Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74936
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 217.147.176.214 cause and error)
Message-ID: <53A00AC1.2050001@lsces.co.uk>
Date: Tue, 17 Jun 2014 10:30:41 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
In-Reply-To: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP6, drop open_basedir?
From: lester@lsces.co.uk (Lester Caine)

On 17/06/14 09:26, Pierre Joye wrote:
> One of the last reminding so called "security" feature is open_basedir.
> 
> On Windows f.e. it is very easy to create application pool with the
> right users/permissions settings (IIS) or only permissions settings
> (Apache). It is not possible to create one user per host on Apache
> using mod_php but I think it is acceptable as it is mostly used as
> development server or dedicated apps.
> 
> On linux, fcgi/fpm with linux permissions systems allow pretty much
> the same. And my solutions exist for a per user/application isolation
> system.
> 
> I think it is not worth the effort to keep maintaining something that
> will never be as safe as system level permissions.
> 
> What do you think about removing it in php 6? Thoughts?

Managing security on servers that one has full access to is not the main
target of open_basedir? It has a useful place when working with shared
hosting? While on-line storage costs are going down, sharing code across
a few sites while maintaining maintaining a level of isolation between
specific content is not easy to achieve in other ways?

The usage I'm seeing is that open_basedir provides access to the site
files and a shared set of resources used across several sites. This is
probably not the best way of doing things but is one documented on
several hosting packages. The examples I could link to require a private
login :( Just a pointer to something that provides an alternative
resolution would obviously be acceptable. With many of these facilities
it's not simply removing something but much more important to provide
education on the alternatives?

-- 
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk