Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124298
Content-Type: text/plain;
	charset=us-ascii
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\))
Subject: Re: [PHP-DEV] pcntl_exec update proposal
In-Reply-To: <CA+XhMqyiBUbGvZDAvZsGJ08Cn7qUT6Hm9+kb58DNZDKfhSJOxQ@mail.gmail.com>
Date: Mon, 8 Jul 2024 15:11:52 -0700
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <A4D21688-4766-434D-9C11-AC7727785DF3@woofle.net>
References: <CA+XhMqyiBUbGvZDAvZsGJ08Cn7qUT6Hm9+kb58DNZDKfhSJOxQ@mail.gmail.com>
To: David CARLIER <devnexen@gmail.com>
From: dusk@woofle.net (Dusk)

On Jul 8, 2024, at 14:12, David CARLIER <devnexen@gmail.com> wrote:
> Through this existing PR, I wanted to know how would appeal to you =
adding some access restriction upon this existing call, using the open =
basedir check. So if the sysadmin wants the php user having no business =
calling `/bin` commands for examples would do that, bringing a bit more =
of the former suhosin "spirit" here.

open_basedir is usually used in conjunction with the disable_functions =
directive to disable all functions which execute external commands, =
including pcntl_exec(). It's largely ineffective if the user can execute =
external commands, as those commands are not themselves restricted by =
open_basedir. (For instance, if PHP is allowed to execute /bin/cat, that =
can be used to read any file; if it can execute /bin/sh, that can =
execute any other command.) Additionally, if there *are* PHP =
installations which set open_basedir but do allow pcntl_exec(), this =
change would introduce a major incompatibility by disallowing all =
commands.

If your goal is to restrict what external commands can be executed by a =
PHP script, any solution would need to be applied to all functions which =
can execute shell commands - exec(), shell_exec(), system(), passthru(), =
proc_open(), shell_exec(), popen(), not just pcntl_exec(). Keep in mind =
that some of these functions take a string as input which is parsed by =
the shell; implementing path-based restrictions may be very difficult to =
do in a general fashion.=