php-fpm, chroot & apc/opcache key collision
| From: | etienne dot champetier at free dot fr | Date: | Thu, 27 Feb 2014 13:11:06 +0000 |
| Subject: | php-fpm, chroot & apc/opcache key collision | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-323001@lists.php.net to get a copy of this message | ||
Hi,
I'm running multiple php site, with nginx 1.4 + php-fpm 5.3 (on centos 6.5, i'm also
considering php 5.5),
and i'm looking into ways to secure my setup and the best way seems to use chroot.
I'm using apc and i will use opcache, and they both use the full path as key in the cache,
and with chroot you might and up with collision.
The problem is that by default opcache.revalidate_freq is at 2sec,
so you can 'attack' a secure chroot from a compromised one (i've tested it and it
work perfectly).
(same can happen with apc.stat=0)
So how to use php-fpm, chroot and apc/opcache?
Thanks in advance
Etienne