Re: PHP6, drop open_basedir?

On 17/06/14 09:26, Pierre Joye wrote: > One of the last reminding so called "security" feature is open_basedir. > > On Windows f.e. it is very easy to create application pool with the > right users/permissions settings (IIS) or only permissions settings > (Apache). It is not possible to create one user per host on Apache > using mod_php but I think it is acceptable as it is mostly used as > development server or dedicated apps. > > On linux, fcgi/fpm with linux permissions systems allow pretty much > the same. And my solutions exist for a per user/application isolation > system. > > I think it is not worth the effort to keep maintaining something that > will never be as safe as system level permissions. > > What do you think about removing it in php 6? Thoughts? Managing security on servers that one has full access to is not the main target of open_basedir? It has a useful place when working with shared hosting? While on-line storage costs are going down, sharing code across a few sites while maintaining maintaining a level of isolation between specific content is not easy to achieve in other ways? The usage I'm seeing is that open_basedir provides access to the site files and a shared set of resources used across several sites. This is probably not the best way of doing things but is one documented on several hosting packages. The examples I could link to require a private login :( Just a pointer to something that provides an alternative resolution would obviously be acceptable. With many of these facilities it's not simply removing something but much more important to provide education on the alternatives? -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk Rainbow Digital Media - http://rainbowdigitalmedia.co.uk