Is there any way I can bypass symlinks from php open_basedir?

Question

I have configured open_basedir in Apache virtual host in Linux which is working fine.

<Directory /var/www/abc/public_html>
     php_admin_value open_basedir "/var/www/abc/public_html"
</Directory>

I am required to allow a single symlink which is located outside the specified basedir (/var/www/abc/public_html/files --> ../files).

Is there anyway to do that?

The whole point if that configuration option is to securely prevent any access outside that folder. — arkascha, Sep 25 '16 at 09:23
Yes. But I am searching for an exception for a single symlink. Somehow I add the path somewhere to allow the specific link. — Saqib Iqbal, Sep 25 '16 at 09:26
Sorry, but what sense is there in a general protection mechanism if it allows "exceptions"? Think a bit about what you ask for... — arkascha, Sep 25 '16 at 09:28
Thanks for the response. Found my answer. That was actually pretty simple. — Saqib Iqbal, Sep 25 '16 at 09:43

score 4 · Accepted Answer · answered Sep 25 '16 at 09:27

There is no way to bypass the open_basedir restriction, no. However, you could just include the additional symlink path to your open_basedir since it can accept more than just one path.

open_basedir=/var/www/abc/public_html:/var/www/abc/files

All symbolic links are resolved, so it's not possible to avoid this restriction with a symlink.

PHP Manual: open_basedir

What you have to keep in mind is that open_basedir allows everything in a given path. So that means once access is granted to the path /var/www/abc/files, everything in that path like /var/www/abc/files/foo, /var/www/abc/files/bar, etc... is also allowed.

Is there any way I can bypass symlinks from php open_basedir?

1 Answers1