Harden managed PHP-FPM execution

Author: eldryoth

CHANGELOG.md

@@ -28,6 +28,10 @@ behavior when the change improves security or project direction.
   configurable admission pool and a fixed 32-slot blocking-work class.
 - Document that the opt-in clock capability exposes full host clock resolution
   and is unsuitable for untrusted plugins colocated with secret-dependent work.
+- Bound complete FastCGI request/response operations with one deadline, retain
+  anonymous request-body spool descriptors, and fix the managed child `PATH`.
+- Bind managed PHP-FPM spawn to a trusted executable descriptor and terminate
+  its complete dedicated process group during shutdown and watchdog recovery.
 
 ## 1.7.7 - 2026-07-10
 

crates/fluxheim-php-fpm/src/managed_config.rs

@@ -11,13 +11,11 @@ pub fn managed_php_fpm_restart_backoff_secs(restart_failures: usize) -> u64 {
 }
 
 pub fn managed_php_fpm_path_env_from(value: Option<String>) -> String {
-    const DEFAULT_PATH: &str = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+    const MANAGED_PHP_FPM_PATH: &str =
+        "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 
-    value
-        .filter(|value| {
-            !value.is_empty() && value.bytes().all(|byte| !matches!(byte, 0..=31 | 127))
-        })
-        .unwrap_or_else(|| DEFAULT_PATH.to_owned())
+    let _ = value;
+    MANAGED_PHP_FPM_PATH.to_owned()
 }
 
 pub fn managed_php_fpm_instance_name(metric_pool: &str) -> io::Result<String> {

crates/fluxheim-php-fpm/src/managed_process_lifecycle.rs

@@ -7,8 +7,7 @@ use std::time::{Duration, Instant};
 use crate::managed_config::managed_php_fpm_restart_backoff_secs;
 use crate::managed_process::ManagedPhpFpmSpawnPlan;
 use crate::managed_spawn::{
-    ensure_managed_php_fpm_binary_spawn_safe, managed_php_fpm_path_env,
-    wait_for_managed_php_fpm_socket,
+    managed_php_fpm_path_env, open_managed_php_fpm_executable, wait_for_managed_php_fpm_socket,
 };
 
 const MANAGED_PHP_FPM_STABLE_RESTART_SECS: u64 = 30;
@@ -47,11 +46,11 @@ pub(super) fn spawn_managed_php_fpm_cleanup(
                 Ok(mut guard) => guard.take(),
                 Err(poisoned) => poisoned.into_inner().take(),
             };
-            if let Some(mut child) = child {
+            if let Some(child) = child {
                 // Drop can run on a Tokio worker after the last request releases an
                 // old runtime snapshot. If cleanup-thread creation fails, do not
                 // block that worker on Child::wait().
-                let _ = child.kill();
+                signal_managed_php_fpm_group(&child, rustix::process::Signal::KILL);
             }
             cleanup_managed_php_fpm_files(&socket, &config_path, &pid_path);
         }
@@ -66,63 +65,73 @@ pub(super) fn cleanup_managed_php_fpm_files(socket: &Path, config_path: &Path, p
 
 pub(super) fn terminate_managed_php_fpm_child(child: &mut std::process::Child) {
     match child.try_wait() {
-        Ok(Some(_)) => return,
+        Ok(Some(_)) => {
+            signal_managed_php_fpm_group(child, rustix::process::Signal::KILL);
+            return;
+        }
         Ok(None) => {}
         Err(_) => {
-            let _ = child.kill();
+            signal_managed_php_fpm_group(child, rustix::process::Signal::KILL);
             let _ = child.wait();
             return;
         }
     }
 
-    let _ = rustix::process::kill_process(
-        rustix::process::Pid::from_child(child),
-        rustix::process::Signal::TERM,
-    );
+    signal_managed_php_fpm_group(child, rustix::process::Signal::TERM);
     let deadline = Instant::now() + Duration::from_secs(5);
     loop {
         match child.try_wait() {
-            Ok(Some(_)) => return,
+            Ok(Some(_)) => {
+                signal_managed_php_fpm_group(child, rustix::process::Signal::KILL);
+                return;
+            }
             Ok(None) if Instant::now() < deadline => {
                 std::thread::sleep(Duration::from_millis(100));
             }
             _ => {
-                let _ = child.kill();
+                signal_managed_php_fpm_group(child, rustix::process::Signal::KILL);
                 let _ = child.wait();
                 return;
             }
         }
     }
 }
 
+fn signal_managed_php_fpm_group(child: &std::process::Child, signal: rustix::process::Signal) {
+    let _ = rustix::process::kill_process_group(rustix::process::Pid::from_child(child), signal);
+}
+
 pub(super) fn spawn_managed_php_fpm_child(
     plan: &ManagedPhpFpmSpawnPlan,
     shutdown: Option<&AtomicBool>,
 ) -> io::Result<(std::process::Child, Instant)> {
-    ensure_managed_php_fpm_binary_spawn_safe(&plan.scope, &plan.binary)?;
+    use std::os::unix::process::CommandExt as _;
+
+    let executable = open_managed_php_fpm_executable(&plan.scope, &plan.binary)?;
     let _ = std::fs::remove_file(&plan.socket);
     let _ = std::fs::remove_file(&plan.pid_path);
 
-    let mut child = std::process::Command::new(&plan.binary)
+    let mut command = executable.command();
+    command
+        .process_group(0)
         .arg("-F")
         .arg("-y")
         .arg(&plan.config_path)
         .env_clear()
         .env("PATH", managed_php_fpm_path_env())
         .stdin(std::process::Stdio::null())
         .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .map_err(|error| {
-            io::Error::new(
-                error.kind(),
-                format!(
-                    "{}: failed to start managed php-fpm binary {}: {error}",
-                    plan.scope,
-                    plan.binary.display()
-                ),
-            )
-        })?;
+        .stderr(std::process::Stdio::null());
+    let mut child = command.spawn().map_err(|error| {
+        io::Error::new(
+            error.kind(),
+            format!(
+                "{}: failed to start managed php-fpm binary {}: {error}",
+                plan.scope,
+                plan.binary.display()
+            ),
+        )
+    })?;
 
     match wait_for_managed_php_fpm_socket(
         &mut child,
@@ -185,12 +194,16 @@ fn run_managed_php_fpm_watchdog(
             };
             match guard.as_mut().map(std::process::Child::try_wait) {
                 Some(Ok(Some(status))) => {
-                    *guard = None;
+                    if let Some(exited_child) = guard.take() {
+                        signal_managed_php_fpm_group(&exited_child, rustix::process::Signal::KILL);
+                    }
                     Some(format!("exited with status {status}"))
                 }
                 Some(Ok(None)) => None,
                 Some(Err(error)) => {
-                    *guard = None;
+                    if let Some(mut failed_child) = guard.take() {
+                        terminate_managed_php_fpm_child(&mut failed_child);
+                    }
                     Some(format!("status check failed: {error}"))
                 }
                 None => Some("missing child process handle".to_owned()),
@@ -274,3 +287,54 @@ fn managed_php_fpm_sleep_until_restart(shutdown: &AtomicBool, restart_failures:
         std::thread::sleep((deadline - now).min(Duration::from_millis(100)));
     }
 }
+
+#[cfg(all(test, target_os = "linux"))]
+mod tests {
+    use super::terminate_managed_php_fpm_child;
+    use std::os::unix::process::CommandExt as _;
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn forced_cleanup_terminates_managed_process_group() {
+        let pid_path = fluxheim_common::test_support::unique_temp_path("php-fpm-worker-pid");
+        let script = format!("sleep 30 & echo $! > '{}'; wait", pid_path.display());
+        let mut command = std::process::Command::new("/bin/sh");
+        command
+            .process_group(0)
+            .arg("-c")
+            .arg(script)
+            .stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null());
+        let mut child = command.spawn().expect("spawn process group");
+        let deadline = Instant::now() + Duration::from_secs(2);
+        while !pid_path.exists() && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        let worker_pid = std::fs::read_to_string(&pid_path)
+            .expect("worker pid file")
+            .trim()
+            .parse::<u32>()
+            .expect("worker pid");
+
+        terminate_managed_php_fpm_child(&mut child);
+
+        assert!(child.try_wait().expect("master status").is_some());
+        let worker_proc = std::path::PathBuf::from(format!("/proc/{worker_pid}/stat"));
+        let deadline = Instant::now() + Duration::from_secs(2);
+        loop {
+            match std::fs::read_to_string(&worker_proc) {
+                Ok(stat) if !stat.contains(") Z ") && Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                Ok(stat) => {
+                    assert!(stat.contains(") Z "), "worker remained alive: {stat}");
+                    break;
+                }
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => break,
+                Err(error) => panic!("failed to inspect worker process: {error}"),
+            }
+        }
+        let _ = std::fs::remove_file(pid_path);
+    }
+}

crates/fluxheim-php-fpm/src/managed_spawn.rs

@@ -8,7 +8,20 @@ use crate::request_body::{
     create_php_request_body_spool_dir_sync, ensure_php_request_body_spool_dir,
 };
 
+pub(super) struct ManagedPhpFpmExecutable {
+    file: std::fs::File,
+}
+
 pub fn ensure_managed_php_fpm_binary_spawn_safe(scope: &str, binary: &Path) -> io::Result<()> {
+    open_managed_php_fpm_executable(scope, binary).map(|_| ())
+}
+
+pub(super) fn open_managed_php_fpm_executable(
+    scope: &str,
+    binary: &Path,
+) -> io::Result<ManagedPhpFpmExecutable> {
+    use rustix::fs::{Mode, OFlags};
+
     if binary.as_os_str().is_empty() || !binary.is_absolute() {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
@@ -39,34 +52,61 @@ pub fn ensure_managed_php_fpm_binary_spawn_safe(scope: &str, binary: &Path) -> i
             ),
         ));
     }
-    if existing_php_fpm_parent_has_insecure_write_permissions(binary)? {
+    let file = rustix::fs::openat(
+        rustix::fs::CWD,
+        binary,
+        OFlags::RDONLY | OFlags::NOFOLLOW,
+        Mode::empty(),
+    )
+    .map_err(|error| {
+        io::Error::new(
+            io::Error::from(error).kind(),
+            format!(
+                "{scope}: failed to open managed php-fpm binary {} safely: {error}",
+                binary.display()
+            ),
+        )
+    })?;
+    let stat = rustix::fs::fstat(&file).map_err(io::Error::from)?;
+    let effective_uid = rustix::process::geteuid().as_raw();
+    if !rustix::fs::FileType::from_raw_mode(stat.st_mode).is_file()
+        || (stat.st_uid != 0 && stat.st_uid != effective_uid)
+        || stat.st_mode & 0o022 != 0
+        || stat.st_mode & 0o111 == 0
+    {
         return Err(io::Error::new(
             io::ErrorKind::PermissionDenied,
             format!(
-                "{scope}: managed php-fpm binary {} is below a group/world-writable parent",
+                "{scope}: managed php-fpm binary {} has an untrusted owner or mode",
                 binary.display()
             ),
         ));
     }
-    let metadata = std::fs::symlink_metadata(binary).map_err(|error| {
-        io::Error::new(
-            error.kind(),
-            format!(
-                "{scope}: failed to inspect managed php-fpm binary {} before spawn: {error}",
-                binary.display()
-            ),
-        )
-    })?;
-    if !metadata.is_file() {
+    let parent = binary.parent().unwrap_or_else(|| Path::new("/"));
+    if fluxheim_config::fs_trust::existing_path_or_parent_has_insecure_write_permissions(parent)? {
         return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
+            io::ErrorKind::PermissionDenied,
             format!(
-                "{scope}: managed php-fpm binary {} must point directly to a regular file",
+                "{scope}: managed php-fpm binary {} is below an untrusted or group/world-writable ancestor",
                 binary.display()
             ),
         ));
     }
-    Ok(())
+    Ok(ManagedPhpFpmExecutable {
+        file: std::fs::File::from(file),
+    })
+}
+
+impl ManagedPhpFpmExecutable {
+    pub(super) fn command(&self) -> std::process::Command {
+        use std::os::fd::AsRawFd as _;
+
+        #[cfg(target_os = "linux")]
+        let path = format!("/proc/self/fd/{}", self.file.as_raw_fd());
+        #[cfg(not(target_os = "linux"))]
+        let path = format!("/dev/fd/{}", self.file.as_raw_fd());
+        std::process::Command::new(path)
+    }
 }
 
 fn existing_php_fpm_path_prefix_contains_symlink(path: &Path) -> io::Result<bool> {
@@ -83,30 +123,8 @@ fn existing_php_fpm_path_prefix_contains_symlink(path: &Path) -> io::Result<bool
     Ok(false)
 }
 
-fn existing_php_fpm_parent_has_insecure_write_permissions(path: &Path) -> io::Result<bool> {
-    use std::os::unix::fs::PermissionsExt;
-
-    let mut current = path
-        .parent()
-        .filter(|parent| !parent.as_os_str().is_empty())
-        .unwrap_or_else(|| Path::new("."))
-        .to_path_buf();
-
-    loop {
-        match std::fs::metadata(&current) {
-            Ok(metadata) => return Ok(metadata.permissions().mode() & 0o022 != 0),
-            Err(error) if error.kind() == io::ErrorKind::NotFound => {
-                if !current.pop() {
-                    return Ok(false);
-                }
-            }
-            Err(error) => return Err(error),
-        }
-    }
-}
-
 pub(super) fn managed_php_fpm_path_env() -> String {
-    managed_php_fpm_path_env_from(std::env::var("PATH").ok())
+    managed_php_fpm_path_env_from(None)
 }
 
 pub(super) fn write_managed_php_fpm_config_file(path: &Path, contents: &[u8]) -> io::Result<()> {
@@ -183,3 +201,44 @@ pub(super) fn wait_for_managed_php_fpm_socket(
         std::thread::sleep(Duration::from_millis(50));
     }
 }
+
+#[cfg(all(test, target_os = "linux"))]
+mod tests {
+    use super::ManagedPhpFpmExecutable;
+    use std::os::unix::fs::MetadataExt as _;
+    use std::os::unix::fs::PermissionsExt as _;
+
+    #[test]
+    fn retained_executable_descriptor_survives_path_replacement() {
+        use rustix::fs::{Mode, OFlags};
+
+        let root = tempfile::TempDir::new().expect("temp dir");
+        let binary = root.path().join("php-fpm");
+        let moved = root.path().join("php-fpm.original");
+        std::fs::copy("/usr/bin/true", &binary).expect("copy original executable");
+        std::fs::set_permissions(&binary, std::fs::Permissions::from_mode(0o700))
+            .expect("set executable mode");
+        let file = rustix::fs::openat(
+            rustix::fs::CWD,
+            &binary,
+            OFlags::RDONLY | OFlags::NOFOLLOW,
+            Mode::empty(),
+        )
+        .expect("open executable descriptor");
+        let executable = ManagedPhpFpmExecutable {
+            file: std::fs::File::from(file),
+        };
+        std::fs::rename(&binary, &moved).expect("move original executable");
+        std::fs::copy("/usr/bin/false", &binary).expect("copy replacement executable");
+        std::fs::set_permissions(&binary, std::fs::Permissions::from_mode(0o700))
+            .expect("set replacement mode");
+
+        let retained_metadata = executable.file.metadata().expect("retained metadata");
+        let replacement_metadata = std::fs::metadata(&binary).expect("replacement metadata");
+        let command = executable.command();
+        let command_path = command.get_program().to_string_lossy();
+
+        assert_ne!(retained_metadata.ino(), replacement_metadata.ino());
+        assert!(command_path.starts_with("/proc/self/fd/"));
+    }
+}