Securing Apache server against slightly untrusted PHP code?

Question

I have an unusual situation where I need multiple users to be able to upload and execute PHP code on my Apache server, but I cannot allow one user to access another user's PHP source (if concrete examples make you feel better, imagine I'm hosting a PHP programming competition).

Here's what I have so far in the PHP.ini:

disable_functions = readfile, fpassthru, file, file_get_contents, 
 system, fopen, symlink, rename, copy, exec, passthru, pcntl_exec, 
 backtick_operator, shell_exec, popen, proc_open

What other functions would I need to add to this list, to prevent PHP code from accessing local files (and hence other PHP source?)?

Answer 1

Please also take a look at http://www.suphp.org/ which executes PHP scripts with user permissions, instead of the user the webserver is running as. If you make sure the webserver can read the directory (but not necessarily the PHP file itself), then it will be able to execute these files with user permissions. Other users should not be able to read or access them in this case. This should be a more graceful and secure way of handling this.

Answer 2

Sounds like you need to enable PHP's Safe Mode, this will disable all of relevent functions.

(Note this has been depreacited in 5.3 & removed in PHP6)

Answer 3

Rather than trying to handle this within PHP, I'd step up a layer or two, and use Apache + unix accounts to segregate things - for instance, using suexec to keep the user's processes separate.