Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

as the Debian developers consider safe_mode (which will not make it into PHP6) and open_basedir inherently broken security measures, I wonder if they can be considered replaceable by mod_suexec combined with mod_fcgid. Do you think this is valid?

Kind regards, Benjamin.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I would suggest that given appropriate file permissions in the filesystem, using suexec with PHP would be acceptable to replace safe_mode. This is simply because you are allowing the filesystem to prevent file access instead of letting PHP do it for you, which is considered broken and therefore removed as of PHP 5.4.

open_basedir does have some issues that make it broken, such as the fact that there is a bad race condition related to symlink replacement, and therefore it probably shouldn't be used. I'm not aware that it is being removed from PHP and I would assume they would try to tighten that up someday. I wouldn't rely on it. suexec won't solve this problem, though. For example, if you want to prevent a PHP script from accessing /etc/passwd, there is nothing that suexec will do to prevent it since that's always a world-readable file. open_basedir would possibly prevent that from happening if it weren't for that pesky race condition. I don't think suexec solves this part and I'm not sure what would solve it aside from using a chroot in some fashion.

share|improve this answer
1  
I accepted this answer as it is the only one. I really enjoyed your shared insights. –  benjamin Jun 11 '12 at 11:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.