jvoisin / snuffleupagus

Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!
https://snuffleupagus.readthedocs.io
GNU Lesser General Public License v3.0
771 stars 90 forks source link

Add instructions for OpenBSD #498

Closed lakdif closed 1 month ago

lakdif commented 2 months ago

I managed to get snuffleupagus 0.10 (latest git pull) working on OpenBSD 7.5 with the PHP 8.3.9 official package. Everything works great, and it works with the php-pledge module as well, although I didn't test it together.

The instructions are: doas pkg_add git php autoconf gmake

Here you will be propmted to choose your software versions, we will use autoconf 2.71, and latest PHP 8.3.9 at the time of writing. (Option 17 to choose autoconf 2.71, and option 3 to choose PHP 8.3.9). I do believe that this mini-guide is future-proof, just choose the latest software versions.

cd /tmp git clone https://github.com/jvoisin/snuffleupagus cd /tmp/snuffleupagus-master/src AUTOCONF_VERSION=2.71 phpize-8.3 gmake

(You might wonder why we use gmake and not make. Because of the syntax snuffleupagus is using, if we use make, we will get a "Using $< in a non-suffix rule context is a GNUmake idiom (Makefile:213)" error. So I just used gmake.)

After this is done, you should see this:

Libraries have been installed in: /tmp/snuffleupagus-master/src/modules

If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following:

See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages.

Build complete. Don't forget to run 'make test'.

This means the compilation went fine. The next step is: doas make install

Installing shared extensions: /usr/local/lib/php-8.3/modules/

That's all.

In order to use the module, create 2 files in /etc/php-8.3, first is snuffleupagus.ini with the following lines:

extension=snuffleupagus.so sp.configuration_file=/etc/php-8.3/snuffleupagus.rules

This tells PHP to load the new snuffleupagus.so module we compiled and installed earlier.

The second one will be the file with your rules, /etc/php-8.3/snuffleupagus.rules, Some useful examples of the rules can be found on the wiki.

Reload PHP: rcctl restart php83_fpm

And you are all set. Check that snuffleupagus is available with phpinfo, it should output a value there.

//TODO: Test and document the work of snuffleupagus together with the php-pledge extension.

Screenshot 2024-07-19 at 03 31 44
lakdif commented 2 months ago

I might submit and maintain an OpenBSD port with it, but since the instructions are easy and clear, I don't really see a need for it, since it's a module you should only upgrade with a major PHP version.

jvoisin commented 1 month ago

Feel free to send a pull-request adding an OpenBSD section to doc/source/installation.rst :)