Req #64437 [Com]: [feature request] log of php writes to local files
Edit report at https://bugs.php.net/bug.php?id=64437&edit=1
ID: 64437
Comment by: mail+php at requinix dot net
Reported by: spamik at yum dot pl
Summary: [feature request] log of php writes to local files
Status: Open
Type: Feature/Change Request
Package: Filesystem function related
PHP Version: 5.4.13
Block user comment: N
Private report: N
New Comment:
But a setup shouldn't allow PHP to do anything to files in the first place (with
possible exceptions for things like file uploads). Directories should be locked
down to 0755 or better, files to 0644 or better, and the web server/PHP running as
a very under-privileged user like "nobody". Then there's no risk of creating new
files or overwriting code or really any kind of modifications at all.
Previous Comments:
------------------------------------------------------------------------
[2013-03-18 20:23:42] spamik at yum dot pl
Only writes to files with selected extensions (by php.ini, like php|htm|html|js)
should be logged.
------------------------------------------------------------------------
[2013-03-15 23:27:01] spamik at yum dot pl
Just to clarify that log would actualy be later on used by user land aplications
that would scan those files that were writen to.
In light of what is happening with php aplications, mass hacks, botnets, people
are moving to other languages that are more obscure just for their obscurity. PHP
really need to counteract and provide functionality like one I propose.
------------------------------------------------------------------------
[2013-03-15 23:21:02] spamik at yum dot pl
Description:
------------
As you probably know there are a lot of security bugs in current world php
aplications. Using these bugs attacker executes his own code that writes to a
new .php files (usualy) or modyfy existing one - putting there his malicious
"botnet zombie" code.
It is really hard to quick and efectivly detect changes on filesystem/kernel
level, especialy if where are talking about monitoring milions of directories
(as in popular shared hosting).
I propose making php file write log (to a file defined in php.ini). Operations
that write to local files should be logged there (file_put_contents() and all
fopen() except 'r' and 'r+' mode) Log should contain:
unix_timestamp<SEPARATOR>absolute path of file that used write
function<SEPARATOR>absolute file of modified file
<SEPARATOR> could be '\0' as it can't be in filename anyway. Other solution
would be to escape paths as those can contain spaces etc.
most of this code should probably go to ext/standard/file.c
I've made very very crude implementation of this for myself but that is really
bad code because I lack c skills. It actualy seg faults in some cases. So I wont
even share it, no point.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=64437&edit=1
Thread (6 messages)