Ubuntu
php5 package

Not possible to run PHP in a multiuser and secure way

Bug #312493 reported by Yann Hamon
8
Affects Status Importance Assigned to Milestone
php5 (Ubuntu)
Fix Released
Wishlist
Unassigned

Bug Description

As I started to describe here: https://wiki.ubuntu.com/ServerTeam/WebArchitecture

There is no way (as I am aware of) to run two websites (website A and website B) where website B wouldn't be put at risk if website A is hacked, and where you could setup permissions where users with system access could change website A but not website B and vice versa.

There used to be php's safe mode, which is just an ugly way to circumvent the problem, and that seems to have been removed in PHP6.

Revision history for this message
Chuck Short (zulcss) wrote :

Thanks for the bug report.

Changed in php5:
importance: Undecided → Wishlist
Revision history for this message
Chuck Short (zulcss) wrote :

Patches accepted ;)

Changed in php5 (Ubuntu):
status: New → Triaged
Revision history for this message
Ondřej Surý (ondrej) wrote :

There is a way:

a) run php5 as fcgi for each user
b) use apache2-mpm-itk

You didn't google enough :)

Revision history for this message
Yann Hamon (yannh) wrote :

Hello Ondfej, please read the page I linked :)

Revision history for this message
Randy Syring (rsyring) wrote :

Might the inclusion of php-fvm in 5.3.3 be a solution to this?

http://www.php.net/archive/2010.php#id2010-07-22-2

It allows running the fastcgi processes as different users.

Revision history for this message
Jakob Unterwurzacher (jakobunt) wrote :

The proposal is to get the packages apache2-suexec and libapache2-mod-fcgid from universe into main? This combo works really well.

Revision history for this message
Randy Syring (rsyring) wrote :

It seems to me that php fpm is going to be the better option for running PHP under normal user accounts now that it is built into PHP 5.3 and has patches for 5.2.x.

Revision history for this message
Ondřej Surý (ondrej) wrote :

I think this bug can be closed. apache2-mod-itk, cgi, fastcgi and now FPM SAPI is a way how to solve this problem.

Revision history for this message
Ondřej Surý (ondrej) wrote :

php5-fpm (and others listed in my previous comment) pretty much solves this bug.

Changed in php5 (Ubuntu):
status: Triaged → Fix Committed
Revision history for this message
Robie Basak (racb) wrote :

Closing this bug under Ondřej's direction. If his suggestion is not sufficient, please explain.

Changed in php5 (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.