JezK

Edit File: redis_svc.sh

#!/bin/bash
# Starts/stops redis user services
# Parameters start|stop $USER
if (( $# < 2 )); then
    echo "You must specify an action and a user"
    exit 1
fi

ACTION=$1
USER=$2
HOMEDIR=$(/usr/bin/getent passwd "$USER" | /usr/bin/cut -d: -f6)

# Cage-dir selection: mirror the writer's logic in get_dir_filenames() so both
# sides always agree on the path.  LiteSpeed Containers (namespace=2 in
# httpd_config.xml) always use ~/.lsns; fall back to ~/.cagefs otherwise.
# Using the same namespace check avoids the divergence described in §2g-2 where
# the writer uses namespace= while the reader used /etc/cagefs/cagefs.mp.
_LSWS_HOME="${LSWS_HOME:-/usr/local/lsws}"
if grep '<namespace>2</namespace>' "${_LSWS_HOME}/conf/httpd_config.xml" >/dev/null 2>&1; then
  SOCKDIR1="${HOMEDIR}/.lsns"
  SOCKDIR="${HOMEDIR}/.lsns/tmp"
  REDISDIR="${HOMEDIR}/.lsns/tmp/redis"
else
  SOCKDIR1="${HOMEDIR}/.cagefs"
  SOCKDIR="${HOMEDIR}/.cagefs/tmp"
  REDISDIR="${HOMEDIR}/.cagefs/tmp/redis"
fi

if [ "$ACTION" == "start" ]; then

# V12 (CWE-276): ensure per-user redis runtime dirs exist and are 0700.
    # mkdir -p is a no-op when the dir already exists, so this also remediates
    # pre-existing 0777 dirs created before this hardening was applied.
    mkdir -p "$SOCKDIR1" -m 0700
    chown "$USER" "$SOCKDIR1"
    chmod 0700 "$SOCKDIR1"
    mkdir -p "$SOCKDIR" -m 0700
    chown "$USER" "$SOCKDIR"
    chmod 0700 "$SOCKDIR"
    mkdir -p "$REDISDIR" -m 0700
    chown "$USER" "$REDISDIR"
    chmod 0700 "$REDISDIR"

DIR="$(dirname "$0")"
    PACKAGE_SIZES="${DIR}/../conf/redis_package_size.conf"
    if [ -e "${DIR}/../conf/use-valkey" ]; then
        REDIS="valkey"
    else
        REDIS="redis"
    fi

# §7b: reject size/package files not owned by root so a tenant cannot forge
    # their memory cap by creating a competing redis.size in the tenant-owned dir.
    _redis_size_owner() { stat -c '%u' "$1" 2>/dev/null; }

# §13b: two-tier authoritative lookup — both files are root-owned,
    # out-of-cage, on a root-controlled ancestor path.
    #
    # 1. Explicit per-user admin override (redis_size.conf / CONF): set by
    #    direct admin action (update_user_size_conf) for users with a custom
    #    size, independent of package membership.
    # 2. Package-derived per-user map (redis_pkg_user_size.conf): populated by
    #    do_syncpkgfiles / do_pkg for every user in a sized package.  Kept
    #    separate so package reconciliation never clobbers explicit overrides.
    #
    # A tenant can hide the in-cage redis.size/redis.package by renaming the
    # tenant-owned REDISDIR, but they cannot rename or forge either of these
    # host-path files whose entire ancestor chain is root-controlled.
    SIZEMB=""
    _SIZE_CONF="${DIR}/../conf/redis_size.conf"
    if [ -r "${_SIZE_CONF}" ]; then
        _auth_size=$(awk -F'"' -v u="${USER}" '$2 == u { print $4; exit }' "${_SIZE_CONF}" 2>/dev/null)
        if [[ "${_auth_size}" =~ ^[1-9][0-9]*$ ]]; then
            SIZEMB="${_auth_size}"
            echo "SIZEMB from authoritative size conf (${USER}): ${SIZEMB}"
        fi
    fi

if [ -z "${SIZEMB}" ]; then
        _PKG_SIZE_CONF="${DIR}/../conf/redis_pkg_user_size.conf"
        if [ -r "${_PKG_SIZE_CONF}" ]; then
            _pkg_auth_size=$(awk -F'"' -v u="${USER}" '$2 == u { print $4; exit }' "${_PKG_SIZE_CONF}" 2>/dev/null)
            if [[ "${_pkg_auth_size}" =~ ^[1-9][0-9]*$ ]]; then
                SIZEMB="${_pkg_auth_size}"
                echo "SIZEMB from package-derived size conf (${USER}): ${SIZEMB}"
            fi
        fi
    fi

if [ -z "${SIZEMB}" ] && [ -e "${REDISDIR}/redis.size" ]; then
        _owner=$(_redis_size_owner "${REDISDIR}/redis.size")
        if [ "${_owner}" = "0" ]; then
            SIZEMB=$(cat "${REDISDIR}/redis.size" 2>/dev/null)
            echo "SIZEMB from size file: ${SIZEMB}"
        else
            echo "redis.size not root-owned (uid=${_owner}); ignoring"
        fi
    fi

if [ -z "${SIZEMB}" ] && [ -e "${REDISDIR}/redis.package" ]; then
        _owner=$(_redis_size_owner "${REDISDIR}/redis.package")
        if [ "${_owner}" = "0" ]; then
            PACKAGE=$(cat "${REDISDIR}/redis.package" 2>/dev/null)
            PKGLINE=$(grep "${PACKAGE}", < "${PACKAGE_SIZES}" 2>/dev/null)
            SIZEMB=$(echo "${PKGLINE}" | cut -d',' -f2 | tr -d '\r')
            echo "SIZEMB from package ${PACKAGE}: ${SIZEMB}"
        else
            echo "redis.package not root-owned (uid=${_owner}); ignoring"
        fi
    fi

if [ -z "${SIZEMB}" ] && SIZEMB=$("cat" "${DIR}/../conf/redis_default_size.conf" 2>/dev/null); then
        echo "SIZEMB from default file: ${SIZEMB}"
    fi

if [ -z "${SIZEMB}" ]; then
        SIZEMB="64"
        echo "SIZEMB final default: ${SIZEMB}"
    fi

# §7 (defense-in-depth): clamp to a strictly-numeric, sane value before
    # passing to --maxmemory.  A non-numeric or empty value would produce a
    # malformed "mb" argument; a zero/negative would disable the limit.
    # Accept only positive integers; fall back to the built-in default on any
    # non-conforming value.
    if ! [[ "${SIZEMB}" =~ ^[1-9][0-9]*$ ]]; then
        echo "SIZEMB '${SIZEMB}' is not a valid positive integer; using default 64"
        SIZEMB="64"
    fi

rm -f "${REDISDIR}"/*.rdb

"/usr/bin/${REDIS}-server" --port 0 --unixsocketperm 700 --unixsocket "${SOCKDIR}"/redis.sock --dir "${REDISDIR}" --maxmemory "${SIZEMB}"mb --supervised systemd
elif [ "$ACTION" == "stop" ]; then
    echo "Stopping redis for ${USER}"
else
    echo "Undefined action: ${ACTION}"
    exit 1
fi