gateway and redis tasks (both also run as root), so re-running these
# chmods from another task's loader is idempotent.
if [[ $CURRENT_UID -eq 0 ]]; then
  for dir in /alloc /alloc/data /alloc/logs /alloc/tmp /local; do
    if [[ -d "$dir" ]]; then
      chown root:root "$dir";
      chmod 0755 "$dir";
    fi;
  done;
fi;

exec "$@"