Re: ENFORCE_SAFE_MODE

I am late to respond, but then better late than never. Zeev Suraski wrote: > In my opinion, safe mode is by definition not reliable. The security > issues it tries to address should, and in my opinion, can only be in the > operating system level. You are basically right, but there is another issue here, but partly plays into this area. This is the issue of threads which in Unix generally tend to suck. There is a number of properties in Unix processes, which are being kept only at process level, not at thread level. These are things like the current UID, the current directory and some other things (like a current root, for example). Some variants such as Linux try to address these issues by providing modified system calls such as clone(2) as an alternative to fork(2) so that you can specify which properties of a thread should be kept at thread or at process level, but these have not been generally accepted in the Unix community and there is no standardized interface to them in for example pthreads(), as far as I know. This in part relates to safe_mode, because safe_mode and a thread wrapper both do similar things here: safe_mode tries to simulate OS security mechanisms at user level in order to get a reuseable process and avoid forking new cgi interpreters each time. Threaded programs do the same (get a reuseable process), but with concurrent threads instead of serialized threads. That is, you can think of safe_mode as vfork()ed threads in some way... If the operating system were able to provide the security context in a way we require, we would be using CGI php and have no need for safe_mode, because we would have no need for mod_php. For example, the operating system could provide security context such as chroot() based on the shlib it is currently executing so that mod_php would be chroot()ed and restricted, but the Apache core wasn't. But there is no such mechanism present, and neither there is such a mechanism for threads (except clone(2)). So we are really going to need a more or less complete safe_mode. Kristian -- Kristian Köhntopp, NetUSE AG Siemenswall, D-24107 Kiel Tel: +49 431 386 436 00, Fax: +49 431 386 435 99 Using PHP3? See our web development library at http://phplib.netuse.de/