BastionGuard WebUI: PHP error
The page could not be loaded. Details were saved in /tmp/bastionguard-webui-php-error.log.
';
if (!empty($_GET['debug'])) echo '
' . htmlspecialchars($msg, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '
';
echo '
Open health.php to check the PHP version, extensions and disabled functions.
' . bg_e($f['message'] ?? '') . '
';
}
unset($_SESSION['flash']);
}
function bg_redirect($url) { header('Location: ' . $url); exit; }
function bg_cmd_exists($cmd) {
$out = trim((string)bg_shell_exec('command -v ' . escapeshellarg($cmd) . ' 2>/dev/null'));
return $out !== '';
}
function bg_run($cmd, $timeout = 60) {
$timeout = max(1, min(600, (int)$timeout));
$wrapped = (bg_cmd_exists('timeout') ? ('timeout ' . $timeout . 's ') : '') . $cmd;
if (function_exists('proc_open')) {
$desc = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
$proc = @proc_open($wrapped, $desc, $pipes);
if (is_resource($proc)) {
$stdout = stream_get_contents($pipes[1]); fclose($pipes[1]);
$stderr = stream_get_contents($pipes[2]); fclose($pipes[2]);
$code = proc_close($proc);
return ['code' => $code, 'output' => trim($stdout . ($stderr ? "\n" . $stderr : ''))];
}
}
$out = bg_shell_exec($wrapped . ' 2>&1');
return ['code' => $out === '' ? 127 : 0, 'output' => trim((string)$out)];
}
function bg_run_argv(array $argv, $timeout = 60) {
$parts = [];
foreach ($argv as $a) $parts[] = escapeshellarg((string)$a);
return bg_run(implode(' ', $parts), $timeout);
}
function bg_username_for_uid($uid) {
$uid = (int)$uid;
if ($uid < 0) return '';
if (function_exists('posix_getpwuid')) {
$pw = @posix_getpwuid($uid);
if (is_array($pw) && !empty($pw['name'])) return (string)$pw['name'];
}
$out = trim((string)bg_shell_exec('getent passwd ' . escapeshellarg((string)$uid) . ' 2>/dev/null | cut -d: -f1'));
return $out;
}
function bg_user_record($username) {
$username = trim((string)$username);
if (!preg_match('/^[a-z_][a-z0-9_-]*[$]?$/i', $username)) return null;
if (function_exists('posix_getpwnam')) {
$pw = @posix_getpwnam($username);
if (is_array($pw)) {
return [
'name' => $pw['name'] ?? $username,
'uid' => (int)($pw['uid'] ?? -1),
'gid' => (int)($pw['gid'] ?? -1),
'home' => $pw['dir'] ?? '',
'shell' => $pw['shell'] ?? '',
];
}
}
$line = trim((string)bg_shell_exec('getent passwd ' . escapeshellarg($username) . ' 2>/dev/null'));
if ($line === '') return null;
$p = explode(':', $line);
if (count($p) < 7) return null;
return ['name'=>$p[0], 'uid'=>(int)$p[2], 'gid'=>(int)$p[3], 'home'=>$p[5], 'shell'=>$p[6]];
}
function bg_valid_desktop_user($username) {
$rec = bg_user_record($username);
if (!$rec) return null;
if (($rec['uid'] ?? -1) < 0) return null;
return $rec;
}
function bg_current_process_user() {
if (function_exists('posix_geteuid')) {
$name = bg_username_for_uid((int)@posix_geteuid());
if ($name !== '') return $name;
}
$out = trim((string)bg_shell_exec('id -un 2>/dev/null'));
return $out !== '' ? $out : 'webserver';
}
function bg_detect_desktop_user() {
static $cached = null;
if ($cached !== null) return $cached;
$candidates = [];
$web = bg_read_json('web_options.json', []);
foreach ([$web['desktop_user'] ?? '', getenv('BASTIONGUARD_USER') ?: '', getenv('SUDO_USER') ?: ''] as $u) {
$u = trim((string)$u);
if ($u !== '') $candidates[] = $u;
}
foreach (['/etc/bastionguard-webui/user', '/etc/bastionguard/user'] as $file) {
if (is_readable($file)) {
$u = trim((string)@file_get_contents($file));
if ($u !== '') $candidates[] = preg_split('/\s+/', $u)[0] ?? $u;
}
}
foreach (glob('/run/user/[0-9]*', GLOB_ONLYDIR) ?: [] as $dir) {
$uid = basename($dir);
if (!ctype_digit($uid) || (int)$uid < 1000) continue;
if (!bg_path_is_socket($dir . '/bus')) continue;
$u = bg_username_for_uid((int)$uid);
if ($u !== '') $candidates[] = $u;
}
if (bg_cmd_exists('loginctl')) {
$out = trim((string)bg_shell_exec('loginctl list-sessions --no-legend 2>/dev/null'));
foreach (preg_split('/\R+/', $out) as $line) {
$cols = preg_split('/\s+/', trim($line));
if (count($cols) >= 3 && ctype_digit($cols[1]) && (int)$cols[1] >= 1000) $candidates[] = $cols[2];
}
}
foreach (glob('/home/*', GLOB_ONLYDIR) ?: [] as $home) {
$u = basename($home);
if (is_dir($home . '/.config/systemd/user') || is_dir($home . '/.config/bastionguard') || is_dir($home . '/.local/share/systemd/user')) $candidates[] = $u;
}
$seen = [];
foreach ($candidates as $u) {
$u = trim((string)$u);
if ($u === '' || isset($seen[$u])) continue;
$seen[$u] = true;
$rec = bg_valid_desktop_user($u);
if ($rec && (int)$rec['uid'] >= 1000) {
$cached = $rec['name'];
return $cached;
}
}
$cached = '';
return $cached;
}
function bg_user_systemd_context($username = null) {
$username = $username ?: bg_detect_desktop_user();
$rec = $username ? bg_user_record($username) : null;
if (!$rec) return null;
$uid = (int)$rec['uid'];
return [
'user' => $rec['name'],
'uid' => $uid,
'home' => $rec['home'] ?? '',
'runtime_dir' => '/run/user/' . $uid,
'bus' => '/run/user/' . $uid . '/bus',
];
}
function bg_systemctl_user_exec($verb, $unit, array $props = [], $timeout = 10) {
$unit = preg_replace('/[^a-zA-Z0-9@_.:-]/', '', (string)$unit);
$verb = preg_replace('/[^a-z-]/', '', (string)$verb);
if ($unit === '' || $verb === '') return ['code'=>2, 'output'=>'Unità o comando invalid.', 'method'=>'invalid'];
$ctx = bg_user_systemd_context();
if (!$ctx) return ['code'=>3, 'output'=>'Utente desktop non configurato o non rilevato.', 'method'=>'no-user'];
$props = array_values(array_filter(array_map(function($p){ return preg_replace('/[^A-Za-z0-9_]/', '', (string)$p); }, $props)));
$helper = '/usr/local/sbin/bastionguard-webui-systemctl';
$attempts = [];
if (is_executable($helper) && bg_cmd_exists('sudo')) {
$args = ['sudo','-n',$helper,'user',$ctx['user'],$verb,$unit];
foreach ($props as $p) $args[] = $p;
$attempts[] = ['helper', $args];
}
$env = ['env', 'XDG_RUNTIME_DIR=' . $ctx['runtime_dir'], 'DBUS_SESSION_BUS_ADDRESS=unix:path=' . $ctx['bus']];
$sysArgs = array_merge($env, ['systemctl','--user',$verb,$unit]);
if ($verb === 'show') {
foreach ($props as $p) { $sysArgs[] = '-p'; $sysArgs[] = $p; }
$sysArgs[] = '--no-pager';
}
if (function_exists('posix_geteuid') && (int)@posix_geteuid() === (int)$ctx['uid']) {
$attempts[] = ['same-user-dbus', $sysArgs];
}
// Tentativo diretto con XDG_RUNTIME_DIR/DBus già impostati. Su molte installazioni fallisce per policy DBus,
// ma quando PHP-FPM gira come utente desktop consente la lettura senza sudoers.
$attempts[] = ['direct-dbus', $sysArgs];
if (bg_cmd_exists('sudo')) {
$sudoArgs = array_merge(['sudo','-n','-u',$ctx['user']], $sysArgs);
$attempts[] = ['sudo-user-dbus', $sudoArgs];
}
if (function_exists('posix_geteuid') && (int)@posix_geteuid() === 0 && bg_cmd_exists('runuser')) {
$runArgs = array_merge(['runuser','-u',$ctx['user'],'--'], $sysArgs);
$attempts[] = ['runuser-dbus', $runArgs];
}
$last = ['code'=>127, 'output'=>'Nessun metodo disponibile per interrogare systemd --user.', 'method'=>'none'];
foreach ($attempts as [$method, $argv]) {
$res = bg_run_argv($argv, $timeout);
$res['method'] = $method;
$out = trim((string)($res['output'] ?? ''));
$accessError = $out !== '' && preg_match('/Failed to connect|Permission denied|Interactive authentication|a password is required|not allowed to execute|sudo:/i', $out);
if (($res['code'] ?? 1) === 0 || ($out !== '' && !$accessError)) return $res;
$last = $res;
}
return $last;
}
function bg_systemctl_system_exec($verb, $unit, array $props = [], $timeout = 10) {
$unit = preg_replace('/[^a-zA-Z0-9@_.:-]/', '', (string)$unit);
$verb = preg_replace('/[^a-z-]/', '', (string)$verb);
$args = ['systemctl', $verb, $unit];
if ($verb === 'show') {
foreach ($props as $p) { $args[] = '-p'; $args[] = $p; }
$args[] = '--no-pager';
}
$res = bg_run_argv($args, $timeout);
$res['method'] = 'system';
return $res;
}
function bg_parse_systemctl_show($raw) {
$data = [];
foreach (preg_split('/\R/', trim((string)$raw)) as $line) {
if (strpos($line, '=') === false) continue;
[$k, $v] = explode('=', $line, 2);
$data[$k] = $v;
}
return $data;
}
function bg_user_unit_file_probe($unit, $username = null) {
$ctx = bg_user_systemd_context($username);
$out = ['found'=>false, 'fragment'=>'', 'enabled'=>'unknown'];
if (!$ctx) return $out;
$home = rtrim($ctx['home'] ?? '', '/');
$paths = [];
if ($home !== '') {
$paths[] = $home . '/.config/systemd/user/' . $unit;
$paths[] = $home . '/.local/share/systemd/user/' . $unit;
}
$paths[] = '/etc/systemd/user/' . $unit;
$paths[] = '/usr/local/lib/systemd/user/' . $unit;
$paths[] = '/usr/lib/systemd/user/' . $unit;
$paths[] = '/lib/systemd/user/' . $unit;
foreach ($paths as $p) {
if (is_file($p) || is_link($p)) {
$out['found'] = true;
$out['fragment'] = $p;
break;
}
}
$wantPatterns = [];
if ($home !== '') $wantPatterns[] = $home . '/.config/systemd/user/*.wants/' . $unit;
$wantPatterns[] = '/etc/systemd/user/*.wants/' . $unit;
foreach ($wantPatterns as $pat) {
$g = glob($pat) ?: [];
if (!empty($g)) { $out['enabled'] = 'enabled'; break; }
}
if ($out['enabled'] === 'unknown' && $out['found']) $out['enabled'] = 'disabled';
return $out;
}
function bg_user_process_probe($unit, $username = null) {
$ctx = bg_user_systemd_context($username);
if (!$ctx || !bg_cmd_exists('pgrep')) return [];
$base = preg_replace('/\.service$/', '', basename($unit));
$patterns = array_values(array_unique([$base, strtolower($base), str_replace('BastionGuard-', 'bastionguard-', $base)]));
foreach ($patterns as $pattern) {
if ($pattern === '') continue;
$res = bg_run_argv(['pgrep','-u',$ctx['user'],'-f',$pattern], 5);
$pids = array_values(array_filter(array_map('trim', preg_split('/\R+/', trim($res['output']))), 'ctype_digit'));
if (!empty($pids)) return array_map('intval', $pids);
}
return [];
}
function bg_systemctl_query($name, $user = false) {
$name = preg_replace('/[^a-zA-Z0-9@_.:-]/', '', (string)$name);
if ($name === '') return [];
$props = ['ActiveState','SubState','LoadState','UnitFileState','MainPID','FragmentPath','Description'];
$data = ['name' => $name, 'user' => (bool)$user, 'raw_show' => '', 'AccessMethod' => '', 'AccessError' => ''];
if ($user) {
$ctx = bg_user_systemd_context();
$data['TargetUser'] = $ctx['user'] ?? '';
$show = bg_systemctl_user_exec('show', $name, $props, 10);
$data['AccessMethod'] = $show['method'] ?? '';
$data['raw_show'] = trim((string)($show['output'] ?? ''));
if (($show['code'] ?? 1) === 0 && $data['raw_show'] !== '') {
$data = array_merge($data, bg_parse_systemctl_show($data['raw_show']));
} else {
$data['AccessError'] = trim((string)($show['output'] ?? ''));
}
$active = bg_systemctl_user_exec('is-active', $name, [], 8);
$aout = trim((string)($active['output'] ?? ''));
$activeToken = $aout !== '' ? preg_split('/\s+/', $aout)[0] : '';
if (in_array($activeToken, ['active','inactive','failed','activating','deactivating','reloading','unknown'], true)) $data['ActiveState'] = $data['ActiveState'] ?? $activeToken;
if (empty($data['AccessMethod']) && !empty($active['method'])) $data['AccessMethod'] = $active['method'];
$enabled = bg_systemctl_user_exec('is-enabled', $name, [], 8);
$eout = trim((string)($enabled['output'] ?? ''));
$enabledToken = $eout !== '' ? preg_split('/\s+/', $eout)[0] : '';
if (in_array($enabledToken, ['enabled','enabled-runtime','linked','linked-runtime','alias','masked','masked-runtime','static','indirect','disabled','generated','transient','bad','not-found'], true)) $data['UnitFileState'] = $data['UnitFileState'] ?? $enabledToken;
$probe = bg_user_unit_file_probe($name, $ctx['user'] ?? null);
if (!empty($probe['found'])) {
$data['LoadState'] = $data['LoadState'] ?? 'loaded';
$data['FragmentPath'] = $data['FragmentPath'] ?? $probe['fragment'];
}
if (($data['UnitFileState'] ?? '') === '' || ($data['UnitFileState'] ?? '') === 'unknown') $data['UnitFileState'] = $probe['enabled'];
$activeState = $data['ActiveState'] ?? '';
if ($activeState === '' || in_array($activeState, ['unknown','inactive','failed'], true)) {
$pids = bg_user_process_probe($name, $ctx['user'] ?? null);
if (!empty($pids)) {
$data['ActiveState'] = 'active';
$data['SubState'] = $data['SubState'] ?? 'process-detected';
$data['MainPID'] = $data['MainPID'] ?? (string)$pids[0];
$data['ProcessDetected'] = implode(',', $pids);
if (empty($data['AccessMethod']) || $data['AccessMethod'] === 'direct-dbus') $data['AccessMethod'] = 'process-probe';
}
}
return $data;
}
$show = bg_systemctl_system_exec('show', $name, $props, 10);
$data['AccessMethod'] = $show['method'] ?? 'system';
$data['raw_show'] = trim((string)($show['output'] ?? ''));
if (($show['code'] ?? 1) === 0 && $data['raw_show'] !== '') $data = array_merge($data, bg_parse_systemctl_show($data['raw_show']));
else $data['AccessError'] = trim((string)($show['output'] ?? ''));
$active = bg_systemctl_system_exec('is-active', $name, [], 8);
$aout = trim((string)($active['output'] ?? ''));
$activeToken = $aout !== '' ? preg_split('/\s+/', $aout)[0] : '';
if (in_array($activeToken, ['active','inactive','failed','activating','deactivating','reloading','unknown'], true)) $data['ActiveState'] = $data['ActiveState'] ?? $activeToken;
$enabled = bg_systemctl_system_exec('is-enabled', $name, [], 8);
$eout = trim((string)($enabled['output'] ?? ''));
$enabledToken = $eout !== '' ? preg_split('/\s+/', $eout)[0] : '';
if (in_array($enabledToken, ['enabled','enabled-runtime','linked','linked-runtime','alias','masked','masked-runtime','static','indirect','disabled','generated','transient','bad','not-found'], true)) $data['UnitFileState'] = $data['UnitFileState'] ?? $enabledToken;
return $data;
}
function bg_service_status(array $names, $user = false) {
$fallback = null;
foreach ($names as $name) {
$name = preg_replace('/[^a-zA-Z0-9@_.:-]/', '', (string)$name);
if ($name === '') continue;
$q = bg_systemctl_query($name, $user);
$activeState = $q['ActiveState'] ?? '';
$subState = $q['SubState'] ?? '';
$loadState = $q['LoadState'] ?? '';
$unitFileState = $q['UnitFileState'] ?? '';
$pid = (int)($q['MainPID'] ?? 0);
$loaded = $loadState === 'loaded' || ($unitFileState !== '' && !in_array($unitFileState, ['not-found','unknown'], true)) || !empty($q['FragmentPath']) || !empty($q['ProcessDetected']);
$targetUser = $q['TargetUser'] ?? '';
$row = [
'active' => $activeState === 'active',
'name' => $name,
'raw' => $activeState !== '' ? $activeState : 'unknown',
'active_state' => $activeState !== '' ? $activeState : 'unknown',
'sub_state' => $subState !== '' ? $subState : 'unknown',
'load_state' => $loadState !== '' ? $loadState : 'unknown',
'unit_file_state' => $unitFileState !== '' ? $unitFileState : 'unknown',
'main_pid' => $pid,
'fragment_path' => $q['FragmentPath'] ?? '',
'description' => $q['Description'] ?? '',
'exists' => $loaded,
'user' => (bool)$user,
'target_user' => $targetUser,
'scope' => $user ? 'user' : 'system',
'access_method' => $q['AccessMethod'] ?? '',
'access_error' => $q['AccessError'] ?? '',
'process_detected' => $q['ProcessDetected'] ?? '',
];
if ($row['active']) return $row;
if ($fallback === null || ($row['exists'] && !$fallback['exists'])) $fallback = $row;
}
$targetUser = $user ? bg_detect_desktop_user() : '';
return $fallback ?? [
'active' => false,
'name' => $names[0] ?? '',
'raw' => 'unknown',
'active_state' => 'unknown',
'sub_state' => 'unknown',
'load_state' => 'unknown',
'unit_file_state' => 'unknown',
'main_pid' => 0,
'fragment_path' => '',
'description' => '',
'exists' => false,
'user' => (bool)$user,
'target_user' => $targetUser,
'scope' => $user ? 'user' : 'system',
'access_method' => '',
'access_error' => '',
'process_detected' => '',
];
}
function bg_service_scope_label(array $st) {
$scope = (string)($st['scope'] ?? 'system');
$label = $scope === 'user' ? bg_t('scope_user') : bg_t('scope_system');
$target = trim((string)($st['target_user'] ?? ''));
return $scope === 'user' && $target !== '' ? $label . ' (' . $target . ')' : $label;
}
function bg_systemd_value_label($value) {
$raw = trim((string)$value);
if ($raw === '') return '—';
$normalized = strtolower(str_replace(['-', ' '], '_', $raw));
$key = 'systemd_' . $normalized;
$translated = bg_t($key);
return $translated === $key ? $raw : $translated;
}
function bg_access_method_label($method) {
$raw = trim((string)$method);
if ($raw === '') return '—';
$normalized = strtolower(str_replace(['-', ' '], '_', $raw));
$key = 'access_' . $normalized;
$translated = bg_t($key);
return $translated === $key ? $raw : $translated;
}
function bg_service_state_badge(array $st) {
$state = $st['active_state'] ?? ($st['active'] ? 'active' : 'inactive');
if ($state === 'active') return '