9VjY4 d Z ddlZddlZddlZ ej e ZdZdZdZ dZ
dZ dZ d Z
d
Zd Zd Zd
efdZd Zd Zd Zd Zd Zd Zd Zd Zd ZdS )a+
CLOS-4642: dedicated per-domain lsphp pools for standalone LiteSpeed (LSWS).
Background
----------
On standalone LiteSpeed under cPanel, PHP runs as ONE shared lsphp pool per
Linux user (the ``APVH_`` external app), and LiteSpeed multiplexes every
vhost of the account over it. CageFS per-website isolation masks sibling
docroots with a per-website mount namespace, and a process can live in only
ONE namespace at a time -- so a single shared worker cannot serve several
isolated docroots correctly (addon vhosts return 500, or nothing is masked).
Apache + mod_lsapi is unaffected: it already runs a per-vhost lsphp pool and
passes a per-vhost DOCUMENT_ROOT, so the existing startup site-isolation
constructor works there.
Fix
---
Make LiteSpeed run a DEDICATED lsphp pool per isolated domain so each pool
enters its own website namespace:
* ``DedicatePhpHandler on`` in a per-vhost cPanel *userdata* include
(``/etc/apache2/conf.d/userdata/{std,ssl}/2_4///``). cPanel
always emits a per-vhost ``Include`` for that directory, so the directive
survives every ``httpd.conf`` regeneration (account/domain changes, EA4
updates).
* ``DOCUMENT_ROOT=$DOC_ROOT`` in LiteSpeed's global ```` so each
dedicated pool receives its own document root at spawn time; the alt-php
lsphp startup constructor (CLOS-4506) then re-execs the worker into the
matching website namespace. ``$DOC_ROOT`` is expanded per vhost by LiteSpeed.
Every public helper here is a strict NO-OP unless the active web server is
standalone LiteSpeed on a cPanel server.
Nz /usr/local/lsws/bin/lswsctrlz%/usr/local/lsws/conf/httpd_config.xmlz//usr/local/cpanel/scripts/ensure_vhost_includesz/etc/cpanel/ea4/paths.confz/var/cpanel/userdata)z$/etc/apache2/conf.d/userdata/std/2_4z$/etc/apache2/conf.d/userdata/ssl/2_4zcl_siteiso.confz9
DedicatePhpHandler on
zDOCUMENT_ROOT=$DOC_ROOTz' DOCUMENT_ROOT=$DOC_ROOT
returnc * ddl m} n# t $ r Y dS w xY w | sdS t t d 5 }|D ])}| d rd|v c cddd S * ddd n # 1 swxY w Y n# t $ r Y nw xY wdS ) a
True only on a cPanel server whose ACTIVE web server is standalone
LiteSpeed. Apache+mod_lsapi, Plesk and DirectAdmin return False, so every
helper below becomes a no-op there.
Checking that lswsctrl merely exists is NOT enough: LiteSpeed can be
installed but switched out for Apache. cPanel records the active server's
control binary in ea4/paths.conf (bin_apachectl -> lswsctrl when LiteSpeed
is active, -> apachectl when Apache is), so use that as the source of truth.
r ) is_cpanelFutf-8encoding
bin_apachectllswsctrlN) cldetectlibr ImportErroropenEA4_PATHS_CONF
startswithOSError)r fhlines Vopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/litespeed.pyis_litespeed_activer F sF ))))))) uu 9;; u
.7
3
3
3 .r
.
.???33 .%--- . . . . . . . ..
. . . . . . . . . . . . . . . .
5sL
B A7 B )A7+ B 7A;;B >A;?B
BBc | d }g }t j t | } t j | }n# t $ r |cY S w xY w|D ]}|dv s| d r t j || }t j | s] t |dd 5 }|D ]u} |
d r^| dd d d }
|
|k r|
| nvd
d
d
n # 1 swxY w Y # t $ r Y w xY w|S ) a
Map a document root to the cPanel vhost key(s) that serve it.
cPanel stores one userdata file per vhost in ``/var/cpanel/userdata/``
keyed by the vhost ServerName (an addon domain ``foo.com`` is served by a
vhost like ``sub.maindomain.com``). The per-vhost include directory is keyed
by that same name, so resolve the key by matching ``documentroot:``.
/)maincache)z.cache_SSLr replace)r errorsz
documentroot:: N)rstripospathjoinCPANEL_USERDATAlistdirr endswithisfiler
r splitstripappend) user
document_roottargetkeysuser_direntriesnamer r r drs r _vhost_keys_for_docrootr1 a s
!
!#
&
&F
Dw||OT22H*X&& $ $ $
6H(I(I $ w||Hd++w~~d## dWY???
2 D77 !ZZQ / / 2 8 8 : : A A# F F << KK - - -
H KsH A A"!A"E)A9E E) E E)#E $E))
E76E7c . fdt D S )Nc R g | ]#}t j | $S )r r r! ).0rootr) vhost_keys r
z!_include_dirs.. s+ S S SDBGLLtY / / S S S )USERDATA_INCLUDE_ROOTS)r) r7 s ``r
_include_dirsr; s" S S S S S`` so every dedicated per-domain pool spawns with its own
document root. Idempotent; backs the file up before the first edit.
Returns "added" if the env line was inserted (caller should reload),
"present" if it was already there, or "failed" if it could not be ensured
(read/parse/write error) so callers can avoid creating broken pools.
r r Nz'LSWS site-isolation: cannot read %s: %sfailedpresentz z0LSWS site-isolation: not found in %s
r z
.clos4642.bakz
.clos4642.tmpr> z)LSWS site-isolation: cannot update %s: %sadded)r
LSWS_HTTPD_CONFIGreadr rC rD DOC_ROOT_ENV_MARKERfindDOC_ROOT_ENV_LINElenr r existsrA r )
r contentrF tagidxnl new_contentcutbackuptmps
r _ensure_docroot_envrb s
#g
6
6
6 "ggiiG @BSUXYYYxxxxx g%%y
C
,,s
C
byyIK\]]]x
dC B Rxx grAvg&)::WR!VWW=MM CHHn dsdmd*->> N
0F
o
-C w~~f%% "fcG444
"!!!
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
#sW
-
-
- " HH[ ! ! ! " " " " " " " " " " " " " " "
3)**** BDUWZ[[[xxxxx 7s A 9 A =A =A
A;!A66A;1H F" H "F&&H )F&*H ?G! H !G%%H (G%) H
H=!H88H=c t j t rU t j t d| z gdd n2# t $ r%}t d| Y d}~nd}~ww xY w t j t dgdd dS # t $ r&}t d| Y d}~dS d}~ww xY w) zBRe-emit the user's vhost includes and gracefully reload LiteSpeed.z --user=%sFT)checkcapture_outputz5LSWS site-isolation: ensure_vhost_includes failed: %sNreloadz/LSWS site-isolation: lswsctrl reload failed: %s)
r r rY ENSURE_VHOST_INCLUDES
subprocessrunr rC rD LSWS_CTRL)r) rF s r _rebuild_and_reloadrk s
w~~+,, Y Y N 1;3EF!&t
=
=
=
=
= Y Y Y NNRTW X X X X X X X X YO 8,E$OOOOOO O O OH#NNNNNNNNNOs/ !A
A7A22A7; B
C %CC c 8 t sdS t | | }|s t d|| dS t dk r#t dt | dS |D ]}t | | t | dS )a
Give the vhost(s) serving ``document_root`` a dedicated lsphp pool so the
worker can enter that website's CageFS namespace. No-op unless LSWS active.
NOTE: this rebuilds the user's vhost includes and reloads LiteSpeed per
call. Enabling many domains for one account in a single command therefore
triggers several rebuilds; batching across a bulk enable is a possible
future optimization (see CLOS-4642).
NzLSWS site-isolation: no cPanel vhost serves docroot %s (user %s); per-site isolation will NOT take effect for it on LiteSpeed until a vhost exists (the worker stays in the shared per-user pool)rN zLSWS site-isolation: cannot ensure DOCUMENT_ROOT env in %s; not creating a dedicated pool for %s -- without it the worker falls back to the primary docroot and 500s addon vhosts) r r1 rC rD rb errorrS rG rk )r) r* r, keys r enable_dedicated_php_handlerro s "4 7 7D
J
4 ! ! !
((
;
} . . .
" "tS!!!! r9 c t sdS t }|D ]'}|r#| t | | (d}d}|r@t }|dk r$t
dt | d}n|dk rd}|rJ|D ]G}d t | | D }t d |D st | | d}Ht D ]} t j
t j | | }
n# t $ r Y Bw xY w|
D ]} | |v rt j | | | t" } t j | rK t j | d}e# t $ r&}
t
d | |
Y d}
~
d}
~
ww xY w|rt+ | dS dS )
a
Make the user's dedicated-pool includes match exactly the given set of
currently-isolated document roots: add includes for isolated docroots that
lack one, and remove includes for vhosts whose docroot is no longer
isolated. Robust to full teardown (empty list), docroots shared by several
domains (kept while any sibling is still isolated), and docroots that no
longer resolve (their stale includes are swept). No-op off standalone
LiteSpeed. Reloads LiteSpeed only when something actually changed.
NFTrN zyLSWS site-isolation: cannot ensure DOCUMENT_ROOT env in %s; not creating dedicated pools, only removing stale ones for %srR c X g | ]'}t j |t (S r4 )r r r! r? )r5 ds r r8 z4reconcile_dedicated_php_handlers.. s) YYY1RW\\!%566YYYr9 c 3 T K | ]#}t j | V $d S )N)r r rY )r5 ps r z3reconcile_dedicated_php_handlers.. s0 88Qrw~~a((888888r9 rI )r setupdater1 rb rC rm rS r; allrG r: r r# r r! r r? rY rJ rD rk )r) isolated_docroots keep_keysr0 changed add_includes
env_statusrn pathsr6 vhostsvhostr rF s r reconcile_dedicated_php_handlersr sh I @ @
@ 4T2 > > ? ? ?GL
(**
! !
LLP!4
)
)
) !LL
7
"
"G CYY
dTW@X@XYYYE88%88888
tS))) & [ [ Z T4 8 899FF H [ [E !!7<<dE3CDDDw~~d##
[[IdOOO "GG [ [ [NN#NPTVYZZZZZZZZ[
[ [ "D!!!!!" "s* %2D
D%$D%8F
F? F::F?c t sdS d}t D ]}t j || } t j | }n# t $ r Y Dw xY w|D ]}}t j ||t } t j | d}@# t $ r Y Lt $ r&}t d|| Y d}~vd}~ww xY w|rt | dS dS )a
Remove every dedicated-pool include for a user. Used on full isolation
teardown (``--isolates-deny`` / ``--isolates-deny-all`` ->
_cleanup_user_isolation), where individual docroots may no longer be
resolvable. No-op unless LSWS is active.
NFTrI )
r r: r r r! r# r r? rJ rK rC rD rk )r) removedr6 user_rootr r r rF s r !remove_all_dedicated_php_handlersr 5 sJ G& W WGLLt,, Z **FF H W WE7<< 52BCCD
W $ $
W
W
W JDRUVVVVVVVV
W W "D!!!!!" "s/ A
A A
B$$
C 0 C 9 CC ) __doc__loggingr rh getLogger__name__rC rj rS rg r r" r: r? rB rU rW boolr r1 r; rG rL rb rk ro r r r4 r9 r r s< ! !D 8 $ $ * ; I .( % P/ > T 6 FT T TR R RS S S+ + +\ O O O @8" 8" 8"v" " " " "r9