Bug #74605 [Com]: PHP disable_functions and FPM

Edit report at https://bugs.php.net/bug.php?id=74605&edit=1 ID: 74605 Comment by: yuri+bugs at fused dot com Reported by: s dot peterse at detoekomst dot nl Summary: PHP disable_functions and FPM Status: Open Type: Bug Package: PHP options/info functions Operating System: Ubuntu 16.04.4 PHP Version: 7.0.19 Block user comment: N Private report: N New Comment: This bug is still present and exceptionally easy to reproduce in 7.2.27. Previous Comments: ------------------------------------------------------------------------ [2018-06-24 20:22:14] pguru dot rahul at gmail dot com did anyone find a patch for issue 1.. I am facing same issue. A strange Issue.. a) Phpinfo function loads default ini files ,additional ini files And showing disable Functions has no value. But some of the Functions like 'ini_get_all', ini_get are actually disabled or are not callable. ------------------------------------------------------------------------ [2017-05-17 12:41:37] s dot peterse at detoekomst dot nl Description: ------------ I'm running a PHP 7.0.15 setup on Ubuntu 16.04.4 (7.0.15-0ubuntu0.16.04.4). Apache calls PHP using a PHP FPM socket. I have disabled php_uname in my main php.ini (/etc/php/7.0/fpm/php.ini) configuration. Changing this setting or overriding it in my FPM-Pool environment (using php_admin_value[disable_functions]) does correctly update the output of phpinfo(); but it doesn't actually work. There are actually 2 issues with disable_functions: 1. Having a function disabled in the main php.ini and overriding it for a certain FPM pool (in /etc/php/7.0/fpm/pool.d/www.conf) will not showing the method listed in the phpinfo ouput (disable_functions). So it means it's not disabled, but it is disabled (PHP Warning: php_uname() has been disabled for security reasons). 2. Having a function disabled in the main php.ini and adding to the same file a host override will correctly enable the function again but it's still showed as disabled in the phpinfo (but it isn't blocked!). Test script: --------------- My PHP test script: <?php phpinfo(); echo "php_uname: " . php_uname(); ?> --- NOTE: the difference between the 'disable_functions' option values is the php_uname function! Configs for issue 1 (php_uname() function IS blocked but NOT SHOWN as disabled in phpinfo): /etc/php/7.0/fpm/php.ini: ... [PHP] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,php_uname,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... /etc/php/7.0/fpm/pool.d/www.conf [www] user = www group = www listen = /run/php/php7.0-fpm.www.sock listen.owner = www-data listen.group = www-data pm = dynamic pm.max_children = 5 pm.start_servers = 2 pm.min_spare_servers = 1 pm.max_spare_servers = 3 ; Custom php.ini settings php_admin_value[max_execution_time] = 300 php_admin_value[disable_functions] = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, --- Configs for issue 2 (php_uname() function NOT blocked but SHOWN as disabled in phpinfo): /etc/php/7.0/fpm/php.ini: ... [HOST=mydomain] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... [PHP] disable_functions = apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd,eval,exec,fp,fput,ftp_connect,ftp_exec,ftp_get,ftp_login,ftp_nb_fput,ftp_put,ftp_raw,ftp_rawlist,highlight_file,ini_alter,ini_get_all,ini_restore,inject_code,mysql_pconnect,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,phpAds_XmlRpc,phpAds_remoteInfo,phpAds_xmlrpcDecode,phpAds_xmlrpcEncode,php_uname,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,syslog,system,xmlrpc_entity_decode, ... /etc/php/7.0/fpm/pool.d/www.conf [www] user = www group = www listen = /run/php/php7.0-fpm.www.sock listen.owner = www-data listen.group = www-data pm = dynamic pm.max_children = 5 pm.start_servers = 2 pm.min_spare_servers = 1 pm.max_spare_servers = 3 ; Custom php.ini settings php_admin_value[max_execution_time] = 300 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74605&edit=1