My FreeBSD9.1 server configured for single user, and Apache serves all websites as "www" user. My aim is to disable some potentially dangerous php function on particular websites. I know it's possible with Suhosin, and i was using it in such way on php5.3. But recently i moved to php5.4 and Suhosin is not available anymore for normal install using FreeBSD ports, only manual compilation, which i'm not like to do. When i was using Suhosin, my setup was as follows:
- Commented line "disable_functions = " in php.ini
- Added suhosin.executor.func.blacklist = "exec,passthru,shell_exec" to php.ini
In virtual host added
php_admin_value suhosin.executor.func.blacklist= "passthru,shell_exec"
As you can see i have omitted "exec" function, that means exec will work on this website.
I know that disabled function not working in .htacces/httpd.conf, from php manual:
This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode. Only internal functions can be disabled using this directive. User-defined functions are unaffected. This directive must be set in php.ini For example, you cannot set this in httpd.conf.
Is some reliable workaround to achieve same without Suhosin, or i need to compile it anyway ?