Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105610
MIME-Version: 1.0
References: <CAF+90c-4-R4SYY_AAL679ZYBn2QAZTYAGXH6E6Bz1hYGN=MFcA@mail.gmail.com>
 <CAOwTYAv_kmgqoLvqqsp04ajh0RyPTxqGg3z_zBTx6hX_ydTxrw@mail.gmail.com> <CAOkcCt_jEbzwX3ukj1dreL910Effz-vBo8YJGQ5iN=5tkvFJCg@mail.gmail.com>
In-Reply-To: <CAOkcCt_jEbzwX3ukj1dreL910Effz-vBo8YJGQ5iN=5tkvFJCg@mail.gmail.com>
Date: Tue, 7 May 2019 12:37:18 +0200
Message-ID: <CAL0xaBHSM_KR=tWXCE_njrgTddK27zZCx-m1VkDOL1jJd8c_dA@mail.gmail.com>
To: Gert <gertp93@gmail.com>
Cc: Joe Watkins <krakjoe@gmail.com>, Nikita Popov <nikita.ppv@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000a90429058849cef7"
Subject: Re: [PHP-DEV] open_basedir?
From: arvids.godjuks@gmail.com (Arvids Godjuks)

--000000000000a90429058849cef7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

as an end-user, I'd say that it should go the way of the dinosaurs as
request globals and alike went - these days there are a lot of ways to do
it better and way more securely.

Makes it easier on everyone and removes abuse of it for security purposes.
Deprecate 7.4, dump it in 8.0.

Implement a & b to warn people.

=D0=B2=D1=82, 7 =D0=BC=D0=B0=D1=8F 2019 =D0=B3. =D0=B2 12:25, Gert <gertp93=
@gmail.com>:

> Hello,
>
> If the plan is to remove it in 8.0, then i'd say its beneficial to alread=
y
> deprecate it in 7.4. This will give users an earlier warning that these
> upgrades need to happen.
>
> Cheers
>
> On Tue, 7 May 2019 at 12:18, Joe Watkins <krakjoe@gmail.com> wrote:
>
> > Morning Nikita,
> >
> > It would be wise to do a) and b) regardless of whether it's going to be
> > removed.
> >
> > I think +1 on removing it in 8 ... I'm not sure if it should be
> deprecated
> > in 7.4 first, or how that would work ?
> >
> > Cheers
> > Joe
> >
> > On Tue, 7 May 2019 at 12:11, Nikita Popov <nikita.ppv@gmail.com> wrote:
> >
> > > Hi internals,
> > >
> > > The open_basedir ini setting has two significant problems:
> > >
> > > 1. It is a major performance hit, because it disables the realpath
> cache.
> > >
> > > 2. Many people think it is a security feature and use it as such.
> > However,
> > > open_basedir is in reality a "best effort" mechanism, with known
> > > workarounds and more regularly being found. Especially when it comes =
to
> > > interactions with 3rd party libraries, enforcing open_basedir is simp=
ly
> > > impossible.
> > >
> > > What open_basedir tries to do must be implemented on the operating
> system
> > > level to work reliably (and of course such mechanisms exist, such as
> > jails,
> > > chroot and friends).
> > >
> > > I wonder if it is feasible to drop this ini setting? Enforcing this
> > doesn't
> > > really seem like any of PHP's business. If not, I think we need to at
> > least
> > >
> > > a) make it clear in the documentation that this is *not* a security
> > option
> > > and only exists to prevent "accidents" and
> > > b) update the security policy (https://wiki.php.net/security) to stat=
e
> > > that
> > > open_basedir bypasses are not security issues. I believe this has bee=
n
> > part
> > > of Debian's security policy for some time already.
> > >
> > > Regards,
> > > Nikita
> > >
> >
>


--=20
Arv=C4=ABds Godjuks

+371 26 851 664
arvids.godjuks@gmail.com
Skype: psihius
Telegram: @psihius https://t.me/psihius

--000000000000a90429058849cef7--