1

We have a quite huge Wordpress multi-sites installation with lots of themes/plugins. So we often have new available updates (core/themes/plugins).

We don't use automatic updates :

  • AUTOMATIC_UPDATER_DISABLED is true
  • DISALLOW_FILES_MODS is false

Indeed we use a security system on server side (Security-Enhanced Linux) that prevent file modification. We have to do the updates manually, by first disabling SELinux, then starting the updates, then enabling SELinux back...

Is there any way we can enable auto updates and then :

  1. detect when an update process is going to start, then disabling SELinux
  2. detect when the update process is done, then enabling SELinux back
  3. log to file or database what has been updated

I have identified the file wp-includes/update.php but I want to avoid modifying core files.

Improve this question

1 Answer 1

Reset to default
1

No.

First there is the practical problem of enabling your OS being influenced by the web server, something that should never be possible. (a plugin will trigger an update and make you open to all attacks)

Second, on a more philosophical level, what is the point of hardening your security if in the end you let any script being installed on your system without any minimal audit.

Security is many times not convenient... If you have nothing of value to protect then you don't need the SELinux layer, otherwise I can't imagine how justify relaxing your security for even a minute just to save few hours of work a month.

.... In addition, you should always test new versions of plugins and themes before deploying them to production and never ever use unsupervised automatic updates.

Improve this answer
5
  • It was just an idea, but you are right. Unfortunately we cannot test all updates in test environment before applying them to production, it would be a 100% job. And I wonder what is the most secure : stay with a not up to date plugin in prod while testing it, or update it in prod as soon as possible (we have backups in worst case). Security plugins like itheme, secuPress, etc. recommend using automatic updates. SELinux has been set by our system admins and all we can do is activating/deactivating it, maybe we can simply ask them to remove the protection on theme/plugin files if not necessary.
    – Yann39
    Dec 7, 2016 at 9:30
  • @Yann39 Without knowing the nature of what you have it is hard to make a smart comment here, but too many times a plugin update causes errors. My strategy would have probably be something like updating things only once a month and just ignore the mantra of "always run latest version", most people do not follow it... even 4.6 didn't get to 50% usage and now you have 4.7 (even combining two latest versions will get you only to about 60% of wordpress installs)
    – Mark Kaplun
    Dec 7, 2016 at 9:54
  • We have a growing 350+ websites installation (500+ webmasters, 180+ plugins, 30+ themes). It's not a big deal to activate/deactivate SELinux before applying updates, we do it every day, I was just wondering if I can avoid this easily. But we already have good security settings and good managed protection layers (firewall, scanners, anti spam, alerts, logging, backups, security plugin, etc.) so maybe this file protection for plugin/theme is not necessary, especially if as you said, we have to disable it to apply the updates...
    – Yann39
    Dec 7, 2016 at 10:14
  • @Yann39, whu not to use wp-cli for that? write a script to disbale whatever is needed and run upgrade
    – Mark Kaplun
    Dec 7, 2016 at 11:25
  • I never used wp-cli, I'm not sure it will help a lot but I will take a look (disabling security is already scripted as a simple one-line command). Thank you for clarifying my points Mark.
    – Yann39
    Dec 7, 2016 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.