Skip to content

Commit 26d1e07

Browse files
bukkabukka
committed
Add debugging
1 parent 5a08325 commit 26d1e07

File tree

3 files changed

+264
-1
lines changed

3 files changed

+264
-1
lines changed

‎.github/actions/apt-x64/action.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ runs:
2929
slapd \
3030
bind9 \
3131
bind9utils \
32+
apparmor-utils \
3233
language-pack-de \
3334
libgmp-dev \
3435
libicu-dev \

‎ext/standard/tests/dns/bind-start.sh‎

Lines changed: 262 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ NAMED_CONF="$SCRIPT_DIR/named.conf"
1010
PID_FILE="$ZONES_DIR/named.pid"
1111
LOG_FILE="$SCRIPT_DIR/named.log"
1212

13+
# Debug: show current user and permissions
14+
echo "Debug: Current user: $(whoami)"
15+
echo "Debug: Current UID: $(id -u)"
16+
echo "Debug: Script dir: $SCRIPT_DIR"
17+
echo "Debug: Zones dir: $ZONES_DIR"
18+
1319
# Default mode: background
1420
FOREGROUND=false
1521
if [[ "${1:-}" == "-f" ]]; then
@@ -30,11 +36,121 @@ fi
3036

3137
# Generate named.conf from template
3238
echo "Generating $NAMED_CONF from $NAMED_CONF_TEMPLATE"
39+
40+
# Check if 127.0.0.1 is available and decide on listen address
41+
echo "Debug: Testing network connectivity for BIND address selection..."
42+
43+
IPV4_OK=false
44+
IPV6_OK=false
45+
46+
# Test IPv4 connectivity
47+
if ping -c 1 127.0.0.1 >/dev/null 2>&1; then
48+
IPV4_OK=true
49+
echo "Debug: IPv4 (127.0.0.1) is reachable"
50+
else
51+
echo "Debug: IPv4 (127.0.0.1) is NOT reachable"
52+
fi
53+
54+
# Test IPv6 connectivity
55+
if command -v ping6 >/dev/null 2>&1; then
56+
if ping6 -c 1 ::1 >/dev/null 2>&1; then
57+
IPV6_OK=true
58+
echo "Debug: IPv6 (::1) is reachable"
59+
fi
60+
else
61+
if ping -6 -c 1 ::1 >/dev/null 2>&1; then
62+
IPV6_OK=true
63+
echo "Debug: IPv6 (::1) is reachable via ping -6"
64+
fi
65+
fi
66+
67+
if ! $IPV6_OK; then
68+
echo "Debug: IPv6 (::1) is NOT reachable"
69+
fi
70+
71+
# Choose the listen address
72+
if $IPV4_OK; then
73+
LISTEN_ADDRESS="127.0.0.1"
74+
echo "Debug: Using IPv4 (127.0.0.1) for BIND"
75+
elif $IPV6_OK; then
76+
LISTEN_ADDRESS="::1"
77+
echo "Debug: Using IPv6 (::1) for BIND"
78+
else
79+
echo "Debug: Neither 127.0.0.1 nor ::1 is available!"
80+
echo "Debug: Falling back to 127.0.0.1 anyway"
81+
LISTEN_ADDRESS="127.0.0.1"
82+
fi
83+
3384
sed -e "s|@ZONES_DIR@|$ZONES_DIR|g" \
3485
-e "s|@PID_FILE@|$PID_FILE|g" \
3586
-e "s|@SCRIPT_DIR@|$SCRIPT_DIR|g" \
87+
-e "s|@LISTEN_ADDRESS@|$LISTEN_ADDRESS|g" \
3688
"$NAMED_CONF_TEMPLATE" > "$NAMED_CONF"
3789

90+
# Ensure the generated config file is readable
91+
chmod 644 "$NAMED_CONF"
92+
93+
# Debug: Check if the file is actually readable
94+
echo "Debug: Testing config file readability:"
95+
if [[ -r "$NAMED_CONF" ]]; then
96+
echo "Debug: Config file is readable"
97+
else
98+
echo "Debug: Config file is NOT readable"
99+
ls -la "$NAMED_CONF"
100+
exit 1
101+
fi
102+
103+
# Enhanced AppArmor handling
104+
if [[ -f /etc/apparmor.d/usr.sbin.named ]]; then
105+
echo "Debug: AppArmor profile detected, attempting comprehensive bypass..."
106+
107+
# Install apparmor-utils if not present
108+
if ! command -v aa-complain >/dev/null 2>&1; then
109+
echo "Debug: Installing apparmor-utils..."
110+
apt-get update -qq
111+
apt-get install -y apparmor-utils
112+
fi
113+
114+
# Check initial status
115+
echo "Debug: Initial AppArmor status for named:"
116+
aa-status 2>/dev/null | grep named || echo "No named profile in initial aa-status"
117+
118+
# Try complain mode first
119+
echo "Debug: Setting to complain mode..."
120+
aa-complain /usr/sbin/named 2>/dev/null || echo "Failed to set AppArmor to complain mode"
121+
122+
# Check what mode it's actually in
123+
echo "Debug: AppArmor profile mode after complain:"
124+
cat /sys/kernel/security/apparmor/profiles 2>/dev/null | grep named || echo "No named in profiles"
125+
126+
# Try to completely disable it
127+
echo "Debug: Attempting to disable AppArmor profile completely..."
128+
aa-disable /usr/sbin/named 2>/dev/null || echo "Failed to disable AppArmor profile"
129+
130+
# Alternative disable method
131+
echo "Debug: Trying alternative disable method..."
132+
ln -sf /etc/apparmor.d/usr.sbin.named /etc/apparmor.d/disable/ 2>/dev/null || echo "Symlink method failed"
133+
134+
# Unload from kernel
135+
if command -v apparmor_parser >/dev/null 2>&1; then
136+
echo "Debug: Unloading profile from kernel..."
137+
apparmor_parser -R /etc/apparmor.d/usr.sbin.named 2>/dev/null || echo "Failed to unload profile"
138+
fi
139+
140+
# Final status check
141+
echo "Debug: Final AppArmor status:"
142+
aa-status 2>/dev/null | grep named || echo "No named profile found (good!)"
143+
144+
elif [ -d /etc/apparmor.d/ ]; then
145+
echo "Debug: AppArmor directory exists but no named profile found:"
146+
ls /etc/apparmor.d/ | grep -i named || echo "No named-related profiles"
147+
else
148+
echo "Debug: No AppArmor directory found"
149+
fi
150+
151+
echo "Debug: Generated named.conf contents:"
152+
cat "$NAMED_CONF"
153+
38154
# Clean up any leftover journal or PID files
39155
rm -f "$ZONES_DIR"/*.jnl "$PID_FILE"
40156

@@ -43,10 +159,149 @@ echo "Starting BIND from $SCRIPT_DIR"
43159

44160
if $FOREGROUND; then
45161
echo "(running in foreground)"
162+
echo "Debug: About to exec: named -c $NAMED_CONF -p 53 -u $(whoami) -g -d 1"
46163
exec named -c "$NAMED_CONF" -p 53 -u "$(whoami)" -g -d 1
47164
else
48165
echo "(running in background)"
49-
named -c "$NAMED_CONF" -p 53 -u "$(whoami)"
166+
echo "Debug: About to run: named -c $NAMED_CONF -p 53 -u $(whoami)"
167+
168+
# Test configuration first
169+
echo "Debug: Testing BIND configuration..."
170+
if named-checkconf "$NAMED_CONF"; then
171+
echo "Debug: Configuration check passed"
172+
else
173+
echo "Debug: Configuration check failed"
174+
exit 1
175+
fi
176+
177+
# Check if zone files exist
178+
echo "Debug: Checking zone files..."
179+
if [[ -f "$ZONES_DIR/basic.dnstest.php.net.zone" ]]; then
180+
echo "Debug: Zone file exists"
181+
echo "Debug: Zone file contents:"
182+
cat "$ZONES_DIR/basic.dnstest.php.net.zone"
183+
else
184+
echo "Debug: Zone file missing: $ZONES_DIR/basic.dnstest.php.net.zone"
185+
ls -la "$ZONES_DIR/"
186+
exit 1
187+
fi
188+
189+
# Set up permissions for bind user
190+
echo "Debug: Setting up permissions for bind user..."
191+
if id bind >/dev/null 2>&1; then
192+
# The bind user needs execute permissions on all parent directories
193+
echo "Debug: Setting directory permissions for bind user access..."
194+
195+
# Make sure bind can traverse the entire path
196+
ls -la /
197+
ls -la /home
198+
ls -la /home/runner
199+
ls -la /home/runner/work
200+
ls -la /home/runner/work/php-src
201+
ls -la /home/runner/work/php-src/php-src
202+
203+
chmod o+x /home 2>/dev/null || echo "Failed to chmod /home"
204+
chmod o+x /home/runner 2>/dev/null || echo "Failed to chmod /home/runner"
205+
chmod o+x /home/runner/work 2>/dev/null || echo "Failed to chmod /home/runner/work"
206+
chmod o+x /home/runner/work/php-src 2>/dev/null || echo "Failed to chmod /home/runner/work/php-src"
207+
chmod o+x /home/runner/work/php-src/php-src 2>/dev/null || echo "Failed to chmod /home/runner/work/php-src/php-src"
208+
chmod o+x "$SCRIPT_DIR" 2>/dev/null || echo "Failed to chmod $SCRIPT_DIR"
209+
chmod o+x "$ZONES_DIR" 2>/dev/null || echo "Failed to chmod $ZONES_DIR"
210+
211+
# Set file ownership and permissions
212+
chown bind:bind "$NAMED_CONF" "$ZONES_DIR"/*.zone 2>/dev/null || echo "Failed to chown to bind user"
213+
chmod 644 "$NAMED_CONF" "$ZONES_DIR"/*.zone
214+
215+
echo "Debug: File permissions after setup:"
216+
ls -la "$NAMED_CONF" "$ZONES_DIR"/*.zone
217+
218+
echo "Debug: Directory permissions check:"
219+
ls -ld "$SCRIPT_DIR" "$ZONES_DIR"
220+
221+
# Test if bind user can actually read the config file
222+
echo "Debug: Testing bind user access to config file:"
223+
if sudo -u bind test -r "$NAMED_CONF"; then
224+
echo "Debug: bind user CAN read config file"
225+
else
226+
echo "Debug: bind user CANNOT read config file - this is the problem!"
227+
echo "Debug: Let's check what bind user sees:"
228+
sudo -u bind ls -la "$NAMED_CONF" 2>&1 || echo "bind user cannot even stat the file"
229+
fi
230+
else
231+
echo "Debug: bind user does not exist, keeping current permissions"
232+
fi
233+
234+
# Check IPv4/IPv6 configuration with fallbacks
235+
echo "Debug: Network configuration check:"
236+
echo "Debug: localhost resolution:"
237+
getent hosts localhost 2>/dev/null || echo "localhost not found in hosts"
238+
239+
echo "Debug: 127.0.0.1 resolution:"
240+
getent hosts 127.0.0.1 2>/dev/null || echo "127.0.0.1 not found"
241+
242+
echo "Debug: Available IP addresses:"
243+
if command -v ip >/dev/null 2>&1; then
244+
ip addr show lo 2>/dev/null || echo "Failed to show loopback interface with ip"
245+
else
246+
ifconfig lo 2>/dev/null || echo "Failed to show loopback interface with ifconfig"
247+
fi
248+
249+
echo "Debug: Can we reach 127.0.0.1?"
250+
ping -c 1 127.0.0.1 >/dev/null 2>&1 && echo "127.0.0.1 is reachable" || echo "127.0.0.1 is NOT reachable"
251+
252+
echo "Debug: Can we reach ::1?"
253+
if command -v ping6 >/dev/null 2>&1; then
254+
ping6 -c 1 ::1 >/dev/null 2>&1 && echo "::1 is reachable" || echo "::1 is NOT reachable"
255+
else
256+
ping -6 -c 1 ::1 >/dev/null 2>&1 && echo "::1 is reachable (via ping -6)" || echo "::1 is NOT reachable"
257+
fi
258+
259+
# Check what's listening on port 53
260+
echo "Debug: Processes listening on port 53:"
261+
if command -v ss >/dev/null 2>&1; then
262+
ss -tulpn 2>/dev/null | grep ':53' || echo "Debug: No processes found on port 53 (ss)"
263+
else
264+
netstat -tulpn 2>/dev/null | grep ':53' || echo "Debug: No processes found on port 53 (netstat)"
265+
fi
266+
267+
echo "Debug: systemd-resolved status:"
268+
systemctl is-active systemd-resolved 2>/dev/null || echo "systemd-resolved not active"
269+
270+
# Monitor AppArmor denials in background
271+
echo "Debug: Starting AppArmor denial monitoring..."
272+
(timeout 15 tail -f /var/log/syslog 2>/dev/null | grep "apparmor.*DENIED" | head -10 &) || echo "Could not start syslog monitoring"
273+
274+
# Try different user approaches
275+
NAMED_USER="$(whoami)"
276+
if id bind >/dev/null 2>&1; then
277+
echo "Debug: Trying with bind user instead of root..."
278+
NAMED_USER="bind"
279+
fi
280+
281+
# Run named and capture both stdout and stderr separately
282+
echo "Debug: Starting named as user: $NAMED_USER..."
283+
if named -c "$NAMED_CONF" -p 53 -u "$NAMED_USER" > "$LOG_FILE" 2>&1; then
284+
echo "Debug: named command succeeded"
285+
else
286+
NAMED_EXIT_CODE=$?
287+
echo "Debug: named command failed with exit code: $NAMED_EXIT_CODE"
288+
echo "Debug: Log file contents:"
289+
cat "$LOG_FILE" 2>/dev/null || echo "No log file found"
290+
291+
# Show any AppArmor denials
292+
echo "Debug: Checking for AppArmor denials:"
293+
grep "apparmor.*DENIED.*named" /var/log/syslog 2>/dev/null | tail -10 || echo "No AppArmor denials found in syslog"
294+
295+
# Show general AppArmor messages
296+
echo "Debug: Recent AppArmor messages for named:"
297+
grep "apparmor.*named" /var/log/syslog 2>/dev/null | tail -10 || echo "No AppArmor messages found"
298+
299+
# Try to run named with more verbose output
300+
echo "Debug: Trying to run named in foreground for better error output:"
301+
timeout 5 named -c "$NAMED_CONF" -p 53 -u "$NAMED_USER" -g -d 1 || echo "Foreground attempt timed out or failed"
302+
303+
exit $NAMED_EXIT_CODE
304+
fi
50305

51306
# Wait for BIND to start with periodic checks
52307
MAX_WAIT=20 # Maximum wait time in attempts (20 * 0.5s = 10s)
@@ -76,7 +331,13 @@ else
76331
if [[ -f "$LOG_FILE" ]]; then
77332
echo "Last few lines from log:"
78333
tail -5 "$LOG_FILE"
334+
else
335+
echo "No log file found at $LOG_FILE"
79336
fi
80337

338+
# Final AppArmor check
339+
echo "Debug: Final AppArmor denial check:"
340+
grep "apparmor.*DENIED.*named" /var/log/syslog 2>/dev/null | tail -5 || echo "No final AppArmor denials found"
341+
81342
exit 1
82343
fi

‎ext/standard/tests/dns/dns_get_record_basic.phpt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ $result = dns_get_record($domain, DNS_A);
1010
var_dump($result);
1111
?>
1212
--EXPECTF--
13+
WRONG
1314
array(%d) {
1415
[0]=>
1516
array(%d) {

0 commit comments

Comments
 (0)