diff --git a/pillar/role/wiki.sls b/pillar/role/wiki.sls index 5561874..4d9923e 100644 --- a/pillar/role/wiki.sls +++ b/pillar/role/wiki.sls @@ -6,6 +6,9 @@ apparmor: httpd2-prefork: source: salt://profile/wiki/files/httpd2-prefork.apparmor template: jinja + magick: + source: salt://profile/wiki/files/magick.apparmor + template: jinja memcached: source: salt://profile/wiki/files/memcached.apparmor pygmentize: @@ -14,7 +17,7 @@ apparmor: # list of wikis running MediaWiki 1.27 (this will allow us to migrate to a new version one by one later) mediawiki: default_version: '1_37' - elasticsearch_server: water.infra.opensuse.org + elasticsearch_server: water4.infra.opensuse.org mysql_server: 192.168.47.4:3307 wikis: # availale options: @@ -53,7 +56,6 @@ mediawiki: skin: Chameleon robots: robots-disallow.txt site_notice: 'This is a test wiki. You are more than welcome to do test edits, but please keep in mind that all changes will be lost when we import a newer database dump.' - version: '1_27-git' es: dbpass: not_in_salt_yet site_notice: '
The wikis are now using the new authentication system.
If you did not migrate your account yet, visit https://idp-portal-info.suse.com/
' @@ -150,7 +152,8 @@ zypper: apache2-prefork: {} # needed for deploying en-test without going through packaging git: {} - mediawiki_1_27-openSUSE: {} + ImageMagick: {} + mediawiki_1_37-openSUSE: {} mariadb-client: {} check_mk-agent-apache_status: {} # needed for migration to unpack tarballs diff --git a/salt/profile/wiki/docroot.sls b/salt/profile/wiki/docroot.sls index 3d05273..66df708 100644 --- a/salt/profile/wiki/docroot.sls +++ b/salt/profile/wiki/docroot.sls @@ -43,6 +43,7 @@ - target: mediawiki_src/{{ symlink }} {%endfor%} +{% if version != '1_27' %} # don't deploy LocalSettings.php and wiki_settings.php for wikis still using 1_27 /srv/www//{{ wiki }}.opensuse.org/public/LocalSettings.php: file.managed: - source: salt://profile/wiki/files/LocalSettings.php @@ -53,9 +54,11 @@ data: {{ data }} mysql_server: {{ pillar['mediawiki']['mysql_server'] }} elasticsearch_server: {{ pillar['mediawiki']['elasticsearch_server'] }} + wgserver: {{ data.get('wgserver', 'https://' + wiki + '.opensuse.org') }} wiki: {{ wiki }} - source: salt://profile/wiki/files/wiki_settings.php - template: jinja +{% endif %} /srv/www//{{ wiki }}.opensuse.org/public/robots.txt: file.managed: diff --git a/salt/profile/wiki/files/LocalSettings.php b/salt/profile/wiki/files/LocalSettings.php index 32dcee5..521b4fe 100644 --- a/salt/profile/wiki/files/LocalSettings.php +++ b/salt/profile/wiki/files/LocalSettings.php @@ -101,8 +101,8 @@ $wgLocalInterwiki = $wgSitename; ## License and Creative Commons licenses are supported so far. # $wgEnableCreativeCommonsRdf = true; $wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright -$wgRightsUrl = ""; -$wgRightsText = ""; +$wgRightsUrl = "https://www.gnu.org/licenses/fdl-1.2.html"; +$wgRightsText = "GNU Free Documentation License 1.2"; $wgRightsIcon = ""; # $wgRightsCode = ""; # Not yet used @@ -248,33 +248,33 @@ $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['autocreateaccount'] = true; # UserMerge ------------------------ -require_once( "$IP/extensions/UserMerge/UserMerge.php" ); +wfLoadExtension('UserMerge'); // By default nobody can use this function, enable for bureaucrat? $wgGroupPermissions['bureaucrat']['usermerge'] = true; # WikiEditor ----------------------- -require_once("$IP/extensions/WikiEditor/WikiEditor.php"); +wfLoadExtension('WikiEditor'); $wgDefaultUserOptions['usebetatoolbar'] = 1; $wgDefaultUserOptions['usebetatoolbar-cgd'] = 1; $wgDefaultUserOptions['wikieditor-preview'] = 1; -# Intersection --------------------- -include("$IP/extensions/intersection/DynamicPageList.php"); +# Intersection / DynamicPageList --------------------- +wfLoadExtension('intersection'); # RSS ----------------------- -include("$IP/extensions/RSS/RSS.php"); +wfLoadExtension('RSS'); $wgRSSUrlWhitelist = array('*'); $wgRSSUrlNumberOfAllowedRedirects = 2; # poo#67195 # InputBox ------------------------- -require_once($IP.'/extensions/InputBox/InputBox.php'); +wfLoadExtension('InputBox'); # ParserFunctions ----------------- -require_once( "$IP/extensions/ParserFunctions/ParserFunctions.php" ); +wfLoadExtension('ParserFunctions'); # CategoryTree.php ---------------- -require_once("$IP/extensions/CategoryTree/CategoryTree.php"); -$wgCategoryTreeMaxDepth = array(CT_MODE_PAGES => 2, CT_MODE_ALL => 2, CT_MODE_CATEGORIES => 3); +wfLoadExtension('CategoryTree'); +$wgCategoryTreeMaxDepth = array(/*CT_MODE_PAGES*/ 10 => 2, /*CT_MODE_ALL*/ 20 => 2, /*CT_MODE_CATEGORIES*/ 0 => 3); # EventCountdown ------------------ require_once("$IP/extensions/EventCountdown.php"); @@ -285,10 +285,10 @@ $wgMultiBoilerplateOptions = false; $wgMultiBoilerplatePerNamespace = true; # Replace Text ---------------------------------------------- -require_once( "$IP/extensions/ReplaceText/ReplaceText.php" ); +wfLoadExtension('ReplaceText'); # Interwiki links management ---------------------------------- -require_once("$IP/extensions/Interwiki/Interwiki.php"); +wfLoadExtension('Interwiki'); $wgInterwikiMagic=true; $wgHideInterlanguageLinks=false; $wgGroupPermissions['*']['interwiki'] = false; @@ -298,7 +298,7 @@ $wgGroupPermissions['sysop']['interwiki'] = true; require_once("extensions/videoflash.php"); # Syntax highlighting ---------------------------------- -require_once("$IP/extensions/SyntaxHighlight_GeSHi/SyntaxHighlight_GeSHi.php"); +wfLoadExtension('SyntaxHighlight_GeSHi'); # Hide page title ---------------------------------- require_once("$IP/extensions/notitle.php"); @@ -314,7 +314,7 @@ $GLOBALS['egMapsGMaps3ApiKey'] = $google_maps_key; #$GLOBALS['egMapsDefaultService'] = 'leaflet'; # protect user pages ---------------------------------- -include_once( "$IP/extensions/UserPageEditProtection/UserPageEditProtection.php" ); +wfLoadExtension('UserPageEditProtection'); $wgOnlyUserEditUserPage = true; /* Set this to true to turn on user page protection */ $wgGroupPermissions['sysop']['editalluserpages'] = true; /* Set this to allow sysops to edit all user pages */ @@ -322,10 +322,10 @@ $wgGroupPermissions['sysop']['editalluserpages'] = true; /* Set this to allow sy include("$IP/extensions/google-coop.php"); # mass deletion ---------------------------------- -include_once( "$IP/extensions/Nuke/Nuke.php"); +wfLoadExtension('Nuke'); # spam filter ---------------------------------- -include_once( "$IP/extensions/AbuseFilter/AbuseFilter.php"); +wfLoadExtension('AbuseFilter'); # set higher EmergencyDisable limits to prevent spam filter from getting disabled with # "Warning: This filter was automatically disabled as a safety measure. It reached the limit of matching more than 5.00% of actions." $wgAbuseFilterEmergencyDisableThreshold['default'] = 0.50; # default 0.05 @@ -347,7 +347,7 @@ require_once("$IP/extensions/GitHub/GitHub.php"); # search ---------------------------------- wfLoadExtension( 'Elastica' ); -require_once "$IP/extensions/CirrusSearch/CirrusSearch.php"; +wfLoadExtension('CirrusSearch'); $wgCirrusSearchServers = array($elasticsearch_server); $wgSearchType = 'CirrusSearch'; @@ -367,9 +367,3 @@ $wgCirrusSearchNamespaceWeights = array( ); # ---------------------------------- - -# hotfix from 2021-12-15 security announcement to disable vulnerable code - $wgActions['mcrundo'] = false; - $wgActions['mcrrestore'] = false; - $wgWhitelistRead = []; - $wgWhitelistReadRegexp = []; diff --git a/salt/profile/wiki/files/apache-vhost.conf b/salt/profile/wiki/files/apache-vhost.conf index f406583..11ac322 100644 --- a/salt/profile/wiki/files/apache-vhost.conf +++ b/salt/profile/wiki/files/apache-vhost.conf @@ -21,6 +21,8 @@ # make suse PHP sees that https is used SetEnvIf X-Forwarded-Proto "https" HTTPS=on + # ensure MediaWiki finds LocalSettings.php + SetEnv MW_INSTALL_PATH "/srv/www/{{ wiki }}.opensuse.org/public/" php_admin_flag engine on {%- if wiki == 'en-test' %} diff --git a/salt/profile/wiki/files/httpd2-prefork.apparmor b/salt/profile/wiki/files/httpd2-prefork.apparmor index 913ddb6..2daf4cd 100644 --- a/salt/profile/wiki/files/httpd2-prefork.apparmor +++ b/salt/profile/wiki/files/httpd2-prefork.apparmor @@ -35,6 +35,8 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon capability sys_ptrace, capability sys_tty_config, + signal send set=usr1 peer=httpd2-prefork//*, + / rw, /bin/bash rix, /dev/random r, @@ -83,7 +85,7 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon /var/lib/apache2/ssl_mutex w, /var/log/apache2/* rwl, - ^DEFAULT_URI flags=(complain,attach_disconnected) { + ^DEFAULT_URI flags=(attach_disconnected) { #include /proc/meminfo r, @@ -97,6 +99,8 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon ^HANDLING_UNTRUSTED_INPUT flags=(complain,attach_disconnected) { #include + signal receive set=usr1 peer=httpd2-prefork, + /**/.htaccess r, /dev/urandom r, /proc/*/attr/current w, @@ -112,9 +116,17 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon } - ^vhost_files flags=(complain,attach_disconnected) { + ^localhost flags=(complain,attach_disconnected) { + /proc/*/attr/current rw, + /proc/loadavg r, + /var/log/apache2/access_log w, + } + + ^vhost_files flags=(attach_disconnected) { #include + signal receive set=usr1 peer=httpd2-prefork, + /var/log/apache2/files-access_log w, /var/log/apache2/files-access_log-20[12][0-9][01][0-9][0-3][0-9] w, /var/log/apache2/error_log w, @@ -128,6 +140,8 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon #include #include + signal receive set=usr1 peer=httpd2-prefork, + / r, /bin/bash rix, /dev/tty rw, @@ -159,7 +173,9 @@ profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_discon /srv/www/{{wiki}}.opensuse.org/tmp/php* rw, /srv/www/{{wiki}}.opensuse.org/secrets.php r, /srv/www/{{wiki}}.opensuse.org/wiki_settings.php r, + /usr/share/icu/*/icudt*l.dat r, /usr/share/mediawiki_1_*/** r, + /usr/bin/magick Px -> magick-{{wiki}}, } # {% endfor %} diff --git a/salt/profile/wiki/files/magick.apparmor b/salt/profile/wiki/files/magick.apparmor new file mode 100644 index 0000000..3f342c3 --- /dev/null +++ b/salt/profile/wiki/files/magick.apparmor @@ -0,0 +1,33 @@ +#include + +# {% for wiki in pillar['mediawiki']['wikis']|sort %} + +profile magick-{{wiki}} flags=(complain) { + #include + #include + + deny network inet stream, + + deny /var/cache/fontconfig/ w, + + /bin/bash mrix, + /dev/tty rw, + /etc/ImageMagick-7-SUSE/*.xml r, + /etc/nsswitch.conf r, + /etc/passwd r, + /proc/filesystems r, + /usr/bin/magick mr, + /usr/lib64/ImageMagick-7.0.7/modules-7_Q16HDRI6/coders/png.so mr, + /usr/lib64/ImageMagick-7.0.7/modules-7_Q16HDRI6/coders/svg.so mr, + owner /srv/www/{{wiki}}.opensuse.org/cache/l10n_cache-en.cdb r, + owner /srv/www/{{wiki}}.opensuse.org/public/?????? w, + owner /srv/www/{{wiki}}.opensuse.org/public/images/**.svg r, + owner /srv/www/{{wiki}}.opensuse.org/public/images/temp/transform_*.png rw, + owner /tmp/magick-* rw, + owner /var/lib/wwwrun/.cache/ w, + +} + +# {% endfor %} + +# vim: ft=apparmor expandtab diff --git a/salt/profile/wiki/files/pygmentize.apparmor b/salt/profile/wiki/files/pygmentize.apparmor index 3960ad6..50f1841 100644 --- a/salt/profile/wiki/files/pygmentize.apparmor +++ b/salt/profile/wiki/files/pygmentize.apparmor @@ -16,6 +16,10 @@ profile pygmentize /usr/share/mediawiki_*/extensions/SyntaxHighlight_GeSHi/pygme #include #include +# file_inherit + audit deny network inet stream, + audit deny /srv/www/*.opensuse.org/cache/l10n_cache-*.cdb r, + /etc/nsswitch.conf r, /etc/passwd r, /proc/meminfo r, diff --git a/salt/profile/wiki/files/wiki_settings.php b/salt/profile/wiki/files/wiki_settings.php index af04eeb..a028b21 100644 --- a/salt/profile/wiki/files/wiki_settings.php +++ b/salt/profile/wiki/files/wiki_settings.php @@ -32,3 +32,5 @@ $wgDBmysql5 = true; {%- endif %} $wgDefaultSkin = "{{ data.get('skin', 'chameleon') }}"; + +$wgServer = '{{ wgserver }}';