Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57802
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain sury.org designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
Date: Thu, 9 Feb 2012 00:35:19 +0100
Message-ID: <CALjhHG8D3DG9miWSVb9X848WAm+HneoBQ_c5O+TiNy5YmbeaxQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Security risk how to use find recommended in php.ini-*
From: ondrej@sury.org (=?UTF-8?B?T25kxZllaiBTdXLDvQ==?=)

This is very wrong to recommend:

; NOTE: If you are using the subdirectory option for storing session files
[...]
; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0find /path/to/sessions -cmin +24 | xarg=
s rm

because it is prone to '\n' attack. You can see the security
considerations of GNU find.

Much better would be:

find /path/to/sessions -cmin +24 -delete
or at least
find /path/to/sessions -cmin +24 -execdir rm "{}" \; (GNU find)

The most error-prone way is something we cooked up in Debian:

find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f
-ignore_readdir_race -cmin +24 ! -execdir fuser -s {} 2>/dev/null \;
-delete

which depends on fuser at least version 22.15 (which has removed
fork() call which was able to swamp up whole system with zombies).

The fuser call checks if the session file is still in use, because the
script was deleting still active sessions opened 24+ mins ago.

O.
--=20
=EF=BB=BFOnd=C5=99ej Sur=C3=BD <ondrej@sury.org>