Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:67429 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 10979 invoked from network); 15 May 2013 13:02:43 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 15 May 2013 13:02:43 -0000 Authentication-Results: pb1.pair.com header.from=gvormayr@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=gvormayr@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.174 as permitted sender) X-PHP-List-Original-Sender: gvormayr@gmail.com X-Host-Fingerprint: 209.85.210.174 mail-ia0-f174.google.com Received: from [209.85.210.174] ([209.85.210.174:61464] helo=mail-ia0-f174.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 0C/C0-03867-27783915 for ; Wed, 15 May 2013 09:02:42 -0400 Received: by mail-ia0-f174.google.com with SMTP id r13so241988iar.33 for ; Wed, 15 May 2013 06:02:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:date:message-id:subject:from:to :content-type; bh=r+VvODMCUtH2d8AeloK4oyTNyPI/5JyBSKASz3zyP9I=; b=rvENqP9M1x9YBpNYJqFr9xrehW8WSQ70Frbrcr/UmBtVI9KmUa91zHpT/hlelRHDNj n44h+apEPE5/wBYXyRhkUfbiiVr9ZnhmV/CemJz9HwOdx+ippeO/xrhYukUHpbn62h+Z qPKAsLqa7cMpAyHbYGzUuLocMhT2eRbbEttdVGwh/XHuwY/1as92r447XMjSy/GBOjpe LX9syNWEnLY0abxhkXTKRcNKwe4B66/L0c3J2j4PTpzMCIyV6ODlqp7/Xe1oYEk1a276 zzmHM8jFIUwNDCpbTFqAVU8Pgf26LnWNIikDlTX9nsC71QPnCYqkpW643ZiJ03FjaHn2 HUrg== MIME-Version: 1.0 X-Received: by 10.43.133.134 with SMTP id hy6mr16304013icc.57.1368622959814; Wed, 15 May 2013 06:02:39 -0700 (PDT) Received: by 10.64.8.129 with HTTP; Wed, 15 May 2013 06:02:39 -0700 (PDT) Date: Wed, 15 May 2013 15:02:39 +0200 Message-ID: To: internals@lists.php.net Content-Type: multipart/alternative; boundary=20cf307cfeb259fcc004dcc15d08 Subject: [PROPOSAL] apparmor change_hat functionality in fpm From: gvormayr@gmail.com (Gernot Vormayr) --20cf307cfeb259fcc004dcc15d08 Content-Type: text/plain; charset=ISO-8859-1 Hi! The basic idea behind this is to get a better seperation of different php pools (so e.g. php scripts from one pool can't access the other and vice versa). I did a small patch (https://github.com/php/php-src/pull/343) that adds a configuration parameter to pools (apparmor_hat). If this is set, workers of the pool try to change the apparmor hat to the specified value. The patch only touches fpm. Only thing that's needed is libapparmor - if it is not there the functionality just gets left out. To keep things simple this version is very coarse - meaning it is not possible to change the hat back, or change to a different hat according to the executed script. Any thoughts on this? Cheers, Gernot --20cf307cfeb259fcc004dcc15d08--