Enabling opcache.restrict_api for security reasons

Question

This article says that having opcache_get_status() enabled is a security risk. To turn it off, one has to configure opcache.restrict_api, but I couldn't find an example of how.

This person had the restriction in effect when configured as opcache.restrict_api=/restricted, which gives me a clue that it needs to be a path.

I started by creating a test script with an opcache_get_status() call, and I got an output of lots of PHP scripts on that system, confirming there was no restriction. Then I edited my /etc/php/7.3/fpm/php.ini to have opcache.restrict_api=/dev/null, and that same call now returns bool(false) - I take that the restriction is enabled.

My goal is to forbid opcache_get_status() and the like completely, and by 'allowing' scripts under /dev/null, I'm essentially making it impossible to use, since you can't a file there.

• Is this logic correct?
• Should I maybe use some other path?
• Is there a way to enable the restriction directly, without messing around with fake paths?

Thank you

Answer 1

Looking at the source code of ext/opcache/zend_accelerator_module.c

• For the information to 'leak', validate_api_restriction() needs to return true.
• In that function itself, it takes SG(request_info).path_translated (which, apparently, equals to SCRIPT_FILENAME) and matches it against restrict_api, comparing first few characters of the two values.
• Since the first character of path_translated a.k.a. SCRIPT_FILENAME is a slash, opcache.restrict_api=1 won't match it (/ != 1), and looks therefore safe to use

Also here's someone else using opcache.restrict_api=1 too.

Please correct me if I'm wrong somewhere! Until then, I feel like this pretty much answers my question.