Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75002
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.176 as permitted sender)
Message-ID: <53A36193.1010700@gmail.com>
Date: Fri, 20 Jun 2014 00:17:55 +0200
User-Agent: Thunderbird
MIME-Version: 1.0
To: PHP Developers Mailing List <internals@lists.php.net>
References: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
In-Reply-To: <CAEZPtU7rc+JpguO=Ke8UmiLLaidvyJEQ81C9Lsvn8yHgkp=+qw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] PHP6, drop open_basedir?
From: keisial@gmail.com (=?UTF-8?B?w4FuZ2VsIEdvbnrDoWxleg==?=)

-1

Even when you use a dedicated user per vhost, a defense in depth strategy
where you additionally restrict the to not access /tmp or /etc seems right.*
Note containers/VM are not always available. chroot + bind mounts _would_
be able to provide that restriction, but it is a messy setup, both in 
folder
structure and in polluting the mounts.
AppArmor can be an alternative (assuming you have that LSM in your kernel)
although you may need some trickery, as (IMHO) you can't having have a
profile with different paths depending on the uid (and goog luck on 
restricting
things like the php error log).

I think you should provide -for a few of those alternatives- a recipe of 
"translating"
an open_basedir to provide the same restriction. I suspect it will be 
quite hard to
do (without requiring more server features -sometimes an upgrade-), 
specially
when you start facing requisites like "don't allow enumerating the other 
accounts
on this host".


* Obviously, this can only work if the user can't exec outside of the 
php process.


PS: I also disagree with the statement «mod_php but I think it is 
acceptable
as it is mostly used as development server», but it may be considered 
‘right’ to
remove open_basedir even without that premise.