Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74937
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <53A00AC1.2050001@lsces.co.uk>
References: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
 <53A00AC1.2050001@lsces.co.uk>
Date: Tue, 17 Jun 2014 11:34:37 +0200
Message-ID: <CALtuQzDC6qA=hXNC42MFEU3bHyKtNOB07LHQY4yeH22p5Vvy3Q@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d043be04c8f258304fc04dc9e
Subject: Re: [PHP-DEV] PHP6, drop open_basedir?
From: krebs.seb@gmail.com (Sebastian Krebs)

--f46d043be04c8f258304fc04dc9e
Content-Type: text/plain; charset=UTF-8

2014-06-17 11:30 GMT+02:00 Lester Caine <lester@lsces.co.uk>:

> On 17/06/14 09:26, Pierre Joye wrote:
> > One of the last reminding so called "security" feature is open_basedir.
> >
> > On Windows f.e. it is very easy to create application pool with the
> > right users/permissions settings (IIS) or only permissions settings
> > (Apache). It is not possible to create one user per host on Apache
> > using mod_php but I think it is acceptable as it is mostly used as
> > development server or dedicated apps.
> >
> > On linux, fcgi/fpm with linux permissions systems allow pretty much
> > the same. And my solutions exist for a per user/application isolation
> > system.
> >
> > I think it is not worth the effort to keep maintaining something that
> > will never be as safe as system level permissions.
> >
> > What do you think about removing it in php 6? Thoughts?
>
> Managing security on servers that one has full access to is not the main
> target of open_basedir?


In my experiene it only leads to a false sense of security. I've seen it
more than once, that people just set a value there and believed, that they
are now safe. On the other hand they wonder, why many things were broken,
so they loosen the restrictions again.


> It has a useful place when working with shared
> hosting?


I'd recommend a using VMs, or container instead.


> While on-line storage costs are going down, sharing code across
> a few sites while maintaining maintaining a level of isolation between
> specific content is not easy to achieve in other ways?
>

Composer?


>
> The usage I'm seeing is that open_basedir provides access to the site
> files and a shared set of resources used across several sites. This is
> probably not the best way of doing things but is one documented on
> several hosting packages. The examples I could link to require a private
> login :( Just a pointer to something that provides an alternative
> resolution would obviously be acceptable. With many of these facilities
> it's not simply removing something but much more important to provide
> education on the alternatives?
>
> --
> Lester Caine - G8HFL
> -----------------------------
> Contact - http://lsces.co.uk/wiki/?page=contact
> L.S.Caine Electronic Services - http://lsces.co.uk
> EnquirySolve - http://enquirysolve.com/
> Model Engineers Digital Workshop - http://medw.co.uk
> Rainbow Digital Media - http://rainbowdigitalmedia.co.uk
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
github.com/KingCrunch

--f46d043be04c8f258304fc04dc9e--