harden runtime config and docs

src/lib/fcgi_forward.h

@@ -2,7 +2,7 @@
 
 // Minimal FastCGI client used by the connection brokers (the custom HTTP server
 // dispatcher and the websocket exec child) to render a request through a normal
-// worker on /run/uce.sock instead of rendering wasm in the broker's own forked
+// worker on FCGI_SOCKET_PATH instead of rendering wasm in the broker's own forked
 // process. Wasmtime cannot be safely re-created across fork, so the broker owns
 // the connection but forwards the actual unit invocation to a clean-engine
 // worker — the "broker holds connections, units respond like RENDER()" model.

src/lib/sys.cpp

@@ -876,7 +876,6 @@ String shell_exec(String cmd)
 
 String shell_escape(String raw)
 {
-	// FIXME
 	String result = "";
 	for(auto c : raw)
 	{
@@ -971,8 +970,12 @@ bool path_is_within(String path, String root)
 
 bool mkdir(String path)
 {
-	shell_exec(String("mkdir -p ")+" "+shell_escape(path));
-	return(true);
+	if(path == "")
+		return(false);
+	std::error_code ec;
+	if(std::filesystem::exists(path, ec))
+		return(std::filesystem::is_directory(path, ec));
+	return(std::filesystem::create_directories(path, ec) || std::filesystem::is_directory(path, ec));
 }
 
 bool file_exists(String path)
@@ -1605,7 +1608,18 @@ void on_child_exit(int sig)
 
 StringList ls(String dir)
 {
-	return(split(trim(shell_exec("ls -1 "+shell_escape(dir))), "\n"));
+	StringList entries;
+	std::error_code ec;
+	if(!std::filesystem::is_directory(dir, ec))
+		return(entries);
+	for(auto const& entry : std::filesystem::directory_iterator(dir, ec))
+	{
+		if(ec)
+			break;
+		entries.push_back(entry.path().filename().string());
+	}
+	std::sort(entries.begin(), entries.end());
+	return(entries);
 }
 
 StringMap make_server_settings()
@@ -1622,8 +1636,10 @@ StringMap make_server_settings()
 	cfg["SETUP_TEMPLATE"] = "scripts/setup.h.template";
 	cfg["LIT_ESC"] = "3d5b5_1";
 	cfg["CONTENT_TYPE"] = "text/html; charset=utf-8";
-	cfg["FCGI_SOCKET_PATH"] = "/run/uce.sock";
+	cfg["FCGI_SOCKET_PATH"] = "/run/uce/fastcgi.sock";
+	cfg["FCGI_SOCKET_MODE"] = "0666";
 	cfg["CLI_SOCKET_PATH"] = "/run/uce/cli.sock";
+	cfg["CLI_SOCKET_MODE"] = "0600";
 	// Command socket the WS broker listens on; workers flush ws_* dispatch
 	// command batches here at workspace teardown.
 	cfg["WS_BROKER_SOCKET_PATH"] = "/run/uce/ws-broker.sock";
@@ -1632,6 +1648,7 @@ StringMap make_server_settings()
 	cfg["UCE_HOSTCALL_BLOCKLIST"] = "";
 	cfg["TMP_UPLOAD_PATH"] = "/tmp/uce/uploads";
 	cfg["SESSION_PATH"] = "/tmp/uce/sessions";
+	cfg["SESSION_COOKIE_SECURE"] = "0";
 	cfg["COMPILER_SYS_PATH"] = ".";
 	cfg["PRECOMPILE_FILES_IN"] = "";
 	cfg["SITE_DIRECTORY"] = "site";

src/lib/uri.cpp

@@ -843,7 +843,8 @@ String session_start(String session_name)
 	if(session_id.length() == 0)
 	{
 		session_id = session_id_create();
-		set_cookie(session_name, session_id, time() + int_val(context->server->config["SESSION_TIME"]));
+		bool secure_cookie = context->server->config["SESSION_COOKIE_SECURE"] == "1";
+		set_cookie(session_name, session_id, time() + int_val(context->server->config["SESSION_TIME"]), "/", "", secure_cookie, true);
 	}
 	context->session_id = session_id;
 	context->session_name = session_name;
@@ -856,12 +857,23 @@ String session_start(String session_name)
 
 void session_destroy(String session_name)
 {
-	if(context->cookies[session_name].length() > 0)
+	String cookie_session_id = context->cookies[session_name];
+	String active_session_id = context->session_name == session_name ? context->session_id : "";
+	String destroy_session_id = active_session_id != "" ? active_session_id : cookie_session_id;
+	if(cookie_session_id.length() > 0 || active_session_id.length() > 0)
 	{
-		set_cookie(session_name, "", time() - int_val(context->server->config["SESSION_TIME"]));
-		context->session.clear();
-		save_session_data(context->session_id, context->session);
-		context->session_id = "";
+		bool secure_cookie = context->server->config["SESSION_COOKIE_SECURE"] == "1";
+		set_cookie(session_name, "", time() - int_val(context->server->config["SESSION_TIME"]), "/", "", secure_cookie, true);
+		String session_path = session_file_path(destroy_session_id);
+		if(session_path != "")
+			file_unlink(session_path);
+		if(active_session_id != "")
+		{
+			context->session.clear();
+			context->session_loaded_hash = session_hash_serialized(session_serialize(context->session));
+			context->session_id = "";
+			context->session_name = "";
+		}
 	}
 }
 

src/linux_fastcgi.cpp

@@ -1353,6 +1353,27 @@ void listen_for_connections()
 	}
 }
 
+mode_t configured_socket_mode(String value, mode_t fallback)
+{
+	value = trim(value);
+	if(value == "")
+		return(fallback);
+	char* end = 0;
+	long parsed = strtol(value.c_str(), &end, 8);
+	if(end == value.c_str() || *end != '\0' || parsed < 0 || parsed > 0777)
+		return(fallback);
+	return((mode_t)parsed);
+}
+
+void chmod_configured_socket(String path, String mode_value, mode_t fallback)
+{
+	if(path == "")
+		return;
+	mode_t mode = configured_socket_mode(mode_value, fallback);
+	if(chmod(path.c_str(), mode) != 0)
+		fprintf(stderr, "(!) Could not chmod socket %s to %04o: %s\n", path.c_str(), (unsigned int)mode, strerror(errno));
+}
+
 void init_base_process()
 {
 	printf("(P) Starting parent server PID:%i\n", getpid());
@@ -1369,13 +1390,13 @@ void init_base_process()
 	if(server_state.config["FCGI_SOCKET_PATH"] != "")
 	{
 		server.listen(server_state.config["FCGI_SOCKET_PATH"]);
-		chmod(server_state.config["FCGI_SOCKET_PATH"].c_str(), S_IRWXU | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
+		chmod_configured_socket(server_state.config["FCGI_SOCKET_PATH"], server_state.config["FCGI_SOCKET_MODE"], 0666);
 	}
 
 	if(server_state.config["CLI_SOCKET_PATH"] != "")
 	{
 		server.listen_cli(server_state.config["CLI_SOCKET_PATH"]);
-		chmod(server_state.config["CLI_SOCKET_PATH"].c_str(), S_IRWXU | S_IRGRP | S_IWGRP);
+		chmod_configured_socket(server_state.config["CLI_SOCKET_PATH"], server_state.config["CLI_SOCKET_MODE"], 0600);
 	}
 
 	// HTTP_PORT (WebSocket + raw HTTP) is owned by the dedicated WS broker, not