Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96866
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
To: "'Christoph M. Becker'" <cmbecker69@gmx.de>,
	<internals@lists.php.net>
References: <5eea66e9-0e47-852a-8720-7c7a6a0d2224@gmx.de>
In-Reply-To: <5eea66e9-0e47-852a-8720-7c7a6a0d2224@gmx.de>
Date: Sat, 12 Nov 2016 21:25:17 +0100
Message-ID: <0ca201d23d22$e3d623d0$ab826b70$@belski.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQGhhl8nlm7vhO4uD7RW7udIH5N6sqE3N2DQ
Content-Language: en-us
Subject: RE: [PHP-DEV] PaX MPROTECT / W^X protection
From: anatol.php@belski.net ("Anatol Belski")

Hi Christoph,

> -----Original Message-----
> From: Christoph M. Becker [mailto:cmbecker69@gmx.de]
> Sent: Friday, November 11, 2016 7:40 PM
> To: internals@lists.php.net
> Subject: [PHP-DEV] PaX MPROTECT / W^X protection
>=20
> Hi!
>=20
> There are currently at least two unresolved tickets[1][2] in our bug =
tracker
> regarding PaX MPROTECT / W^X protection issues with regard to PCRE =
JIT.  The
> problem is that PCRE JIT mmaps W|X pages[3], what is no longer allowed =
on
> several platforms, such as OpenBSD, FreeBSD and SELinux.  It seems =
that there
> are workarounds (e.g. using paxctl to allow W|X mapping[1], or =
mounting with
> wxallowed[4]), but these appear to be very system specific.
>=20
> My best idea to resolve the reports is to document this issue.  Maybe =
somebody
> has a better idea?
>=20
AFM, the linked tickets are not about an issue in PHP. There are just =
systems, or system configurations, that are very security oriented. If =
some feature is disabled on the system level, there's not much PHP can =
do. To compare - it were wrong same way to say atime doesn't work in =
PHP, if indeed a volume is mounted with atime disabled. Any issue, that =
is only to be solved by the system configuration, is a configuration =
issue in the most case. So the documentation is probably the only what =
we can do in the case.

Regrads

Anatol