4

We have a issue that just came to our notice, some of our developers used ini_set('memory_limit', -1) to over-ride the php.ini memory_limit settings in their code files.

Due to which sometimes our Memory/CPU usage is way far more than usual and we even have experienced server hanging/crashing many times.

Is there any way to restrict these changes for certain params like memory_limit, upload_max_filesize & post_max_size? Users should not be able to edit them after a certain limit set?

Sorry if i asked a dumb question, tried searching but there was no reference to this only found answers asking for increasing these parameters.

Improve this question

1 Answer 1

Reset to default
3

There are two options i know of to accomplish at least parts of your goal.

First php safe_mode, which might give your Devs a lot of additional work.

Suhosin www.hardened-php.net

When installed you can edit /etc/php5/conf.d/suhosin.ini and set:

suhosin.memory_limit = 512M

Qoute from Manual 1:

suhosin.memory_limit

Type: Integer
Default: 0

As long scripts are not running within safe_mode they are free to change the memory_limit to whatever value they want. Suhosin changes this fact and disallows setting the memory_limit to a value greater than the one the script started with, when this option is left at 0. A value greater than 0 means that Suhosin will disallows scripts setting the memory_limit to a value above this configured hard limit. This is for example usefull if you want to run the script normaly with a limit of 16M but image processing scripts may raise it to 20M.

Stackoverflow question for reference

Improve this answer
3
  • Thanks Dennis, But we are using PHP 5.5 whereas Suhosin stable release was available only till 5.1 version. But will see if the same is compatible with ver 5.5 also. As you say that php safe_mode has access to change these parameters, but usually the scripts won't run in safe mode? Besides Suhosin is there any other way around?
    – Rohit Batra
    May 28, 2014 at 10:35
  • safe_mode would disable setting this value by user scripts. But from experience this might break the user scripts even without them trying to set the memory limit because of other safe_mode limitations. Depending how the scripts were written a lot of them depend on beeing run when the "server" has safe_mode set to off. But this depends on the scripts and might be solveable. for your 2nd question: no i do not know any other way than either safe_mode or suhosin, which both are quite much work for this, but are nice in the long run (once configured correctly.. which takes time :)
    – Dennis Nolte
    May 28, 2014 at 11:14
  • @RohitBatra just to note it down Suhosin is working with PHP 5.5 and latest version from 2014.02.24 actually needs PHP 5.4 or newer hardened-php.net/suhosin/changelog.html it might be that you use a distribution where it was not updated yet.
    – Dennis Nolte
    May 28, 2014 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .