WIP: temmie/userweb: fcgiwrap

hosts/temmie/services/nfs-mounts.nix

@@ -1,4 +1,4 @@
-{ lib, values, ... }:
+{ lib, pkgs, values, ... }:
 let
   # See microbel:/etc/exports
   letters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
@@ -6,6 +6,20 @@ in
 {
   systemd.targets."pvv-homedirs" = {
     description = "PVV Homedir Partitions";
+    requires = map (l: "pvv-homedir-create-uidmapped-bindmounts@${l}.service") letters;
+  };
+
+  systemd.tmpfiles.settings."10-pvv-homedirs" = {
+    "/run/pvvhome".d = {
+      user = "root";
+      group = "root";
+      mode = "0755";
+    };
+    "/run/pvvhome/by-uid".d = {
+      user = "root";
+      group = "root";
+      mode = "0755";
+    };
   };
 
   systemd.mounts = map (l: {
@@ -17,7 +31,7 @@ in
 
     type = "nfs";
     what = "homepvv${l}.pvv.ntnu.no:/export/home/pvv/${l}";
-    where = "/run/pvv-home-mounts/${l}";
+    where = "/run/pvvhome/${l}";
 
     options = lib.concatStringsSep "," [
       "nfsvers=3"
@@ -54,4 +68,50 @@ in
       "rw"
     ];
   }) letters;
+
+  systemd.services."pvv-homedir-create-uidmapped-bindmounts@" = {
+    bindsTo = [ "run-pvvhome-%i.mount" ];
+    after = [ "run-pvvhome-%i.mount" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+    };
+
+    path = with pkgs; [
+      coreutils
+      systemdMinimal
+    ];
+
+    scriptArgs = "%i";
+    script = ''
+      for dir in "/run/pvvhome/$1"/*/; do
+          [[ -d "$dir" ]] || continue
+
+          uid="$(stat -c '%u' "$dir")"
+          username="$(basename "$dir")"
+
+          mountpoint="/run/pvvhome/by-uid/$uid/$1/$username"
+          mkdir -p "$mountpoint"
+
+          unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")
+
+          if systemctl --quiet is-active "$unit_name" ||
+             systemctl --quiet is-failed "$unit_name"; then
+              echo "Skipping existing mount unit: $unit_name"
+              continue
+          fi
+
+          systemd-mount \
+              --collect \
+              --fsck=no \
+              --type=none \
+              --options=bind \
+              --property=BindsTo=$(systemd-escape --path --suffix=mount "/run/pvvhome/$1") \
+              --property=After=$(systemd-escape --path --suffix=mount "/run/pvvhome/$1") \
+              "$dir" \
+              "$mountpoint" \
+         || echo "Failed mounting for uid $uid"
+      done
+    '';
+  };
 }

hosts/temmie/services/userweb/default.nix

@@ -1,9 +1,11 @@
 {
   imports = [
+    ./fcgiwrap.nix
     ./httpd.nix
     ./log-processor.nix
     ./mail.nix
     ./module.nix
     ./packages.nix
+    ./passwd-sync.nix
   ];
 }

hosts/temmie/services/userweb/fcgiwrap.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+let
+  mcfg = config.services.pvv-userweb;
+in
+{
+  config = lib.mkIf mcfg.enable {
+    systemd.slices.system-userweb-fcgiwrap = { };
+
+    # NOTE: expected %i here is the UID of the user
+    systemd.sockets."userweb-fcgiwrap@" = {
+      description = "UserWeb fcgiwrap server for user %i";
+      socketConfig = {
+        ListenStream = "/run/userweb-fcgiwrap/%i.sock";
+        RemoveOnStop = true;
+
+        SocketUser = "wwwrun";
+        SocketGroup = "wwwrun";
+        SocketMode = "0660";
+      };
+    };
+
+    systemd.services."userweb-fcgiwrap@" = {
+      after = [
+        "httpd-passwd-sync.service"
+      ];
+      requires = [
+        "httpd-passwd-sync.service"
+      ];
+      documentation = [ "man:fcgiwrap(8)" ];
+
+      unitConfig = {
+        AssertPathExists = "/run/pvvhome/by-uid/%i";
+      };
+
+      serviceConfig = {
+
+        Slice = "system-userweb-fcgiwrap.slice";
+        Type = "simple";
+        User = "%i";
+
+        ExecStart = "${lib.getExe pkgs.fcgiwrap}";
+
+        RuntimeDirectoryMode = "0750";
+        RuntimeDirectory = [
+          "fcgiwrap/%i/root-mnt"
+        ];
+        RootDirectory = "/run/fcgiwrap/%i/root-mnt";
+        MountAPIVFS = true;
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+
+          # TODO: set up minimal fake passwd + group in `ExecStartPre` instead
+          "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
+          "/var/lib/httpd-passwd-sync/group:/etc/group"
+
+          "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
+            passwd:    files
+            group:     files
+            shadow:    files
+            sudoers:   files
+
+            hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
+            networks:  files
+
+            ethers:    files
+            services:  files
+            protocols: files
+            rpc:       files
+
+            subuid:    files
+            subgid:    files
+          ''}:/etc/nsswitch.conf"
+        ] ++ lib.optionals mcfg.debugMode [
+          "/bin"
+        ] ++ mcfg.fhsBindPaths;
+
+        # TODO: handle /amd/homepvv${l}
+        BindPaths = [
+          "/run/pvvhome/by-uid/%i:/home/pvv"
+        ];
+      };
+    };
+  };
+}

hosts/temmie/services/userweb/httpd.nix

@@ -65,6 +65,7 @@ in
       extraConfig = ''
         <Directory "${pkgs.emptyDirectory}">
           Require all denied
+          LogLevel authz_core:crit
         </Directory>
 
         CustomLog "${cfg.logDir}/access.log" combined
@@ -276,31 +277,8 @@ in
         "/dev/null"
         "/var/lib/acme"
         "/var/run/nscd"
-        "${mcfg.fhsEnv}/bin:/bin"
-        "${mcfg.fhsEnv}/sbin:/sbin"
-        "${mcfg.fhsEnv}/lib:/lib"
-        "${mcfg.fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${mcfg.fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-          "/run/current-system/sw"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-      BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvv-home-mounts/${letter}:${directoryFn letter}${letter}") {
+      ] ++ mcfg.fhsBindPaths;
+      BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
         directoryFn = [
           (_: "/home/pvv/")
           (l: "/amd/homepvv${l}/")

hosts/temmie/services/userweb/log-processor.nix

@@ -3,11 +3,6 @@ let
   mcfg = config.services.pvv-userweb;
 in
 {
-  sops.secrets = {
-    "httpd/passwd-ssh-key" = { };
-    "httpd/ssh-known-hosts" = { };
-  };
-
   systemd.targets.sockets.wants = [
     "httpd-log-processor@access.socket"
     "httpd-log-processor@error.socket"
@@ -27,6 +22,9 @@ in
 
   systemd.services."httpd-log-processor@" = lib.mkIf config.services.httpd.enable {
     requiredBy = [ "userweb.target" ];
+    after = [ "httpd-passwd-sync.service" ];
+    requires = [ "httpd-passwd-sync.service" ];
+
     serviceConfig = {
       User = "wwwrun";
       Group = "wwwrun";
@@ -37,58 +35,20 @@ in
       StandardOutput = "journal";
       StandardError = "journal";
 
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
-      ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          verbose = true;
-          compress = true;
-          rsh = "${lib.getExe' pkgs.openssh "ssh"} -o BatchMode=yes -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-        inputDir = "/run/httpd-log-processor-%i/pamunix-in";
-        outputDir = "/run/httpd-log-processor-%i/pamunix-out";
-      in lib.mkForce [
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/passwd ${inputDir}/"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/group ${inputDir}/"
-
-        (let
-          args = lib.cli.toCommandLineShellGNU { } {
-            passwd-file = "${inputDir}/passwd";
-            group-file = "${inputDir}/group";
-            output-dir = outputDir;
-            shadow-file = pkgs.emptyFile;
-
-            output-passwd = true;
-
-            ignore-user-file = toString ./ignore_user_file.txt;
-            ignore-group-file = toString ./ignore_group_file.txt;
-          };
-        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
-        "${lib.getExe' pkgs.coreutils "shred"} -u ${inputDir}/passwd ${inputDir}/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' ${outputDir}/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' ${outputDir}/group"
-        "+${lib.getExe' pkgs.coreutils "chown"} root:root ${outputDir}/passwd ${outputDir}/group"
-        "+${lib.getExe' pkgs.coreutils "chmod"} 0644 ${outputDir}/passwd ${outputDir}/group"
-        "+${lib.getExe pkgs.mount} --bind ${outputDir}/passwd /etc/passwd"
-        "+${lib.getExe pkgs.mount} --bind ${outputDir}/group  /etc/group"
-      ];
-
       ExecStart = "${lib.getExe mcfg.apacheLogProcessorPackage} %i";
 
       AmbientCapabilities = [ "CAP_SETUID" "CAP_SETGID" ];
       CapabilityBoundingSet = [ "CAP_SETUID" "CAP_SETGID" ];
       DeviceAllow = [ "" ];
+      IPAddressDeny = "any";
       LockPersonality = true;
       MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
       PrivateDevices = true;
       PrivateIPC = true;
+      PrivateNetwork = true;
       PrivateTmp = true;
-      # PrivateUsers = true;
+      PrivateUsers = false;
       ProcSubset = "pid";
       ProtectClock = true;
       ProtectControlGroups = true;
@@ -96,14 +56,11 @@ in
       ProtectHostname = true;
       ProtectKernelLogs = true;
       ProtectKernelModules = true;
+      ProtectKernelTunables = true;
       ProtectProc = "invisible";
       ProtectSystem = "strict";
-      ProtectKernelTunables = true;
       RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-      ];
+      RestrictAddressFamilies = [ "none" ];
       RestrictNamespaces = true;
       RestrictRealtime = true;
       RestrictSUIDSGID = true;
@@ -112,32 +69,21 @@ in
       SystemCallFilter = [
          "@system-service"
          "@setuid"
+         "~@resources"
       ];
       UMask = "0077";
 
-      IPAddressAllow = [
-        "127.0.0.53" # systemd-resolved
-        values.hosts.microbel.ipv4
-        values.hosts.microbel.ipv6
-      ];
-      IPAddressDeny = "any";
-
       RootDirectory = "/run/httpd-log-processor-%i/root-mnt";
       MountAPIVFS = true;
 
       RuntimeDirectoryMode = "0750";
-      RuntimeDirectory = [
-        "httpd-log-processor-%i/root-mnt"
-        "httpd-log-processor-%i/pamunix-in"
-        "httpd-log-processor-%i/pamunix-out"
-      ];
+      RuntimeDirectory = [ "httpd-log-processor-%i/root-mnt" ];
       BindReadOnlyPaths = [
         builtins.storeDir
         "/etc"
-        "/etc/resolv.conf"
 
-        "-/run/httpd-log-processor-%i/pamunix-out/passwd:/etc/passwd"
-        "-/run/httpd-log-processor-%i/pamunix-out/group:/etc/group"
+        "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
+        "/var/lib/httpd-passwd-sync/group:/etc/group"
 
         "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
           passwd:    files
@@ -159,7 +105,7 @@ in
       ] ++ lib.optionals mcfg.debugMode [
         "/bin"
       ];
-      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") mcfg.homeLetters ++ [
+      BindPaths = map (l: "/run/pvvhome/${l}:/home/pvv/${l}") mcfg.homeLetters ++ [
         "/var/log/httpd"
       ];
     };

hosts/temmie/services/userweb/module.nix

@@ -4,7 +4,9 @@ let
 in
 {
   options.services.pvv-userweb = {
-    enable = lib.mkEnableOption "";
+    enable = lib.mkEnableOption "" // {
+      default = true;
+    };
 
     debugMode = lib.mkEnableOption "";
 
@@ -104,6 +106,36 @@ in
         ];
       };
     };
+
+    fhsBindPaths = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      readOnly = true;
+      default = [
+        "${cfg.fhsEnv}/bin:/bin"
+        "${cfg.fhsEnv}/sbin:/sbin"
+        "${cfg.fhsEnv}/lib:/lib"
+        "${cfg.fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${cfg.fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+          "/run/current-system/sw"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
+    };
   };
 
   config = lib.mkIf cfg.enable {

hosts/temmie/services/userweb/passwd-sync.nix

@@ -0,0 +1,147 @@
+{ config, lib, pkgs, values, ... }:
+let
+  mcfg = config.services.pvv-userweb;
+in
+{
+  config = lib.mkIf mcfg.enable {
+    sops.secrets = {
+      "httpd/passwd-ssh-key" = { };
+      "httpd/ssh-known-hosts" = { };
+    };
+
+    # NOTE: because we are running as `DynamicUser` and we want the result files to be available to
+    #       other services, this directory needs to be created via systemd-tmpfiles
+    systemd.tmpfiles.settings."10-httpd-passwd-sync"."/var/lib/httpd-passwd-sync".d = {
+      user = "root";
+      group = "root";
+      mode = "0700";
+    };
+
+    systemd.timers.httpd-passwd-sync = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        Unit = "httpd-passwd-sync.service";
+      };
+    };
+
+    systemd.services."httpd-passwd-sync" = {
+      requiredBy = [ "userweb.target" ];
+      after = [
+        "systemd-tmpfiles-setup.service"
+        "systemd-tmpfiles-resetup.service"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        Slice = "system-userweb.slice";
+        Restart = "on-failure";
+        RestartSec = "3s";
+
+        DynamicUser = true;
+
+        LoadCredential = [
+          "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
+          "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
+        ];
+        ExecStart = let
+          rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+            verbose = true;
+            compress = true;
+            rsh = "${lib.getExe' pkgs.openssh "ssh"} -o BatchMode=yes -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+          };
+          inputDir = "/run/httpd-passwd-sync/in";
+          wipDir = "/run/httpd-passwd-sync/wip";
+          outputDir = "/var/lib/httpd-passwd-sync";
+        in [
+          "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/passwd ${inputDir}/"
+          "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/group ${inputDir}/"
+
+          (let
+            args = lib.cli.toCommandLineShellGNU { } {
+              passwd-file = "${inputDir}/passwd";
+              group-file = "${inputDir}/group";
+              output-dir = wipDir;
+              shadow-file = pkgs.emptyFile;
+
+              output-passwd = true;
+
+              ignore-user-file = toString ./ignore_user_file.txt;
+              ignore-group-file = toString ./ignore_group_file.txt;
+            };
+          in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
+
+          "${lib.getExe' pkgs.coreutils "shred"} -u ${inputDir}/passwd ${inputDir}/group"
+
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' ${wipDir}/passwd"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' ${wipDir}/passwd"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' ${wipDir}/group"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' ${wipDir}/group"
+
+          "+${lib.getExe' pkgs.coreutils "install"} -m644 -o root -g root -t '${outputDir}' ${wipDir}/passwd ${wipDir}/group"
+          "${lib.getExe' pkgs.coreutils "shred"} -u ${wipDir}/passwd ${wipDir}/group"
+        ];
+
+        AmbientCapabilities = [ "" ];
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = "tmpfs";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@resources"
+        ];
+        UMask = "0077";
+
+        IPAddressAllow = [
+          values.hosts.microbel.ipv4
+          values.hosts.microbel.ipv6
+        ];
+        IPAddressDeny = "any";
+
+        RootDirectory = "/run/httpd-passwd-sync/root-mnt";
+        MountAPIVFS = true;
+
+        RuntimeDirectoryMode = "0750";
+        RuntimeDirectory = [
+          "httpd-passwd-sync/root-mnt"
+          "httpd-passwd-sync/in"
+          "httpd-passwd-sync/wip"
+        ];
+
+        BindPaths = [
+          "/var/lib/httpd-passwd-sync"
+        ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+          "/var/run/nscd"
+        ];
+      };
+    };
+  };
+}