Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My FreeBSD9.1 server configured for single user, and Apache serves all websites as "www" user. My aim is to disable some potentially dangerous php function on particular websites. I know it's possible with Suhosin, and i was using it in such way on php5.3. But recently i moved to php5.4 and Suhosin is not available anymore for normal install using FreeBSD ports, only manual compilation, which i'm not like to do. When i was using Suhosin, my setup was as follows:

  1. Commented line "disable_functions = " in php.ini
  2. Added suhosin.executor.func.blacklist = "exec,passthru,shell_exec" to php.ini
  3. In virtual host added

    php_admin_value suhosin.executor.func.blacklist= "passthru,shell_exec"

As you can see i have omitted "exec" function, that means exec will work on this website.

I know that disabled function not working in .htacces/httpd.conf, from php manual:

disable_functions string

This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode.

Only internal functions can be disabled using this directive. User-defined functions are unaffected.

This directive must be set in php.ini For example, you cannot set this in httpd.conf.

Is some reliable workaround to achieve same without Suhosin, or i need to compile it anyway ?

share|improve this question
    
Why not just install FastCGI and run every website under its own user? –  Jeroen Sep 26 '13 at 8:56
    
Know this way. But want to keep one user for simplicity and as far i know fastcgi works slower than mod_php –  Demontager Sep 26 '13 at 14:22
    
You can also run PHP-FPM in combination with FastCGI and have a few workers running already. Saves you having to spawn them like normal with FastCGI. Simplicity is not safer in this case. There are plenty of ways to hack all other websites on this server without the things your trying to disable. –  Jeroen Sep 26 '13 at 14:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.