Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74935
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.179 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
References: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
Date: Tue, 17 Jun 2014 11:15:35 +0200
Message-ID: <CAMUwpuQmzeGXugPPY6pjif5TB5Ut=GT42+c=eTvDQB4jsoMxwA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] PHP6, drop open_basedir?
From: jpauli@php.net (Julien Pauli)

On Tue, Jun 17, 2014 at 10:26 AM, Pierre Joye <pierre.php@gmail.com> wrote:
> hi,
>
> One of the last reminding so called "security" feature is open_basedir.
>
> On Windows f.e. it is very easy to create application pool with the
> right users/permissions settings (IIS) or only permissions settings
> (Apache). It is not possible to create one user per host on Apache
> using mod_php but I think it is acceptable as it is mostly used as
> development server or dedicated apps.
>
> On linux, fcgi/fpm with linux permissions systems allow pretty much
> the same. And my solutions exist for a per user/application isolation
> system.
>
> I think it is not worth the effort to keep maintaining something that
> will never be as safe as system level permissions.
>
> What do you think about removing it in php 6? Thoughts?

I'am obviously +1.

This param is not needed any more, it's been very easy to abuse it and
it's removal
will lead to many places of code cleaning :-)

Julien