BlueOnyx 5210R/5211R/5212R DNF updates
BlueOnyx maintenance updates have been released.
A few minor issues popped up in the last few days and we released a set of DNF updates for BlueOnyx 5210R, 5211R and 5212R to address those:
Easy-Migrate:
Easy-Migrate was using perl(Unix::PasswdFile) to read the user and group information of Vsites and Users that need to be migrated. However, sometimes less is more. In cases where a GUI or shell transaction has an exclusive lock on the Password files Easy-Migrate is then unable to obtain the information it seeks. We made a small change and no longer use perl(Unix::PasswdFile) for this. Instead we brought our own read-only parser to run during the information gathering phase. That creates less friction.
PHP 'open_basedir' restrictions:
Our PHP implementation on BlueOnyx is designed with security in mind and one of the measures we take is to set restrictive open_basedir limits for Vsites. However, these limits also used to apply on the CLI, where it is often counter-productive. Hence base-vsite and base-apache got updated to to remove the open_basedir restrictions from the php.ini files of all installed PHP versions. The open_basedir restrictions for Vsites (via PHP-FPM, suPHP, DSO or mod_ruid2) during web access continue to use the same open_basedir restrictions as before. Just during CLI usage we don't enforce them anymore.
PHP Opcache defaults:
Newer PHP versions from the BlueOnyx shop all come with enabled Opcache support. We're now enforcing proper defaults on all of them. Opcache gets enabled if called via the webserver, but remains disabled if PHP is used on the CLI.
Jailkit Jails:
Vsites (and user accounts) on a BlueOnyx can be put into chrooted jails via Jailkit. Occasionally OS updates break the library support of binaries in the jail and so far this was ugly to remedy whenever it happened.
This set of updates contains a "self-healing" mechanism for Jailkit jails. Once a day (either via Cronjob or during the first CCEd restart of the day) a script is run and it checks the consistency and integrity of all Jails. If inconsistencies are found in a Jails config file or its rolled out binaries and libraries, the Jail will be reinstalled using the configured defaults for that Vsite or User.
Example usage:
[root@5212r ~]# /usr/sausalito/sbin/jailkit_integrity.pl --help
Usage: jailkit_integrity.pl [options]
Checks and repairs active BlueOnyx Jailkit Vsite and user jails.
--help, -h Show this help
--quiet Suppress normal output
--if-due Run only if the last run is older than 24 hours
--force Ignore the daily execution guard
--dry-run Do not write files or repair jails
If you run it with --force it will walk through all Vsites with enabled Jailkit support, will examine the Vsite and User jails and will repair them if need be.
Full Changelog:
The full history of changes can be found here in SVN.