#23277 [NEW]: Apache safe_mode and open_basedir not enough

From: flatface at flatface dot net Operating system: *nix PHP version: 4.3.0 PHP Bug Type: Program Execution Bug description: Apache safe_mode and open_basedir not enough I'm sorry for addressing it here, but I can't find anywhere else to put it. I sysadmin a system with 1200 users, and I can't seem to find the appropriate security to apply with php. suexec is fine with this shared resoruce server, but with open_basedir, the most I can do is disallow viewing of files below the script's location. With safe_mode on, it goes overboard and disables a LOT of important functions that people use (e.g. shell_exec), and even when people create files, it's still chowned by apache and not the user. If mod_php could act a bit more like suexec and run as the user in mod_php. This is on php 4.3.0 on Gentoo Linux. -- Edit bug report at http://bugs.php.net/?id=23277&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23277&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23277&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23277&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23277&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23277&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23277&r=support Expected behavior: http://bugs.php.net/fix.php?id=23277&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23277&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23277&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23277&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23277&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23277&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23277&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23277&r=gnused