Re: Securing PHP or finding PHP alternatives

[Crispin Cowan <crispin () novell com>]

Sheryl Coppenger wrote:
> Crispin Cowan wrote:
>   
> > Wrap it in AppArmor http://en.opensuse.org/AppArmor for when you screw
> > up ^W^W don't do all the above perfectly.
> >     
> But that's only available if you're using Suse, right?
No. AppArmor ships with SUSE Linux, but ports are available for
Slackware, Ubuntu, and Pardus Linux. I have heard of several ports to
Red Hat, but so far no one has chosen to release it. It is open source,
and you can port it to any Linux you like, as long as it has a 2.6 kernel.

>   What about
> hardened PHP, modsecurity,
Those are good things too.

>  putting Apache in a chroot jail,
That only jails all of Apache at once into a single large cell. AppArmor
can confine each individual PHP page separately. And each PHP pages'
confinement can overlap with others, allowing the components of the web
site to work together.

Crispin

-- 
Crispin Cowan, Ph.D.                      http://crispincowan.com/~crispin/
Director of Software Engineering, Novell  http://novell.com
     Hack: adroit engineering solution to an unaticipated problem
     Hacker: one who is adroit at pounding round pegs into square holes