Merge "Implement wall clock time limits for shell commands" into wmf/1.21wmf6origin/wmf/1.21wmf6

3 files changed, 41 insertions, 8 deletions

diff --git a/bin/ulimit5.sh b/bin/ulimit5.sh
new file mode 100644
index 000000000000..3f2417210583
--- /dev/null
+++ b/bin/ulimit5.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+if [ "$1" -gt 0 ]; then
+	ulimit -t "$1"
+fi
+if [ "$2" -gt 0 ]; then
+	ulimit -v "$2"
+fi
+if [ "$3" -gt 0 ]; then
+	ulimit -f "$3"
+fi
+if [ "$4" -gt 0 ]; then
+	timeout $4 /bin/bash -c "$5"
+	STATUS="$?"
+	if [ "$STATUS" == 124 ]; then
+		echo "ulimit5.sh: timed out." 1>&2
+	fi
+	exit "$STATUS"
+else
+	eval "$5"
+fi
diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 92e473c9ac04..23ff4090b73b 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -6097,11 +6097,17 @@ $wgMaxShellMemory = 102400;
 $wgMaxShellFileSize = 102400;
 
 /**
- * Maximum CPU time in seconds for shell processes under linux
+ * Maximum CPU time in seconds for shell processes under Linux
  */
 $wgMaxShellTime = 180;
 
 /**
+ * Maximum wall clock time (i.e. real time, of the kind the clock on the wall
+ * would measure) in seconds for shell processes under Linux
+ */
+$wgMaxShellWallClockTime = 180;
+
+/**
  * Executable path of the PHP cli binary (php/php5). Should be set up on install.
  */
 $wgPhpCli = '/usr/bin/php';
diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index 7833a71f06ef..64d550f2b7f0 100644
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -2767,12 +2767,13 @@ function wfEscapeShellArg( ) {
  *                 (non-zero is usually failure)
  * @param $environ Array optional environment variables which should be
  *                 added to the executed command environment.
- * @param $limits Array optional array with limits(filesize, memory, time)
+ * @param $limits Array optional array with limits(filesize, memory, time, walltime)
  *                 this overwrites the global wgShellMax* limits.
  * @return string collected stdout as a string (trailing newlines stripped)
  */
 function wfShellExec( $cmd, &$retval = null, $environ = array(), $limits = array() ) {
-	global $IP, $wgMaxShellMemory, $wgMaxShellFileSize, $wgMaxShellTime;
+	global $IP, $wgMaxShellMemory, $wgMaxShellFileSize, $wgMaxShellTime,
+		$wgMaxShellWallClockTime;
 
 	static $disabled;
 	if ( is_null( $disabled ) ) {
@@ -2820,14 +2821,19 @@ function wfShellExec( $cmd, &$retval = null, $environ = array(), $limits = array
 
 	if ( php_uname( 's' ) == 'Linux' ) {
 		$time = intval ( isset($limits['time']) ? $limits['time'] : $wgMaxShellTime );
+		if ( isset( $limits['walltime'] ) ) {
+			$wallTime = intval( $limits['walltime'] );
+		} elseif ( isset( $limits['time'] ) ) {
+			$wallTime = $time;
+		} else {
+			$wallTime = intval( $wgMaxShellWallClockTime );
+		}
 		$mem = intval ( isset($limits['memory']) ? $limits['memory'] : $wgMaxShellMemory );
 		$filesize = intval ( isset($limits['filesize']) ? $limits['filesize'] : $wgMaxShellFileSize );
 
-		if ( $time > 0 && $mem > 0 ) {
-			$script = "$IP/bin/ulimit4.sh";
-			if ( is_executable( $script ) ) {
-				$cmd = '/bin/bash ' . escapeshellarg( $script ) . " $time $mem $filesize " . escapeshellarg( $cmd );
-			}
+		if ( $time > 0 || $mem > 0 || $filesize > 0 || $wallTime > 0 ) {
+			$cmd = '/bin/bash ' . escapeshellarg( "$IP/bin/ulimit5.sh" ) .
+				" $time $mem $filesize $wallTime " . escapeshellarg( $cmd );
 		}
 	}
 	wfDebug( "wfShellExec: $cmd\n" );