theraw/The-World-Is-Yours
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

isolation
build-and-publish / build (Raccoon, ubuntu:26.04, NEXUS_PASS_RACCOON, NEXUS_REPO_RACCOON, NEXUS_USER_RACCOON, raccoon) (push) Successful in 3m51s
Details
build-and-publish / build (Trixie, debian:13, NEXUS_PASS_TRIXIE, NEXUS_REPO_TRIXIE, NEXUS_USER_TRIXIE, trixie) (push) Successful in 3m35s
Details

Browse Source
This commit is contained in:
theraw
2026-06-26 03:13:19 +00:00
parent 2f6102e8aa
commit 99e75aaf4d
6 changed files with 415 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
version
+16
View File
@@ -86,3 +86,19 @@ export APPLY_PATCH_DYNAMIC_TLS_RECORDS=1
# hunks reference internals that have drifted). Patch NOT yet shipped — would
# need a full rebase. Keep toggle here for the day someone ports it.
export APPLY_PATCH_HTTP2_HPACK_ENC=0
# Tenant isolation: kernel-enforced (openat2 RESOLVE_BENEATH|NO_MAGICLINKS)
# confinement of static-file resolution to each tenant's document root, so a
# symlink/".."/magic-link that would escape the tenant tree is refused with 403
# at the syscall level (no TOCTOU, unlike disable_symlinks). Patch shipped at
# build/patches/nginx-${NGINX}-tenant-isolation.patch; self-contained in
# ngx_http_static_module.c (adds the `tenant_isolation` + `tenant_isolation_root`
# directives). Optional for a plain nginx build — set =0 to exclude entirely.
export APPLY_PATCH_TENANT_ISOLATION=1
# When the patch is applied, also compile the `tenant_isolation` directive
# default-ON (-DNGX_TENANT_ISOLATION_DEFAULT_ON=1) so EVERY vhost is confined
# unless it sets `tenant_isolation off;`. This is the twiy-raweb posture. Set =0
# to ship the patch but leave the directive opt-in per vhost (`tenant_isolation
# on;`) — the "default nginx" posture. Inert at runtime on kernels w/o openat2.
export TENANT_ISOLATION_DEFAULT_ON=1