Rozdział 26. Filesystem Security

PHP is subject to the security built into most server systems with respect to permissions on a file and directory basis. This allows you to control which files in the filesystem may be read. Care should be taken with any files which are world readable to ensure that they are safe for reading by all users who have access to that filesystem.

Since PHP was designed to allow user level access to the filesystem, it's entirely possible to write a PHP script that will allow you to read system files such as /etc/passwd, modify your ethernet connections, send massive printer jobs out, etc. This has some obvious implications, in that you need to ensure that the files that you read from and write to are the appropriate ones.

Consider the following script, where a user indicates that they'd like to delete a file in their home directory. This assumes a situation where a PHP web interface is regularly used for file management, so the Apache user is allowed to delete files in the user home directories.

Przykład 26-1. Poor variable checking leads to....


<?php

// remove a file from the user's home directory

$username = $_POST['user_submitted_name'];

$homedir = "/home/$username";

$file_to_delete = "$userfile";

unlink ("$homedir/$userfile");

echo "$file_to_delete has been deleted!";

?>

Since the username is postable from a user form, they can submit a username and file belonging to someone else, and delete files. In this case, you'd want to use some other form of authentication. Consider what could happen if the variables submitted were "../etc/" and "passwd". The code would then effectively read:

Przykład 26-2. ... A filesystem attack


<?php

// removes a file from anywhere on the hard drive that

// the PHP user has access to. If PHP has root access:

$username = "../etc/";

$homedir = "/home/../etc/";

$file_to_delete = "passwd";

unlink ("/home/../etc/passwd");

echo "/home/../etc/passwd has been deleted!";

?>

There are two important measures you should take to prevent these issues.

Only allow limited permissions to the PHP web user binary.
Check all variables which are submitted.

Here is an improved script:

Przykład 26-3. More secure file name checking


<?php

// removes a file from the hard drive that

// the PHP user has access to.

$username = $_SERVER['REMOTE_USER']; // using an authentication mechanisim



$homedir = "/home/$username";



$file_to_delete = basename("$userfile"); // strip paths

unlink ($homedir/$file_to_delete);



$fp = fopen("/home/logging/filedelete.log","+a"); //log the deletion

$logstring = "$username $homedir $file_to_delete";

fwrite ($fp, $logstring);

fclose($fp);



echo "$file_to_delete has been deleted!";

?>

However, even this is not without it's flaws. If your authentication system allowed users to create their own user logins, and a user chose the login "../etc/", the system is once again exposed. For this reason, you may prefer to write a more customized check:

Przykład 26-4. More secure file name checking


<?php

$username = $_SERVER['REMOTE_USER']; // using an authentication mechanisim

$homedir = "/home/$username";



if (!ereg('^[^./][^/]*$', $userfile))

     die('bad filename'); //die, do not process



if (!ereg('^[^./][^/]*$', $username))

     die('bad username'); //die, do not process

//etc...

?>

Depending on your operating system, there are a wide variety of files which you should be concerned about, including device entries (/dev/ or COM1), configuration files (/etc/ files and the .ini files), well known file storage areas (/home/, My Documents), etc. For this reason, it's usually easier to create a policy where you forbid everything except for what you explicitly allow.

User Contributed Notes


(A) Better not to create files or folders with user-supplied names. If you do not validate enough, you can have trouble. Instead create files and folders with randomly generated names like fg3754jk3h and store the username and this file or folder name in a table named, say, user_objects. This will ensure that whatever the user may type, the command going to the shell will contain values from a specific set only and no mischief can be done.



(B) The same applies to commands executed based on an operation that the user chooses. Better not to allow any part of the user's input to go to the command that you will execute. Instead, keep a fixed set of commands and based on what the user has input, and run those only. 



For example,

(A) Keep a table named, say, user_objects with values like:

username|chosen_name   |actual_name|file_or_dir

--------|--------------|-----------|-----------

jdoe    |trekphotos    |m5fg767h67 |D

jdoe    |notes.txt     |nm4b6jh756 |F

tim1997 |_imp_ folder  |45jkh64j56 |D



and always use the actual_name in the filesystem operations rather than the user supplied names.



(B)

<?php

$op = $_POST['op'];//after a lot of validations 

$dir = $_POST['dirname'];//after a lot of validations or maybe you can use technique (A)

switch($op){

    case "cd":

        chdir($dir);

        break;

    case "rd":

        rmdir($dir);

        break;

    .....

    default:

        mail("webmaster@example.com", "Mischief", $_SERVER['REMOTE_ADDR']." is probably attempting an attack.");

}


I don't think the filename validation solution from Jones at partykel is complete.  It certainly helps, but it doesn't address the case where the user is able to create a symlink pointing from his home directory to the root.  He might then ask to unlink "foo/etc/passwd" which would be in his home directory, except that foo is a symlink pointing to /.



Personally I wouldn't feel confident that any solution to this problem would keep my system secure.  Running PHP as root (or some equivalent which can unlink files in all users' home directories) is asking for trouble.



If you have a multi-user system and you are afraid that users may install scripts like this, try security-enhanced Linux.  It won't give total protection, but it at least makes sure that an insecure user script can only affect files which the web server is meant to have access to.  Whatever script someone installs, outsiders are not going to be able to read your password file---or remove it.