hello,
i'm testing with suhosin on our testing envoirment.
the patch is working, but i don't get suhosin.executor.func.blacklist working.
what i'm doing wrong?
tested on multiply servers with php 5.3.10, 5.2.16, 5.2.17
output of php -v:
PHP 5.2.17 with Suhosin-Patch 0.9.7 (cli) (built: Feb 20 2012 12:54:27)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2010 Zend Technologies
with the ionCube PHP Loader v4.0.10, Copyright (c) 2002-2011, by ionCube Ltd.
httpd.conf
# Auto generated apache config file by DirectAdmin version 1.40.3
# Modifying this file is not recommended as any changes you make will be
# overwritten when the user makes any changes to his/her website
# For global config changes that affect all Users, see this guide:
# http://help.directadmin.com/item.php?id=2
# For local config changes that only affect one User, see this guide:
# http://help.directadmin.com/item.php?id=3
# Frontpage requires these parameters in every httpd.conf file or else
# it won't work.
ServerRoot /etc/httpd
<VirtualHost *.*.*.*:80 >
ServerName www.testwebserver.com
ServerAlias www.testwebserver.com testwebserver.com
ServerAdmin webmaster@testwebserver.com
DocumentRoot /home/test/domains/testwebserver.com/public_html
ScriptAlias /cgi-bin/ /home/test/domains/testwebserver.com/public_html/cgi-bin/
UseCanonicalName OFF
#SuexecUserGroup test test
RMode config
RUidGid test test
RGroups apache
#RDocumentChRoot /home/test /home/test/domains/testwebserver.com/public_html
CustomLog /var/log/httpd/domains/testwebserver.com.bytes bytes
CustomLog /var/log/httpd/domains/testwebserver.com.log combined
ErrorLog /var/log/httpd/domains/testwebserver.com.error.log
<Directory /home/test/domains/testwebserver.com/public_html>
Options +Includes -Indexes
php_admin_value upload_tmp_dir "/home/test/tmp"
php_admin_value suhosin.executor.func.blacklist "system, shell_exec, exec, passthru, php_uname, popen, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid,posix_setgid, posix_uname, proc_close, proc_nice, proc_open, proc_terminate"
php_admin_value session.save_path "/home/test/tmp"
php_admin_value soap.wsdl_cache_dir "/home/test/tmp"
php_admin_value eaccelerator.cache_dir "/home/test/tmp/eaccelerator"
php_admin_flag engine ON
<IfModule !mod_php6.c>
php_admin_flag safe_mode OFF
</IfModule>
php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f test@testwebserver.com'
php_admin_value open_basedir /home/test/:/tmp:/var/tmp:/usr/local/lib/php/
</Directory>
<Location /phpMyAdmin>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /phpmyadmin>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /squirrelmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /roundcube>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /uebimiau>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /webmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /atmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
</VirtualHost>
<VirtualHost *.*.*.*:443 >
SSLEngine on
SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
ServerName www.testwebserver.com
ServerAlias www.testwebserver.com testwebserver.com
ServerAdmin webmaster@testwebserver.com
DocumentRoot /home/test/domains/testwebserver.com/private_html
ScriptAlias /cgi-bin/ /home/test/domains/testwebserver.com/public_html/cgi-bin/
UseCanonicalName OFF
#SuexecUserGroup test test
RMode config
#RDocumentChRoot /home/test /home/test/domains/testwebserver.com/private_html
RUidGid test test
RGroups apache
CustomLog /var/log/httpd/domains/testwebserver.com.bytes bytes
CustomLog /var/log/httpd/domains/testwebserver.com.log combined
ErrorLog /var/log/httpd/domains/testwebserver.com.error.log
<Directory /home/test/domains/testwebserver.com/private_html>
Options +Includes -Indexes
php_admin_value upload_tmp_dir "/home/test/tmp"
php_admin_value suhosin.executor.func.blacklist "system, shell_exec, exec, passthru, php_uname, popen, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid,posix_setgid, posix_uname, proc_close, proc_nice, proc_open, proc_terminate"
php_admin_value session.save_path "/home/test/tmp"
php_admin_value soap.wsdl_cache_dir "/home/test/tmp"
php_admin_value eaccelerator.cache_dir "/home/test/tmp/eaccelerator"
php_admin_flag engine ON
<IfModule !mod_php6.c>
php_admin_flag safe_mode OFF
</IfModule>
php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f test@testwebserver.com'
php_admin_value open_basedir /home/test/:/tmp:/var/tmp:/usr/local/lib/php/
</Directory>
<Location /phpMyAdmin>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /phpmyadmin>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /squirrelmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /roundcube>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /uebimiau>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /webmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
<Location /atmail>
RMode config
RUidGid webapps webapps
RGroups apache
</Location>
</VirtualHost>
when i'm running this script:
<?php
$output = shell_exec('ls -lart');
echo "<pre>$output</pre>";
?>
i get
total 12
drwx--x--x 9 test test 4096 Feb 16 00:12 ..
drwxr-xr-x 2 test test 4096 Feb 20 11:57 .
-rw-r--r-- 1 test test 80 Feb 20 12:03 index.php
tried it over and over and over, but no result. Also with the module it is not working...
thank you.