Bug #66611 [NEW]: php allows sockets to be inherited

From: arekm at maven dot pl Operating system: Linux PHP version: 5.5.8 Package: FPM related Bug Type: Bug Bug description:php allows sockets to be inherited Description: ------------ php fcgi and fpm unfortunately allow subprocesses to inherit server socket. For example, test script: <?php system("sleep 1000"); ?> run it using browser over fcgi or fpm, we get: # pstree -lpu |grep 32686 | `-php55.fcgi(32671)-+-php55.fcgi(32678)---sh(32686) but now look what descriptors are avilable to "sh" process: # lsof |grep 32686 [...] sh 32686 lighttpd 0u unix 0xffff880261a17700 0t0 9572697 /var/run/php/php-fcgi-32664.sock-1 [...] sh 32686 lighttpd 3u unix 0xffff880261a15e80 0t0 9576285 /var/run/php/php-fcgi-32664.sock-1 as you can see "sleep" has access to fcgi socket! And instead of sleep I could run some malicious code. The same happens with tcp socket in case of fpm over tcp. Processes forked from php have access to server socket 9000. The solution is to set FD_CLOEXEC (see man fcntl) flag on socket or use proper api (SOCK_CLOEXEC flag, accept4()). Note that leaking descriptors/sockets falls into secutity catgory in some cases. -- Edit bug report at https://bugs.php.net/bug.php?id=66611&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66611&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66611&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66611&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66611&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66611&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66611&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66611&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66611&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66611&r=support Expected behavior: https://bugs.php.net/fix.php?id=66611&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66611&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66611&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66611&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66611&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66611&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66611&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66611&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66611&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66611&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66611&r=mysqlcfg