Security, suexec and safe_mode

We're currently working on an suexec wrapper for binaries executed with the PHP commands system, exec, passthru and popen. We hope this will make it safer to provide PHP to multiple customers each with virtual servers at an ISP. My comments are therefore focused purely on those sort of installations, and therefore when used should only be the ISP-mode. When the phpsuexec code is finished I'll send patches to you. One item came up that I would like to raise here: currently, in safe_mode, files to be included, opened etc must be the same as PHP UID. There is, however, no restriction on PHP UID. Apache provides a pair of directives, User and Group, used by suexec when it appears in a Virtual Host. Wouldn't improve security in safe_mode if it required all PHP scripts to be owned by whatever these directives are set to? Of course, this would _reduce_ security if User was set to the same thing for all accounts (requiring all PHP scripts to be owned by the same user), but that's why it is an option, switched off by default. What do you think? We're thinking about including something similar in our php_suexec patches, and thought it might have more general application. I'd be interested in any warnings about why not to require the user to match. Malcolm. -------------------------------------------------------------------------- Internet Vision Internet Consultancy Tel: 0171 589 4500 60 Albert Court & Web development Fax: 0171 589 4522 Prince Consort Road E-mail: vision@ivision.co.uk London SW7 2BE Web: http://www.ivision.co.uk -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net