note 56411 deleted from function.shell-exec by cmb

Note Submitter: ludvig dot ericson at gmail dot com ---- (if you have any other way of doing this PLEASE send me a mail) (The following note is interesting to *NIX administrators ONLY) Jailing a PHP CLI session is not the easiest thing to do. PHP has a gigantic list of dependencies, you can check it by ldd which php Each of these .so files (shared libraries) can have dependencies, and can depend on each other, making the list much bigger. However, there are tools out there to copy all dependencies into a jailed directory, you just have to search for them - and I had no luck. What I did was just to run these few commands: su mkdir /jailpath && mkdir /jailpath/lib cp /lib/*.so* /jailpath/lib/ mkdir /jailpath/usr && mkdir /jailpath/usr/bin && mkdir /jailpath/usr/lib cp /usr/lib/*.so* /jailpath/usr/lib cp which php /jailpath/usr/bin chmod -R 0755 /jailpath && chown -R root:root /jailpath && chmod 0000 /jailpath Do note that this copies _all_ of your shared objects. There is one or two more libraries you have top copy, but chroot will tell you about which one it is. Hope this helped somehow.