Security: php_suexec

Some time ago I mentioned that WebFarms (ISPs) like the one I run would be better able to install PHP3 if external commands executed through it ran setuid the owner of the PHP script. I wanted an suexec wrapper for the PHP system, exec, popen and passthru commands. Well, we've now put our money where my mouth was. Please find attached code for php3_suexec. Also included are a set of patches for php-3.0.5 to make use of this wrapper, and reasonably full documentation. The new mode is orthogonal to safe_mode, however if both modes are activated PHP_SAFE_MODE_EXEC_DIR is ignored in favour of GLOBAL_BIN and ~user/USERDIR_SUFFIX. In suexec_mode local php-bin directories for each user work, analgous to the cgi-bin directories our customers have come to expect. NB: I am forwarding this to PHP3-Dev in advance of testing the USERDIR_SUFFIX (which _should_ work). We're going to try that in the morning :-) In writing this code we have become more aware of the limitations of the original suexec code. We have attempted to mimic its security, not to beat it; we expect that ISPs running this code will also be running the original suexec for CGIs. As I make clear in the documentation, this code should not be activated by everyone. However in many circumstances I hope and believe it will increase the level of security and improve service. As it is deactivated by default, I hope that it will be possible to include this code in future distributions of PHP3. Naturally, if any bugs or other flaws are found _which don't also exist in suexec_, I would be grateful for any feedback. Not quite all of the Many thanks to Alaric Williams, for doing the actual coding. Regards, Malcolm Hutty. --------------------------------------------------------------------------- Internet Vision Internet Consultancy Tel: 0171 589 4500 60 Albert Court & Web development Fax: 0171 589 4522 Prince Consort Road E-mail: vision@ivision.co.uk London SW7 2BE Web: http://www.ivision.co.uk