diff --git a/nginx_config_reloader/__init__.py b/nginx_config_reloader/__init__.py index fe93697..6b98d79 100644 --- a/nginx_config_reloader/__init__.py +++ b/nginx_config_reloader/__init__.py @@ -30,6 +30,7 @@ MAGENTO1_CONF, MAGENTO2_CONF, MAGENTO_CONF, + MAIN_CONFIG_DIR, NGINX, NGINX_PID_FILE, UNPRIVILEGED_GID, @@ -133,6 +134,9 @@ def install_magento_config(self): # Move temporary symlink to actual location, overwriting existing link or file os.rename(MAGENTO_CONF_NEW, MAGENTO_CONF) + def check_can_write_to_main_config_dir(self): + return os.access(MAIN_CONFIG_DIR, os.W_OK) + def check_no_forbidden_config_directives_are_present(self): """ Loop over the :FORBIDDEN_CONFIG_REGEX: to check if nginx config directory contains forbidden configuration @@ -197,6 +201,12 @@ def _apply(self): if self.check_no_forbidden_config_directives_are_present(): return False + if not self.check_can_write_to_main_config_dir(): + self.logger.error( + "No write permissions to main nginx config directory, please check your permissions." + ) + return False + if not self.no_magento_config: try: self.install_magento_config() diff --git a/tests/test_nginx_config_reloader.py b/tests/test_nginx_config_reloader.py index 2076f8b..1bfcc5b 100644 --- a/tests/test_nginx_config_reloader.py +++ b/tests/test_nginx_config_reloader.py @@ -26,10 +26,12 @@ def setUp(self): self.source = mkdtemp() self.dest = mkdtemp() self.backup = mkdtemp() + self.main = mkdtemp() _, self.mag_conf = mkstemp(text=True) _, self.mag1_conf = mkstemp(text=True) _, self.mag2_conf = mkstemp(text=True) + nginx_config_reloader.MAIN_CONFIG_DIR = self.main nginx_config_reloader.DIR_TO_WATCH = self.source nginx_config_reloader.CUSTOM_CONFIG_DIR = self.dest nginx_config_reloader.BACKUP_CONFIG_DIR = self.backup @@ -49,6 +51,7 @@ def tearDown(self): shutil.rmtree(self.source, ignore_errors=True) shutil.rmtree(self.dest, ignore_errors=True) shutil.rmtree(self.backup, ignore_errors=True) + shutil.rmtree(self.main, ignore_errors=True) for f in [self.mag_conf, self.mag1_conf, self.mag2_conf]: try: os.unlink(f) @@ -646,6 +649,17 @@ def test_permissions_are_masked_for_file_in_subdir(self): & stat.S_IXOTH ) + def test_no_permission_to_main_config_dir(self): + os.chmod(self.main, 0o400) # Read-only + + tm = self._get_nginx_config_reloader_instance() + try: + result = tm.check_can_write_to_main_config_dir() + self.assertFalse(result) + finally: + # Restore permissions after test + os.chmod(self.main, 0o700) + def _get_nginx_config_reloader_instance( self, no_magento_config=False,