From owner-freebsd-security@FreeBSD.ORG Sun Feb 25 11:17:10 2007 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9391C16A400 for ; Sun, 25 Feb 2007 11:17:10 +0000 (UTC) (envelope-from simon@zaphod.nitro.dk) Received: from mx.nitro.dk (zarniwoop.nitro.dk [83.92.207.38]) by mx1.freebsd.org (Postfix) with ESMTP id 3CF1713C428 for ; Sun, 25 Feb 2007 11:17:09 +0000 (UTC) (envelope-from simon@zaphod.nitro.dk) Received: from zaphod.nitro.dk (unknown [192.168.3.39]) by mx.nitro.dk (Postfix) with ESMTP id 2CC642D4A98; Sun, 25 Feb 2007 11:17:09 +0000 (UTC) Received: by zaphod.nitro.dk (Postfix, from userid 3000) id 116471141E; Sun, 25 Feb 2007 12:17:09 +0100 (CET) Date: Sun, 25 Feb 2007 12:17:08 +0100 From: "Simon L. Nielsen" To: Momchil Ivanov Message-ID: <20070225111708.GA978@zaphod.nitro.dk> References: <20070221131421.1709206a.stas@FreeBSD.org> <20070221183154.GA14590@zone3000.net> <200702212218.19806.idiotbg@gmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="9amGYk9869ThD9tj" Content-Disposition: inline In-Reply-To: <200702212218.19806.idiotbg@gmail.com> User-Agent: Mutt/1.5.11 Cc: Stanislav Sedov , Alexis Susset , freebsd-security@freebsd.org Subject: Re: Secure shared web hosting using MAC Framework X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Feb 2007 11:17:10 -0000 --9amGYk9869ThD9tj Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2007.02.21 22:18:15 +0100, Momchil Ivanov wrote: > > But is there any way to disbale related php functions? is there any well > > defined configuration examples for mod_php? >=20 > Is this what you are looking for:=20 > http://www.php.net/manual/en/features.safe-mode.php You should not rely on PHP safe mode and related features working since it's broken by design. There is a reason this was added to the default php.ini on FreeBSD: SECURITY NOTE: The FreeBSD Security Officer strongly recommend that the PHP Safe Mode feature not be relied upon for security, since the issues Safe Mode tries to handle cannot properly be handled in PHP (primarily due to PHP's use of external libraries). While many bugs in Safe Mode has been fixed it's very likely that more issues exist which allows a user to bypass Safe Mode restrictions. For increased security we always recommend to install the Suhosin extension. Running untrusted code in PHP just as unsafe as any other untrusted program on your system. It can be OK to use safe mode related features as an extra layer of trouble an attacker has to get through, but you should still treat the setup as though the safe mode stuff isn't there and assume people can break it. See also http://www.vuxml.org/freebsd/pkg-php5.html for more information on why safe mode shouldn't be trusted. --=20 Simon L. Nielsen FreeBSD Security Team --9amGYk9869ThD9tj Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) iD8DBQFF4XAzBJx0gP90kKsRAjMZAKCBTOMuL7CQFjJcWp78XU+T9lB+iQCeJZx5 k7+L5JTZDfTqdNUk5lq0TiM= =T/lw -----END PGP SIGNATURE----- --9amGYk9869ThD9tj--