php-fpm Hardening

• Features
• Config
• Usage

Features

• Make .php file not in path defineded in funny_php.conf be invisible to php-fpm by LD_PRELOAD trick.
• Compare with original php-fpm:

	php-fpm	php-fpm hardening (OSS Edition)	php-fpm hardening (Enterpise Edition)
PATH_NOT_TRUSTED/ANY.php	Happy executing...	No such file!	No such file!
Bind with Cloud SQL Proxy Hardening (Enterpise Edition)	No	No	Yes

Contact [email protected] for more infomation.

Config

The funny_php.conf should be consist with two sections, and each path should be seperated by newline.

• enable:
  This section declares the paths where trusted .php files would be placed.
• disable:
  This section declares paths where .php files will not be visible to php-fpm.

Path found in both section would be treat as untrusted.

[enable]
/var/www/html
/var/www/project

[disable]
/var/www/html/uploads

Usage

1. Define trusted path and excluded path in funny_php.conf.
2. Move funny_php.conf to /.
   • funny_php.conf MUST be place at / or php-fpm would exit with error.
3. Execute php-fpm like this: LD_PRELOAD=funny.so php-fpm

That's all!