Manual:Shell framework

MediaWiki provides a robust framework for shelling out to external commands for increased performance, security, and portability. See the documentation for and. A basic example:

This replaces the  global function, which is deprecated since MediaWiki 1.30, in favor of this new shell framework.

Parameters
Most of the time you'll also want to provide some parameters to the command. MediaWiki will automatically escape all parameters to prevent shell injection attacks:

In the rare case you need to pass a parameter unscaped, you can use:

You can use  to manually escape parts of an unescaped parameter.

Limits
For both performance and security reasons, MediaWiki institutes limits on CPU time, wall clock time, file size and the memory usage a command can use. The defaults from, , , and will be used unless overriden with a call to.

Further restrictions can be implemented using cgroups, see for more details.

Restrictions
Since 1.31, MediaWiki supports sandboxing commands with external restriction software - currently only firejail is supported, and must be enabled with. You can pass any of the following constants to :
 * - a convenience constant equivalent to
 * - Disallow any root access. Any setuid binaries will be run without elevated access.
 * - Use seccomp to block dangerous syscalls.
 * - Create a private
 * - Deny access to LocalSettings.php, which likely contains database passwords and other secrets.
 * - Disallow any network access.
 * - Deny the execve syscall with seccomp (basically preventing the program from calling other executables). must also be set.

You can look at the restriction of binaries in the Score extension as an example.

firejail profile
MediaWiki uses a firejail profile that allows for extra customization and restrictions depending upon your platform. Create  (syntax) to restrict other paths that might have secret information, e.g.: blacklist /srv/private
 * 1) MediaWiki local firejail additions

See Wikimedia's mediawiki.local as an example.

Logging
By default, errors and standard error output are logged to the  channel in a structured form. A different logger can be set via the standard PSR-3.