Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to set permissions on a directory or configure apache in a way that allows PHP to include files from this directory for execution but scripts cannot open them using fopen() or other similar functionality? I am trying to secure some keys, salts and whatnot that I don't want scripts to be able to reference or read directly.

share|improve this question
add comment

2 Answers

There is no way to set up files so that PHP can include them but not read them via it's own APIs - it has to read them in order to include them.

What are you trying to achieve? Maybe the answer to your problem is obfuscation? Maybe the answer is to move them outside the document root, maybe the answer is to disable PHP parsing in the directory tree.

share|improve this answer
    
Tvanover probably wants to only allow script execution, not reading the code. This would allow for some kind of secret API then. –  Lukas Mar 14 '13 at 1:32
    
Mostly I want a place where I can store config info that only certain classes can read. Ideally that data would be in the class file, but those are easily read and parsed by other scripts. Especially since the file locations are easily predicted by simple rules. –  Tvanover Mar 15 '13 at 0:18
    
There's potentially lots of ways to achieve this - but your suggestion isn't one of them. Encrypt the files and push the authentication key out to the client / secure session. Use a secure session. Use multiple instances of PHP running under different uids with different permissions (suPHP / php-fpm with different pools).... –  symcbean Mar 15 '13 at 9:54
add comment

As symcbean already said, this is not possible with a single instance of PHP. However, you could try to spawn a 2nd PHP instance running as another user, also having access to other files.
Thinking about how to spawn this instance, that would be your job then.

Maybe PHP's integrated server would be an option - although it's still recommended for non-productive usage only.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.