From owner-freebsd-questions@freebsd.org Wed May 4 18:13:43 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 93B42B2D5A6 for ; Wed, 4 May 2016 18:13:43 +0000 (UTC) (envelope-from eto.freebsd@ethome.sk) Received: from smtpout6.dnsserver.eu (smtpout6.dnsserver.eu [92.240.253.144]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 53B3C1A4A for ; Wed, 4 May 2016 18:13:42 +0000 (UTC) (envelope-from eto.freebsd@ethome.sk) Received: from [92.240.253.67] (helo=smtp3s109.dnsserver.eu) by smtpout6.dnsserver.eu with esmtp (Exim 4.84 (FreeBSD)) (envelope-from ) id 1ay0vJ-0008BQ-82 for freebsd-questions@freebsd.org; Wed, 04 May 2016 19:49:21 +0200 Received: from [80.242.44.220] (helo=eto-mona.office.smartweb.sk) by smtp3s109.dnsserver.eu with esmtpsa (TLSv1.2:AES128-GCM-SHA256:128) (Exim 4.83 (FreeBSD)) (envelope-from ) id 1ay0vL-0006v0-6Z for freebsd-questions@freebsd.org; Wed, 04 May 2016 19:49:23 +0200 Date: Wed, 4 May 2016 19:42:28 +0200 From: "Martin \"eto\" Misuth" To: freebsd-questions@freebsd.org Subject: Re: php-fpm _and_ open_basedir = Necessary? Message-ID: <20160504194228.52047ab6@eto-mona.office.smartweb.sk> In-Reply-To: References: Organization: ethome.sk MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-SA-Exim-Connect-IP: 80.242.44.220 X-SA-Exim-Mail-From: eto.freebsd@ethome.sk X-SA-Exim-Scanned: No (on smtp3s109.dnsserver.eu); SAEximRunCond expanded to false X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 May 2016 18:13:43 -0000 On Wed, 27 Apr 2016 15:12:33 +0200 Andy Wodfer wrote: > Now I wonder - Is open_basedir even necessary when I run php with php-fpm > pools with their own users. From what I understand php-fpm does just this > (jail) the daemon/process to its specified virtualhost/user homedir (hope > this came out correctly). ? As far as I understand it, open_basedir is "poor mans jailing" courtesy of php. It's intended to solve path traversal problems in mass hosting configurations usual for ISPs (using virtual hosts), eg cross domain script read/write. Instead of relying on higher/lower layer (depending on your pov) of isolation provided by os, php runtime with open_basedir configured, changes behaviour of most php's IO related functions to prevent unintended directory traversal. Eg it "locks" php's IO (php userland fileops, include/require) into specific subtrees. Ofc this has no effect on anything spawned by php's system() call or on backticks operators, and I don't remember even if all IO functions in php runtime are open_basedir capable. Some consider it has dubious value, others think differently. Also remember that open_basedir "jails" only scripts and their IO, actual runtime has normal access capabilities and it has nothing to do with php-fpm chroot. Depending on how you have setup your php-fpm instances (chroot or jail, jail, jail + chroot, fpm-pool per jail, custom users) it might be turned off even. eto