Bug #67481 [Com]: Opcache uses wrong file from cache

Edit report at https://bugs.php.net/bug.php?id=67481&edit=1 ID: 67481 Comment by: spam at rw23 dot de Reported by: Danack at basereality dot com Summary: Opcache uses wrong file from cache Status: Closed Type: Bug Package: opcache Operating System: Centos PHP Version: 5.5.13 Block user comment: N Private report: N New Comment: Confirmed to still be a problem in PHP7. Cant understand why nobody cares about it, this is a real bug that causes data corrution, confusion and security problems! My Workaround (PHP5/PHP7) is this: i have htdocs directory inside my chroot. rename this to htdocs.someuniqueid and created a symlink from htdocs to htdocs.someuniqueid. restart php-fpm. the opcache will use the realpath (the path after resolution of all symlinks) and therefore the path with the unique id. by using the symlink, other configurations can stay unchanged. My workaround in php5 was to uninstall opcache and use xcache, but as xcache is not available anymore with php7. Previous Comments: ------------------------------------------------------------------------ [2016-11-08 07:06:19] php-dev at coydogsoftware dot net Related To: Bug #69090 ------------------------------------------------------------------------ [2016-11-04 21:43:32] php-dev at coydogsoftware dot net I've posted a proposed patch for the cross-user cache access vulnerability to https://bugs.php.net/bug.php?id=69090 . It doesn't solve the problem in all chroot cases, but it will solve it if the chroot environments run PHP scripts as different system users. My fix might not be perfect, but after 2 years of inaction on this bug I think it's better than nothing. ------------------------------------------------------------------------ [2016-10-28 11:05:51] sander dot dbeer at gmail dot com Problem also exists in PHP 7. Opcache is useless in a chrooted production environment. It's appalling how this problem is ignored ... ------------------------------------------------------------------------ [2016-08-08 11:50:01] spam at rw23 dot de yes, its duplicate. this is a big issue with fatal consequences, and it is still just ignored :( ------------------------------------------------------------------------ [2016-08-08 11:05:49] rgpublic at gmx dot net Related to/Duplicate?: https://bugs.php.net/bug.php?id=69090 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=67481 -- Edit this bug report at https://bugs.php.net/bug.php?id=67481&edit=1