Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74965
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 74.125.82.173 cause and error)
Message-ID: <53A10C5B.1000003@lerdorf.com>
Date: Wed, 18 Jun 2014 05:49:47 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Pierre Joye <pierre.php@gmail.com>, 
 PHP internals <internals@lists.php.net>
References: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
In-Reply-To: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP6, drop open_basedir?
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 06/17/2014 10:26 AM, Pierre Joye wrote:
> hi,
> 
> One of the last reminding so called "security" feature is open_basedir.
> 
> On Windows f.e. it is very easy to create application pool with the
> right users/permissions settings (IIS) or only permissions settings
> (Apache). It is not possible to create one user per host on Apache
> using mod_php but I think it is acceptable as it is mostly used as
> development server or dedicated apps.
> 
> On linux, fcgi/fpm with linux permissions systems allow pretty much
> the same. And my solutions exist for a per user/application isolation
> system.
> 
> I think it is not worth the effort to keep maintaining something that
> will never be as safe as system level permissions.
> 
> What do you think about removing it in php 6? Thoughts?

I think you have a very narrow view of how this feature is used.
Security and code quality is about layers. This is a useful layer that
helps verify that an application, or even a subset of an application, is
only able to access a given set of directories. If something tries to
access a file outside of the defined scope, we get an error and we know
there is a bug in the code. I, and many companies out there, rely quite
heavily on this feature to catch mistakes. And yes, there are ways of
getting around it at the PHP-level if you deliberately craft your PHP
code to do so, but that doesn't make the feature any less useful to all
the people using it to catch non-deliberate mistakes.

-Rasmus