Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Actually I discovered that I can access the root via exec in php something like

<?php
   echo exec('cat /etc/passwd');
?>

will print the content of the passwd file, note that with cd command I can easly navigate where ever I want, so how can I correct this ? Defining a kind of virtual root for example limited to the actuel directory

Thanks !

share|improve this question

1 Answer 1

The file cat /etc/passwd is read-only by default to all users. The file doesn't contain critical information. It's normal behaviour for a user (be it www-data/apache or anyone else) to be able to browse the filesystem. However some files are restricted for all users except the super user (root). If any process under Apache can access for example /etc/shadow you have a serious permission problem, as the file contains the encrypted passwords of all users.

Now if you don't want PHP to be able to access the filesystem there are number of ways to counteract this behaviour. Also note that this behaviour is not a security risk by itself, as the file permissions control who and what can modify or view files/directories.

  1. Before PHP 5.4.0 there was something called safe-mode that could be used to limit the users access. (it had a number of issues and therefore later removed).
  2. You can disallow all the shell commands (system, exec, passthru).
  3. Use open_basedir
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.