Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96872
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pthreads.org from 74.125.82.65 cause and error)
MIME-Version: 1.0
In-Reply-To: <0ca201d23d22$e3d623d0$ab826b70$@belski.net>
References: <5eea66e9-0e47-852a-8720-7c7a6a0d2224@gmx.de> <0ca201d23d22$e3d623d0$ab826b70$@belski.net>
Date: Sun, 13 Nov 2016 06:36:51 +0000
Message-ID: <CAL=_i_=VpCtNWzF5re7h7puvRNpFED=g+E+g3hyko_z64d9xXg@mail.gmail.com>
To: Anatol Belski <anatol.php@belski.net>
Cc: "Christoph M. Becker" <cmbecker69@gmx.de>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7beb9098d5b763054128f230
Subject: Re: [PHP-DEV] PaX MPROTECT / W^X protection
From: pthreads@pthreads.org (Joe Watkins)

--047d7beb9098d5b763054128f230
Content-Type: text/plain; charset=UTF-8

Morning,

Just wanted to give a thumbs up to documenting the issue ...

Trying to work around it with platform/distro/kernel specific solutions,
sounds quite horrible, and is bound to be fragile.

Cheers
Joe

On Sat, Nov 12, 2016 at 8:25 PM, Anatol Belski <anatol.php@belski.net>
wrote:

> Hi Christoph,
>
> > -----Original Message-----
> > From: Christoph M. Becker [mailto:cmbecker69@gmx.de]
> > Sent: Friday, November 11, 2016 7:40 PM
> > To: internals@lists.php.net
> > Subject: [PHP-DEV] PaX MPROTECT / W^X protection
> >
> > Hi!
> >
> > There are currently at least two unresolved tickets[1][2] in our bug
> tracker
> > regarding PaX MPROTECT / W^X protection issues with regard to PCRE JIT.
> The
> > problem is that PCRE JIT mmaps W|X pages[3], what is no longer allowed on
> > several platforms, such as OpenBSD, FreeBSD and SELinux.  It seems that
> there
> > are workarounds (e.g. using paxctl to allow W|X mapping[1], or mounting
> with
> > wxallowed[4]), but these appear to be very system specific.
> >
> > My best idea to resolve the reports is to document this issue.  Maybe
> somebody
> > has a better idea?
> >
> AFM, the linked tickets are not about an issue in PHP. There are just
> systems, or system configurations, that are very security oriented. If some
> feature is disabled on the system level, there's not much PHP can do. To
> compare - it were wrong same way to say atime doesn't work in PHP, if
> indeed a volume is mounted with atime disabled. Any issue, that is only to
> be solved by the system configuration, is a configuration issue in the most
> case. So the documentation is probably the only what we can do in the case.
>
> Regrads
>
> Anatol
>
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--047d7beb9098d5b763054128f230--