Re: [PHP3] does PAM lib PHP3 interface exist ?

On Fri, 14 Jan 2000, Chad Cunningham wrote: > > *I* care about flexibility. :) I want both flexibility and security, and I > > mean to get it! :) If your current system works, and you're happy with it, > > then more power to you, but that's no reason to say that PHP *shouldn't* be > > allowed to run as root. > Until someone proves that there is a way to do it without exploiting it, > I think there's a damn good reason. This is one of those things where I > tend to think it's best to wait for a proof that it can be done safely > rather than trying it and waiting for someone to prove it wasn't safe... suidperl seems like a rather good example to me of a way to do it without being exploitable. As for *proving* that it's not exploitable, well--the only *proof* that a program can't be exploited is a rigorous audit of a sort one rarely finds, even with most suid programs that ship with an OS. -Steve Langasek postmodern programmer