Is popen() a security risk?

Problems with the Linux version of XAMPP, questions, comments, and anything related.

Is popen() a security risk?

Postby PhaseMaster » 06. December 2011 05:03

I am using a technique that works with the Linux version of XAMPP, but not with my Linux web host. I am using PHP's popen() function to interact with command line programs written in C++. With XAMPP the script below prints a string, and with my web host it prints a 0.

Code: Select all
<?php
$read = popen('./test', 'r');
echo fread($read, 255);
?>


Would it be a security risk to for my web host to allow this technique on a shared server?
PhaseMaster
 
Posts: 5
Joined: 05. December 2011 20:56
Operating System: Ubuntu

Re: Is popen() a security risk?

Postby JonB » 06. December 2011 12:59

I am using PHP's popen() function to interact with command line programs written in C++.

Would it be a security risk to for my web host to allow this technique on a shared server?


Isn't that a self-answering question??? :shock:

http://www.cyberciti.biz/faq/linux-unix ... functions/

Good Luck
8)
User avatar
JonB
AF Moderator
 
Posts: 3210
Joined: 12. April 2010 16:41
Location: Land of the Blazing Sun
Operating System: Windows XP/7 - Fedora 15 1.7.7

Re: Is popen() a security risk?

Postby PhaseMaster » 07. December 2011 00:27

I didn't know much about this issue and JonB's link was very helpful. It led to a large number of other useful links. Thank you JonB.

Am I right in believing that SELinux could be used to eliminate any security problems that might exist with running a binary process with PHP's popen() function?
PhaseMaster
 
Posts: 5
Joined: 05. December 2011 20:56
Operating System: Ubuntu

Re: Is popen() a security risk?

Postby JonB » 07. December 2011 03:32

That is a complicated question -

In theory - the answer is broadly 'yes - that is part of what SE LInux is designed to abate'. SE Linux is like driving with handcuffs on, many turns you want to make will not be available, because you can't turn the wheel that sharply. Many third party applications/scripts just won't run without 'turning down' SE Linux ('permissive'/reporting only mode). In fact if you explore the /opt/lampp/lampp bash script that powers LAMPP, you will find an SE Linux hack for Fedora (which comes with SE Linux 'on'). I have several frameworks and tools that will not work with SE Linux because they have working directories where they 'shouldn't be' i.e. under the Document Root (which should not contain 'working data'). Yes, I "could" fix that -- too much work, for little benefit on my development platform, and I know I won't find SE Linux where the code I am building is going.

You won't find SE Linux except on 'owned'/dedicated or VPS servers or Desktops as it breaks too many things, and the average user/admin will never get the fix right. Its much like 'Group Policies' in a Windows environment (although the Windows model is broader, as Windows does not have as many native User Contols) - SE Linux is aimed at applications

http://selinuxproject.org/page/FAQ

http://www.crypt.gen.nz/selinux/disable_selinux.html

SE Linux is rarely fully implemented except in highly structured environments, as it is a huge investment in intellectual capital/time to execute properly. So governments, and large organizations are where you typically find SE Linux rollouts. These are also the only places you find many 'working environment' Linux desktops. Its 'a whole enchilada'. :lol:

Good Luck
8)
User avatar
JonB
AF Moderator
 
Posts: 3210
Joined: 12. April 2010 16:41
Location: Land of the Blazing Sun
Operating System: Windows XP/7 - Fedora 15 1.7.7


Return to XAMPP for Linux

Who is online

Users browsing this forum: No registered users and 3 guests