Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124299
Precedence: bulk
MIME-Version: 1.0
References: <CA+XhMqyiBUbGvZDAvZsGJ08Cn7qUT6Hm9+kb58DNZDKfhSJOxQ@mail.gmail.com>
 <A4D21688-4766-434D-9C11-AC7727785DF3@woofle.net>
In-Reply-To: <A4D21688-4766-434D-9C11-AC7727785DF3@woofle.net>
Date: Mon, 8 Jul 2024 23:38:52 +0100
Message-ID: <CAEKnhAEUzOy9SSSCQyse2kv7=NODqMmhew9eF2P4ee2ZcCg++w@mail.gmail.com>
Subject: Re: [PHP-DEV] pcntl_exec update proposal
To: Dusk <dusk@woofle.net>
Cc: David CARLIER <devnexen@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000088f437061cc414c2"
From: bukka@php.net (Jakub Zelenka)

--00000000000088f437061cc414c2
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 8, 2024 at 11:14=E2=80=AFPM Dusk <dusk@woofle.net> wrote:

> On Jul 8, 2024, at 14:12, David CARLIER <devnexen@gmail.com> wrote:
> > Through this existing PR, I wanted to know how would appeal to you
> adding some access restriction upon this existing call, using the open
> basedir check. So if the sysadmin wants the php user having no business
> calling `/bin` commands for examples would do that, bringing a bit more o=
f
> the former suhosin "spirit" here.
>
> open_basedir is usually used in conjunction with the disable_functions
> directive to disable all functions which execute external commands,
> including pcntl_exec(). It's largely ineffective if the user can execute
> external commands, as those commands are not themselves restricted by
> open_basedir. (For instance, if PHP is allowed to execute /bin/cat, that
> can be used to read any file; if it can execute /bin/sh, that can execute
> any other command.) Additionally, if there *are* PHP installations which
> set open_basedir but do allow pcntl_exec(), this change would introduce a
> major incompatibility by disallowing all commands.
>
> If your goal is to restrict what external commands can be executed by a
> PHP script, any solution would need to be applied to all functions which
> can execute shell commands - exec(), shell_exec(), system(), passthru(),
> proc_open(), shell_exec(), popen(), not just pcntl_exec(). Keep in mind
> that some of these functions take a string as input which is parsed by th=
e
> shell; implementing path-based restrictions may be very difficult to do i=
n
> a general fashion.


 Completely agree with this. Using open_basedir would be just a hard to
catch BC break without any extra protection. So -1 on this proposal.

Cheers

Jakub

--00000000000088f437061cc414c2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Jul 8, 2024 at 11:14=E2=80=AFPM D=
usk &lt;<a href=3D"mailto:dusk@woofle.net">dusk@woofle.net</a>&gt; wrote:<b=
r></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">On Jul 8, 2024, at 14:12, David CARLIER &lt;<a href=3D"mailto:de=
vnexen@gmail.com" target=3D"_blank">devnexen@gmail.com</a>&gt; wrote:<br>
&gt; Through this existing PR, I wanted to know how would appeal to you add=
ing some access restriction upon this existing call, using the open basedir=
 check. So if the sysadmin wants the php user having no business calling `/=
bin` commands for examples would do that, bringing a bit more of the former=
 suhosin &quot;spirit&quot; here.<br>
<br>
open_basedir is usually used in conjunction with the disable_functions dire=
ctive to disable all functions which execute external commands, including p=
cntl_exec(). It&#39;s largely ineffective if the user can execute external =
commands, as those commands are not themselves restricted by open_basedir. =
(For instance, if PHP is allowed to execute /bin/cat, that can be used to r=
ead any file; if it can execute /bin/sh, that can execute any other command=
.) Additionally, if there *are* PHP installations which set open_basedir bu=
t do allow pcntl_exec(), this change would introduce a major incompatibilit=
y by disallowing all commands.<br>
<br>
If your goal is to restrict what external commands can be executed by a PHP=
 script, any solution would need to be applied to all functions which can e=
xecute shell commands - exec(), shell_exec(), system(), passthru(), proc_op=
en(), shell_exec(), popen(), not just pcntl_exec(). Keep in mind that some =
of these functions take a string as input which is parsed by the shell; imp=
lementing path-based restrictions may be very difficult to do in a general =
fashion.</blockquote><div><br></div><div>=C2=A0Completely agree with this. =
Using open_basedir would be just a hard to catch BC break without any extra=
 protection. So -1 on this proposal.</div><div><br></div><div>Cheers</div><=
div><br></div><div>Jakub</div></div></div>

--00000000000088f437061cc414c2--