PHP Security-Safe Mode

Safe Mode

The purpose of the PHP safe_mode option is to resolve some of the issues described in this chapter. However, it is architecturally incorrect to address such issues at the PHP level, as described in the PHP Manual (http://www.php.cn/).

When Safe mode is in effect, PHP checks the owner of the file that is being read (or manipulated) by the executing script to ensure that it is the same as the owner of the script. While this can really protect against many of the examples in this chapter, it does not affect programs written in other languages. For example, a CGI script written using bash:

#!/bin/bash   echo "Content-type:text/plain"  echo "  cat/home/victim/inc/db.inc

Does the Bash parser care about or even check the configuration string for the open security mode in the PHP configuration file? Of course not. Similarly, other languages supported by the server, such as Perl,python, do not care about this. All the examples in this chapter can be easily adapted to other programming languages.

Another typical problem is that Safe mode does not deny access to files that belong to the Web server. This is because a script can be used to build another script, and the new script belongs to the Web server, so it can access all the files that belong to the Web server:

<?php   $filename = ' file.php ';  $script = ' <?php   header (\ ' content-type:text/plain\ ');  ReadFile ($_get[\ ' file\ ');   ? > ';   File_put_contents ($filename, $script);   ? >

The script above establishes the following file:

<?php   Header (' Content-type:text/plain ');  ReadFile ($_get[' file ');   ? >

Since the file was created by a Web server, its owner is a Web server (Apache typically runs with nobody users):

$ ls file.php  -rw-r--r--  1 Nobody nobody 12:34file.php

Therefore, this script bypasses the security measures provided by many safe modes. Even if safe mode is turned on, attackers can display information such as session information that is stored in the/tmp directory because the files belong to the Web server (nobody).

PHP's security model does play a role, and can be thought of as a defense-in-depth mechanism. However, it provides only poor protection, and in this chapter there are no other security measures to replace it.

The above is the PHP security-Safe Mode content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

