Edit report at https://bugs.php.net/bug.php?id=77979&edit=1
ID: 77979
Updated by: cmb@php.net
Reported by: spam2 at rhsoft dot net
Summary: open_basedir deprecation
-Status: Open
+Status: Not a bug
-Type: Security
+Type: Bug
-Package: *General Issues
+Package: Safe Mode/open_basedir
PHP Version: Irrelevant
Block user comment: N
Private report: Y
New Comment:
Sigh
Previous Comments:
------------------------------------------------------------------------
[2019-05-07 10:47:19] spam2 at rhsoft dot net
Description:
------------
can you guys please step back from trying to remove everything left and right in PHP 8.0?
everybody knows that it's not bullet proof but it has it's value
the performance penalty is only because of the hardcoded nonsense instead a ini-option we patch out
of PHP because with disable_functions="symlink" the race can't happen
until you fix the design of realpath cache it's worthless anyways
https://bugs.php.net/bug.php?id=73888
-------- Weitergeleitete Nachricht --------
Betreff: [PHP-DEV] open_basedir?
Datum: Tue, 7 May 2019 12:11:03 +0200
Von: Nikita Popov <nikita.ppv@gmail.com>
An: PHP internals <internals@lists.php.net>
Hi internals,
The open_basedir ini setting has two significant problems:
1. It is a major performance hit, because it disables the realpath cache.
2. Many people think it is a security feature and use it as such. However,
open_basedir is in reality a "best effort" mechanism, with known
workarounds and more regularly being found. Especially when it comes to
interactions with 3rd party libraries, enforcing open_basedir is simply
impossible.
What open_basedir tries to do must be implemented on the operating system
level to work reliably (and of course such mechanisms exist, such as jails,
chroot and friends).
I wonder if it is feasible to drop this ini setting? Enforcing this doesn't
really seem like any of PHP's business. If not, I think we need to at least
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77979&edit=1