Topic: PHP script file upload using SME7 and question about selinux

[arne]

The SME 6.0.1 and a number of e-smith/sme revisions before that use a php chroot environment (for security reasons) that restrict the functionality of the php scripts.

If you try to program or install a php script that should make a file upload from the client, you will dicover that this will not work. Reason: Linux will by default first try to upload the file to the directory /temp and from there to transfer it to the proper location of the php script from there. Because PHP is running in a security chroot, php will not have access to /temp and there will be no file upload.

One way of handling this situation (on sme 6.0.1 and earlier) is to remove the php chroot entirely. This will reduce security, but on the other hand, most Linux distros do not have this PHP chroot.

Does any of you know if this PHP chroot still exist on the SME 7B5 and if it eventually can be turned off using the same procedure as for the SME 6.0.1 ? (I have not tried yet, with the 7.0 B5)

What about "selinux" this is some aditional "chroot alike" security functions of the RedHat ES 4 and Centos 4.x Doing some experimenting on "selinux" on Centos 4.0 my conclusion (as far as I eventually understood things right) were that selinux actually tends to make a lot more problems than it solves. I guess that the selinux "functions" of Centos 4.1 is disabled on SME 7.0 B5. Is this right ?

My guess is that the php chroot is still there, and that it can be ulocked like before, and that there is no selinux. Right ... ??

Best reg Arne.

[CharlieBrady]

The SME 6.0.1 and a number of e-smith/sme revisions before that use a php chroot environment (for security reasons) that restrict the functionality of the php scripts.

It's not really a chroot, it's just a restriction on which files can be opened (openbasedir).

Does any of you know if this PHP chroot still exist on the SME 7B5 and if it eventually can be turned off using the same procedure as for the SME 6.0.1 ? (I have not tried yet, with the 7.0 B5)

Why don't you try it? Then you'll know, and can let everyone else know

 I guess that the selinux "functions" of Centos 4.1 is disabled on SME 7.0 B5. Is this right ?

Correct - see /etc/sysconfig/selinux.

[arne]

Hello mr CharlieBrady !

Thanks for the info. I think I will try to test out the php restriction "problem".

It's just a good thing to try to find out as much as possible before testing ..

By the way .. I think that some of the people that claim that they have to upgrade to e newer PHP version actually is dealing with this security function. (When they experince that their downloaded php application dont work as expected.)

Phproject as an exapmle is a good one for testing. (Will the document upload work or will it not ..)

(But I think the security function is a good thing as long as one knows that it is there and how to open it.)

Best reg Arne.