Daniel Berteaud
2017-07-05 08:17:03 UTC
Hi.
FYI, I've started working on https://bugs.contribs.org/show_bug.cgi?id=10335
I have several goals, which I hope to reach one step at a time. I'll
take a lot of inspiration from the smeserver-php-scl contrib from
Stéphane, as from a user POV, it's quite similar, but there will in fact
be a lot of differences under the hood.
The main differences with smeserver-php-scl:
* Use FPM instead of CGI, which should gives much higher performances.
This will also open the door to a better security model where each
ibay can have its own PHP pool, executed under a dedicated user
account. It'll also be possible to create additional pools for
contribs if you need particular PHP settings
* Reduce code duplication. Most, if not all the templates for the
different PHP versions can be the same, the small differences can be
managed with some variables passed in MORE_DATA (in a
templates.metadata file)
* I don't intend to support php54 and php55 (unless someone convince
me otherwise)
* Make it super easy to add support for future PHP major versions
(just a template metadata and some defaults in the DB)
* I don't intend to support switching the version of mod_php. In fact,
one of my goal is to ditch mod_php entirely, and only use FPM. Once
this step is achieved, we'll be able to switch to httpd to MPM
worker, which should give better performances too
Here's what I want to achieve (more or less in order of priority)
* Create one default FPM pool per major, supported PHP versions. One
for the default PHP (5.3 on SME9, 5.4 on SME10), php56, php70 and php71
* Provides stricter defaults settings, like disable dangerous
functions (system, show_source, symlink, exec, dl, shell_exec,
passthru, phpinfo, escapeshellarg, escapeshellcmd)
* Add support for mod_proxy_fcgi in Apache
* Switch some contribs to use this instead of mod_php
* Add support for defining custom FPM pools in a DB
* Switch Shared Folders contrib to use it (before ibays, Shared
Folders will be a good playground)
* Create automatically one FPM pool for each ibay which has dynamic
content enabled, running under the ibay account
* Audit if we need any permission changes applied on ibay to have
execution done by the ibay account instead of www (not that www will
still need read access to every ibay because httpd itself still
needs to access files, but we could restrict this to a read only
access, with the ibay account having write access. This can provide
a much better isolation between applications because it'll be harder
to compromise the www account, and if an app is compromised, it will
be harder to gain more info, or compromise other apps on the same
server)
* Switch horde to use an FPM pool
* Convert all the contribs we can to use an FPM pool
* Remove support for mod_php
* Switch to MPM worker
* Be happy with a much better PHP support :-)
I have just started this, and am at the very beginning of the project. I
can't give any ETA.
++
--
Logo FWS
*Daniel Berteaud*
FIREWALL-SERVICES SAS.
Société de Services en Logiciels Libres
Tel : 05 56 64 15 32 <tel:0556641532>
Visio : http://vroom.fws.fr/dani
/www.firewall-services.com/
FYI, I've started working on https://bugs.contribs.org/show_bug.cgi?id=10335
I have several goals, which I hope to reach one step at a time. I'll
take a lot of inspiration from the smeserver-php-scl contrib from
Stéphane, as from a user POV, it's quite similar, but there will in fact
be a lot of differences under the hood.
The main differences with smeserver-php-scl:
* Use FPM instead of CGI, which should gives much higher performances.
This will also open the door to a better security model where each
ibay can have its own PHP pool, executed under a dedicated user
account. It'll also be possible to create additional pools for
contribs if you need particular PHP settings
* Reduce code duplication. Most, if not all the templates for the
different PHP versions can be the same, the small differences can be
managed with some variables passed in MORE_DATA (in a
templates.metadata file)
* I don't intend to support php54 and php55 (unless someone convince
me otherwise)
* Make it super easy to add support for future PHP major versions
(just a template metadata and some defaults in the DB)
* I don't intend to support switching the version of mod_php. In fact,
one of my goal is to ditch mod_php entirely, and only use FPM. Once
this step is achieved, we'll be able to switch to httpd to MPM
worker, which should give better performances too
Here's what I want to achieve (more or less in order of priority)
* Create one default FPM pool per major, supported PHP versions. One
for the default PHP (5.3 on SME9, 5.4 on SME10), php56, php70 and php71
* Provides stricter defaults settings, like disable dangerous
functions (system, show_source, symlink, exec, dl, shell_exec,
passthru, phpinfo, escapeshellarg, escapeshellcmd)
* Add support for mod_proxy_fcgi in Apache
* Switch some contribs to use this instead of mod_php
* Add support for defining custom FPM pools in a DB
* Switch Shared Folders contrib to use it (before ibays, Shared
Folders will be a good playground)
* Create automatically one FPM pool for each ibay which has dynamic
content enabled, running under the ibay account
* Audit if we need any permission changes applied on ibay to have
execution done by the ibay account instead of www (not that www will
still need read access to every ibay because httpd itself still
needs to access files, but we could restrict this to a read only
access, with the ibay account having write access. This can provide
a much better isolation between applications because it'll be harder
to compromise the www account, and if an app is compromised, it will
be harder to gain more info, or compromise other apps on the same
server)
* Switch horde to use an FPM pool
* Convert all the contribs we can to use an FPM pool
* Remove support for mod_php
* Switch to MPM worker
* Be happy with a much better PHP support :-)
I have just started this, and am at the very beginning of the project. I
can't give any ETA.
++
--
Logo FWS
*Daniel Berteaud*
FIREWALL-SERVICES SAS.
Société de Services en Logiciels Libres
Tel : 05 56 64 15 32 <tel:0556641532>
Visio : http://vroom.fws.fr/dani
/www.firewall-services.com/