Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:49058
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :cc:content-type;
        b=qUEJd2IWYtqp517CXa21mcYusVA3z2escO9NpDz2EJhK6gii4VY4xL7F7AxXivReqd
         h8Z+1WKX+B36/3/6npsr/KDhxo2uJoRTikIdnCs9/hWzddi6z2F/orO6PLmZd007vWfb
         GaSgmClJz94+XyYi8ypuQubAEEFsS7u81mx/g=
MIME-Version: 1.0
In-Reply-To: <1279028299.2918.111.camel@samnmax>
References: <AANLkTik3JJKNodbzAnYGQ8qpAinSiFTQEyHIsdxbISeI@mail.gmail.com> 
	<AANLkTik4tbBxzhlIBGJ036bHYl4o77V3IOg9dTDCZjXr@mail.gmail.com> 
	<AANLkTimjs_p-PTauBvJRTG5mdUaOyARTx0NLB3zpebII@mail.gmail.com> 
	<AANLkTikBp2v8wW7UGePx3sxkCZzh5PVC8HlspyadANFb@mail.gmail.com> 
	<1279028299.2918.111.camel@samnmax>
Date: Tue, 13 Jul 2010 16:31:25 +0200
Message-ID: <AANLkTimi1fPvPP_DccAqOOIxCcLJlcO-pNxzngJkVCRw@mail.gmail.com>
To: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>
Cc: Pierre Joye <pierre.php@gmail.com>, internals@lists.php.net
Content-Type: multipart/alternative; boundary=0016363b9bf88b7c3f048b45ba3e
Subject: Re: [PHP-DEV] Re: Performance problem with php
From: v.damore@gmail.com ("Vincenzo D'Amore")

--0016363b9bf88b7c3f048b45ba3e
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Thanks Johannes,

you are really clear and I finally understand what's the problem.
I'm following a big free web hosting service, I would like to enhance
performance of customers webspache.

What do you think if:

   - set safe_mode off
   - remove open_basedir
   - disable_functions symlink, unlink
      - w/ functions: passthru, proc_close, proc_get_status, proc_nice,
      proc, exec, shell_exec, system, proc_open, popen, curl_multi_exec,
      parse_ini_file, show_source, set_time_limit, error_reporting, mail,
      fsockopen, ini_set




2010/7/13 Johannes Schl=C3=BCter <johannes@schlueters.de>

> On Tue, 2010-07-13 at 15:11 +0200, Vincenzo D'Amore wrote:
> > thank you for reading my posts, *could anybody help me to
> > understand why realpath cache is disabled if safe_mode or open_basedir
> are
> > set?*
>
> For security reasons.
>
> Assume the following (simplified) code:
>
> <?php
> symlink('./bar', 'foo');
> access_bar_in_some_way_to_get_it_cached();
> unlink('bar');
> symlink('/', 'bar');
> do_bad_things_with_bar();
> ?>
>
> and suddenly you've bypassed the check as for do_bad_things_with_bar()
> the cached value is used. Now I hear you say "then invalidate the cache
> entries"  or something like that, but well, there are so many ways to
> achieve such a result (including from outside PHP) that the check won't
> be reliable in any way anymore.
>
> That's the issue one has with security features on application level,
> the operating system itself can implement it way more efficiently but
> this doesn't (easily) work with a mod_php vhost config (solaris +
> mod_privileges would be one way, probably linux + apparmor can do,
> too ...)
>
> johannes
>
>
>


--=20
Vincenzo D'Amore
email: v.damore@gmail.com
msn: freedev@hotmail.com
skype: free.dev
mobile: +39 349 8513251

--0016363b9bf88b7c3f048b45ba3e--