How to disable PHP's ini_set for specific configuration options?

Question

I'm running a setup with PHP 5.3.8 and use php-fpm with it's chroot functionality to separate multiple customers. So each customer has it's own chrooted PHP-environment, which is quite fine.

I now want to disallow that a customer can change the memory_limit of his PHP-instance by using ini_set. On the other hand I don't want to disable ini_set completely. So I'm searching for a possibility to disable the possibility to set specific PHP configuration options (like memory_limit) via ini_set.

Does somebody know how to achieve that?

Answer 1

You can't, without patching the PHP source code.

Answer 2

As cyberx86 noted in his comment, it's at least possible with suhosin to disallow changes to memory_limit during runtime. The configuration option for that in suhoshin is called suhosin.memory_limit.