custom suhosin settings

[redjersey]

I'm using php 5.6 (mod_php) with suhosin

I would like to use suhosin.executor.func.blacklist to disable certain php functions and only allow those functions for certain domains.

so I have created: suhosin.ini in /usr/local/directadmin/custombuild/custom/suhosin/
and set:
suhosin.executor.func.blacklist = "exec, passthru... ...."

when I rebuild php using custombuild, it works, those functions are blocked.

now I would like to allow those functions for certain domains, so based on help: https://help.directadmin.com/item.php?id=622 I have created:

/usr/local/lib/php.conf.d/30-mydomain.com.ini
and add
[HOST=mydomain.com]
suhosin.executor.func.blacklist = ""

and it's not working, for instance I can't use exec() on mydomain.com

any one knows how to fix it?

 

[zEitEr]

What error do you get?
What value do you have for disable_functions in php.ini?

 

[redjersey]

no error.

i don't use disable_functions in php.ini so right now it's
disable_functions =

 

[zEitEr]

add in php script:

error_reporting(E_ALL);
ini_set('display_errors', 1);

and show what error you have when you try to execute PHP exec().

 

[redjersey]

Warning: exec() has been disabled for security reasons in /home/admin/domains/mydomain.com/public_html/test.php on line 4

 

[redjersey]

I have "sort of" fixed the problem.

instead of creating 30-mydomain.com.ini

I have added:

<IfModule mod_php5.c>
php_value suhosin.executor.func.blacklist passthru
</IfModule>

(php_value suhosin.executor.func.blacklist cannot be empty so i'll just put a function that i never use)

in directadmin Httpd.conf Customization (custom 3 box)

and it's working now, but I still wonder why 30-mydomain.com.ini is not working??

 

[zEitEr]

Is 30-mydomain.com.ini shown in

phpinfo();

With PHP-FPM 5.6 the following worked for me:

; disabled globally for all hosts
suhosin.executor.func.blacklist=exec


; enabled for one domain
[HOST=example.com]
suhosin.executor.func.blacklist=
memory_limit=256M

in /usr/local/php56/lib/php.conf.d/99-custom.ini

 

[redjersey]

yes, 30-mydomain.com.ini is showing in phpinfo, along with the 10-directadmin and 50-webapp ini

 

[zEitEr]

I don't have a server with mod_php for testing, so I don't have anything to add. Probably later or somebody else can help you with it.

 

[redjersey]

ok, thanks
not only suhosin not working on 30-mydomain.com.ini but also other settings like memory_limit=256M not wokring ie. the memory limit is still set as default (128m)