From a9ff5c830951eead9c4cfa04532d378220ccd8e4 Mon Sep 17 00:00:00 2001 From: Yurii Izorkin Date: Mon, 25 Oct 2021 17:31:20 +0300 Subject: [PATCH 1/3] templates/systemd/mastodon: update sandbox mode (#16235) * templates/systemd/mastodon: add new sandboxing options * templates/systemd/mastodon: add '@privileged' and remove duplicates SystemCallFilters * templates/systemd/mastodon: add '@ipc' SystemCallFilter * templates/systemd/mastodon: add '@memlock' SystemCallFilter * templates/systemd/mastodon: allow '@resources' filter to mastodon-web service --- dist/mastodon-sidekiq.service | 9 ++++++++- dist/mastodon-streaming.service | 8 +++++++- dist/mastodon-web.service | 9 ++++++++- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 35b121cd7..7d2d72e99 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -13,6 +13,9 @@ Environment="LD_PRELOAD=libjemalloc.so" ExecStart=/home/mastodon/.rbenv/shims/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service index 0befc529a..6d71298a5 100644 --- a/dist/mastodon-streaming.service +++ b/dist/mastodon-streaming.service @@ -12,6 +12,9 @@ Environment="STREAMING_CLUSTER_NUM=1" ExecStart=/usr/bin/node ./streaming TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -34,11 +37,14 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @memlock @mount @obsolete @privileged @resources @setuid +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-web.service b/dist/mastodon-web.service index f41efd2b0..16d1d5653 100644 --- a/dist/mastodon-web.service +++ b/dist/mastodon-web.service @@ -13,6 +13,9 @@ ExecStart=/home/mastodon/.rbenv/shims/bundle exec puma -C config/puma.rb ExecReload=/bin/kill -SIGUSR1 $MAINPID TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target From 11d4f9eefc7b40df84baceff9b2e0747887b23ec Mon Sep 17 00:00:00 2001 From: Sasha Sorokin <10401817+Brawaru@users.noreply.github.com> Date: Mon, 25 Oct 2021 21:32:28 +0700 Subject: [PATCH 2/3] Split context for filter bar and unread markers (#16865) On notifications page, in settings, "Show" for quick filter bar and unread notifications markers use the same string, while being placed in the separate contexts - under different settings categories. This commit splits the contexts, creating new strings: - "Show filter bar" in place of "Show" for filter bar; - "Highlight unread notifications" in place of "Show" for unread notification markers, which are now simply called "Highlighting"; - There's also "Unread notifications" in place of "Unread notification markers" string to accompany the changes to "Show" string under that category. All new strings have new IDs, which will cause previous strings to invalidate on the next translation update and new strings to be created. This will help Mastodon translators to know that there are changes and improve translation in accordance to the source string update. --- .../notifications/components/column_settings.js | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/app/javascript/mastodon/features/notifications/components/column_settings.js b/app/javascript/mastodon/features/notifications/components/column_settings.js index 0c24c3294..005f5afda 100644 --- a/app/javascript/mastodon/features/notifications/components/column_settings.js +++ b/app/javascript/mastodon/features/notifications/components/column_settings.js @@ -26,11 +26,12 @@ export default class ColumnSettings extends React.PureComponent { render () { const { settings, pushSettings, onChange, onClear, alertsEnabled, browserSupport, browserPermission, onRequestNotificationPermission } = this.props; - const filterShowStr = ; + const unreadMarkersShowStr = ; + const filterBarShowStr = ; const filterAdvancedStr = ; - const alertStr = ; - const showStr = ; - const soundStr = ; + const alertStr = ; + const showStr = ; + const soundStr = ; const showPushSettings = pushSettings.get('browserSupport') && pushSettings.get('isSubscribed'); const pushStr = showPushSettings && ; @@ -57,11 +58,11 @@ export default class ColumnSettings extends React.PureComponent {
- +
- +
@@ -71,7 +72,7 @@ export default class ColumnSettings extends React.PureComponent {
- +
From 5ba46952af87e42a64962a34f7ec43bc710bdcaf Mon Sep 17 00:00:00 2001 From: Claire Date: Mon, 25 Oct 2021 16:34:15 +0200 Subject: [PATCH 3/3] Fix mastodon:setup to take dotenv/docker-compose differences into account (#16896) In order to work around https://github.com/mastodon/mastodon/issues/16895, add a warning to .env.production.sample, and change the mastodon:setup rake task to: - output a warning if a variable will be interpreted differently by dotenv and docker-compose - ensure the printed config is compatible with docker-compose --- .env.production.sample | 6 ++++++ lib/tasks/mastodon.rake | 15 +++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.env.production.sample b/.env.production.sample index 86ae5d111..c24c31c9b 100644 --- a/.env.production.sample +++ b/.env.production.sample @@ -4,6 +4,12 @@ # not demonstrate all available configuration options. Please look at # https://docs.joinmastodon.org/admin/config/ for the full documentation. +# Note that this file accepts slightly different syntax depending on whether +# you are using `docker-compose` or not. In particular, if you use +# `docker-compose`, the value of each declared variable will be taken verbatim, +# including surrounding quotes. +# See: https://github.com/mastodon/mastodon/issues/16895 + # Federation # ---------- # This identifies your server and cannot be changed safely later diff --git a/lib/tasks/mastodon.rake b/lib/tasks/mastodon.rake index 72bacb5eb..9146f78e1 100644 --- a/lib/tasks/mastodon.rake +++ b/lib/tasks/mastodon.rake @@ -333,8 +333,12 @@ namespace :mastodon do prompt.say 'This configuration will be written to .env.production' if prompt.yes?('Save configuration?') + incompatible_syntax = false + env_contents = env.each_pair.map do |key, value| if value.is_a?(String) && value =~ /[\s\#\\"]/ + incompatible_syntax = true + if value =~ /[']/ value = value.to_s.gsub(/[\\"\$]/) { |x| "\\#{x}" } "#{key}=\"#{value}\"" @@ -346,12 +350,19 @@ namespace :mastodon do end end.join("\n") - File.write(Rails.root.join('.env.production'), "# Generated with mastodon:setup on #{Time.now.utc}\n\n" + env_contents + "\n") + generated_header = "# Generated with mastodon:setup on #{Time.now.utc}\n\n" + + if incompatible_syntax + generated_header << "Some variables in this file will be interpreted differently whether you are\n" + generated_header << "using docker-compose or not.\n\n" + end + + File.write(Rails.root.join('.env.production'), "#{generated_header}#{env_contents}\n") if using_docker prompt.ok 'Below is your configuration, save it to an .env.production file outside Docker:' prompt.say "\n" - prompt.say File.read(Rails.root.join('.env.production')) + prompt.say "#{generated_header}#{env.each_pair.map { |key, value| "#{key}=#{value}" }.join("\n")}" prompt.say "\n" prompt.ok 'It is also saved within this container so you can proceed with this wizard.' end