Bug #66611 [Com]: php allows sockets to be inherited

Edit report at https://bugs.php.net/bug.php?id=66611&edit=1 ID: 66611 Comment by: arekm at maven dot pl Reported by: arekm at maven dot pl Summary: php allows sockets to be inherited Status: Open Type: Bug Package: FPM related Operating System: Linux PHP Version: 5.5.8 Block user comment: N Private report: N New Comment: Note, example of similar case (leaking socket/descriptors) in apache apr code and how it got fixed there: http://svn.apache.org/viewvc?view=revision&revision=747990 Previous Comments: ------------------------------------------------------------------------ [2014-01-30 10:37:18] arekm at maven dot pl Description: ------------ php fcgi and fpm unfortunately allow subprocesses to inherit server socket. For example, test script: <?php system("sleep 1000"); ?> run it using browser over fcgi or fpm, we get: # pstree -lpu |grep 32686 | `-php55.fcgi(32671)-+-php55.fcgi(32678)---sh(32686) but now look what descriptors are avilable to "sh" process: # lsof |grep 32686 [...] sh 32686 lighttpd 0u unix 0xffff880261a17700 0t0 9572697 /var/run/php/php-fcgi-32664.sock-1 [...] sh 32686 lighttpd 3u unix 0xffff880261a15e80 0t0 9576285 /var/run/php/php-fcgi-32664.sock-1 as you can see "sleep" has access to fcgi socket! And instead of sleep I could run some malicious code. The same happens with tcp socket in case of fpm over tcp. Processes forked from php have access to server socket 9000. The solution is to set FD_CLOEXEC (see man fcntl) flag on socket or use proper api (SOCK_CLOEXEC flag, accept4()). Note that leaking descriptors/sockets falls into secutity catgory in some cases. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66611&edit=1