Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33034
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.229 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=puyCE3GlDWWBxaEGJLI7EImFjH6CcPa7lovTxzs81hEBGFPq8EtypQXXJH0L+iTik/ea04s8m4RvH7kTFtFpMg5u2c7UvCHKMbGTQ7BLNvU9u9I38h3fOgqOPueLhgEPY8Vy5CiKqbRb11AKpZUfO/JtJMkPtqV4cQjQjUC4DCo=
Message-ID: <ffa0ace80711051142j34e8b670je1a219af5905c76@mail.gmail.com>
Date: Mon, 5 Nov 2007 14:42:38 -0500
To: internals@lists.php.net
In-Reply-To: <7d5a202f0711050928y368b1f88i41ee82f4ed3f565a@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070826193146.GQ16782@arvo.suso.org> <46D1ED8A.2060302@zend.com>
	 <20070827024804.GS16782@arvo.suso.org> <46D26834.9040001@lerdorf.com>
	 <20071105171202.GA12944@arvo.suso.org>
	 <7d5a202f0711050928y368b1f88i41ee82f4ed3f565a@mail.gmail.com>
Subject: Re: [PHP-DEV] Safe mode being removed in PHP6?
From: nlgordon@gmail.com ("Nate Gordon")

>
> >   Unless there is some other way in PHP of restricting where you can run
> > programs from (can't find any),
>
> Why PHP needs to do that ? isnt that part of OS level security ?

There are those of us in shared environments where scripts can't be
run as a single user because the content is owned by a group of users
and thus a group is the limiting factor.  Since PHP is what is
allowing me to run scripts/progs through a php function I don't see
how it would be that difficult to lock that down to a specific
directory on a per vhost basis.

>
> >this is going to become a major problem.
>
> This is going to **solve** a major problem, this change will eliminate
> the false sense of security that safe_mode provides and will tell
> people to start securing their stuff better.
>
> safe_mode does not really resist any analysis, whoever convinced you
> that it is a good thing does not have a clue.

I will be the first to acknowledge that the basic premise of safe_mode
is broken (the part about uids/gids matching), but the extra feature I
used was a per vhost disabling of executing anything that wasn't php.

This is the real feature I want, simple per vhost disable functions.
I realize that suhosin provides a per vhost disable functions feature,
but why is it up to an extension to provide that?  The next thing I
would want is a per vhost exec dir limit.

People are too quick to throw out the baby with the bath water on
safe_mode.  It isn't completely useless to everyone.


-- 
-Nathan Gordon

If the database server goes down and there is no code to hear it, does
it really go down?
<esc>:wq<CR>