Enhancement of OPcache security

[brnquester]

For security reasons, it would be nice to have the two OPcache parameters below included to the templates/opcache.ini.j2:

opcache.validate_permission=(bool)

• Validates the cached file permissions against the current user. It should be enabled on shared hosting environments.

opcache.validate_root=(bool)

• Prevents name collisions in chroot'ed environments. This should be enabled in all chroot'ed environments to prevent access to files outside the chroot.

I understand it can be added in many ways via Ansible, but it would be important to have it as default.

References:

• https://ma.ttias.be/mitigating-phps-long-standing-issue-opcache-leaking-sensitive-data/
• https://www.php.net/manual/en/opcache.configuration.php#ini.opcache.validate-permission
• https://www.cvedetails.com/cve/CVE-2015-8994/

[stale[bot]]

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark issues as stale.

[stale[bot]]

This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.