PHP safe mode broken?

[Michal Krause]

Hi,

I think there is a bug in PHP safe mode handling from version 4.3.0 till
now.

Problem description:

There is a function php_check_safe_mode_include_dir() (fopen_wrappers.c)
which checks, if file is in safe_mode_include_dir. When no
safe_mode_include_dir is specified in the configuration, this function
returns 0 which means success. Older versions (4.2.3) returned -1
(failure) in such case.

There is other function in streams.c - _php_stream_fopen_with_path()
which makes two tests in some cases (on line 1856 in version 4.3.2): it
checks results of functions php_check_safe_mode_include_dir() and
php_checkuid().

And there is a problem: there is OR condition between theese two tests.
When there is no value in the safe_mode_include_dir directive,
php_check_safe_mode_include_dir() returns always 0 (true) and due to OR
condition result of php_checkuid() is irrelevant. This means that
include() and require() functions in PHP scripts always succeed
- regardless of file permissions.

I think, there was made one of the following mistakes:

a) php_check_safe_mode_include_dir() should return -1 (false) when there
is no value in the safe_mode_include_dir directive as older versions

or

b) someone wanted to switch behaviour of theese test to the state where
both tests must pass ("file must be in safe_mode_include_dir and must
have appropriate owner/group"). In this case
php_check_safe_mode_include_dir() really should return 0 (true) when
there is no value in the safe_mode_include_dir directive, but there must
be AND condition instead of OR in the _php_stream_fopen_with_path()
function.

This behaviour could make older working setups insecure after upgrading
to PHP 4.3.x.

I tried to report this bug to PHP developers twice in last weeks, but
I didn't receive any answer.

Best regards
Michal Krause

[Michal Krause]

On 16/07/2003, Michal Krause wrote:

> Hi,
>
> I think there is a bug in PHP safe mode handling from version 4.3.0
> till now.

I forgot to provide straight information how to fix this bug until there
will be an official patch. I hope it was clear from my previous email,
but if not, there is one of possible solutions:

find function php_check_safe_mode_include_dir in file
main/fopen_wrappers.c and change its last statement from

return 0;

to

return -1;

(you can find it at line 253 in PHP version 4.3.2).

Then recompile PHP, install it and restart web server.


To test it, create simple PHP script owned by some regular user, which
will try to include /etc/passwd for example.

<?
echo("trying to read /etc/passwd");
include("/etc/passwd");
?>

This script should fail on safe mode error (when safe mode is enabled,
of course).

Best regards
Michal Krause