Bug #74605 [NEW]: PHP disable_functions and FPM

From: s dot peterse at detoekomst dot nl Operating system: Ubuntu 16.04.4 PHP version: 7.0.19 Package: PHP options/info functions Bug Type: Bug Bug description:PHP disable_functions and FPM Description: ------------ I'm running a PHP 7.0.15 setup on Ubuntu 16.04.4 (7.0.15-0ubuntu0.16.04.4). Apache calls PHP using a PHP FPM socket. I have disabled php_uname in my main php.ini (/etc/php/7.0/fpm/php.ini) configuration. Changing this setting or overriding it in my FPM-Pool environment (using php_admin_value[disable_functions]) does correctly update the output of phpinfo(); but it doesn't actually work. There are actually 2 issues with disable_functions: 1. Having a function disabled in the main php.ini and overriding it for a certain FPM pool (in /etc/php/7.0/fpm/pool.d/www.conf) will not showing the method listed in the phpinfo ouput (disable_functions). So it means it's not disabled, but it is disabled (PHP Warning: php_uname() has been disabled for security reasons). 2. Having a function disabled in the main php.ini and adding to the same file a host override will correctly enable the function again but it's still showed as disabled in the phpinfo (but it isn't blocked!). Test script: --------------- My PHP test script: <?php phpinfo(); echo "php_uname: " . php_uname(); ?> --- NOTE: the difference between the 'disable_functions' option values is the php_uname function! Configs for issue 1 (php_uname() function IS blocked but NOT SHOWN as disabled in phpinfo): /etc/php/7.0/fpm/php.ini: ... [PHP] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,php_uname,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... /etc/php/7.0/fpm/pool.d/www.conf [www] user = www group = www listen = /run/php/php7.0-fpm.www.sock listen.owner = www-data listen.group = www-data pm = dynamic pm.max_children = 5 pm.start_servers = 2 pm.min_spare_servers = 1 pm.max_spare_servers = 3 ; Custom php.ini settings php_admin_value[max_execution_time] = 300 php_admin_value[disable_functions] = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, --- Configs for issue 2 (php_uname() function NOT blocked but SHOWN as disabled in phpinfo): /etc/php/7.0/fpm/php.ini: ... [HOST=mydomain] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... [PHP] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,php_uname,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... /etc/php/7.0/fpm/pool.d/www.conf [www] user = www group = www listen = /run/php/php7.0-fpm.www.sock listen.owner = www-data listen.group = www-data pm = dynamic pm.max_children = 5 pm.start_servers = 2 pm.min_spare_servers = 1 pm.max_spare_servers = 3 ; Custom php.ini settings php_admin_value[max_execution_time] = 300 -- Edit bug report at https://bugs.php.net/bug.php?id=74605&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74605&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74605&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74605&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74605&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74605&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74605&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74605&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74605&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74605&r=support Expected behavior: https://bugs.php.net/fix.php?id=74605&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74605&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74605&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74605&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74605&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74605&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74605&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74605&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74605&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74605&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74605&r=mysqlcfg